Vincent Canfield's Blog

In December 2015 and January 2016, cock.li was subject to two raids by German police by the hands of the US government, that clearly demonstrated an attempt to disrupt the website. The first raid took the first hard drive, and was a gross overreach of power by the hands of Uncle Sam. However, the site was able to continue running thanks to a RAID 1 system which utilized two hard drives both containing equal data. Since the order wasn't to disrupt the site but to seize the data, this sufficiently satisfied the order and the site was able to remain online. However just three weeks later, the other hard drive was taken. The authorities that ordered the raid, including stupid faggot German prosecutor Jürgen Pfeiffer, already had a copy of the site's data, meaning the second raid was a clear attempt to disrupt the site, presumably with the intent to knock it offline or scare me out of operating the site.

Since the raids, cock.li has obviously not shut down. The site is back, better than ever, and colocating in Bucharest, Romania. With purchased hardware, cock.li has deployed numerous security mechanisms, physical and digital, to ensure that no government ever gets access to my users' data without going through proper legal process. Actually owning hardware affords you various luxuries to protect against physical attack, but an angry enough mob of police could still disrupt the site by physically seizing the hardware and preventing access to the server. Cock.li has never had a truly resilient backup solution. A home solution has never really worked as I have been travelling and plan on travelling in the near future and could not regularly back up data. Instead, today I am announcing a truly resilient backup solution that will protect cock.li for several years to come.

The Iron Dong is a VPS hosted in an undisclosed location (no, not cockbox) used to house several types of backups. It is registered, paid for, and used only over Tor, and has no identifying information tracing it back to me, cock.li, or any other of my projects. The server is only accessible over hidden service, and has no public-facing ports. The server houses an encrypted data store that is currently being used to store two things. First, the server is housing a slave version of the cock.li database. This means the second someone registers on cock.li, it is written to the database, and then written again to the Iron Dong. This means that if the cock.li server were to be seized, I would have a copy of the database accurate up until the exact time the server went offline, meaning the site could come back in full force with all registration enabled as soon as hardware for the site can be obtained. Secondly, the server makes periodic, incremental backups of the database using mysqldump and duplicity, again to the encrypted storage. This means even if all databases were dropped somehow, I would still have a copy of the database accurate within the last ten minutes, and could just restore from that. This backup solution is currently being used to back up cock.li, vc.gg/blog, vc.gg/photos, and box.cock.li. This means barring some serious state-level kung fu or me being murdered, cock.li will keep on going no matter what.

Mr. Jürgen Pfeiffer, state prosecutor in Zwickau, come the fuck at me you shit-eating poof.

For those interested in hosting their own Iron Dong, it's fairly simple:

Install Tor, MySQL, and Duplicity on the backup server:

# apt-get install tor mysql-server duplicity

Install Tor and autossh on the host (the server being backed up):

# apt-get install tor autossh

Add a user on the hidden VPS:

# adduser autossh

Restrict that user to only be able to use TCP Tunnels:

Match User autossh   AllowAgentForwarding no   ForceCommand echo 'haha gay'

On your host, generate an SSH key:

$ ssh-keygen

Put that SSH key on the backup VPS. Put ~/.ssh/id_rsa.pub on the host into ~/.ssh/authorized_keys on the guest.

Configure your hidden service (in /etc/tor/torrc):

HiddenServiceDir /var/lib/tor/hiddenservice/ HiddenServicePort 22 127.0.0.1:22

Enable and start Tor on both the guest and host:

# systemctl enable tor; systemctl start tor

Once you start Tor, your hidden service address should be available at /var/lib/tor/hiddenservice/hostname .

Now you need to connect to your hidden service with AutoSSH. In ~/.ssh/config on your host:

Host iron_dong   HostName thehiddenservice.onion   User autossh   ServerAliveInterval 30   ServerAliveCountMax 3   RemoteForward 6969:127.0.0.1:3306   IdentityFile ~/.ssh/id_rsa   ProxyCommand /usr/bin/nc -x 127.0.0.1:9050 %h %p

Then, to connect:

$ autossh -M 0 iron_dong

Set this up to run when your server starts, and you should be gucci mane

The last thing to actually do is configure your MySQL server for replication, which you can find instructions for here:

Configure your slave MySQL instance

Just configure it to connect to 127.0.0.1:6969, or whatever you set as your local port in RemoteForward.

To set up duplicity, write a script to periodically dump your databases, then have it back up using duplicity using whatever settings you'd like. Put that shit in a cronjob and you're all good.

Configuring encrypted stores is more specific to your own preferences and use case, so it's not included here. Instructions on using dm-crypt or any other encryption utility are widely available online, use whatever you want.