#iamwikileaks Mirror #wikileaks, but do it a litte more safely…

Wikileaks is, in my humble opinion, a laudable cause. Even if you don’t like Wikileaks because of what they do, there are reasons to defend them at such a time where they’re being attacked by the powers that be.

It is why I decided to also be a mirror of their mass mirroring project for as long as I can hold it. You should too, even if you don’t like them 🙂 At this time there are just over 76 sites, but that’s actually very few mirrors if you’re fighting the almighty owners of ICANN: the USA government.

However their instructions require you to take a huge leap of faith: not only the best way to do this mirror is with rsync via ssh, but also you would have to trust them to manage your Apache installation via a .htaccess file.

This isn’t so good, so here’s how to help them without surrendering everything…

  1. Prepare the (ssh) account for user fubarwl (no, not my real user)
    1. I use OpenSSH with fairly restrictive configuration, but still I used a Match User to forbid any kind of forwarding
    2. At ~fubarwl/.ssh/authorized_keys I put no-user-rc at the beginning, just before their ssh-key
    3. I also did a chattr -R +i ~fubarwl
  2. Install rssh (useful hints on the setup here)
    1. I don’t use it for anything else, so in it’s config I only enabled rsync support (just uncomment the line with allowrsync)
    2. I created a filesystem on a file with dd if=/dev/zero of=wikileaks.img bs=1M count=4096 and mke2fs wikileaks.img and mount it at a designated path (henceforth CHROOT) with the following options: defaults,loop,nodev,noatime,nodiratime
    3. At this filesystem, I setup the root of rssh’s chroot path.
    4. The chroot helper didn’t do it’s job properly for rsync, so I needed to copy some extra libs into CHROOT/lib: libacl.so.1* , libpopt.so.0* and libattr.so.1*
    5. Also had to copy rsync into CHROOT/usr/bin
    6. Created a CHROOT/home/fubarwl with permissions for that user
    7. Created a CHROOT/etc/passwd with only one entry for that user
  3. Now it’s possible to rsync files into that directory, and the remote user has no way (short of a chroot bug) to change his ~foobarwl/.ssh
  4. Setup Apache
    <VirtualHost YourSite:80>
            ServerName YourSite
            ServerAdmin YourAdmin
    
            TransferLog logs/http-YourSite-access_log
    
            ErrorLog logs/http-YourSite-error_log
    
            DocumentRoot CHROOT/home/fubarwl
    
            BandWidthModule On
            BandWidth all YourLimit
    
            RewriteEngine On
    
            RewriteRule media/support.html  /support.html [R=301,L]
            RewriteRule media/about.html  /about.html [R=301,L]
    
            <Directory CHROOT/home/fubarwl>
                    AllowOverride None
            </Directory>
    </VirtualHost>
    
  5. Tell wikileaks your hostname, user (fubarwl) and path /home/fubarwl

4 Replies to “#iamwikileaks Mirror #wikileaks, but do it a litte more safely…”

  1. Pingback: World Spinner
  2. I found this page after googling, and I absolutely share your point of “having good faith”.

    I would welcome it, as would probably many others, if you could describe your steps in little bit more detail, so that less-technical server owners can follow instructions.

Comments are closed.