diff --git a/doc/EN/app_vpn.org b/doc/EN/app_vpn.org new file mode 100644 index 00000000..0d991799 --- /dev/null +++ b/doc/EN/app_vpn.org @@ -0,0 +1,83 @@ +#+TITLE: +#+AUTHOR: Bob Mottram +#+EMAIL: bob@freedombone.net +#+KEYWORDS: freedombone, openvpn +#+DESCRIPTION: How to use OpenVPN on Freedombone +#+OPTIONS: ^:nil toc:nil +#+HTML_HEAD: + +#+BEGIN_CENTER +[[file:images/logo.png]] +#+END_CENTER + +#+BEGIN_EXPORT html +
+

OpenVPN

+
+#+END_EXPORT + +#+begin_quote +"/The Net interprets censorship as damage and routes around it./" -- John Gilmore +#+end_quote + +A Virtual Private Network (VPN) allows you to move your internet traffic to a different machine in a different geographical location by creating a private cryptographically protected route to that location. The usual use cases are to get around local censorship of the internet such as when you see the message "/this content is not available in your area/" when trying to play a video. Maybe you're on holiday and your hotel or workplace internet connection is censored. Using a VPN you can connect to your home server and then use the internet normally. + +Using a Tor browser is another way to get around censorship, but there might be occasions where you don't want to use a Tor browser or where Tor relays and bridges are blocked or where you want to run internet apps which aren't within a browser. + +On Freedombone the VPN is wrapped within a TLS layer of encryption, making it difficult for any deep packet inspection systems to know whether you are using a VPN or not. Since there is lots of TLS traffic on the internet your connection looks like any other TLS connection to a server, and this may help to avoid being censored. It's probably not possible for your local ISP to block TLS traffic without immediately generating a lot of irate customers, and stopping any kind of commercial activity. + +* Installation + +ssh into the system with: + +#+BEGIN_SRC bash +ssh myusername@mydomainname -p 2222 +#+END_SRC + +Select *Administrator controls* then *Add/Remove apps* then *vpn*. Choose the port which you want the VPN to operate on and then the install will continue. + +Only use ports 443 or 80 for VPN as an /absolute last resort/, since doing so will prevent other web based apps from running on your server. + +* Usage + +When the installation is complete you can download your VPN keys and configuration files onto your local machine. + +#+begin_src bash +scp -P 2222 myusername@mydomainname:/home/myusername/client.ovpn . +scp -P 2222 myusername@mydomainname:/home/myusername/stunnel* . +#+end_src + +You will need to ensure that the /openvpn/ and /stunnel/ packages are installed. On an Arch based system: + +#+begin_src bash +sudp pacman -S openvpn stunnel4 +#+end_src + +Or on a Debian based system: + +#+begin_src bash +sudo apt-get install openvpn stunnel4 +#+end_src + +Now you can connect to your VPN with: + +#+begin_src bash +sudo stunnel stunnel-client.conf +sudo openvpn client.ovpn +#+end_src + +You should see a series of messages with "/Initialization Sequence Completed/" showing at the end. Leave the terminal open and perhaps minimize it to remain connected to the VPN. To leave the VPN close the terminal window. + +* Changing port number + +Avoiding censorship can be a cat and mouse game, and so if the port you're using for VPN gets blocked then you may want to change it. + +#+BEGIN_SRC bash +ssh myusername@mydomainname -p 2222 +#+END_SRC + +Select *Administrator controls* then *App Settings* then *vpn*. Choose *Change TLS port* and enter a new port value. You can then either manually change the port within your VPN configuration files, or download them again as described in the [[Usage]] section above. + +* Generating new keys + +It's possible that your VPN keys might get lost or compromised on your local machine. If that happens you can generate new ones from the *Administrator controls* by going to *App Settings* then *vpn* then choosing *Regenerate keys for a user* and downloading the new keys as described in the [[Usage]] section above. diff --git a/doc/EN/apps.org b/doc/EN/apps.org index 7126510a..d46d7daf 100644 --- a/doc/EN/apps.org +++ b/doc/EN/apps.org @@ -154,6 +154,10 @@ A system for privately creating and sharing notes and images, similar to Evernot * Vim If you use the Mutt client to read your email then this will set it up to use vim for composing new mail. +* Virtual Private Network (VPN) +Set up a VPN on your server so that you can bypass local internet censorship. + +[[./app_vpn.html][How to use it]] * XMPP Chat server which can be used together with client such as Gajim or Conversations to provide end-to-end content security and also onion routed metadata security. Includes advanced features such as /client state notification/ to save battery power on your mobile devices, support for seamless roaming between networks and /message carbons/ so that you can receive the same messages while being simultaneously logged in to your account on more than one device. diff --git a/src/freedombone-addcert b/src/freedombone-addcert index 701ceb53..5f729922 100755 --- a/src/freedombone-addcert +++ b/src/freedombone-addcert @@ -49,7 +49,7 @@ HOSTNAME= remove_cert= LETSENCRYPT_HOSTNAME= COUNTRY_CODE="US" -AREA="Free Speech Zone" +AREA="Apparent Free Speech Zone" LOCATION="Freedomville" ORGANISATION="Freedombone" UNIT="Freedombone Unit" diff --git a/src/freedombone-app-vpn b/src/freedombone-app-vpn index a22a0bd6..b32e4c36 100755 --- a/src/freedombone-app-vpn +++ b/src/freedombone-app-vpn @@ -9,11 +9,14 @@ # Freedom in the Cloud # # VPN functions +# https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-8 +# https://jamielinux.com/blog/force-all-network-traffic-through-openvpn-using-iptables/ +# http://www.farrellf.com/projects/software/2016-05-04_Running_a_VPN_Server_with_OpenVPN_and_Stunnel/index_.php # # License # ======= # -# Copyright (C) 2014-2016 Bob Mottram +# Copyright (C) 2014-2017 Bob Mottram # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as published by @@ -28,12 +31,31 @@ # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . -VARIANTS='' +VARIANTS='full full-vim' IN_DEFAULT_INSTALL=0 SHOW_ON_ABOUT=0 -vpn_variables=() +OPENVPN_SERVER_NAME="server" +OPENVPN_KEY_FILENAME='client.ovpn' + +VPN_COUNTRY_CODE="US" +VPN_AREA="Apparent Free Speech Zone" +VPN_LOCATION="Freedomville" +VPN_ORGANISATION="Freedombone" +VPN_UNIT="Freedombone Unit" +STUNNEL_PORT=3439 +VPN_TLS_PORT=553 + +vpn_variables=(MY_EMAIL_ADDRESS + DEFAULT_DOMAIN_NAME + MY_USERNAME + VPN_COUNTRY_CODE + VPN_AREA + VPN_LOCATION + VPN_ORGANISATION + VPN_UNIT + VPN_TLS_PORT) function logging_on_vpn { echo -n '' @@ -44,10 +66,135 @@ function logging_off_vpn { } function install_interactive_vpn { - echo -n '' + read_config_param VPN_TLS_PORT + if [ ! $VPN_TLS_PORT ]; then + VPN_TLS_PORT=553 + fi + VPN_DETAILS_COMPLETE= + while [ ! $VPN_DETAILS_COMPLETE ] + do + data=$(tempfile 2>/dev/null) + trap "rm -f $data" 0 1 2 5 15 + currtlsport=$(grep 'VPN_TLS_PORT' temp.cfg | awk -F '=' '{print $2}') + if [ $currtlsport ]; then + VPN_TLS_PORT=$currtlsport + fi + dialog --backtitle $"Freedombone Configuration" \ + --title $"VPN Configuration" \ + --form $"\nPlease enter your VPN details. Changing the port to 443 will help defend against censorship but will prevent other web apps from running." 12 65 1 \ + $"TLS port:" 1 1 "$VPN_TLS_PORT" 1 12 5 5 \ + 2> $data + sel=$? + case $sel in + 1) exit 1;; + 255) exit 1;; + esac + tlsport=$(cat $data | sed -n 1p) + if [ ${#tlsport} -gt 1 ]; then + if [[ "$tlsport" != *' '* && "$tlsport" != *'.'* ]]; then + VPN_TLS_PORT="$tlsport" + VPN_DETAILS_COMPLETE="yes" + write_config_param "VPN_TLS_PORT" "$VPN_TLS_PORT" + fi + fi + done + clear APP_INSTALLED=1 } +function vpn_change_tls_port { + EXISTING_VPN_TLS_PORT=$VPN_TLS_PORT + + data=$(tempfile 2>/dev/null) + trap "rm -f $data" 0 1 2 5 15 + dialog --title $"VPN Configuration" \ + --backtitle $"Freedombone Control Panel" \ + --inputbox $'Change TLS port' 10 50 $VPN_TLS_PORT 2>$data + sel=$? + case $sel in + 0) + tlsport=$(<$data) + if [ ${#tlsport} -gt 0 ]; then + if [[ "$tlsport" != "$EXISTING_VPN_TLS_PORT" ]]; then + clear + VPN_TLS_PORT=$tlsport + write_config_param "VPN_TLS_PORT" "$VPN_TLS_PORT" + sed -i "s|accept =.*|accept = $VPN_TLS_PORT|g" /etc/stunnel/stunnel.conf + sed -i "s|accept =.*|accept = $VPN_TLS_PORT|g" /etc/stunnel/stunnel-client.conf + + for d in /home/*/ ; do + USERNAME=$(echo "$d" | awk -F '/' '{print $3}') + if [ -f /home/$USERNAME/stunnel-client.conf ]; then + cp /etc/stunnel/stunnel-client.conf /home/$USERNAME/stunnel-client.conf + chown $USERNAME:$USERNAME /home/$USERNAME/stunnel-client.conf + fi + done + + if [ $VPN_TLS_PORT -eq 443 ]; then + systemctl stop nginx + systemctl disable nginx + else + systemctl enable nginx + systemctl restart nginx + fi + + systemctl restart stunnel + + dialog --title $"VPN Configuration" \ + --msgbox $"TLS port changed to $VPN_TLS_PORT" 6 60 + fi + fi + ;; + esac +} + +function vpn_regenerate_client_keys { + data=$(tempfile 2>/dev/null) + trap "rm -f $data" 0 1 2 5 15 + dialog --title $"Regenerate VPN keys for a user" \ + --backtitle $"Freedombone Control Panel" \ + --inputbox $'username' 10 50 2>$data + sel=$? + case $sel in + 0) + USERNAME=$(<$data) + if [ ${#USERNAME} -gt 0 ]; then + if [ -d /home/$USERNAME ]; then + clear + create_user_vpn_key $USERNAME + dialog --title $"Regenerate VPN keys for a user" \ + --msgbox $"VPN keys were regenerated for $USERNAME" 6 60 + fi + fi + ;; + esac +} + +function configure_interactive_vpn { + read_config_param VPN_TLS_PORT + while true + do + data=$(tempfile 2>/dev/null) + trap "rm -f $data" 0 1 2 5 15 + dialog --backtitle $"Freedombone Control Panel" \ + --title $"VPN Configuration" \ + --radiolist $"Choose an operation:" 13 70 3 \ + 1 $"Change TLS port (currently $VPN_TLS_PORT)" off \ + 2 $"Regenerate keys for a user" off \ + 3 $"Exit" on 2> $data + sel=$? + case $sel in + 1) return;; + 255) return;; + esac + case $(cat $data) in + 1) vpn_change_tls_port;; + 2) vpn_regenerate_client_keys;; + 3) break;; + esac + done +} + function reconfigure_vpn { echo -n '' } @@ -57,40 +204,457 @@ function upgrade_vpn { } function backup_local_vpn { - echo -n '' + for d in /home/*/ ; do + USERNAME=$(echo "$d" | awk -F '/' '{print $3}') + if [ -f /home/$USERNAME/$OPENVPN_KEY_FILENAME ]; then + cp /home/$USERNAME/$OPENVPN_KEY_FILENAME /etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME} + fi + done + + function_check backup_directory_to_usb + backup_directory_to_usb /etc/openvpn/easy-rsa/keys vpn + backup_directory_to_usb /etc/stunnel vpnstunnel } function restore_local_vpn { - echo -n '' + temp_restore_dir=/root/tempvpn + restore_directory_from_usb $temp_restore_dir vpn + if [ -d ${temp_restore_dir} ]; then + cp -r ${temp_restore_dir}/* /etc/openvpn/easy-rsa/keys + cp -r ${temp_restore_dir}/${OPENVPN_SERVER_NAME}* /etc/openvpn/ + cp -r ${temp_restore_dir}/dh* /etc/openvpn/ + rm -rf ${temp_restore_dir} + + for d in /home/*/ ; do + USERNAME=$(echo "$d" | awk -F '/' '{print $3}') + if [ -f /etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME} ]; then + cp /etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME} /home/$USERNAME/$OPENVPN_KEY_FILENAME + chown $USERNAME:$USERNAME /home/$USERNAME/$OPENVPN_KEY_FILENAME + fi + done + fi + temp_restore_dir=/root/tempvpnstunnel + restore_directory_from_usb $temp_restore_dir vpnstunnel + if [ -d ${temp_restore_dir} ]; then + cp -r ${temp_restore_dir}/* /etc/stunnel + rm -rf ${temp_restore_dir} + for d in /home/*/ ; do + USERNAME=$(echo "$d" | awk -F '/' '{print $3}') + if [ -f /home/$USERNAME/stunnel.pem ]; then + cp /etc/stunnel/stunnel.pem /home/$USERNAME/stunnel.pem + chown $USERNAME:$USERNAME /home/$USERNAME/stunnel.pem + fi + if [ -f /home/$USERNAME/stunnel.p12 ]; then + cp /etc/stunnel/stunnel.p12 /home/$USERNAME/stunnel.p12 + chown $USERNAME:$USERNAME /home/$USERNAME/stunnel.p12 + fi + done + fi } function backup_remote_vpn { - echo -n '' + for d in /home/*/ ; do + USERNAME=$(echo "$d" | awk -F '/' '{print $3}') + if [ -f /home/$USERNAME/$OPENVPN_KEY_FILENAME ]; then + cp /home/$USERNAME/$OPENVPN_KEY_FILENAME /etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME} + fi + done + + function_check backup_directory_to_friend + backup_directory_to_friend /etc/openvpn/easy-rsa/keys vpn + backup_directory_to_friend /etc/stunnel vpnstunnel } function restore_remote_vpn { - echo -n '' + temp_restore_dir=/root/tempvpn + restore_directory_from_friend $temp_restore_dir vpn + if [ -d ${temp_restore_dir} ]; then + cp -r ${temp_restore_dir}/* /etc/openvpn/easy-rsa/keys + cp -r ${temp_restore_dir}/${OPENVPN_SERVER_NAME}* /etc/openvpn/ + cp -r ${temp_restore_dir}/dh* /etc/openvpn/ + rm -rf ${temp_restore_dir} + + for d in /home/*/ ; do + USERNAME=$(echo "$d" | awk -F '/' '{print $3}') + if [ -f /etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME} ]; then + cp /etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME} /home/$USERNAME/$OPENVPN_KEY_FILENAME + chown $USERNAME:$USERNAME /home/$USERNAME/$OPENVPN_KEY_FILENAME + fi + done + fi + temp_restore_dir=/root/tempvpnstunnel + restore_directory_from_friend $temp_restore_dir vpnstunnel + if [ -d ${temp_restore_dir} ]; then + cp -r ${temp_restore_dir}/* /etc/stunnel + rm -rf ${temp_restore_dir} + for d in /home/*/ ; do + USERNAME=$(echo "$d" | awk -F '/' '{print $3}') + if [ -f /home/$USERNAME/stunnel.pem ]; then + cp /etc/stunnel/stunnel.pem /home/$USERNAME/stunnel.pem + chown $USERNAME:$USERNAME /home/$USERNAME/stunnel.pem + fi + if [ -f /home/$USERNAME/stunnel.p12 ]; then + cp /etc/stunnel/stunnel.p12 /home/$USERNAME/stunnel.p12 + chown $USERNAME:$USERNAME /home/$USERNAME/stunnel.p12 + fi + done + fi } function remove_vpn { - apt-get -yq remove --purge fastd + systemctl stop stunnel + systemctl disable stunnel + rm /etc/systemd/system/stunnel.service + + systemctl stop openvpn + if [ $VPN_TLS_PORT -ne 443 ]; then + firewall_remove VPN-TLS $VPN_TLS_PORT + else + systemctl enable nginx + systemctl restart nginx + fi + + apt-get -yq remove --purge fastd openvpn easy-rsa + apt-get -yq remove stunnel4 + if [ -d /etc/openvpn ]; then + rm -rf /etc/openvpn + fi + firewall_disable_vpn + + echo 0 > /proc/sys/net/ipv4/ip_forward + sed -i 's|net.ipv4.ip_forward=.*|net.ipv4.ip_forward=0|g' /etc/sysctl.conf + remove_completion_param install_vpn + + # remove any client keys + for d in /home/*/ ; do + USERNAME=$(echo "$d" | awk -F '/' '{print $3}') + if [ -f /home/$USERNAME/$OPENVPN_KEY_FILENAME ]; then + shred -zu /home/$USERNAME/$OPENVPN_KEY_FILENAME + fi + rm /home/$USERNAME/stunnel* + done + userdel -f vpn + groupdel -f vpn + + if [ -d /etc/stunnel ]; then + rm -rf /etc/stunnel + fi +} + +function create_user_vpn_key { + username=$1 + + if [ ! -d /home/$username ]; then + return + fi + + echo $"Creating VPN key for $username" + + cd /etc/openvpn/easy-rsa + + if [ -f /etc/openvpn/easy-rsa/keys/$username.crt ]; then + rm /etc/openvpn/easy-rsa/keys/$username.crt + fi + if [ -f /etc/openvpn/easy-rsa/keys/$username.key ]; then + rm /etc/openvpn/easy-rsa/keys/$username.key + fi + if [ -f /etc/openvpn/easy-rsa/keys/$username.csr ]; then + rm /etc/openvpn/easy-rsa/keys/$username.csr + fi + + sed -i 's| --interact||g' build-key + ./build-key "$username" + + if [ ! -f /etc/openvpn/easy-rsa/keys/$username.crt ]; then + echo $'VPN user cert not generated' + exit 783528 + fi + user_cert=$(cat /etc/openvpn/easy-rsa/keys/$username.crt) + if [ ${#user_cert} -lt 10 ]; then + cat /etc/openvpn/easy-rsa/keys/$username.crt + echo $'User cert generation failed' + exit 634659 + fi + if [ ! -f /etc/openvpn/easy-rsa/keys/$username.key ]; then + echo $'VPN user key not generated' + exit 682523 + fi + user_key=$(cat /etc/openvpn/easy-rsa/keys/$username.key) + if [ ${#user_key} -lt 10 ]; then + cat /etc/openvpn/easy-rsa/keys/$username.key + echo $'User key generation failed' + exit 285838 + fi + + user_vpn_cert_file=/home/$username/$OPENVPN_KEY_FILENAME + + echo 'client' > $user_vpn_cert_file + echo 'dev tun' >> $user_vpn_cert_file + echo 'proto tcp' >> $user_vpn_cert_file + echo "remote localhost $STUNNEL_PORT" >> $user_vpn_cert_file + echo "route $DEFAULT_DOMAIN_NAME 255.255.255.255 net_gateway" >> $user_vpn_cert_file + echo 'resolv-retry infinite' >> $user_vpn_cert_file + echo 'nobind' >> $user_vpn_cert_file + echo 'tun-mtu 1500' >> $user_vpn_cert_file + echo 'tun-mtu-extra 32' >> $user_vpn_cert_file + echo 'mssfix 1450' >> $user_vpn_cert_file + echo 'persist-key' >> $user_vpn_cert_file + echo 'persist-tun' >> $user_vpn_cert_file + echo 'auth-nocache' >> $user_vpn_cert_file + echo 'remote-cert-tls server' >> $user_vpn_cert_file + echo 'comp-lzo' >> $user_vpn_cert_file + echo 'verb 3' >> $user_vpn_cert_file + echo '' >> $user_vpn_cert_file + + echo '' >> $user_vpn_cert_file + cat /etc/openvpn/ca.crt >> $user_vpn_cert_file + echo '' >> $user_vpn_cert_file + + echo '' >> $user_vpn_cert_file + cat /etc/openvpn/easy-rsa/keys/$username.crt >> $user_vpn_cert_file + echo '' >> $user_vpn_cert_file + + echo '' >> $user_vpn_cert_file + cat /etc/openvpn/easy-rsa/keys/$username.key >> $user_vpn_cert_file + echo '' >> $user_vpn_cert_file + + chown $username:$username $user_vpn_cert_file + + # keep a backup + cp $user_vpn_cert_file /etc/openvpn/easy-rsa/keys/$username.ovpn + + #rm /etc/openvpn/easy-rsa/keys/$username.crt + #rm /etc/openvpn/easy-rsa/keys/$username.csr + shred -zu /etc/openvpn/easy-rsa/keys/$username.key + + echo $"VPN key created at $user_vpn_cert_file" +} + +function add_user_vpn { + new_username="$1" + new_user_password="$2" + + create_user_vpn_key $new_username + if [ -f /etc/stunnel/stunnel.pem ]; then + cp /etc/stunnel/stunnel.pem /home/$new_username/stunnel.pem + chown $new_username:$new_username /home/$new_username/stunnel.pem + fi + if [ -f /etc/stunnel/stunnel.p12 ]; then + cp /etc/stunnel/stunnel.p12 /home/$new_username/stunnel.p12 + chown $new_username:$new_username /home/$new_username/stunnel.p12 + fi + cp /etc/stunnel/stunnel-client.conf /home/$new_username/stunnel-client.conf + chown $new_username:$new_username /home/$new_username/stunnel-client.conf +} + +function remove_user_vpn { + new_username="$1" +} + +function install_stunnel { + apt-get -yq install stunnel4 + + cd /etc/stunnel + + openssl req -x509 -nodes -days 3650 -sha256 \ + -subj "/O=$VPN_ORGANISATION/OU=$VPN_UNIT/C=$VPN_COUNTRY_CODE/ST=$VPN_AREA/L=$VPN_LOCATION/CN=$HOSTNAME" \ + -newkey rsa:2048 -keyout key.pem \ + -out cert.pem + if [ ! -f key.pem ]; then + echo $'stunnel key not created' + exit 793530 + fi + if [ ! -f cert.pem ]; then + echo $'stunnel cert not created' + exit 204587 + fi + chmod 400 key.pem + chmod 640 cert.pem + + cat key.pem cert.pem >> stunnel.pem + chmod 640 stunnel.pem + + openssl pkcs12 -export -out stunnel.p12 -inkey key.pem -in cert.pem -passout pass: + if [ ! -f stunnel.p12 ]; then + echo $'stunnel pkcs12 not created' + exit 639353 + fi + chmod 640 stunnel.p12 + + echo 'chroot = /var/lib/stunnel4' > stunnel.conf + echo 'pid = /stunnel4.pid' >> stunnel.conf + echo 'setuid = stunnel4' >> stunnel.conf + echo 'setgid = stunnel4' >> stunnel.conf + echo 'socket = l:TCP_NODELAY=1' >> stunnel.conf + echo 'socket = r:TCP_NODELAY=1' >> stunnel.conf + echo 'cert = /etc/stunnel/stunnel.pem' >> stunnel.conf + echo '[openvpn]' >> stunnel.conf + echo "accept = $VPN_TLS_PORT" >> stunnel.conf + echo 'connect = localhost:1194' >> stunnel.conf + echo 'cert = /etc/stunnel/stunnel.pem' >> stunnel.conf + + sed -i 's|ENABLED=.*|ENABLED=1|g' /etc/default/stunnel4 + + echo '[openvpn]' > stunnel-client.conf + echo 'client = yes' >> stunnel-client.conf + echo "accept = $STUNNEL_PORT" >> stunnel-client.conf + echo "connect = $DEFAULT_DOMAIN_NAME:$VPN_TLS_PORT" >> stunnel-client.conf + echo 'cert = stunnel.pem' >> stunnel-client.conf + + echo '[Unit]' > /etc/systemd/system/stunnel.service + echo 'Description=SSL tunnel for network daemons' >> /etc/systemd/system/stunnel.service + echo 'Documentation=man:stunnel https://www.stunnel.org/docs.html' >> /etc/systemd/system/stunnel.service + echo 'DefaultDependencies=no' >> /etc/systemd/system/stunnel.service + echo 'After=network.target' >> /etc/systemd/system/stunnel.service + echo 'After=syslog.target' >> /etc/systemd/system/stunnel.service + echo '' >> /etc/systemd/system/stunnel.service + echo '[Install]' >> /etc/systemd/system/stunnel.service + echo 'WantedBy=multi-user.target' >> /etc/systemd/system/stunnel.service + echo 'Alias=stunnel.target' >> /etc/systemd/system/stunnel.service + echo '' >> /etc/systemd/system/stunnel.service + echo '[Service]' >> /etc/systemd/system/stunnel.service + echo 'Type=forking' >> /etc/systemd/system/stunnel.service + echo 'RuntimeDirectory=stunnel' >> /etc/systemd/system/stunnel.service + echo 'EnvironmentFile=-/etc/stunnel/stunnel.conf' >> /etc/systemd/system/stunnel.service + echo 'ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf' >> /etc/systemd/system/stunnel.service + echo 'ExecStop=/usr/bin/killall -9 stunnel' >> /etc/systemd/system/stunnel.service + echo 'RemainAfterExit=yes' >> /etc/systemd/system/stunnel.service + + if [ $VPN_TLS_PORT -eq 443 ]; then + systemctl stop nginx + systemctl disable nginx + else + systemctl enable nginx + systemctl restart nginx + fi + + systemctl enable stunnel + systemctl daemon-reload + systemctl start stunnel + + cp /etc/stunnel/stunnel.pem /home/$MY_USERNAME/stunnel.pem + cp /etc/stunnel/stunnel.p12 /home/$MY_USERNAME/stunnel.p12 + cp /etc/stunnel/stunnel-client.conf /home/$MY_USERNAME/stunnel-client.conf + chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/stunnel* } function install_vpn { - if ! grep -q "repo.universe-factory.net" /etc/apt/sources.list; then - echo 'deb http://repo.universe-factory.net/debian/ sid main' >> /etc/apt/sources.list - gpg --keyserver pgpkeys.mit.edu --recv-key 16EF3F64CB201D9C - if [ ! "$?" = "0" ]; then - exit 76272 - fi - gpg -a --export 16EF3F64CB201D9C | sudo apt-key add - - apt-get update - apt-get -yq install fastd - if [ ! "$?" = "0" ]; then - exit 52026 - fi + apt-get -yq install fastd openvpn easy-rsa + + groupadd vpn + useradd -r -s /bin/false -g vpn vpn + + # server configuration + echo 'port 1194' > /etc/openvpn/server.conf + echo 'proto tcp' >> /etc/openvpn/server.conf + echo 'dev tun' >> /etc/openvpn/server.conf + echo 'tun-mtu 1500' >> /etc/openvpn/server.conf + echo 'tun-mtu-extra 32' >> /etc/openvpn/server.conf + echo 'mssfix 1450' >> /etc/openvpn/server.conf + echo 'ca /etc/openvpn/ca.crt' >> /etc/openvpn/server.conf + echo 'cert /etc/openvpn/server.crt' >> /etc/openvpn/server.conf + echo 'key /etc/openvpn/server.key' >> /etc/openvpn/server.conf + echo 'dh /etc/openvpn/dh2048.pem' >> /etc/openvpn/server.conf + echo 'server 10.8.0.0 255.255.255.0' >> /etc/openvpn/server.conf + echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server.conf + echo "push \"dhcp-option DNS 85.214.73.63\"" >> /etc/openvpn/server.conf + echo "push \"dhcp-option DNS 213.73.91.35\"" >> /etc/openvpn/server.conf + echo 'keepalive 5 30' >> /etc/openvpn/server.conf + echo 'comp-lzo' >> /etc/openvpn/server.conf + echo 'persist-key' >> /etc/openvpn/server.conf + echo 'persist-tun' >> /etc/openvpn/server.conf + echo 'status /dev/null' >> /etc/openvpn/server.conf + echo 'verb 3' >> /etc/openvpn/server.conf + echo '' >> /etc/openvpn/server.conf + + echo 1 > /proc/sys/net/ipv4/ip_forward + sed -i 's|# net.ipv4.ip_forward|net.ipv4.ip_forward|g' /etc/sysctl.conf + sed -i 's|#net.ipv4.ip_forward|net.ipv4.ip_forward|g' /etc/sysctl.conf + sed -i 's|net.ipv4.ip_forward.*|net.ipv4.ip_forward=1|g' /etc/sysctl.conf + + cp -r /usr/share/easy-rsa/ /etc/openvpn + if [ ! -d /etc/openvpn/easy-rsa/keys ]; then + mkdir /etc/openvpn/easy-rsa/keys fi + + # keys configuration + sed -i "s|export KEY_COUNTRY.*|export KEY_COUNTRY=\"US\"|g" /etc/openvpn/easy-rsa/vars + sed -i "s|export KEY_PROVINCE.*|export KEY_PROVINCE=\"TX\"|g" /etc/openvpn/easy-rsa/vars + sed -i "s|export KEY_CITY.*|export KEY_CITY=\"Dallas\"|g" /etc/openvpn/easy-rsa/vars + sed -i "s|export KEY_ORG.*|export KEY_ORG=\"$PROJECT_NAME\"|g" /etc/openvpn/easy-rsa/vars + sed -i "s|export KEY_EMAIL.*|export KEY_EMAIL=\"$MY_EMAIL_ADDRESS\"|g" /etc/openvpn/easy-rsa/vars + sed -i "s|export KEY_OU=.*|export KEY_OU=\"MoonUnit\"|g" /etc/openvpn/easy-rsa/vars + sed -i "s|export KEY_NAME.*|export KEY_NAME=\"$OPENVPN_SERVER_NAME\"|g" /etc/openvpn/easy-rsa/vars + + # generate host keys + if [ ! -f /etc/openvpn/dh2048.pem ]; then + openssl dhparam -out /etc/openvpn/dh2048.pem 2048 + fi + if [ ! -f /etc/openvpn/dh2048.pem ]; then + echo $'vpn dhparams were not generated' + exit 73724523 + fi + cp /etc/openvpn/dh2048.pem /etc/openvpn/easy-rsa/keys/dh2048.pem + + cd /etc/openvpn/easy-rsa + . ./vars + ./clean-all + vpn_openssl_version='1.0.0' + if [ ! -f openssl-${vpn_openssl_version}.cnf ]; then + echo $"openssl-${vpn_openssl_version}.cnf was not found" + exit 7392353 + fi + cp openssl-${vpn_openssl_version}.cnf openssl.cnf + + if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt ]; then + rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt + fi + if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key ]; then + rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key + fi + if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.csr ]; then + rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.csr + fi + sed -i 's| --interact||g' build-key-server + sed -i 's| --interact||g' build-ca + ./build-ca + ./build-key-server $OPENVPN_SERVER_NAME + if [ ! -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt ]; then + echo $'OpenVPN crt not found' + exit 7823352 + fi + server_cert=$(cat /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt) + if [ ${#server_cert} -lt 10 ]; then + cat /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt + echo $'Server cert generation failed' + exit 3284682 + fi + + if [ ! -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key ]; then + echo $'OpenVPN key not found' + exit 6839436 + fi + if [ ! -f /etc/openvpn/easy-rsa/keys/ca.key ]; then + echo $'OpenVPN ca not found' + exit 7935203 + fi + cp /etc/openvpn/easy-rsa/keys/{$OPENVPN_SERVER_NAME.crt,$OPENVPN_SERVER_NAME.key,ca.crt} /etc/openvpn + + create_user_vpn_key $MY_USERNAME + + firewall_enable_vpn + + if [ $VPN_TLS_PORT -ne 443 ]; then + firewall_add VPN-TLS $VPN_TLS_PORT tcp + fi + + systemctl start openvpn + + install_stunnel + + systemctl restart openvpn + APP_INSTALLED=1 } diff --git a/src/freedombone-controlpanel b/src/freedombone-controlpanel index c4eb712d..db4ae9c8 100755 --- a/src/freedombone-controlpanel +++ b/src/freedombone-controlpanel @@ -519,7 +519,7 @@ function show_ip_addresses { echo $'IP/DNS addresses' echo '================' echo '' - echo -n "IPv4: $(get_ipv4_address)" + echo -n "IPv4: $(get_ipv4_address)/$(get_external_ipv4_address)" ipv6_address="$(get_ipv6_address)" if [ ${#ipv6_address} -gt 0 ]; then echo " IPv6: ${ipv6_address}" diff --git a/src/freedombone-utils-firewall b/src/freedombone-utils-firewall index 56460df7..f9b02827 100755 --- a/src/freedombone-utils-firewall +++ b/src/freedombone-utils-firewall @@ -32,6 +32,8 @@ FIREWALL_CONFIG=$HOME/${PROJECT_NAME}-firewall.cfg FIREWALL_DOMAINS=$HOME/${PROJECT_NAME}-firewall-domains.cfg +FIREWALL_EIFACE=eth0 +EXTERNAL_IPV4_ADDRESS= function save_firewall_settings { iptables-save > /etc/firewall.conf @@ -108,6 +110,30 @@ function enable_ipv6 { echo 1 > /proc/sys/net/ipv6/conf/all/forwarding } +function firewall_disable_vpn { + firewall_remove VPN 1194 + iptables -D INPUT -i ${FIREWALL_EIFACE} -m state --state NEW -p tcp --dport 1194 -j ACCEPT + iptables -D INPUT -i tun+ -j ACCEPT + iptables -D FORWARD -i tun+ -j ACCEPT + iptables -D FORWARD -i tun+ -o ${FIREWALL_EIFACE} -m state --state RELATED,ESTABLISHED -j ACCEPT + iptables -D FORWARD -i ${FIREWALL_EIFACE} -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT + iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o ${FIREWALL_EIFACE} -j MASQUERADE + iptables -D OUTPUT -o tun+ -j ACCEPT + save_firewall_settings +} + +function firewall_enable_vpn { + firewall_add VPN 1194 tcp + iptables -A INPUT -i ${FIREWALL_EIFACE} -m state --state NEW -p tcp --dport 1194 -j ACCEPT + iptables -A INPUT -i tun+ -j ACCEPT + iptables -A FORWARD -i tun+ -j ACCEPT + iptables -A FORWARD -i tun+ -o ${FIREWALL_EIFACE} -m state --state RELATED,ESTABLISHED -j ACCEPT + iptables -A FORWARD -i ${FIREWALL_EIFACE} -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT + iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ${FIREWALL_EIFACE} -j MASQUERADE + iptables -A OUTPUT -o tun+ -j ACCEPT + save_firewall_settings +} + function configure_firewall { if [ $INSTALLING_MESH ]; then mesh_firewall diff --git a/src/freedombone-utils-network b/src/freedombone-utils-network index 2befcc1a..ce0fb3c6 100755 --- a/src/freedombone-utils-network +++ b/src/freedombone-utils-network @@ -31,6 +31,13 @@ # If the system is on an IPv6 network IPV6_NETWORK='2001:470:26:307' +# Destinations used to get the local IP address of this system +# Google ipv6 DNS 2001:4860:4860::8888 +# OpenDNS ipv6 DNS 2620:0:ccc::2 +IPV4_ADDRESS_TEST_DESTINATION='85.214.73.63' +IPV6_ADDRESS_TEST_DESTINATION='2620:0:ccc::2' +EXTERNAL_IP_LOOKUP_URL='ifcfg.me' + # The static IP address of the system within the local network # By default the IP address is dynamic within your LAN LOCAL_NETWORK_STATIC_IP_ADDRESS= @@ -64,13 +71,31 @@ function install_static_network { mark_completed $FUNCNAME } +function get_external_ipv4_address { + nslookup . $EXTERNAL_IP_LOOKUP_URL | grep Address | tail -n 1 | awk -F ' ' '{print $2}' +} + function get_ipv4_address { - IPv4dev=$(ip route get 8.8.8.8 | awk '{for(i=1;i<=NF;i++)if($i~/dev/)print $(i+1)}') + IPv4dev=$(ip route get $IPV4_ADDRESS_TEST_DESTINATION | awk '{for(i=1;i<=NF;i++)if($i~/dev/)print $(i+1)}') echo $(ip -o -f inet addr show dev "$IPv4dev" | awk '{print $4}' | awk 'END {print}' | awk -F '/' '{print $1}') } function get_ipv6_address { - echo $(ip -6 route get 2001:4860:4860::8888 | awk -F " " '{ for(i=1;i<=NF;i++) if ($i == "src") print $(i+1) }') + retval=$(ip -6 route get $IPV6_ADDRESS_TEST_DESTINATION 2> /dev/null) + echo $(echo "$retval" | awk -F " " '{ for(i=1;i<=NF;i++) if ($i == "src") print $(i+1) }') +} + +function update_external_ip { + ip_update_script=/usr/bin/externalipupdate + echo '#!/bin/bash' >> $ip_update_script + echo "existing_ip=\$(cat $CONFIGURATION_FILE | grep \"EXTERNAL_IPV4_ADDRESS=\" | head -n 1 | awk -F '=' '{print \$2}')'" >> $ip_update_script + echo "curr_ip=\$(nslookup . $EXTERNAL_IP_LOOKUP_URL | grep Address | tail -n 1 | awk -F ' ' '{print \$2}')" >> $ip_update_script + echo 'if [[ "$curr_ip" != "$existing_ip" ]]; then' >> $ip_update_script + echo " sed -i \"s|EXTERNAL_IPV4_ADDRESS=.*|EXTERNAL_IPV4_ADDRESS=\${curr_ip}|g\" $CONFIGURATION_FILE" >> $ip_update_script + echo " echo \"\$(date)\" >> ~/${PROJECT_NAME}-external-ip-changes.txt" >> $ip_update_script + echo 'fi' >> $ip_update_script + + cron_add_mins 10 $ip_update_script } # NOTE: deliberately no exit 0 diff --git a/website/EN/app_vpn.html b/website/EN/app_vpn.html new file mode 100644 index 00000000..566214c0 --- /dev/null +++ b/website/EN/app_vpn.html @@ -0,0 +1,390 @@ + + + + + + + +‎ + + + + + + + + + +
+ +
+
+
+ +
+

logo.png +

+
+
+ +
+

OpenVPN

+
+ +
+

+"The Net interprets censorship as damage and routes around it." – John Gilmore +

+
+ +

+A Virtual Private Network (VPN) allows you to move your internet traffic to a different machine in a different geographical location by creating a private cryptographically protected route to that location. The usual use cases are to get around local censorship of the internet such as when you see the message "this content is not available in your area" when trying to play a video. Maybe you're on holiday and your hotel or workplace internet connection is censored. Using a VPN you can connect to your home server and then use the internet normally. +

+ +

+Using a Tor browser is another way to get around censorship, but there might be occasions where you don't want to use a Tor browser or where Tor relays and bridges are blocked or where you want to run internet apps which aren't within a browser. +

+ +

+On Freedombone the VPN is wrapped within a TLS layer of encryption, making it difficult for any deep packet inspection systems to know whether you are using a VPN or not. Since there is lots of TLS traffic on the internet your connection looks like any other TLS connection to a server, and this may help to avoid being censored. It's probably not possible for your local ISP to block TLS traffic without immediately generating a lot of irate customers, and stopping any kind of commercial activity. +

+ +
+

Installation

+
+

+ssh into the system with: +

+ +
+
ssh myusername@mydomainname -p 2222
+
+
+ +

+Select Administrator controls then Add/Remove apps then vpn. Choose the port which you want the VPN to operate on and then the install will continue. +

+ +

+Only use ports 443 or 80 for VPN as an absolute last resort, since doing so will prevent other web based apps from running on your server. +

+
+
+ +
+

Usage

+
+

+When the installation is complete you can download your VPN keys and configuration files onto your local machine. +

+ +
+
scp -P 2222 myusername@mydomainname:/home/myusername/client.ovpn .
+scp -P 2222 myusername@mydomainname:/home/myusername/stunnel* .
+
+
+ +

+You will need to ensure that the openvpn and stunnel packages are installed. On an Arch based system: +

+ +
+
sudp pacman -S openvpn stunnel4
+
+
+ +

+Or on a Debian based system: +

+ +
+
sudo apt-get install openvpn stunnel4
+
+
+ +

+Now you can connect to your VPN with: +

+ +
+
sudo stunnel stunnel-client.conf
+sudo openvpn client.ovpn
+
+
+ +

+You should see a series of messages with "Initialization Sequence Completed" showing at the end. Leave the terminal open and perhaps minimize it to remain connected to the VPN. To leave the VPN close the terminal window. +

+
+
+ +
+

Changing port number

+
+

+Avoiding censorship can be a cat and mouse game, and so if the port you're using for VPN gets blocked then you may want to change it. +

+ +
+
ssh myusername@mydomainname -p 2222
+
+
+ +

+Select Administrator controls then App Settings then vpn. Choose Change TLS port and enter a new port value. You can then either manually change the port within your VPN configuration files, or download them again as described in the Usage section above. +

+
+
+ +
+

Generating new keys

+
+

+It's possible that your VPN keys might get lost or compromised on your local machine. If that happens you can generate new ones from the Administrator controls by going to App Settings then vpn then choosing Regenerate keys for a user and downloading the new keys as described in the Usage section above. +

+
+
+
+
+ + + +
+Back to top | E-mail me +
+
+ + diff --git a/website/EN/apps.html b/website/EN/apps.html index d6ba427d..843c3e34 100644 --- a/website/EN/apps.html +++ b/website/EN/apps.html @@ -3,10 +3,10 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + - +‎ -
-

CryptPad

-
+
+

CryptPad

+

Collaborate on editing documents, presentations and source code, or vote on things. All with a good level of security.

@@ -276,9 +276,9 @@ Collaborate on editing documents, presentations and source code, or vote on thin

-
-

DLNA

-
+
+

DLNA

+

Enables you to use the system as a music server which any DLNA compatible devices can connect to within your home network.

@@ -288,9 +288,9 @@ Enables you to use the system as a music server which any DLNA compatible device

-
-

Dokuwiki

-
+
+

Dokuwiki

+

A databaseless wiki system.

@@ -300,9 +300,9 @@ A databaseless wiki system.

-
-

Emacs

-
+
+

Emacs

+

If you use the Mutt client to read your email then this will set it up to use emacs for composing new mail.

@@ -312,9 +312,9 @@ If you use the Mutt client to read your email then this will set it up to use em

-
-

Etherpad

-
+
+

Etherpad

+

Collaborate on creating documents in real time. Maybe you're planning a holiday with other family members or creating documentation for a Free Software project along with other volunteers. Etherpad is hard to beat for simplicity and speed. Only users of the system will be able to access it.

@@ -324,9 +324,9 @@ Collaborate on creating documents in real time. Maybe you're planning a holiday

-
-

Friendica

-
+
+

Friendica

+

Federated social network system.

@@ -336,9 +336,9 @@ Federated social network system.

-
-

Ghost

-
+
+

Ghost

+

Modern looking blogging system.

@@ -348,9 +348,9 @@ Modern looking blogging system.

-
-

GNU Social

-
+
+

GNU Social

+

Federated social network. You can "remote follow" other users within the GNU Social federation.

@@ -360,9 +360,9 @@ Federated social network. You can "remote follow" other users within the

-
-

Gogs

-
+
+

Gogs

+

Lightweight git project hosting system. You can mirror projects from Github, or if Github turns evil then just host your own projects while retaining the familiar fork-and-pull workflow. If you can use Github then you can also use Gogs.

@@ -372,9 +372,9 @@ Lightweight git project hosting system. You can mirror projects from Github, or

-
-

HTMLy

-
+
+

HTMLy

+

Databaseless blogging system. Quite simple and with a markdown-like format.

@@ -384,9 +384,9 @@ Databaseless blogging system. Quite simple and with a markdown-like format.

-
-

Hubzilla

-
+
+

Hubzilla

+

Web publishing platform with social network like features and good privacy controls so that it's possible to specify who can see which content. Includes photo albums, calendar, wiki and file storage.

@@ -396,9 +396,9 @@ Web publishing platform with social network like features and good privacy contr

-
-

IRC Server (ngirc)

-
+
+

IRC Server (ngirc)

+

Run your own IRC chat channel which can be secured with a password and accessible via an onion address. A bouncer is included so that you can receive messages sent while you were offline. Works with Hexchat and other popular clients.

@@ -408,18 +408,18 @@ Run your own IRC chat channel which can be secured with a password and accessibl

-
-

Jitsi Meet

-
+
+

Jitsi Meet

+

Experimental WebRTC video conferencing system, similar to Google Hangouts. This may not be fully functional, but is hoped to be in the near future.

-
-

KanBoard

-
+
+

KanBoard

+

A simple kanban system for managing projects or TODO lists.

@@ -429,9 +429,9 @@ A simple kanban system for managing projects or TODO lists.

-
-

Key Server

-
+
+

Key Server

+

An OpenPGP key server for storing and retrieving GPG public keys.

@@ -441,9 +441,9 @@ An OpenPGP key server for storing and retrieving GPG public keys.

-
-

Koel

-
+
+

Koel

+

Access your music collection from any internet connected device.

@@ -453,9 +453,9 @@ Access your music collection from any internet connected device.

-
-

Lychee

-
+
+

Lychee

+

Make your photo albums available on the web.

@@ -465,9 +465,9 @@ Make your photo albums available on the web.

-
-

Mailpile

-
+
+

Mailpile

+

Modern email client which supports GPG encryption.

@@ -477,9 +477,9 @@ Modern email client which supports GPG encryption.

-
-

Matrix

-
+
+

Matrix

+

Multi-user chat with some security and moderation controls.

@@ -489,9 +489,9 @@ Multi-user chat with some security and moderation controls.

-
-

Mediagoblin

-
+
+

Mediagoblin

+

Publicly host video and audio files so that you don't need to use YouTube/Vimeo/etc.

@@ -501,9 +501,9 @@ Publicly host video and audio files so that you don't need to use YouTube/Vimeo/

-
-

Mumble

-
+
+

Mumble

+

The popular VoIP and text chat system. Say goodbye to old-fashioned telephony conferences with silly dial codes. Also works well on mobile.

@@ -513,9 +513,9 @@ The popular VoIP and text chat system. Say goodbye to old-fashioned telephony co

-
-

NextCloud

-
+
+

NextCloud

+

Store files on your server and sync them with laptops or mobile devices. Includes many plugins including videoconferencing and collaborative document editing.

@@ -525,9 +525,9 @@ Store files on your server and sync them with laptops or mobile devices. Include

-
-

PI-Hole

-
+
+

PI-Hole

+

The black hole for web adverts. Block adverts at the domain name level within your local network. It can significantly reduce bandwidth, speed up page load times and protect your systems from being tracked by spyware.

@@ -537,9 +537,9 @@ The black hole for web adverts. Block adverts at the domain name level within yo

-
-

PostActiv

-
+
+

PostActiv

+

An alternative federated social networking system compatible with GNU Social. It includes some optimisations and fixes currently not available within the main GNU Social project.

@@ -549,9 +549,9 @@ An alternative federated social networking system compatible with GNU Social. It

-
-

Profanity

-
+
+

Profanity

+

A shell based XMPP client which you can run on the Freedombone server via ssh.

@@ -561,9 +561,9 @@ A shell based XMPP client which you can run on the Freedombone server via ssh.

-
-

Riot Web

-
+
+

Riot Web

+

A browser based user interface for the Matrix federated communications system, including WebRTC audio and video chat.

@@ -573,9 +573,9 @@ A browser based user interface for the Matrix federated communications system, i

-
-

SearX

-
+
+

SearX

+

A metasearch engine for customised and private web searches.

@@ -585,9 +585,9 @@ A metasearch engine for customised and private web searches.

-
-

tt-rss

-
+
+

tt-rss

+

Private RSS reader. Pulls in RSS/Atom feeds via Tor and is only accessible via an onion address. Have "the right to read" without the Surveillance State knowing what you're reading. Also available with a user interface suitable for viewing on mobile devices via a browser such as OrFox.

@@ -597,9 +597,9 @@ Private RSS reader. Pulls in RSS/Atom feeds via Tor and is only accessible via a

-
-

Syncthing

-
+
+

Syncthing

+

Possibly the best way to synchronise files across all of your devices. Once it has been set up it "just works" with no user intervention needed.

@@ -609,9 +609,9 @@ Possibly the best way to synchronise files across all of your devices. Once it h

-
-

Tahoe-LAFS

-
+
+

Tahoe-LAFS

+

Robust and encrypted storage of files on one or more server.

@@ -621,9 +621,9 @@ Robust and encrypted storage of files on one or more server.

-
-

Tox

-
+
+

Tox

+

Client and bootstrap node for the Tox chat/VoIP system.

@@ -633,9 +633,9 @@ Client and bootstrap node for the Tox chat/VoIP system.

-
-

Turtl

-
+
+

Turtl

+

A system for privately creating and sharing notes and images, similar to Evernote but without the spying.

@@ -645,18 +645,30 @@ A system for privately creating and sharing notes and images, similar to Evernot

-
-

Vim

-
+
+

Vim

+

If you use the Mutt client to read your email then this will set it up to use vim for composing new mail.

-
-

XMPP

-
+
+

Virtual Private Network (VPN)

+
+

+Set up a VPN on your server so that you can bypass local internet censorship. +

+ +

+How to use it +

+
+
+
+

XMPP

+

Chat server which can be used together with client such as Gajim or Conversations to provide end-to-end content security and also onion routed metadata security. Includes advanced features such as client state notification to save battery power on your mobile devices, support for seamless roaming between networks and message carbons so that you can receive the same messages while being simultaneously logged in to your account on more than one device.