diff --git a/doc/EN/app_pleroma.org b/doc/EN/app_pleroma.org index 1db4e627..562bdd04 100644 --- a/doc/EN/app_pleroma.org +++ b/doc/EN/app_pleroma.org @@ -49,6 +49,12 @@ If you prefer a Tweetdeck-style user interface, similar to Mastodon, then once y [[file:images/pleromamastodon.jpg]] #+END_CENTER +* Mobile apps +It's also possible to use Mastodon apps together with Pleroma, such as Tusky, since it supports the Mastodon API. You may need to install *IcecatMobile* and set it as your default browser (under *Settings/Apps/Menu*) in order for the initial oauth registration process to work. + +#+BEGIN_CENTER +[[file:images/tusky.jpg]] +#+END_CENTER * Blocking controls #+BEGIN_CENTER [[file:images/controlpanel/control_panel_blocking.jpg]] diff --git a/doc/EN/apps.org b/doc/EN/apps.org index 2974036d..281824ea 100644 --- a/doc/EN/apps.org +++ b/doc/EN/apps.org @@ -10,10 +10,6 @@ [[file:images/logo.png]] #+END_CENTER -#+begin_export html -

Apps

-#+end_export - #+begin_quote "/In times of aggressive corporatization, increasing enclosure of communication spaces, and blanket surveillance, emancipatory communication practices appear to be particularly well suited to offer concrete alternatives to activists and citizens alike/" -- Stefania Milan #+end_quote @@ -53,6 +49,8 @@ Extremely simple and distraction-free notes system. If you use the Mutt client to read your email then this will set it up to use emacs for composing new mail. [[./app_emacs.html][How to use it]] +* Email Server +Since many apps require email registration an email server is installed by default. You can find advice on using the email system [[./usage_email.html][here]]. * Etherpad Collaborate on creating documents in real time. Maybe you're planning a holiday with other family members or creating documentation for a Free Software project along with other volunteers. Etherpad is hard to beat for simplicity and speed. Only users of the system will be able to access it. diff --git a/doc/EN/fediverse.org b/doc/EN/fediverse.org index 971bca8b..5af89588 100644 --- a/doc/EN/fediverse.org +++ b/doc/EN/fediverse.org @@ -10,16 +10,14 @@ [[file:images/logo.png]] #+END_CENTER -#+BEGIN_EXPORT html -
-

Homesteading the Fediverse

-
-#+END_EXPORT +#+BEGIN_CENTER +*Homesteading the Fediverse* +#+END_CENTER Some things you might want to know about the Fediverse: * Federation as a concept -The political definition of a federation is "/a union of partially self-governing states or regions under a central (federal) government/". The fediverse isn't exactly like that, in that there is no federal government. However there are protocols which govern the communication between instances and that might be analogized to being a sort of elemantary constitution or mutual agreement binding all participants together. The protocols are merely ways of moving data around though, and don't impose any sort of moral code. +The political definition of a federation is "/a union of partially self-governing states or regions under a central (federal) government/". The fediverse isn't exactly like that, in that there is no federal government. However there are protocols which govern the communication between instances and that might be analogized to being a sort of elementary constitution or mutual agreement binding all participants together. The protocols are merely ways of moving data around though, and don't impose any sort of moral code. * Keep the number of users on each server small The importance of this can't be overstated. Servers with lots of users always eventually have problems where the interests of the users are not the same as the interests of the server administrator. If you are the server administrator, or if there are only a small squad-size group of people on the server, then it's a lot easier to resolve differences and everyone's interests are likely to be similar. @@ -33,7 +31,9 @@ Especially if other servers are publishing content which may not be legal in you Over time follows and blocking rules come to match the underlying social geography of affinity groups. Blocking will happen and users will move around or start new servers. Drama related to blocking will dissipate. * Keep your follows under the Dunbar number -Keep the number of other users you're following and who are also active to under a couple of hundred. Any more than that and you'll just be overwhelmed by irrelevant stuff and whatever community you may have been part of will dissolve in a sea of entropy. There are no algorithmic timelines, and even if they're introduced then they create their own problems as an opaque form of censorship. _Real community happens at tribal scale_. It's something which people often don't like to admit because they get fixated upon bigger and bigger numbers, but it definitely seems to be true. +Keep the number of other frequently active users you're following to under a couple of hundred. Your actual number of follows might be larger than this but could include users who rarely post anything. + +Once there are more than a couple of hundred highly active users in your timeline then you'll just be overwhelmed by irrelevant stuff and whatever community you may have been part of will be drowned in the entropy. There are no algorithmic timelines to hide posts, and even if they're introduced then they create their own problems as an opaque form of censorship. _Real community happens at tribal scale_. It's something which people often don't like to admit because they get fixated upon bigger and bigger numbers, but it definitely seems to be true. * Avoid big public servers It may seem like a good idea and it may seem like you're doing a service to the community by allowing random strangers to register, but servers with thousands of users only cause problems - social, administrative, financial and possibly also legal. The financial strain of running a powerful server with high reliability may be enough to encourage the administrator to begin pushing advertising onto the system, or sell user content, and then before you know it you have identical problems to Twitter. Instead try to encourage people to set up their own servers. Follow this principle and a lot of arguments and stress will be more easily avoided. diff --git a/doc/EN/index.org b/doc/EN/index.org index e88f500c..ae54ada9 100644 --- a/doc/EN/index.org +++ b/doc/EN/index.org @@ -19,25 +19,26 @@ So you want to run your own internet services? Email, chat, VoIP, web sites, file synchronisation, wikis, blogs, social networks, media hosting, backups, VPN. Freedombone enables you to do all of that in a self-hosted way, where you keep control of your data and it resides in your own home. -[[./homeserver.html][Here's how]]. +A list of other supported ARM boards [[./boards.html][can be found here]], or you can install onto an old laptop or netbook. Some installation instructions for different use cases are: -And here's how [[./beaglebone.html][on a Beaglebone Black]]. A list of other supported ARM boards [[./boards.html][can be found here]]. - -Or you can install [[./debianinstall.html][onto an existing Debian system]]. - -If you have a single board ARM computer which isn't one of the officially supported ones, such as Raspberry Pi, then you may still be able to install [[./armbian.html][Freedombone with Armbian]]. - -Want to make a community mesh network which can either be fully autonomous or connected to the internet? The [[./mesh.html][Freedombone Mesh]] is a wireless solution for networked communication that can be rapidly deployed in temporary, emergency or post-disaster situations where internet access is unavailable or compromised, or used as an infrastructural community service similar to [[https://en.wikipedia.org/wiki/Freifunk][Freifunk]]. + * [[./homeserver.html][Typical installation]] + * Installing [[./beaglebone.html][on a Beaglebone Black]] + * Installing on an [[./debianinstall.html][existing Debian system]] + * Installing [[./armbian.html][on Armbian]], for unsupported ARM boards such as Raspberry Pi + * Creating a dedicated [[./socialinstance.html][fediverse instance]] for a single user or to host a community + * Deploying a [[./mesh.html][mesh network]] which can operate with or without the internet After installation it's possible that you might want some advice on how to run your system and set up apps to work nicely with it. * [[./domains.html][How to get a domain name]] + * [[./security.html][Improving security]] + * [[./users.html][Adding or removing users]] * [[./apps.html][Apps available on the system]] - * [[./usage.html][General usage]] * [[./faq.html][Frequently Asked Questions]] * [[./mobile.html][Advice on setting up a mobile phone]] * [[./support.html][I like this project. How can I help to support it?]] + If you find bugs, or want to add a new app to this system see the [[./devguide.html][Developers Guide]] and [[./codeofconduct.html][Code of Conduct]]. There is a Matrix chat room available at *#fbone:matrix.freedombone.net*. Ready made disk images which can be copied onto USB or microSD drives are [[./downloads/current][available here]]. diff --git a/doc/EN/security.org b/doc/EN/security.org new file mode 100644 index 00000000..d2f21925 --- /dev/null +++ b/doc/EN/security.org @@ -0,0 +1,48 @@ +#+TITLE: +#+AUTHOR: Bob Mottram +#+EMAIL: bob@freedombone.net +#+KEYWORDS: freedombone, security, ssh, debian, beaglebone +#+DESCRIPTION: Improving security +#+OPTIONS: ^:nil toc:nil +#+HTML_HEAD: + +#+BEGIN_CENTER +[[file:images/logo.png]] +#+END_CENTER + +* Authentication with keys +It's a lot more secure to log in to the Freedombone system using ssh keys rather than with a password. You can set that up by first running: + +#+begin_src bash +freedombone-client +#+end_src + +On your local system (i.e. whatever you're logging in to the Freedombone system from, typically a laptop). Then: + +#+begin_src +ssh myusername@freedombone.local -p 2222 +#+end_src + +Select *Administrator controls* and re-enter your password, then *Manage Users* and *Change user ssh public key*. Copy and paste the ssh public keys which appeared after the *freedombone-client* command was run. Then go to *Security settings* and select *Allow ssh login with passwords* followed by *no*. + +You'll need to make sure that you have a copy of the ~/.ssh directory on your local system. You could just copy that directory to a USB drive and then keep that somewhere safe so that you can restore the keys if you need to. +* Administrating the system via an onion address (Tor) +You can also access your system via the Tor system using an onion address. To find out what the onion address for ssh access is you can do the following: + +#+BEGIN_SRC bash +ssh username@freedombone.local -p 2222 +#+END_SRC + +Select /Administrator controls/ then select "About this system" and look for the onion address for ssh. You can then close the terminal and open another, then do the following on your local system: + +#+BEGIN_SRC bash +freedombone-client +#+END_SRC + +This will set up your ssh environment to be able to handle onion addresses. Then you can test ssh with: + +#+BEGIN_SRC bash +ssh username@address.onion -p 2222 +#+END_SRC + +Subsequently even if dynamic DNS isn't working you may still be able to administer your system. Using the onion address also gives you some degree of protection against corporate or government metadata analysis, since it becomes more difficult to passively detect which systems are communicating. diff --git a/doc/EN/socialinstance.org b/doc/EN/socialinstance.org new file mode 100644 index 00000000..7c98dfb3 --- /dev/null +++ b/doc/EN/socialinstance.org @@ -0,0 +1,93 @@ +#+TITLE: +#+AUTHOR: Bob Mottram +#+EMAIL: bob@freedombone.net +#+KEYWORDS: freedombone, debian, social, fediverse, instance, pleroma, gnusocial, postactiv +#+DESCRIPTION: Social Instance +#+OPTIONS: ^:nil toc:nil +#+HTML_HEAD: + +#+BEGIN_CENTER +[[file:images/logo.png]] +#+END_CENTER + +#+BEGIN_EXPORT html +
+

Social Instance

+
+#+END_EXPORT + +A social instance image allows you to easily set up a fediverse server, which federates using the OStatus or ActivityPub protocol. You will need: + + * An old laptop, capable of booting from USB + * A USB drive, preferably Sandisk and 16GB or larger + * An ethernet patch cable + * A domain name of your own + * A dynamic DNS account + +The installation process is the same as usual, with the only difference being that on initial setup it will go straight to the domain setup details for your instance. In summary: + +* Copy the image to the USB drive + +Substitute *sdX* with the device name for your USB drive. + +#+begin_src bash +sudo apt-get install xz-utils wget +wget https://freedombone.net/downloads/current/freedombone-pleroma-amd64.img.xz +wget https://freedombone.net/downloads/current/freedombone-pleroma-amd64.img.xz.sig +gpg --verify freedombone-pleroma-amd64.img.xz.sig +unxz freedombone-pleroma-amd64.img.xz +sudo dd if=/dev/zero of=/dev/sdX bs=1M count=8 +sudo dd bs=1M if=freedombone-pleroma-amd64.img of=/dev/sdX conv=fdatasync +#+end_src + +Also note that if the laptop has a removable SSD drive it's possible to copy the image directly to that if you have enough equipment. + +* Connect the laptop to your internet router + +Plug the USB drive into the laptop and connect it to your internet router with the ethernet cable. + +#+BEGIN_CENTER +[[file:images/laptop_router.jpg]] +#+END_CENTER + +* Boot the laptop from the USB drive + +You may need to alter the BIOS settings to get this to work reliably. + +#+BEGIN_CENTER +[[file:images/bios_boot_usb.jpg]] +#+END_CENTER + +* Forward ports 80 (HTTP) and 443 (HTTPS) from your internet router to the laptop + +Log into your internet router using a non-Tor browser (usually it's on an address like 192.168.1.1 or 192.168.1.254). Often port forwarding settings are together with firewall settings. + +#+BEGIN_CENTER +[[file:images/port_forwarding.png]] +#+END_CENTER + +* From another machine ssh into the laptop + +#+begin_src bash +ssh fbone@freedombone.local -p 2222 +#+END_SRC + +Or alternatively you can log in directly on the laptop. The initial username is *fbone* and the password is *freedombone*. You should make sure you write down or copy the new password when it is shown. + +* Follow the setup procedure + +Enter your user details, domain name and dynamic DNS settings. + +* When installation is complete + +Navigate to your domain and register a new user. + +#+BEGIN_CENTER +[[file:images/pleroma_register.jpg]] +#+END_CENTER + +More details about setting up and using Pleroma [[./app_pleroma.html][can be found here]]. + +#+BEGIN_CENTER +[[file:images/tusky.jpg]] +#+END_CENTER diff --git a/doc/EN/usage_email.org b/doc/EN/usage_email.org index 4d76b080..75112993 100644 --- a/doc/EN/usage_email.org +++ b/doc/EN/usage_email.org @@ -10,23 +10,17 @@ [[file:images/logo.png]] #+END_CENTER -#+BEGIN_EXPORT html -
-

Email

-
-#+END_EXPORT - | [[Things to be aware of]] | | [[A technical note about email transport security]] | | [[Add a password to your GPG key]] | | [[Publishing your GPG public key]] | | [[Mutt email client]] | | [[Thunderbird/Icedove]] | -| [[K9 Android client]] | +| [[Android apps]] | | [[Subscribing to mailing lists]] | | [[Adding email addresses to a group/folder]] | | [[Ignoring incoming emails]] | -| [[Your own mailing list]] | +| [[Using I2P for email transport]] | * Things to be aware of Even though this system makes it easy to set up an email server, running your own email system is still not easy and this is mainly due to the huge amount of collatoral damage caused by spammers over a long period of time, which in turn is due to the inherent insecurity of email protocols which enabled spam to become a big problem. Email is still very popular though and most internet services require that you have an email address in order to register. @@ -40,7 +34,7 @@ Port 465 is used for SMTP and this is supposedly deprecated for secure email. Ho From https://motherboard.vice.com/read/email-encryption-is-broken: #+BEGIN_QUOTE -The researchers also uncovered mass scale attacks of STARTTLS sessions being stripped of their encryption. That attack itself isn't new: internet service providers sometimes do it to monitor users; organizations may use it to keep an eye on employees; or it may come from a malicious actor +/The researchers also uncovered mass scale attacks of STARTTLS sessions being stripped of their encryption. That attack itself isn't new: internet service providers sometimes do it to monitor users; organizations may use it to keep an eye on employees; or it may come from a malicious actor/ #+END_QUOTE * Add a password to your GPG key If you didn't use existing GPG keys during the Freedombone installation then you'll need to add a password to your newly generated private key. This is highly recommended. Go through the following sequence of commands to ssh into the Freedombone and then change your GPG password. @@ -202,232 +196,8 @@ By default you won't be able to see any folders which you may have created earli Make sure that "*show only subscribed folders*" is not checked. Then click the *ok* buttons. Folders will be re-scanned, which may take some time depending upon how much email you have, but your folders will then appear. -* K9 Android client -*** A point about GPG on Android -Before trying to set up email on Android you may want to consider whether you really need to do this. Android (and its variants) is not a particularly secure operating system and whether or not you wish to store GPG keys on it depends on your threat model and in what situations you'll be using your device. - -If you are going to use email on an Android device then ensure that you have full encryption enabled via the security settings, so that if you subsequently lose it, or if it gets stolen, the chances of encryption keys being exposed are minimised. -*** Compiling the development version -To get K9 working with Freedombone you'll need to install development versions of OpenKeychain and K9. At the time of writing the versions available in F-Droid do not support PGP/MIME or the "hidden recipient" feature of GPG. It is hoped that at some stage the patches will be integrated into the mainline or functionally equivalent changes made. Admittedly, this is not at all user friendly, but currently it's the only way to read Freedombone email on Android systems. - -Build script for OpenKeychain: - -#+BEGIN_SRC bash -mkdir ~/develop -cd ~/develop -git clone https://github.com/bashrc/open-keychain -cd open-keychain -git checkout origin/bashrc/hidden-recipient-minimal -git checkout -b bashrc/hidden-recipient-minimal -cd tools -nano build.sh -#+END_SRC - -Then add the following: - -#+BEGIN_SRC bash -#!/bin/bash - -# This script is intended to be used on Debian systems for building -# the project. It has been tested with Debian 8 - -USERNAME=$USER -SIGNING_NAME='openkeychain' -SDK_VERSION='r23.3.4' -SDK_DIR=$HOME/android-sdk - -cd .. - -PROJECT_HOME=$(pwd) - -sudo apt-get install build-essential default-jdk \ - lib32stdc++6 lib32z1 lib32z1-dev - -if [ ! -d $SDK_DIR ]; then - mkdir -p $SDK_DIR -fi -cd $SDK_DIR - -# download the SDK -if [[ ! -f $SDK_DIR/android-sdk_$SDK_VERSION-linux.tgz ]]; then - wget https://dl.google.com/android/android-sdk_$SDK_VERSION-linux.tgz -fi -tar -xzvf android-sdk_$SDK_VERSION-linux.tgz -SDK_DIR=$SDK_DIR/android-sdk-linux - -echo 'Check that you have the SDK tools installed for Android 22, SDK 21.1.2' - -export ANDROID_HOME=$SDK_DIR -echo "sdk.dir=$SDK_DIR" > $ANDROID_HOME/local.properties -export PATH=${PATH}:$ANDROID_HOME/tools:$ANDROID_HOME/platform-tools - -cd $SDK_DIR/tools -./android sdk - -if [ ! -f $SDK_DIR/tools/android ]; then - echo "$SDK_DIR/tools/android not found" - exit -1 -fi -cd $SDK_DIR -chmod -R 0755 $SDK_DIR -chmod a+rx $SDK_DIR/tools - -# android sdk -cd $PROJECT_HOME -git submodule init && git submodule update - -if [ ! -f $SDK_DIR/tools/templates/gradle/wrapper/gradlew ]; then - echo "$SDK_DIR/tools/templates/gradle/wrapper/gradlew not found" - exit -2 -fi -. $PROJECT_HOME/gradlew assembleDebug - -# cleaning up -cd $PROJECT_HOME/OpenKeychain/build/outputs/apk -if [ ! -f OpenKeychain-debug.apk ]; then - echo 'OpenKeychain-debug.apk was not found' - exit -3 -fi - -echo 'Build script ended successfully' -echo -n 'apk is available at: ' -echo "$PROJECT_HOME/OpenKeychain/build/outputs/apk/OpenKeychain-debug.apk" -exit 0 -#+END_SRC - -Save and exit with *CTRL-o*, *CTRL-x*. - -#+BEGIN_SRC bash -chmod +x build.sh -./build.sh -#+END_SRC - -Build script for K9: - -#+BEGIN_SRC bash -cd ~/develop -git clone https://github.com/k9mail/k-9 -cd k-9 -cd tools -nano build.sh -#+END_SRC - -Then add the following: - -#+BEGIN_SRC bash -#!/bin/bash - -# This script is intended to be used on Debian systems for building -# the project. It has been tested with Debian 8 - -USERNAME=$USER -SIGNING_NAME='k-9' -SDK_VERSION='r24.3.3' -SDK_DIR=$HOME/android-sdk - -cd .. - -PROJECT_HOME=$(pwd) - -sudo apt-get install build-essential default-jdk \ - lib32stdc++6 lib32z1 lib32z1-dev - -if [ ! -d $SDK_DIR ]; then - mkdir -p $SDK_DIR -fi -cd $SDK_DIR - -# download the SDK -if [ ! -f $SDK_DIR/android-sdk_$SDK_VERSION-linux.tgz ]; then - wget https://dl.google.com/android/android-sdk_$SDK_VERSION-linux.tgz - tar -xzvf android-sdk_$SDK_VERSION-linux.tgz -fi -SDK_DIR=$SDK_DIR/android-sdk-linux - -echo 'Check that you have the SDK tools installed for Android 17, SDK 19.1' -if [ ! -f $SDK_DIR/tools/android ]; then - echo "$SDK_DIR/tools/android not found" - exit -1 -fi -cd $SDK_DIR -chmod -R 0755 $SDK_DIR -chmod a+rx $SDK_DIR/tools - -ANDROID_HOME=$SDK_DIR -echo "sdk.dir=$SDK_DIR" > $ANDROID_HOME/local.properties -PATH=${PATH}:$ANDROID_HOME/tools:$ANDROID_HOME/platform-tools - -android sdk -cd $PROJECT_HOME - -if [ ! -f $SDK_DIR/tools/templates/gradle/wrapper/gradlew ]; then - echo "$SDK_DIR/tools/templates/gradle/wrapper/gradlew not found" - exit -2 -fi -. $PROJECT_HOME/gradlew assembleDebug - -# cleaning up -cd $PROJECT_HOME/k9mail/build/outputs/apk -if [ ! -f k9mail-debug.apk ]; then - echo 'k9mail-debug.apk was not found' - exit -3 -fi -echo 'Build script ended successfully' -echo -n 'apk is available at: ' -echo "$PROJECT_HOME/k9mail/build/outputs/apk/k9mail-debug.apk" -exit 0 -#+END_SRC - -Save and exit with *CTRL-o*, *CTRL-x*. - -#+BEGIN_SRC bash -chmod +x build.sh -./build.sh -#+END_SRC - -*** Import your GPG key into OpenKeychain -With your device connected to a laptop via USB cable and with USB debugging enabled on it: - -#+BEGIN_SRC bash -ssh username@domainname -p 2222 -gpg --list-keys username@domainname -gpg --output ~/public_key.gpg --armor --export KEY_ID -gpg --output ~/private_key.gpg --armor --export-secret-key KEY_ID -cat ~/public_key.gpg ~/private_key.gpg > ~/mygpgkey.asc -exit -scp -P 2222 username@domainname:/home/username/mygpgkey.asc ~/ -sudo apt-get install android-tools-adb -push ~/mygpgkey.asc /sdcard/ -shred -zu ~/mygpgkey.asc -#+END_SRC - -Then on your device select OpenKeychain and import your key from file. -*** Incoming server settings - * Select settings/account settings - * Select Fetching mail/incoming server - * Enter your username and password - * IMAP server should be your domain name - * Security: SSL/TLS (always) - * Authentication: Plain - * Port: 993 -*** Outgoing (SMTP) server settings - * Select settings/account settings - * Select Sending mail/outgoing server - * Set SMTP server to your domain name - * Set Security to SSL/TLS (always) - * Set port to 465 - * Set authentication to PLAIN - * Enter your username and password - * Accept the SSL certificate -*** Crypto settings -Select *settings*, *Account settings*, *OpenKeychain* and then select your key and press *Allow*. You should now be able to decrypt emails by entering your GPG passphrase. - -You may also want to change the amount of time for which passwords are remembered, so that you don't need to enter your passphrase very often. -*** Folders -To view any new folders which you may have created using the /mailinglistrule/ script from your inbox press the *K9 icon* at the top left to access folders, then press the *menu button* and select *refresh folder list*. - -If your folder still doesn't show up then press the *menu button*, select *show folders* and select *all folders*. - +* Android apps +Mobile devices have a reputation for being quite insecure, so it's recommended that you don't store emails or GPG keys on your phone. Instead [[./app_mailpile.html][install Mailpile]] and access your email via the webmail interface. * Subscribing to mailing lists To subscribe to a mailing list log in as your user (i.e. not the root user). @@ -452,19 +222,5 @@ ssh username@domainname -p 2222 #+END_SRC Select /Administrator controls/ then *Email filtering rules* then *Block/Unblock and email address* or *Block/Unblock email with subject line*. Also see the manpage for *freedombone-ignore*. -* Your own mailing list -If you want to set up a public mailing list then when installing the system remember to set the *PUBLIC_MAILING_LIST* variable within *freedombone.cfg* to the name of your list. The name should have no spaces in it. Public mailing lists are unencrypted so anyone will be able to read the contents, including non subscribers. - -To subscribe to your list send a cleartext email to: - -#+BEGIN_SRC bash -mymailinglistname+subscribe@domainname -#+END_SRC - -Tip: When using the Mutt email client if you want to send an email in cleartext then press *p* (for PGP) on the sending screen and select *clear*. Unsecure email is treated as being the exception rather than the default. - -#+BEGIN_EXPORT html -
-Return to the home page -
-#+END_EXPORT +* Using I2P for email transport +For the most paranoid use cases it is also possible to use I2P as an email transport mechanism. This will of course require the people you're communicating with to have a similar setup in place. For details see the [[./app_bdsmail.html][bdsmail app]]. An advantage of this is that it's very unlikely that your email will get blocked. The disadvantage is that few others will be capable of receiving email this way, and it's only really usable via the Mutt email client. diff --git a/doc/EN/users.org b/doc/EN/users.org new file mode 100644 index 00000000..29be50d6 --- /dev/null +++ b/doc/EN/users.org @@ -0,0 +1,21 @@ +#+TITLE: +#+AUTHOR: Bob Mottram +#+EMAIL: bob@freedombone.net +#+KEYWORDS: freedombone, debian, beaglebone, users +#+DESCRIPTION: Adding or removing users +#+OPTIONS: ^:nil toc:nil +#+HTML_HEAD: + +#+BEGIN_CENTER +[[file:images/logo.png]] +#+END_CENTER + +Log into the system with: + +#+BEGIN_SRC bash +ssh username@domainname -p 2222 +#+END_SRC + +Select *Administrator controls* then *User Management*. + +[[file:images/controlpanel/control_panel_manage_users.jpg]] diff --git a/img/bbb3.png b/img/bbb3.png index 4b3132bf..9158429a 100644 Binary files a/img/bbb3.png and b/img/bbb3.png differ diff --git a/img/bios_boot_usb.jpg b/img/bios_boot_usb.jpg new file mode 100644 index 00000000..878a243a Binary files /dev/null and b/img/bios_boot_usb.jpg differ diff --git a/img/laptop_router.jpg b/img/laptop_router.jpg new file mode 100644 index 00000000..86a622c2 Binary files /dev/null and b/img/laptop_router.jpg differ diff --git a/img/pleroma_register.jpg b/img/pleroma_register.jpg new file mode 100644 index 00000000..cdfb7752 Binary files /dev/null and b/img/pleroma_register.jpg differ diff --git a/img/port_forwarding.png b/img/port_forwarding.png new file mode 100644 index 00000000..9e16cf00 Binary files /dev/null and b/img/port_forwarding.png differ diff --git a/img/tusky.jpg b/img/tusky.jpg new file mode 100644 index 00000000..114bc2b7 Binary files /dev/null and b/img/tusky.jpg differ diff --git a/man/freedombone-image.1.gz b/man/freedombone-image.1.gz index 5b33ddc4..008c1afa 100644 Binary files a/man/freedombone-image.1.gz and b/man/freedombone-image.1.gz differ diff --git a/src/freedombone b/src/freedombone index 0549bcf4..2760fdb0 100755 --- a/src/freedombone +++ b/src/freedombone @@ -77,6 +77,12 @@ if [[ "$command_options" == "menuconfig-postactiv" ]]; then SOCIALINSTANCE='postactiv' fi +if [[ "$command_options" == "menuconfig-pleroma" ]]; then + MINIMAL_INSTALL="yes" + ONION_ONLY="no" + SOCIALINSTANCE='pleroma' +fi + if [ ! "$CONFIGURATION_FILE" ]; then CONFIGURATION_FILE="$HOME/${PROJECT_NAME}.cfg" fi diff --git a/src/freedombone-app-gnusocial b/src/freedombone-app-gnusocial index 90edc7ec..1d65b347 100755 --- a/src/freedombone-app-gnusocial +++ b/src/freedombone-app-gnusocial @@ -611,6 +611,8 @@ function remove_gnusocial { if grep -q 'gnusocial-firewall' /etc/crontab; then sed -i '/gnusocial-firewall/d' /etc/crontab fi + sed -i 's|mysqli.allow_persistent.*|mysqli.allow_persistent = On|g' /etc/php/7.0/cli/php.ini + sed -i 's|mysqli.reconnect.*|mysqli.reconnect = Off|g' /etc/php/7.0/cli/php.ini function_check remove_ddns_domain remove_ddns_domain "$GNUSOCIAL_DOMAIN_NAME" @@ -888,6 +890,15 @@ function install_gnusocial_main { # This improves performance sed -i "s|//\$config\\['db'\\]\\['schemacheck'\\].*|\$config\\['db'\\]\\['schemacheck'\\] = 'script';|g" "$gnusocial_config_file" + # remove the install script + if [ -f "/var/www/$GNUSOCIAL_DOMAIN_NAME/htdocs/install.php" ]; then + rm "/var/www/$GNUSOCIAL_DOMAIN_NAME/htdocs/install.php" + fi + + # php configuration + sed -i 's|mysqli.allow_persistent.*|mysqli.allow_persistent = On|g' /etc/php/7.0/cli/php.ini + sed -i 's|mysqli.reconnect.*|mysqli.reconnect = On|g' /etc/php/7.0/cli/php.ini + systemctl restart mariadb systemctl restart php7.0-fpm systemctl restart nginx diff --git a/src/freedombone-app-pleroma b/src/freedombone-app-pleroma index a00bab46..f808eef8 100755 --- a/src/freedombone-app-pleroma +++ b/src/freedombone-app-pleroma @@ -47,7 +47,7 @@ PLEROMA_CODE= PLEROMA_PORT=4000 PLEROMA_ONION_PORT=8011 PLEROMA_REPO="https://git.pleroma.social/pleroma/pleroma.git" -PLEROMA_COMMIT='b0d242cd9220c22c0af7c153182a51d8e40d34ba' +PLEROMA_COMMIT='312a8783f8dbf563ea9d5af3cc7991ca553dc286' PLEROMA_ADMIN_PASSWORD= PLEROMA_DIR=/etc/pleroma PLEROMA_SECRET_KEY="" @@ -769,6 +769,8 @@ function upgrade_pleroma { expire_pleroma_posts "$PLEROMA_DOMAIN_NAME" "$PLEROMA_EXPIRE_MONTHS" create_pleroma_blocklist + chown -R pleroma:pleroma $PLEROMA_DIR + systemctl restart pleroma } @@ -902,7 +904,7 @@ function remove_pleroma { rm /etc/systemd/system/pleroma.service userdel pleroma - #apt-get -yq remove esl-erlang elixir erlang-xmerl erlang-dev erlang-parsetools + #remove_elixir function_check remove_nodejs remove_nodejs pleroma-backend @@ -936,30 +938,6 @@ function remove_pleroma { remove_ddns_domain "$PLEROMA_DOMAIN_NAME" } -function install_elixir { - apt-get -yq install wget build-essential - - if [ ! -d "$INSTALL_DIR" ]; then - mkdir -p "$INSTALL_DIR" - fi - - cd "$INSTALL_DIR" || exit 768345274 - erlang_package=erlang-solutions_1.0_all.deb - wget https://packages.erlang-solutions.com/$erlang_package - if [ ! -f "$INSTALL_DIR/$erlang_package" ]; then - exit 72853 - fi - dpkg -i $erlang_package - apt-get -yq update - apt-get -yq install esl-erlang - apt-get -yq install elixir erlang-xmerl erlang-dev erlang-parsetools - - if [ ! -f /usr/local/bin/mix ]; then - echo $'/usr/local/bin/mix not found after elixir installation' - exit 629352 - fi -} - function install_pleroma { if [ ! $ONION_ONLY ]; then ONION_ONLY='no' diff --git a/src/freedombone-app-postactiv b/src/freedombone-app-postactiv index 0c3668ea..e8605774 100755 --- a/src/freedombone-app-postactiv +++ b/src/freedombone-app-postactiv @@ -624,6 +624,8 @@ function remove_postactiv { remove_backup_database_local postactiv sed -i '/postactiv-firewall/d' /etc/crontab + sed -i 's|mysqli.allow_persistent.*|mysqli.allow_persistent = On|g' /etc/php/7.0/cli/php.ini + sed -i 's|mysqli.reconnect.*|mysqli.reconnect = Off|g' /etc/php/7.0/cli/php.ini function_check remove_ddns_domain remove_ddns_domain "$POSTACTIV_DOMAIN_NAME" @@ -653,6 +655,9 @@ function install_postactiv_main { apt-get -yq install php-gettext php-curl php-gd php-mysql git curl apt-get -yq install memcached php-memcached php-intl exiftool libfcgi0ldbl + apt-get -yq install php7.0-bcmath php7.0-curl php7.0-exif php7.0-gd + apt-get -yq install php7.0-intl php7.0-mbstring php7.0-mysqlnd + apt-get -yq install php7.0-opcache php7.0-readline php7.0-xmlwriter if [ ! -d "/var/www/$POSTACTIV_DOMAIN_NAME" ]; then mkdir "/var/www/$POSTACTIV_DOMAIN_NAME" @@ -905,6 +910,10 @@ function install_postactiv_main { rm "/var/www/$POSTACTIV_DOMAIN_NAME/htdocs/install.php" fi + # php configuration + sed -i 's|mysqli.allow_persistent.*|mysqli.allow_persistent = On|g' /etc/php/7.0/cli/php.ini + sed -i 's|mysqli.reconnect.*|mysqli.reconnect = On|g' /etc/php/7.0/cli/php.ini + systemctl restart mariadb systemctl restart php7.0-fpm systemctl restart nginx diff --git a/src/freedombone-config b/src/freedombone-config index 168c0b26..53c9d2cf 100755 --- a/src/freedombone-config +++ b/src/freedombone-config @@ -1142,6 +1142,15 @@ function interactive_config { install_postactiv fi + if [[ "$SOCIALINSTANCE" == 'pleroma' ]]; then + PLEROMA_DOMAIN_NAME=$DEFAULT_DOMAIN_NAME + PLEROMA_CODE=$DEFAULT_DOMAIN_CODE + write_config_param "PLEROMA_DOMAIN_NAME" "$PLEROMA_DOMAIN_NAME" + write_config_param "PLEROMA_CODE" "$PLEROMA_CODE" + write_config_param "SOCIALINSTANCE" "$SOCIALINSTANCE" + install_pleroma + fi + # delete the temporary configuration file if [ -f temp.cfg ]; then shred -zu temp.cfg diff --git a/src/freedombone-image b/src/freedombone-image index fb772ab3..14772c86 100755 --- a/src/freedombone-image +++ b/src/freedombone-image @@ -563,7 +563,7 @@ if [[ $AMNESIC != 'no' ]]; then IMAGE_NAME="${IMAGE_NAME}-amnesic" fi -if [[ "$SOCIALINSTANCE" == "gnusocial" || "$SOCIALINSTANCE" == "postactiv" ]]; then +if [[ "$SOCIALINSTANCE" == "gnusocial" || "$SOCIALINSTANCE" == "postactiv" || "$SOCIALINSTANCE" == "pleroma" ]]; then IMAGE_NAME="${IMAGE_NAME}-${SOCIALINSTANCE}" fi diff --git a/src/freedombone-image-customise b/src/freedombone-image-customise index 7427b7d9..b9fa161b 100755 --- a/src/freedombone-image-customise +++ b/src/freedombone-image-customise @@ -395,14 +395,18 @@ EOF if [[ "$SOCIALINSTANCE" == "postactiv" ]]; then echo " ${PROJECT_NAME} menuconfig-postactiv" >> "$rootdir/root/.bashrc" else - if [[ "$ONION_ONLY" == "no" ]]; then - if [[ "$MINIMAL_INSTALL" == "no" ]]; then - echo " ${PROJECT_NAME} menuconfig-full" >> "$rootdir/root/.bashrc" - else - echo " ${PROJECT_NAME} menuconfig" >> "$rootdir/root/.bashrc" - fi + if [[ "$SOCIALINSTANCE" == "pleroma" ]]; then + echo " ${PROJECT_NAME} menuconfig-pleroma" >> "$rootdir/root/.bashrc" else - echo " ${PROJECT_NAME} menuconfig-onion" >> "$rootdir/root/.bashrc" + if [[ "$ONION_ONLY" == "no" ]]; then + if [[ "$MINIMAL_INSTALL" == "no" ]]; then + echo " ${PROJECT_NAME} menuconfig-full" >> "$rootdir/root/.bashrc" + else + echo " ${PROJECT_NAME} menuconfig" >> "$rootdir/root/.bashrc" + fi + else + echo " ${PROJECT_NAME} menuconfig-onion" >> "$rootdir/root/.bashrc" + fi fi fi fi @@ -1917,8 +1921,6 @@ image_preinstall_repos() { if [[ "$SOCIALINSTANCE" == "pleroma" ]]; then git clone "$PLEROMA_REPO" "$rootdir/repos/pleroma" - git clone "$QVITTER_THEME_REPO" "$rootdir/repos/qvitter" - git clone "$PLEROMA_FRONTEND_REPO" "$rootdir/repos/pleroma-fe" return fi @@ -1953,7 +1955,6 @@ image_preinstall_repos() { git clone "$HUBZILLA_REPO" "$rootdir/repos/hubzilla" git clone "$HUBZILLA_ADDONS_REPO" "$rootdir/repos/hubzilla-addons" git clone "$KOEL_REPO" "$rootdir/repos/koel" - #git clone "$LIBREVAULT_REPO" "$rootdir/repos/librevault" git clone "$LYCHEE_REPO" "$rootdir/repos/lychee" git clone "$MAILPILE_REPO" "$rootdir/repos/mailpile" git clone "$MATRIX_REPO" "$rootdir/repos/matrix" @@ -2161,6 +2162,7 @@ create_generic_image atheros_wifi continue_installation image_install_nodejs +image_install_elixir initialise_mesh configure_wifi configure_user_interface diff --git a/src/freedombone-utils-elixir b/src/freedombone-utils-elixir new file mode 100755 index 00000000..347a8eae --- /dev/null +++ b/src/freedombone-utils-elixir @@ -0,0 +1,100 @@ +#!/bin/bash +# +# .---. . . +# | | | +# |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-. +# | | (.-' (.-' ( | ( )| | | | )( )| | (.-' +# ' ' --' --' -' - -' ' ' -' -' -' ' - --' +# +# Freedom in the Cloud +# +# Elixir functions +# +# There's a problem with installing this onto mesh images, which is +# that qemu appears to run out of RAM when using yarn to add webpack. +# +# License +# ======= +# +# Copyright (C) 2018 Bob Mottram +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +erlang_package='erlang-solutions_1.0_all.deb' + +function remove_elixir { + apt-get -yq remove elixir erlang-xmerl erlang-dev erlang-parsetools + apt-get -yq remove esl-erlang +} + +function install_elixir { + if [ -f /usr/local/bin/mix ]; then + return + fi + + apt-get -yq install wget build-essential + + if [ ! -d "$INSTALL_DIR" ]; then + mkdir -p "$INSTALL_DIR" + fi + + cd "$INSTALL_DIR" || exit 768345274 + wget https://packages.erlang-solutions.com/$erlang_package + if [ ! -f "$INSTALL_DIR/$erlang_package" ]; then + exit 72853 + fi + dpkg -i $erlang_package + apt-get -yq update + apt-get -yq install esl-erlang + apt-get -yq install elixir erlang-xmerl erlang-dev erlang-parsetools + + if [ ! -f /usr/local/bin/mix ]; then + echo $'/usr/local/bin/mix not found after elixir installation' + exit 629352 + fi +} + +function image_install_elixir { + if [[ $VARIANT == "mesh"* ]]; then + return + fi + + # shellcheck disable=SC2154 + chroot "$rootdir" apt-get -yq install wget build-essential + + if [ ! -d "$rootdir$INSTALL_DIR" ]; then + mkdir -p "$rootdir$INSTALL_DIR" + fi + + { echo '#!/bin/bash'; + echo "cd $INSTALL_DIR || exit 1"; + echo "erlang_package=$erlang_package"; + echo "wget https://packages.erlang-solutions.com/\$erlang_package"; + echo "if [ ! -f \"$INSTALL_DIR/\$erlang_package\" ]; then"; + echo ' exit 2'; + echo 'fi'; + echo "dpkg -i \$erlang_package"; } > "$rootdir/usr/bin/install_elixir" + chmod +x "$rootdir/usr/bin/install_elixir" + chroot "$rootdir" /usr/bin/install_elixir + chroot "$rootdir" apt-get -yq update + chroot "$rootdir" apt-get -yq install esl-erlang + chroot "$rootdir" apt-get -yq install elixir erlang-xmerl erlang-dev erlang-parsetools + + if [ ! -f "$rootdir/usr/local/bin/mix" ]; then + echo $'/usr/local/bin/mix not found after elixir installation' + exit 629352 + fi +} + +# NOTE: deliberately no exit 0 diff --git a/website/EN/app_pleroma.html b/website/EN/app_pleroma.html index c5a873b4..1a3fa739 100644 --- a/website/EN/app_pleroma.html +++ b/website/EN/app_pleroma.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + ‎ @@ -274,9 +274,9 @@ Some general advice about life in the fediverse can b -
-

Installation

-
+
+

Installation

+

Log into your system with:

@@ -296,9 +296,9 @@ Select Add/Remove Apps then pleroma. You will then be asked for a
-
-

Initial setup

-
+
+

Initial setup

+

The first thing you'll need to do is register a new account. You can set your profile details and profile image by selecting the small settings icon to the right of your name.

@@ -309,9 +309,9 @@ Once you have done that then you can disable further registrations from the A
-
-

Mastodon user interface

-
+
+

Mastodon user interface

+

If you prefer a Tweetdeck-style user interface, similar to Mastodon, then once you have registered an account navigate to /yourpleromadomainname/web and log in.

@@ -326,9 +326,25 @@ If you prefer a Tweetdeck-style user interface, similar to Mastodon, then once y
-
-

Blocking controls

-
+
+

Mobile apps

+
+

+It's also possible to use Mastodon apps together with Pleroma, such as Tusky, since it supports the Mastodon API. You may need to install IcecatMobile and set it as your default browser (under Settings/Apps/Menu) in order for the initial oauth registration process to work. +

+ +
+ +
+

tusky.jpg +

+
+
+
+
+
+

Blocking controls

+
diff --git a/website/EN/apps.html b/website/EN/apps.html index c831809c..227f8e75 100644 --- a/website/EN/apps.html +++ b/website/EN/apps.html @@ -3,33 +3,26 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - - - -‎ - - - + + + + + - + @@ -189,7 +97,7 @@ @licstart The following is the entire license notice for the JavaScript code in this tag. -Copyright (C) 2012-2017 Free Software Foundation, Inc. +Copyright (C) 2012-2013 Free Software Foundation, Inc. The JavaScript code in this tag is free software: you can redistribute it and/or modify it under the terms of the GNU @@ -236,7 +144,8 @@ for the JavaScript code in this tag.
-
+

+

logo.png @@ -244,8 +153,6 @@ for the JavaScript code in this tag.

-

Apps

-

"In times of aggressive corporatization, increasing enclosure of communication spaces, and blanket surveillance, emancipatory communication practices appear to be particularly well suited to offer concrete alternatives to activists and citizens alike" – Stefania Milan @@ -256,7 +163,7 @@ for the JavaScript code in this tag. The base install of the system just contains an email server and Mutt client, but not much else. In addition from within the Administrator control panel under Add/remove apps the following are installable. This list only applies on the home server version, with the mesh network version having a different and smaller set of apps.

-
+

control_panel_apps.jpg @@ -265,9 +172,9 @@ The base install of the system just contains an email server and Mutt client, bu

-
-

Akaunting

-
+
+

Akaunting

+

A web based accounts system for small businesses or freelancers.

@@ -277,9 +184,9 @@ A web based accounts system for small businesses or freelancers.

-
-

BDS Mail

-
+ -
-

CryptPad

-
+
+

CryptPad

+

Collaborate on editing documents, presentations and source code, or vote on things. All with a good level of security.

@@ -301,9 +208,9 @@ Collaborate on editing documents, presentations and source code, or vote on thin

-
-

DLNA

-
+
+

DLNA

+

Enables you to use the system as a music server which any DLNA compatible devices can connect to within your home network.

@@ -313,9 +220,9 @@ Enables you to use the system as a music server which any DLNA compatible device

-
-

Dokuwiki

-
+
+

Dokuwiki

+

A databaseless wiki system.

@@ -325,9 +232,9 @@ A databaseless wiki system.

-
-

Edith

-
+
+

Edith

+

Extremely simple and distraction-free notes system.

@@ -337,9 +244,9 @@ Extremely simple and distraction-free notes system.

-
-

Emacs

-
+
+

Emacs

+

If you use the Mutt client to read your email then this will set it up to use emacs for composing new mail.

@@ -349,9 +256,17 @@ If you use the Mutt client to read your email then this will set it up to use em

-
-

Etherpad

-
+
+

Email Server

+
+

+Since many apps require email registration an email server is installed by default. You can find advice on using the email system here. +

+
+
+
+

Etherpad

+

Collaborate on creating documents in real time. Maybe you're planning a holiday with other family members or creating documentation for a Free Software project along with other volunteers. Etherpad is hard to beat for simplicity and speed. Only users of the system will be able to access it.

@@ -361,9 +276,9 @@ Collaborate on creating documents in real time. Maybe you're planning a holiday

-
-

Federated wiki

-
+
+

Federated wiki

+

A new approach to creating wiki content.

@@ -373,9 +288,9 @@ A new approach to creating wiki content.

-
-

Friendica

-
+
+

Friendica

+

Federated social network system.

@@ -385,9 +300,9 @@ Federated social network system.

-
-

Ghost

-
+
+

Ghost

+

Modern looking blogging system.

@@ -397,9 +312,9 @@ Modern looking blogging system.

-
-

GNU Social

-
+
+

GNU Social

+

Federated social network based on the OStatus protocol. You can "remote follow" other users within the GNU Social federation.

@@ -409,9 +324,9 @@ Federated social network based on the OStatus protocol. You can "remote follo

-
-

Gogs

-
+
+

Gogs

+

Lightweight git project hosting system. You can mirror projects from Github, or if Github turns evil then just host your own projects while retaining the familiar fork-and-pull workflow. If you can use Github then you can also use Gogs.

@@ -421,9 +336,9 @@ Lightweight git project hosting system. You can mirror projects from Github, or

-
-

HTMLy

-
+
+

HTMLy

+

Databaseless blogging system. Quite simple and with a markdown-like format.

@@ -433,9 +348,9 @@ Databaseless blogging system. Quite simple and with a markdown-like format.

-
-

Hubzilla

-
+
+

Hubzilla

+

Web publishing platform with social network like features and good privacy controls so that it's possible to specify who can see which content. Includes photo albums, calendar, wiki and file storage.

@@ -445,9 +360,9 @@ Web publishing platform with social network like features and good privacy contr

-
-

Icecast media stream

-
+
+

Icecast media stream

+

Make your own internet radio station.

@@ -457,9 +372,9 @@ Make your own internet radio station.

-
-

IRC Server (ngirc)

-
+
+

IRC Server (ngirc)

+

Run your own IRC chat channel which can be secured with a password and accessible via an onion address. A bouncer is included so that you can receive messages sent while you were offline. Works with Hexchat and other popular clients.

@@ -469,18 +384,18 @@ Run your own IRC chat channel which can be secured with a password and accessibl

-
-

Jitsi Meet

-
+
+

Jitsi Meet

+

Experimental WebRTC video conferencing system, similar to Google Hangouts. This may not be fully functional, but is hoped to be in the near future.

-
-

KanBoard

-
+
+

KanBoard

+

A simple kanban system for managing projects or TODO lists.

@@ -490,9 +405,9 @@ A simple kanban system for managing projects or TODO lists.

-
-

Key Server

-
+
+

Key Server

+

An OpenPGP key server for storing and retrieving GPG public keys.

@@ -502,9 +417,9 @@ An OpenPGP key server for storing and retrieving GPG public keys.

-
-

Koel

-
+
+

Koel

+

Access your music collection from any internet connected device.

@@ -514,9 +429,9 @@ Access your music collection from any internet connected device.

-
-

Lychee

-
+
+

Lychee

+

Make your photo albums available on the web.

@@ -526,9 +441,9 @@ Make your photo albums available on the web.

-
-

Mailpile

-
+
+

Mailpile

+

Modern email client which supports GPG encryption.

@@ -538,9 +453,9 @@ Modern email client which supports GPG encryption.

-
-

Matrix

-
+
+

Matrix

+

Multi-user chat with some security and moderation controls.

@@ -550,9 +465,9 @@ Multi-user chat with some security and moderation controls.

-
-

Mediagoblin

-
+
+

Mediagoblin

+

Publicly host video and audio files so that you don't need to use YouTube/Vimeo/etc.

@@ -562,9 +477,9 @@ Publicly host video and audio files so that you don't need to use YouTube/Vimeo/

-
-

Mumble

-
+
+

Mumble

+

The popular VoIP and text chat system. Say goodbye to old-fashioned telephony conferences with silly dial codes. Also works well on mobile.

@@ -574,9 +489,9 @@ The popular VoIP and text chat system. Say goodbye to old-fashioned telephony co

-
-

NextCloud

-
+
+

NextCloud

+

Store files on your server and sync them with laptops or mobile devices. Includes many plugins including videoconferencing and collaborative document editing.

@@ -586,9 +501,9 @@ Store files on your server and sync them with laptops or mobile devices. Include

-
-

PeerTube

-
+
+

PeerTube

+

Peer-to-peer video hosting. Similar to Mediagoblin, but the P2P aspect better enables the streaming load to be shared across servers.

@@ -598,9 +513,9 @@ Peer-to-peer video hosting. Similar to Mediagoblin, but the P2P aspect better en

-
-

PI-Hole

-
+
+

PI-Hole

+

The black hole for web adverts. Block adverts at the domain name level within your local network. It can significantly reduce bandwidth, speed up page load times and protect your systems from being tracked by spyware.

@@ -610,9 +525,9 @@ The black hole for web adverts. Block adverts at the domain name level within yo

-
-

Pleroma

-
+
+

Pleroma

+

Fediverse instance which is compatible with GNU Social and Mastodon, and suited for systems without much RAM or CPU resource.

@@ -622,9 +537,9 @@ Fediverse instance which is compatible with GNU Social and Mastodon, and suited

-
-

PostActiv

-
+
+

PostActiv

+

An alternative federated social networking system compatible with GNU Social, Pleroma and Mastodon. It includes some optimisations and fixes currently not available within the main GNU Social project.

@@ -634,9 +549,9 @@ An alternative federated social networking system compatible with GNU Social, Pl

-
-

PrivateBin

-
+
+

PrivateBin

+

A pastebin where the server has zero knowledge of the content being pasted.

@@ -646,9 +561,9 @@ A pastebin where the server has zero knowledge of the content being pasted.

-
-

Profanity

-
+
+

Profanity

+

A shell based XMPP client which you can run on the Freedombone server via ssh.

@@ -658,9 +573,9 @@ A shell based XMPP client which you can run on the Freedombone server via ssh.

-
-

Riot Web

-
+
+

Riot Web

+

A browser based user interface for the Matrix federated communications system, including WebRTC audio and video chat.

@@ -670,9 +585,9 @@ A browser based user interface for the Matrix federated communications system, i

-
-

SearX

-
+
+

SearX

+

A metasearch engine for customised and private web searches.

@@ -682,9 +597,9 @@ A metasearch engine for customised and private web searches.

-
-

tt-rss

-
+
+

tt-rss

+

Private RSS reader. Pulls in RSS/Atom feeds via Tor and is only accessible via an onion address. Have "the right to read" without the Surveillance State knowing what you're reading. Also available with a user interface suitable for viewing on mobile devices via a browser such as OrFox.

@@ -694,9 +609,9 @@ Private RSS reader. Pulls in RSS/Atom feeds via Tor and is only accessible via a

-
-

Syncthing

-
+
+

Syncthing

+

Possibly the best way to synchronise files across all of your devices. Once it has been set up it "just works" with no user intervention needed.

@@ -706,9 +621,9 @@ Possibly the best way to synchronise files across all of your devices. Once it h

-
-

Tahoe-LAFS

-
+
+

Tahoe-LAFS

+

Robust and encrypted storage of files on one or more server.

@@ -718,9 +633,9 @@ Robust and encrypted storage of files on one or more server.

-
-

Tox

-
+
+

Tox

+

Client and bootstrap node for the Tox chat/VoIP system.

@@ -730,9 +645,9 @@ Client and bootstrap node for the Tox chat/VoIP system.

-
-

Turtl

-
+
+

Turtl

+

A system for privately creating and sharing notes and images, similar to Evernote but without the spying.

@@ -742,18 +657,18 @@ A system for privately creating and sharing notes and images, similar to Evernot

-
-

Vim

-
+
+

Vim

+

If you use the Mutt client to read your email then this will set it up to use vim for composing new mail.

-
-

Virtual Private Network (VPN)

-
+
+

Virtual Private Network (VPN)

+

Set up a VPN on your server so that you can bypass local internet censorship.

@@ -763,9 +678,9 @@ Set up a VPN on your server so that you can bypass local internet censorship.

-
-

XMPP

-
+
+

XMPP

+

Chat server which can be used together with client such as Gajim or Conversations to provide end-to-end content security and also onion routed metadata security. Includes advanced features such as client state notification to save battery power on your mobile devices, support for seamless roaming between networks and message carbons so that you can receive the same messages while being simultaneously logged in to your account on more than one device.

diff --git a/website/EN/fediverse.html b/website/EN/fediverse.html index e42ef356..795e80b9 100644 --- a/website/EN/fediverse.html +++ b/website/EN/fediverse.html @@ -3,33 +3,26 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - - - -‎ - - - + + + + + - + @@ -189,7 +97,7 @@ @licstart The following is the entire license notice for the JavaScript code in this tag. -Copyright (C) 2012-2017 Free Software Foundation, Inc. +Copyright (C) 2012-2013 Free Software Foundation, Inc. The JavaScript code in this tag is free software: you can redistribute it and/or modify it under the terms of the GNU @@ -236,7 +144,8 @@ for the JavaScript code in this tag.
-
+

+

logo.png @@ -244,77 +153,83 @@ for the JavaScript code in this tag.

-
-

Homesteading the Fediverse

-
+
+

+Homesteading the Fediverse +

+

Some things you might want to know about the Fediverse:

-
-

Federation as a concept

-
+
+

Federation as a concept

+

-The political definition of a federation is "a union of partially self-governing states or regions under a central (federal) government". The fediverse isn't exactly like that, in that there is no federal government. However there are protocols which govern the communication between instances and that might be analogized to being a sort of elemantary constitution or mutual agreement binding all participants together. The protocols are merely ways of moving data around though, and don't impose any sort of moral code. +The political definition of a federation is "a union of partially self-governing states or regions under a central (federal) government". The fediverse isn't exactly like that, in that there is no federal government. However there are protocols which govern the communication between instances and that might be analogized to being a sort of elementary constitution or mutual agreement binding all participants together. The protocols are merely ways of moving data around though, and don't impose any sort of moral code.

-
-

Keep the number of users on each server small

-
+
+

Keep the number of users on each server small

+

The importance of this can't be overstated. Servers with lots of users always eventually have problems where the interests of the users are not the same as the interests of the server administrator. If you are the server administrator, or if there are only a small squad-size group of people on the server, then it's a lot easier to resolve differences and everyone's interests are likely to be similar.

-
-

Drama will happen

-
+
+

Drama will happen

+

It's inevitable in any social network, but fortunately your options for dealing with it are better than they are in the giant proprietary monoliths. In the proprietary world Google or Facebook don't give a damn about the fate of individual users. On a server with a small number of users if you're getting griefed then the administrator is likely to care and be able to do something about it.

-
-

Don't be afraid to block

-
+
+

Don't be afraid to block

+

Especially if other servers are publishing content which may not be legal in your jurisdiction then don't be afraid to use domain or user blocking from the Administrator control panel. The same applies if users on other servers are trying to harass you. Blocking creates politics and drama but this is a feature not a bug. It allows you to craft your own distinct community and user experience while also existing in the wider federation. It's hard to do this on sites like Twitter or Facebook. Try to keep blocking to a minimum though and avoid doing it for insubstantial reasons. If you have other users on your server then publish the blocked domains list somewhere they can see. That avoids disappointment and enables you to have a discussion about the validity of blocking decisions.

-
-

Network structure maps on to social structure

-
+
+

Network structure maps on to social structure

+

Over time follows and blocking rules come to match the underlying social geography of affinity groups. Blocking will happen and users will move around or start new servers. Drama related to blocking will dissipate.

-
-

Keep your follows under the Dunbar number

-
+
+

Keep your follows under the Dunbar number

+

-Keep the number of other users you're following and who are also active to under a couple of hundred. Any more than that and you'll just be overwhelmed by irrelevant stuff and whatever community you may have been part of will dissolve in a sea of entropy. There are no algorithmic timelines, and even if they're introduced then they create their own problems as an opaque form of censorship. Real community happens at tribal scale. It's something which people often don't like to admit because they get fixated upon bigger and bigger numbers, but it definitely seems to be true. +Keep the number of other frequently active users you're following to under a couple of hundred. Your actual number of follows might be larger than this but could include users who rarely post anything. +

+ +

+Once there are more than a couple of hundred highly active users in your timeline then you'll just be overwhelmed by irrelevant stuff and whatever community you may have been part of will be drowned in the entropy. There are no algorithmic timelines to hide posts, and even if they're introduced then they create their own problems as an opaque form of censorship. Real community happens at tribal scale. It's something which people often don't like to admit because they get fixated upon bigger and bigger numbers, but it definitely seems to be true.

-
-

Avoid big public servers

-
+
+

Avoid big public servers

+

It may seem like a good idea and it may seem like you're doing a service to the community by allowing random strangers to register, but servers with thousands of users only cause problems - social, administrative, financial and possibly also legal. The financial strain of running a powerful server with high reliability may be enough to encourage the administrator to begin pushing advertising onto the system, or sell user content, and then before you know it you have identical problems to Twitter. Instead try to encourage people to set up their own servers. Follow this principle and a lot of arguments and stress will be more easily avoided.

-
+

This site can also be accessed via a Tor browser at http://yjxlc3imv7obva4grjae6u3qw527koaytrgjgdp364hmthrst3jodiid.onion. This documentation is under the GNU Free Documentation License version 1.3

diff --git a/website/EN/index.html b/website/EN/index.html index a9c57b09..2a9ca125 100644 --- a/website/EN/index.html +++ b/website/EN/index.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + ‎ @@ -258,24 +258,17 @@ So you want to run your own internet services? Email, chat, VoIP, web sites, fil

-Here's how. +A list of other supported ARM boards can be found here, or you can install onto an old laptop or netbook. Some installation instructions for different use cases are:

-

-And here's how on a Beaglebone Black. A list of other supported ARM boards can be found here. -

- -

-Or you can install onto an existing Debian system. -

- -

-If you have a single board ARM computer which isn't one of the officially supported ones, such as Raspberry Pi, then you may still be able to install Freedombone with Armbian. -

- -

-Want to make a community mesh network which can either be fully autonomous or connected to the internet? The Freedombone Mesh is a wireless solution for networked communication that can be rapidly deployed in temporary, emergency or post-disaster situations where internet access is unavailable or compromised, or used as an infrastructural community service similar to Freifunk. -

+

After installation it's possible that you might want some advice on how to run your system and set up apps to work nicely with it. @@ -283,13 +276,15 @@ After installation it's possible that you might want some advice on how to run y

+

If you find bugs, or want to add a new app to this system see the Developers Guide and Code of Conduct. There is a Matrix chat room available at #fbone:matrix.freedombone.net.

diff --git a/website/EN/security.html b/website/EN/security.html new file mode 100644 index 00000000..4d2656de --- /dev/null +++ b/website/EN/security.html @@ -0,0 +1,250 @@ + + + + + + + + + + + + + + + + +
+ +
+
+

+
+ +
+

logo.png +

+
+
+ +
+

Authentication with keys

+
+

+It's a lot more secure to log in to the Freedombone system using ssh keys rather than with a password. You can set that up by first running: +

+ +
+ +
freedombone-client
+
+
+ +

+On your local system (i.e. whatever you're logging in to the Freedombone system from, typically a laptop). Then: +

+ +
+ssh myusername@freedombone.local -p 2222
+
+ +

+Select Administrator controls and re-enter your password, then Manage Users and Change user ssh public key. Copy and paste the ssh public keys which appeared after the freedombone-client command was run. Then go to Security settings and select Allow ssh login with passwords followed by no. +

+ +

+You'll need to make sure that you have a copy of the ~/.ssh directory on your local system. You could just copy that directory to a USB drive and then keep that somewhere safe so that you can restore the keys if you need to. +

+
+
+
+

Administrating the system via an onion address (Tor)

+
+

+You can also access your system via the Tor system using an onion address. To find out what the onion address for ssh access is you can do the following: +

+ +
+ +
ssh username@freedombone.local -p 2222
+
+
+ +

+Select Administrator controls then select "About this system" and look for the onion address for ssh. You can then close the terminal and open another, then do the following on your local system: +

+ +
+ +
freedombone-client
+
+
+ +

+This will set up your ssh environment to be able to handle onion addresses. Then you can test ssh with: +

+ +
+ +
ssh username@address.onion -p 2222
+
+
+ +

+Subsequently even if dynamic DNS isn't working you may still be able to administer your system. Using the onion address also gives you some degree of protection against corporate or government metadata analysis, since it becomes more difficult to passively detect which systems are communicating. +

+
+
+
+
+ + + +
+Back to top | E-mail me +
+
+ + diff --git a/website/EN/socialinstance.html b/website/EN/socialinstance.html new file mode 100644 index 00000000..a87a1011 --- /dev/null +++ b/website/EN/socialinstance.html @@ -0,0 +1,419 @@ + + + + + + + +‎ + + + + + + + + + +
+ +
+
+
+ +
+

logo.png +

+
+
+ +
+

Social Instance

+
+ +

+A social instance image allows you to easily set up a fediverse server, which federates using the OStatus or ActivityPub protocol. You will need: +

+ +
    +
  • An old laptop, capable of booting from USB
    • +
  • A USB drive, preferably Sandisk and 16GB or larger
    • +
  • An ethernet patch cable
    • +
  • A domain name of your own
    • +
  • A dynamic DNS account
    • +
+ +

+The installation process is the same as usual, with the only difference being that on initial setup it will go straight to the domain setup details for your instance. In summary: +

+ +
+

Copy the image to the USB drive

+
+

+Substitute sdX with the device name for your USB drive. +

+ +
+
sudo apt-get install xz-utils wget
+wget https://freedombone.net/downloads/current/freedombone-pleroma-amd64.img.xz
+wget https://freedombone.net/downloads/current/freedombone-pleroma-amd64.img.xz.sig
+gpg --verify freedombone-pleroma-amd64.img.xz.sig
+unxz freedombone-pleroma-amd64.img.xz
+sudo dd if=/dev/zero of=/dev/sdX bs=1M count=8
+sudo dd bs=1M if=freedombone-pleroma-amd64.img of=/dev/sdX conv=fdatasync
+
+
+ +

+Also note that if the laptop has a removable SSD drive it's possible to copy the image directly to that if you have enough equipment. +

+
+
+ +
+

Connect the laptop to your internet router

+
+

+Plug the USB drive into the laptop and connect it to your internet router with the ethernet cable. +

+ +
+ +
+

laptop_router.jpg +

+
+
+
+
+ +
+

Boot the laptop from the USB drive

+
+

+You may need to alter the BIOS settings to get this to work reliably. +

+ +
+ +
+

bios_boot_usb.jpg +

+
+
+
+
+ +
+

Forward ports 80 (HTTP) and 443 (HTTPS) from your internet router to the laptop

+
+

+Log into your internet router using a non-Tor browser (usually it's on an address like 192.168.1.1 or 192.168.1.254). Often port forwarding settings are together with firewall settings. +

+ +
+ +
+

port_forwarding.png +

+
+
+
+
+ +
+

From another machine ssh into the laptop

+
+
+
ssh fbone@freedombone.local -p 2222
+
+
+ +

+Or alternatively you can log in directly on the laptop. The initial username is fbone and the password is freedombone. You should make sure you write down or copy the new password when it is shown. +

+
+
+ +
+

Follow the setup procedure

+
+

+Enter your user details, domain name and dynamic DNS settings. +

+
+
+ +
+

When installation is complete

+
+

+Navigate to your domain and register a new user. +

+ +
+ +
+

pleroma_register.jpg +

+
+
+ +

+More details about setting up and using Pleroma can be found here. +

+ +
+ +
+

tusky.jpg +

+
+
+
+
+
+
+ + + +
+Back to top | E-mail me +
+
+ + diff --git a/website/EN/usage_email.html b/website/EN/usage_email.html index 45dfc6d6..28b814e9 100644 --- a/website/EN/usage_email.html +++ b/website/EN/usage_email.html @@ -3,33 +3,26 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - - - - - - + + + + - + @@ -235,7 +144,8 @@ for the JavaScript code in this tag.
-
+

+

logo.png @@ -243,66 +153,62 @@ for the JavaScript code in this tag.

-
-

Email

-
- -+ - + - + - + - + - + - + - + - + - + - + - +
Things to be aware ofThings to be aware of
A technical note about email transport securityA technical note about email transport security
Add a password to your GPG keyAdd a password to your GPG key
Publishing your GPG public keyPublishing your GPG public key
Mutt email clientMutt email client
Thunderbird/IcedoveThunderbird/Icedove
K9 Android clientAndroid apps
Subscribing to mailing listsSubscribing to mailing lists
Adding email addresses to a group/folderAdding email addresses to a group/folder
Ignoring incoming emailsIgnoring incoming emails
Your own mailing listUsing I2P for email transport
-
-

Things to be aware of

-
+
+

Things to be aware of

+

Even though this system makes it easy to set up an email server, running your own email system is still not easy and this is mainly due to the huge amount of collatoral damage caused by spammers over a long period of time, which in turn is due to the inherent insecurity of email protocols which enabled spam to become a big problem. Email is still very popular though and most internet services require that you have an email address in order to register.

@@ -316,9 +222,9 @@ So if you want to use your own email address hosted on your own system you do ne

-
-

A technical note about email transport security

-
+
+

A technical note about email transport security

+

Port 465 is used for SMTP and this is supposedly deprecated for secure email. However, using TLS from the start of the communications seems far more secure than starting off with insecure communications and then trying to upgrade it with a command to begin TLS, as happens with STARTTLS. There are possible attacks against STARTTLS in which the command to begin secure communications is removed or overwritten which could then result in email being transferred in plain text over the internet and be readable by third parties.

@@ -329,25 +235,26 @@ From http

-The researchers also uncovered mass scale attacks of STARTTLS sessions being stripped of their encryption. That attack itself isn't new: internet service providers sometimes do it to monitor users; organizations may use it to keep an eye on employees; or it may come from a malicious actor +The researchers also uncovered mass scale attacks of STARTTLS sessions being stripped of their encryption. That attack itself isn't new: internet service providers sometimes do it to monitor users; organizations may use it to keep an eye on employees; or it may come from a malicious actor

-
-

Add a password to your GPG key

-
+
+

Add a password to your GPG key

+

If you didn't use existing GPG keys during the Freedombone installation then you'll need to add a password to your newly generated private key. This is highly recommended. Go through the following sequence of commands to ssh into the Freedombone and then change your GPG password.

+ 
ssh username@domainname -p 2222
 gpg --edit-key username@domain
 passwd
 save
 quit
-exit
+exit
@@ -357,25 +264,26 @@ Having a password on your GPG key will prevent someone from reading your email <
-
-

Publishing your GPG public key

-
+
+

Publishing your GPG public key

+

If you havn't already then you should publish your GPG public key so that others can find it.

+ 
ssh username@domainname -p 2222
 gpg --send-keys username@domainname
-exit
+exit
-
-

Mutt email client

-
-
+
+

Mutt email client

+
+

mutt.jpeg @@ -388,6 +296,7 @@ Mutt is a terminal based email client which comes already installed onto the Fre

+ 
ssh username@domainname -p 2222
@@ -408,124 +317,124 @@ Some useful keys to know are: - + - + -"/" -Search for text within headers +"/" +Search for text within headers -* -Move to the last message +* +Move to the last message -TAB -Move to the next unread message +TAB +Move to the next unread message -d -Delete a message +d +Delete a message -u -Undelete a mail which is pending deletion +u +Undelete a mail which is pending deletion -$ -Delete all messages selected and check for new messages +$ +Delete all messages selected and check for new messages -a -Add to the address book +a +Add to the address book -m -Send a new mail +m +Send a new mail -ESC-m -Mark all messages as having been read +ESC-m +Mark all messages as having been read -S -Mark a message as spam +S +Mark a message as spam -H -Mark a message as ham +H +Mark a message as ham -CTRL-b -Toggle side bar on/off +CTRL-b +Toggle side bar on/off -CTRL-n -Next mailbox (on side bar) +CTRL-n +Next mailbox (on side bar) -CTRL-p -Previous mailbox (on side bar) +CTRL-p +Previous mailbox (on side bar) -CTRL-o -Open mailbox (on side bar) +CTRL-o +Open mailbox (on side bar) -r -Reply to an email +r +Reply to an email -L -Reply to a mailing list email +L +Reply to a mailing list email -] -Expand or collapse all threads +] +Expand or collapse all threads -[ -Expand of collapse the current thread +[ +Expand of collapse the current thread -CTRL-k -Import a PGP/GPG public key +CTRL-k +Import a PGP/GPG public key -v -View current email in different formats, such as HTML +v +View current email in different formats, such as HTML -CTRL-u -View long URLs +CTRL-u +View long URLs -q -Quit +q +Quit @@ -548,9 +457,9 @@ There is one irksome thing about email within mutt, and that's if you get sent a
-
-

Thunderbird/Icedove

-
+
+

Thunderbird/Icedove

+

Another common way in which you may want to access email is via Thunderbird (also known as Icedove on Debian). This may be especially useful if you're trying to convert former Windows users who may previously have been using some version of Outlook.

@@ -560,9 +469,9 @@ The following instructions should be carried out on the client machines (laptop,

-
-

Initial setup

-
+
+

Initial setup

+

Install Thunderbird and Enigmail. How you do this just depends upon your distro and software manager or "app store".

@@ -588,9 +497,12 @@ The settings should be as follows, substituting mydomainname.com for your

    -
  • Incoming: IMAP, mydomainname.com, 993, SSL/TLS, Normal Password
    • -
  • Outgoing: SMTP, mydomainname.com, 465, SSL/TLS, Normal Password
    • -
  • Username: myusername
    • +
  • Incoming: IMAP, mydomainname.com, 993, SSL/TLS, Normal Password +
    • +
  • Outgoing: SMTP, mydomainname.com, 465, SSL/TLS, Normal Password +
    • +
  • Username: myusername +

@@ -618,14 +530,15 @@ Select "yes" to change default settings.

-
-

Import your GPG keys

-
+
+

Import your GPG keys

+

On the Freedombone export your GPG public and private keys.

+ 
ssh username@domainname -p 2222
 gpg --list-keys username@domainname
 gpg --output ~/public_key.gpg --armor --export KEY_ID
@@ -638,6 +551,7 @@ On your laptop or desktop you can import the keys with:
 

 
 

+
 
scp -P 2222 username@domain:/home/username/*.gpg ~/
 

 

@@ -659,6 +573,7 @@ Remove your exported key files, both on your laptop/desktop and also on the Free
 

 
 

+
 
shred -zu ~/public_key.gpg
 shred -zu ~/private_key.gpg
 

@@ -666,9 +581,9 @@ shred -zu ~/private_key.gpg
-
-

Using for the first time

-
+
+

Using for the first time

+

Click on the Thunderbird menu, which looks like three horizontal bars on the right hand side.

@@ -703,9 +618,9 @@ Get into the habit of using email encryption and encourage others to do so. Rem
-
-

Making folders visible

-
+
+

Making folders visible

+

By default you won't be able to see any folders which you may have created earlier using the mailinglistrule script. To make folders visible select:

@@ -721,312 +636,23 @@ Make sure that "show only subscribed folders" is not checked. Then click
-
-

K9 Android client

-
-
-

A point about GPG on Android

-
+
+

Android apps

+

-Before trying to set up email on Android you may want to consider whether you really need to do this. Android (and its variants) is not a particularly secure operating system and whether or not you wish to store GPG keys on it depends on your threat model and in what situations you'll be using your device. -

- -

-If you are going to use email on an Android device then ensure that you have full encryption enabled via the security settings, so that if you subsequently lose it, or if it gets stolen, the chances of encryption keys being exposed are minimised. +Mobile devices have a reputation for being quite insecure, so it's recommended that you don't store emails or GPG keys on your phone. Instead install Mailpile and access your email via the webmail interface.

-
-

Compiling the development version

-
-

-To get K9 working with Freedombone you'll need to install development versions of OpenKeychain and K9. At the time of writing the versions available in F-Droid do not support PGP/MIME or the "hidden recipient" feature of GPG. It is hoped that at some stage the patches will be integrated into the mainline or functionally equivalent changes made. Admittedly, this is not at all user friendly, but currently it's the only way to read Freedombone email on Android systems. -

- -

-Build script for OpenKeychain: -

- -
-
mkdir ~/develop
-cd ~/develop
-git clone https://github.com/bashrc/open-keychain
-cd open-keychain
-git checkout origin/bashrc/hidden-recipient-minimal
-git checkout -b bashrc/hidden-recipient-minimal
-cd tools
-nano build.sh
-
-
- -

-Then add the following: -

- -
-
#!/bin/bash
-
-# This script is intended to be used on Debian systems for building
-# the project. It has been tested with Debian 8
-
-USERNAME=$USER
-SIGNING_NAME='openkeychain'
-SDK_VERSION='r23.3.4'
-SDK_DIR=$HOME/android-sdk
-
-cd ..
-
-PROJECT_HOME=$(pwd)
-
-sudo apt-get install build-essential default-jdk \
-     lib32stdc++6 lib32z1 lib32z1-dev
-
-if [ ! -d $SDK_DIR ]; then
-    mkdir -p $SDK_DIR
-fi
-cd $SDK_DIR
-
-# download the SDK
-if [[ ! -f $SDK_DIR/android-sdk_$SDK_VERSION-linux.tgz ]]; then
-    wget https://dl.google.com/android/android-sdk_$SDK_VERSION-linux.tgz
-fi
-tar -xzvf android-sdk_$SDK_VERSION-linux.tgz
-SDK_DIR=$SDK_DIR/android-sdk-linux
-
-echo 'Check that you have the SDK tools installed for Android 22, SDK 21.1.2'
-
-export ANDROID_HOME=$SDK_DIR
-echo "sdk.dir=$SDK_DIR" > $ANDROID_HOME/local.properties
-export PATH=${PATH}:$ANDROID_HOME/tools:$ANDROID_HOME/platform-tools
-
-cd $SDK_DIR/tools
-./android sdk
-
-if [ ! -f $SDK_DIR/tools/android ]; then
-    echo "$SDK_DIR/tools/android not found"
-    exit -1
-fi
-cd $SDK_DIR
-chmod -R 0755 $SDK_DIR
-chmod a+rx $SDK_DIR/tools
-
-# android sdk
-cd $PROJECT_HOME
-git submodule init && git submodule update
-
-if [ ! -f $SDK_DIR/tools/templates/gradle/wrapper/gradlew ]; then
-    echo "$SDK_DIR/tools/templates/gradle/wrapper/gradlew not found"
-    exit -2
-fi
-. $PROJECT_HOME/gradlew assembleDebug
-
-# cleaning up
-cd $PROJECT_HOME/OpenKeychain/build/outputs/apk
-if [ ! -f OpenKeychain-debug.apk ]; then
-    echo 'OpenKeychain-debug.apk was not found'
-    exit -3
-fi
-
-echo 'Build script ended successfully'
-echo -n 'apk is available at: '
-echo "$PROJECT_HOME/OpenKeychain/build/outputs/apk/OpenKeychain-debug.apk"
-exit 0
-
-
- -

-Save and exit with CTRL-o, CTRL-x. -

- -
-
chmod +x build.sh
-./build.sh
-
-
- -

-Build script for K9: -

- -
-
cd ~/develop
-git clone https://github.com/k9mail/k-9
-cd k-9
-cd tools
-nano build.sh
-
-
- -

-Then add the following: -

- -
-
#!/bin/bash
-
-# This script is intended to be used on Debian systems for building
-# the project. It has been tested with Debian 8
-
-USERNAME=$USER
-SIGNING_NAME='k-9'
-SDK_VERSION='r24.3.3'
-SDK_DIR=$HOME/android-sdk
-
-cd ..
-
-PROJECT_HOME=$(pwd)
-
-sudo apt-get install build-essential default-jdk \
-     lib32stdc++6 lib32z1 lib32z1-dev
-
-if [ ! -d $SDK_DIR ]; then
-    mkdir -p $SDK_DIR
-fi
-cd $SDK_DIR
-
-# download the SDK
-if [ ! -f $SDK_DIR/android-sdk_$SDK_VERSION-linux.tgz ]; then
-    wget https://dl.google.com/android/android-sdk_$SDK_VERSION-linux.tgz
-    tar -xzvf android-sdk_$SDK_VERSION-linux.tgz
-fi
-SDK_DIR=$SDK_DIR/android-sdk-linux
-
-echo 'Check that you have the SDK tools installed for Android 17, SDK 19.1'
-if [ ! -f $SDK_DIR/tools/android ]; then
-    echo "$SDK_DIR/tools/android not found"
-    exit -1
-fi
-cd $SDK_DIR
-chmod -R 0755 $SDK_DIR
-chmod a+rx $SDK_DIR/tools
-
-ANDROID_HOME=$SDK_DIR
-echo "sdk.dir=$SDK_DIR" > $ANDROID_HOME/local.properties
-PATH=${PATH}:$ANDROID_HOME/tools:$ANDROID_HOME/platform-tools
-
-android sdk
-cd $PROJECT_HOME
-
-if [ ! -f $SDK_DIR/tools/templates/gradle/wrapper/gradlew ]; then
-    echo "$SDK_DIR/tools/templates/gradle/wrapper/gradlew not found"
-    exit -2
-fi
-. $PROJECT_HOME/gradlew assembleDebug
-
-# cleaning up
-cd $PROJECT_HOME/k9mail/build/outputs/apk
-if [ ! -f k9mail-debug.apk ]; then
-    echo 'k9mail-debug.apk was not found'
-    exit -3
-fi
-echo 'Build script ended successfully'
-echo -n 'apk is available at: '
-echo "$PROJECT_HOME/k9mail/build/outputs/apk/k9mail-debug.apk"
-exit 0
-
-
- -

-Save and exit with CTRL-o, CTRL-x. -

- -
-
chmod +x build.sh
-./build.sh
-
-
-
-
- -
-

Import your GPG key into OpenKeychain

-
-

-With your device connected to a laptop via USB cable and with USB debugging enabled on it: -

- -
-
ssh username@domainname -p 2222
-gpg --list-keys username@domainname
-gpg --output ~/public_key.gpg --armor --export KEY_ID
-gpg --output ~/private_key.gpg --armor --export-secret-key KEY_ID
-cat ~/public_key.gpg ~/private_key.gpg > ~/mygpgkey.asc
-exit
-scp -P 2222 username@domainname:/home/username/mygpgkey.asc ~/
-sudo apt-get install android-tools-adb
-push ~/mygpgkey.asc /sdcard/
-shred -zu ~/mygpgkey.asc
-
-
- -

-Then on your device select OpenKeychain and import your key from file. -

-
-
-
-

Incoming server settings

-
-
    -
  • Select settings/account settings
    • -
  • Select Fetching mail/incoming server
    • -
  • Enter your username and password
    • -
  • IMAP server should be your domain name
    • -
  • Security: SSL/TLS (always)
    • -
  • Authentication: Plain
    • -
  • Port: 993
    • -
-
-
-
-

Outgoing (SMTP) server settings

-
-
    -
  • Select settings/account settings
    • -
  • Select Sending mail/outgoing server
    • -
  • Set SMTP server to your domain name
    • -
  • Set Security to SSL/TLS (always)
    • -
  • Set port to 465
    • -
  • Set authentication to PLAIN
    • -
  • Enter your username and password
    • -
  • Accept the SSL certificate
    • -
-
-
-
-

Crypto settings

-
-

-Select settings, Account settings, OpenKeychain and then select your key and press Allow. You should now be able to decrypt emails by entering your GPG passphrase. -

- -

-You may also want to change the amount of time for which passwords are remembered, so that you don't need to enter your passphrase very often. -

-
-
-
-

Folders

-
-

-To view any new folders which you may have created using the mailinglistrule script from your inbox press the K9 icon at the top left to access folders, then press the menu button and select refresh folder list. -

- -

-If your folder still doesn't show up then press the menu button, select show folders and select all folders. -

-
-
-
- -
-

Subscribing to mailing lists

-
+
+

Subscribing to mailing lists

+

To subscribe to a mailing list log in as your user (i.e. not the root user).

+ 
ssh username@domainname -p 2222
@@ -1036,14 +662,15 @@ Select Administrator controls then Email filtering rules then A

-
-

Adding email addresses to a group/folder

-
+
+

Adding email addresses to a group/folder

+

Similar to adding mailing list folders you can also add specified email addresses into a group/folder.

+ 
ssh username@domainname -p 2222
@@ -1053,14 +680,15 @@ Select Administrator controls then Email filtering rules then A

-
-

Ignoring incoming emails

-
+
+

Ignoring incoming emails

+

It is possible to ignore incoming emails if they are from a particular email address or if the subject line contains particular text.

+ 
ssh username@domainname -p 2222
@@ -1070,29 +698,12 @@ Select Administrator controls then Email filtering rules then B

-
-

Your own mailing list

-
+
+

Using I2P for email transport

+

-If you want to set up a public mailing list then when installing the system remember to set the PUBLIC_MAILING_LIST variable within freedombone.cfg to the name of your list. The name should have no spaces in it. Public mailing lists are unencrypted so anyone will be able to read the contents, including non subscribers. +For the most paranoid use cases it is also possible to use I2P as an email transport mechanism. This will of course require the people you're communicating with to have a similar setup in place. For details see the bdsmail app. An advantage of this is that it's very unlikely that your email will get blocked. The disadvantage is that few others will be capable of receiving email this way, and it's only really usable via the Mutt email client.

- -

-To subscribe to your list send a cleartext email to: -

- -
-
mymailinglistname+subscribe@domainname
-
-
- -

-Tip: When using the Mutt email client if you want to send an email in cleartext then press p (for PGP) on the sending screen and select clear. Unsecure email is treated as being the exception rather than the default. -

- -
-Return to the home page -
diff --git a/website/EN/users.html b/website/EN/users.html new file mode 100644 index 00000000..5532e051 --- /dev/null +++ b/website/EN/users.html @@ -0,0 +1,201 @@ + + + + + + + + + + + + + + + + + +
+

+
+ +
+

logo.png +

+
+
+ +

+Log into the system with: +

+ +
+ +
ssh username@domainname -p 2222
+
+
+ +

+Select Administrator controls then User Management. +

+ + +
+

control_panel_manage_users.jpg +

+
+
+ + +