Backup personal email on VPS - privacy, security and trust risks

Question

FastMail.fm hosts my personal email account. Now they claim to have reliable backup services, but I'd like to have my own copy of my email archives.

What I'd like to do is back up to my VPS, which has a very good internet connection and is always online, unlike my laptop. Some problems with this approach:

1. The credentials to my personal email account would have to be stored on the VPS
2. Plaintext email backups would be stored on the VPS

Solving problem #1 is my primary concern. FastMail offer alternative logins with limited access: No password resets, 1 hour time limit after first use, 100x OTPs. Can't think of any sane way around it. Perhaps there is none.

Problem #2 can be solved with GPG, using my public key to encrypt. Though, I supposed somebody could still listen in by teeing the pipe.

I do not own any servers/desktops, so a backup to my own physical machine is not possible.

Answer 1

1 - Credentials

In general, you're going to be limited to what the service is willing to support. It sounds like the alternate password options are not insane - if you can use OTPS, or alternate passwords with some limitations, you have options for scripting a transfer process that are at least a little better than leaving your password somewhere.

Generally it'd be nice to separate the read-only ability for logging in and downloading a copy of sent/received emails from the ability to perform email sending capabilities. If none of the alternate credential options offer that, than I'm not sure they really buy you much of anything.

Your big questions are:

• how secure can you make your credential storage on the VPS?
• how painful is it to update passwords and what are the verification processes involved?
• what's the risk for someone getting their hands on this credential?

2 - Data Security

The fully correct approach here is to secure both the data in transit and the data at rest.

In transit: - you'll end up limited to whatever connection methods the email service provides. - remember that it's great to lock up your email archive route, but if you are accessing the mail in the clear when you use it on a daily basis you haven't really done much. Securing access means securing all parts of access.

At rest: - there's a number of encryption solutions - it largely depends on what your storage method allows. - remember that you're only as good as your encryption secret storage - if you encrypt everything and then have to store the encryption key in the clear on the server, then you didn't really do much.

3 - Alternate Options?

I'd wonder if you don't have other options - for example, can you forward copies of the email you want to archive to the VPS as an alternate email address. In essence, pushing rather than pulling the data. Then you may not need any credentials on the server. Ideally that'd be automated and constant.

Or could you consolidate and encrypt mail on the mail system and then pick it up from VPS - that would definitely keep any keys off the VPS and give you both in transit and at rest security.

Summary

I'm being vague here - all of this relies on the details of the mail service and VPS, I'm just focusing on some common design ideas that might be useful. My general thought is that security is only ever as strong as the weakest link, and often you can change the equation quite profoundly by deciding whether to push or pull data, or who should trust whom.

Answer 2

The CISSP - Business Continuity Planning section deals with the problem of secure backups. Implementing a secure backup system is predominantly a problem where Nature is main threat, and an insecure backups create the possibility of data compromise. By addressing one threat, you are introducing a different threat.

When building any new security system it is best to start with a Threat Model. In this model you must clearly define Actors, your adversary and the resources you are protecting. In the case of email backing up email. State sponsored actors will already a copy, so it is too late to address this threat.

• To address some of the threat imposed by nature; backup data to a replicated storage device such as RAID-1, Amazon-EBS devices are also replicated.

• To address the threat of data compromise on a VPS or backup device; sensitive data must always be encrypted at rest. Most backup software has this feature, Bacula is a secure example. The "decryption master-key" must not be stored on the backup device. Data is downloaded from the backup device to a trusted machine and then decrypted for use.

• To address the threats imposed by data transfer; ensure that all
  backups are transmitted over a SSL/TLS connection. SFTP, HTTPS, or a VPN
  can be used to satisfy this requirement.

Answer 3

You've probably already considered (and dismissed) this - but how about using an external disk for backup, instead of the VPS? You could set up a periodic backup of your emails, and it would be much simpler this way - your credentials would reside on your own system (and they can be encrypted too, since you would control when the backup happens). The data is also secure - you can either create a TrueCrypt container, or you could just use GPG to encrypt your emails. The only network communication now is between your (relatively) trusted laptop , and the email server, so the potential of people sniffing your network connections is reduced as well.

This is the mechanism I've personally used for backup - be it my entire laptop or specific content. I usually keep my disks behind locked drawers, and even if someone stole them, they would have garbage without the password/key needed to decrypt the contents.