20240726_putanon.rst (6525B)
1 An anonymous content server 2 ########################### 3 4 :date: 2024-08-10 18:23:30 5 :category: Hygiene 6 :author: Louis Holbrook 7 :tags: ssh,bash,apache,http,qr 8 :slug: put-anon 9 :summary: How to set up your own mini-service to share files anonymously 10 :lang: en 11 :status: published 12 13 14 Let's say you want to share files or contents with someone you don't know. And you don't want to reveal anything about yourself. 15 16 And let's say, being a concerned and responsible cyber-citizen, you will host the service yourself. 17 18 A few lines of bash script and a webserver is all you need. 19 20 21 Dis-blamer 22 ========== 23 24 Staying fully anonymous is out of scope of this post. 25 26 And as you've probably have heard, staying anonymous on the internet is really, really hard. 27 28 Correct that. Staying anonymous on the internet will demand inconveniences that you are most likely not prepared to endure. 29 30 We'll be getting into that some other time. 31 32 Meanwhile, I don't want you to blame me if you dis-, mis- and malinformation [1]_ Thought Police come knocking because of what you posted on your content server.content server. 33 34 So let's first be clear what we don't cover here. 35 36 37 Host registration 38 ----------------- 39 40 To register for a hosting provider, you still need an email. Everywhere. To my knowledge, at least [2]_. 41 42 To get an email, you may need to provide an email. Or a phonenumber. And so on... 43 44 45 Safe connection 46 --------------- 47 48 Are you using VPN or overlay? 49 50 How did you pay for the service? 51 52 Are you sure they're not keeping logs? 53 54 Is your DNS leaking? 55 56 Remember: You need to use a safe connection whenever you are interacting with the server. Not only when you are setting up. 57 58 59 Payments 60 -------- 61 62 If you pay with card, privacy is out the window anyway. 63 64 So crypto is really the only way. And making sure the crypto cannot be traced back to you is tricky in itself. 65 66 67 68 The anonymous host 69 ================== 70 71 Now, let's pretend you got through all of these precautions, and you are ready to sign up for hosting for your content server. 72 73 There *are* options out there that will let you establish a VPS for a small amount of cryptocurrency per year. I have had luck with using `1984.is <https://1984.is>`_ [3]_. That is not an endorsement, and I'm sure there are other similar options out there. 74 75 Now that you have a VPS, you can set up a webserver. 76 77 78 The web server 79 ============== 80 81 Settings up a webserver is out of the scope of this post. 82 83 I use `Apache Webserver <https://apache.org>`_ myself. I've always used Apache Webserver. You can consider *that* an endorsement! 84 85 You don't really need to set it up much either. All you need is a vanilla server that serves any file in a given directory. 86 87 88 The posts 89 ========= 90 91 How do we get the content to the server? 92 93 First of all, remember that the same anonymity precautions are valid for any connection you make to the VPS. 94 95 Having established that, here's a small shell script [4]_ that will upload a file to a random identifier, while creating 96 97 * A retrieval URI 98 * A QR code for the retrieval URL 99 100 .. code-block:: bash 101 102 REMOTEPROTO=${REMOTEPROTO:-http} 103 REMOTESSHHOST=${REMOTESSHHOST:-localhost} 104 REMOTEHOST=${REMOTEHOST:-localhost} 105 REMOTESSHPATH=${REMOTESSHPATH:-/var/www} 106 # note this should handle missing start or end slash if exposed! 107 REMOTEPATH=/ 108 TMPDIR=/tmp 109 110 fi=$1 111 112 if [ ! -f "$fi" ]; then 113 exit 1 114 fi 115 116 uu=$(uuidgen) 117 118 d=$(mktemp -d) 119 120 ext=${fi##*.} 121 122 fn="$uu.$ext" 123 124 fo=$d/$fn 125 126 cp $fi $fo 127 128 scp -q $fo ${REMOTESSHHOST}:${REMOTESSHPATH} 129 ssh ${REMOTESSHHOST} chmod 644 ${REMOTESSHPATH}/$fn 130 131 url="${REMOTEPROTO}://${REMOTEHOST}${REMOTEPATH}$fn" 132 133 qrencodebin=$(which qrencode) 134 if [ ! -z "$qrencodebin" ]; then 135 $qrencodebin "$url" -s 10 -m 6 -o $TMPDIR/${uu}_qr.png 136 fi 137 138 echo $url 139 140 Simply: 141 142 1. Generate a random identifier as a file basename 143 2. Attach the file extension to the filename 144 3. Make a file copy through SSH to the public web folder of the VPS 145 4. Share the URI (or qr code stored to ``$TMPDIR`` with the same name) to retrieve. 146 147 148 Get a way 149 ========= 150 151 So you have the link. You show the QR code. The other party scans it and all is good. 152 153 But, can it still be used if you share it digitally? 154 155 You just send it off to whoever is the recipient, right? 156 157 Not so fast. 158 159 If you send the link from an email address that is linked to you, that may also link the content server to you. Then all of the above may have been for naught. 160 161 And any other email address you send it from, will be linked to the recipient and the content when future emails are sent. 162 163 Remember, the recipient's email server (which is very likely to be G00gl€, Amaz0n or Micr0$0ft) **can plainly read all your emails**. Unless you are messing with PGP. Which you should. Which is very unlikely that you are. 164 165 Encrypted messengers? Well, they may not be as encrypted as you think. And the same problem applies: If you use one for something, then that something will create context for other things you use it for. 166 167 168 Proportional paranoia 169 --------------------- 170 171 There is scarcely any limit to how paranoid you can get when you start to decompose problems like this. 172 173 So only worry about what is reasonable to worry about. 174 175 In this case, the issue is to protect your identity from the recipient. Maybe you shouldn't worry about a third party listening in. 176 177 Worrying an knowing doesn't have to be the same thing, though. And one thing we do know is that something is listening. To everything. Always. 178 179 180 .. 181 182 .. [1] You can't make this stuff up: "Malinformation is the intentional spreading of genuine information with the intent to cause harm." - [USA Homeland Security](https://www.dhs.gov/sites/default/files/2022-08/22_0824_ope_hsac-disinformation-subcommittee-final-report-08242022.pdf) ([copy](https://g33k.holbrook.no/1ff4b6a6ad8556884de6fc0bfe4756a1ade34cf32abe67c69dba9f16eeeef283)) 183 184 185 .. 186 187 .. [2] If you know of any that do *not* require an identifier in others' custody to sign up, please let me know: `<http://holbrook.no/msg>`_. 188 189 .. 190 191 .. [3] In general, Iceland seems a good territory for digital anonymity and sovereginty ever since they gave the middle finger to the global banking establishment after the 2008 crash, when they wanted to loot the country under the legal cover of utter fraud of the population. 192 193 .. 194 195 .. [4] You will need the ``qrencode`` package for that