Since I cannot receive email directly from my home server, I need an external device to receive messages for me and deliver them to my MTA via another port or via VPN. Instead of renting a VPS just for this, I was thinking about purchasing an unexpensive ARM board and deploying it to one of my friend's house, which has a static IP and can receive email from the outside (no port 25 blocked by his ISP). I would encrypt the root partition, allowing remote unlocking via VPN and SSH intramfs. I would save the SSH fingerprint locally before giving the machine to him.
Of course I trust him, but what could he possibly do?
Things that come to mind, from the easiest to the most difficult:
- He could wipe the SD card, but of course I would notice it
- He could forward the external port 25 of its router to his rogue mail server, but could he read my email?
E.G. by responding to STARTTLS requests saying that no encryption is available, or offering them a self-signed certificate for mail.example.org, while the official CA-issued certificate for mail.example.org is stored in the encrypted partition.
If yes, is there a way to tell external MTA to only deliver through Submissions (AKA SMTPS, usually sender->MTA on port 465), or at least veryfing the issue of the certificate (CAA record, trusted CA...) and eventually alerting me of such a spoof?
- Can he read the wireguard intramfs configuration? If so he could use the peer key to connect to VPN
- Can he add his SSH key to tinyssh, or they have to be added with mkinitcpio? Is it useless or he could install something that leaks the passphrase once I enter it?
- Can he brute force local TTY login when the machine is powered on? How could I prevent this, either disablying local login or rate limiting login attempts? What software could he use (E.G. hydra for http-basic auth)
- Is there a way to protect from cold boot attacks?
- Other paranoid things I'm missing?
I'm 100% sure none of this will happen, it's just a theoretical exercise