mirrors/git-annex
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

p2p --pair with magic wormhole (untested)

Browse source 
It builds. I have not tried to run it yet. :)

This commit was sponsored by Jake Vosloo on Patreon.
This commit is contained in:
Joey Hess 2016-12-18 16:50:58 -04:00
parent b2b6296f9d
commit ccde0932a5
No known key found for this signature in database
GPG key ID: C910D9222512E3C7
8 changed files with 288 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

26
doc/git-annex-p2p.mdwn
View file

@ -16,11 +16,30 @@ services.
# OPTIONS
* `--pair`
Run this in two repositories to pair them together over the P2P network.
This will print out a code phrase, like "3-mango-elephant", and
will prompt for you to enter the code phrase from the other repository.
Once code phrases have been exchanged, the two repositories will
be paired. A git remote will be created for the other repository,
with a name like "peer1".
This uses [Magic Wormhole](https://github.com/warner/magic-wormhole)
to verify the code phrases and securely communicate the P2P addresses of
the repositories, so you will need it installed on both computers that are
being paired.
* `--gen-address`
Generates addresses that can be used to access this git-annex repository
over the available P2P networks. The address or addresses is output to
stdout.
stdout.
Note that anyone who knows these addresses can access your
repository over the P2P networks.
* `--link`
@ -34,7 +53,8 @@ services.
* `--name`
Specify a name to use when setting up a git remote.
Specify a name to use when setting up a git remote with `--link`
or `--pair`.
# SEE ALSO
@ -44,6 +64,8 @@ services.
[[git-annex-remotedaemon]](1)
wormhole(1)
# AUTHOR
Joey Hess <id@joeyh.name>

95
doc/tips/peer_to_peer_network_with_tor.mdwn
View file

@ -1,69 +1,56 @@
git-annex has recently gotten support for running as a
[Tor](https://torproject.org/) hidden service. This is a nice secure
and easy to use way to connect repositories between peers in different
locations, without needing any central server.
and easy to use way to connect repositories in different
locations. No account on a central server is needed; it's peer-to-peer.
## setting up the first peer
## dependencies
First, you need to get Tor installed and running. See
To use this, you need to get Tor installed and running. See
[their website](https://torproject.org/), or try a command like:
sudo apt-get install tor
To make git-annex use Tor, run these commands in your git-annex repository:
You also need to install [Magic Wormhole](https://github.com/warner/magic-wormhole).
sudo git annex enable-tor $(id -u)
git annex remotedaemon
git annex p2p --gen-addresses
sudo apt-get install magic-wormhole
The p2p command will output a long address, such as:
## pairing two repositories
tor-annex::eeaytkuhaupbarfi.onion:4412:7f53c5b65b8957ef626fd461ceaae8056e3dbc459ae715e4
You have two git-annex repositories on different computers, and want to
connect them together over Tor so they share their contents. Or, you and a
friend want to connect your repositories together. Pairing is an easy way
to accomplish this.
At this point, git-annex is running as a tor hidden service, but
it will only talk to peers who know that address.
## adding additional peers
To add a peer, get tor installed and running on it.
sudo apt-get install tor
You need a git-annex repository on the new peer. It's fine to start
with a new empty repository:
git init annex
cd annex
git annex init
And make git-annex use Tor, by running these commands in the git-annex
repository:
In each git-annex repository, run these commands:
sudo git annex enable-tor $(id -u)
git annex remotedaemon
Now, tell the new peer about the address of the first peer.
This will make a git remote named "peer1", which connects,
through Tor, to the repository on the other peer.
Now git-annex is running as a Tor hidden service, but
it will only talk to peers after pairing with them.
git annex p2p --link --name peer1
In both repositories, run this command:
That command will prompt for an address; paste in the address that was
generated on the first peer, and then press Enter.
git annex p2p --pair
Now you can run any commands you normally would to sync with the
peer1 remote:
This will print out a code phrase, like "11-incredible-tumeric",
and prompt for you to enter the other repository's code phrase.
git annex sync --content peer1
Once the code phrases are exchanged, the two repositories will be securely
connected to one-another via Tor. Each will have a git remote, with a name
like "peer1", which connects to the other repository.
You can also generate an address for this new peer, by running `git annex
p2p --gen-addresses`, and link other peers to that address using `git annex
p2p --link`. It's often useful to link peers up in both directions,
so peer1 is a remote of peer2 and peer2 is a remote of peer1.
Then, you can run commands like `git annex sync peer1 --content` to sync
with the paired repository.
Any number of peers can be connected this way, within reason.
The Magic Wormhole code phrases used during pairing will no longer be
useful for anything afterwards.
## starting git-annex remotedaemon
Pairing connects just two repositories, but you can repeat the process to
pair with as many other repositories as you like, in order to build up
larger networks of repositories.
## starting git-annex remotedaemon on boot
Notice the `git annex remotedaemon` being run in the above examples.
That command runs the Tor hidden service so that other peers
@ -72,7 +59,7 @@ can connect to your repository over Tor.
So, you may want to arrange for the remotedaemon to be started on boot.
You can do that with a simple cron job:
@reboot cd myannexrepo && git annex remotedaemon
@reboot cd ~/myannexrepo && git annex remotedaemon
If you use the git-annex assistant, and have it auto-starting on boot, it
will take care of starting the remotedaemon for you.
@ -84,9 +71,9 @@ bandwidth to go around. So, distributing large quantities (gigabytes)
of data over Tor may be slow, and should probably be avoided.
One way to avoid sending much data over tor is to set up an encrypted
[[special_remote|special_remotes]]. git-annex knows that Tor is rather
expensive to use, so if a file is available on a special remote as well as
over Tor, it will download it from the special remote.
[[special_remote|special_remotes]] someplace. git-annex knows that Tor is
rather expensive to use, so if a file is available on a special remote as
well as over Tor, it will download it from the special remote.
You can contribute to the Tor network by
[running a Tor relay or bridge](https://www.torproject.org/getinvolved/relays.html.en).
@ -115,6 +102,9 @@ When you run `git annex peer --link`, it sets up a git remote using
the onion address, and it stashes the authentication data away in a file in
`.git/annex/creds/`
When you pair repositories, these addresses are exchanged using
[Magic Wormhole](https://github.com/warner/magic-wormhole).
## security
Tor hidden services can be quite secure. But this doesn't mean that using
@ -144,3 +134,14 @@ to consider:
* An attacker who can connect to the git-annex Tor hidden service, even
without authenticating, can try to perform denial of service attacks.
* Magic wormhole is pretty secure, but the code phrase could be guessed
(unlikely) or intercepted. An attacker gets just one chance to try to enter
the correct code phrase, before pairing finishes. If the attacker
successfully guesses/intercepts both code phrases, they can MITM the
pairing process.
If you don't want to use magic wormhole, you can instead manually generate
addresses with `git annex p2p --gen-addresses` and send them over an
authenticated, encrypted channel (such as OTR) to a friend to add with
`git annex p2p --link`. This may be more secure, if you get it right.

4
doc/todo/tor.mdwn
View file

@ -16,8 +16,8 @@ Eventually:
* Limiting authtokens to read-only access.
* Revoking authtokens. (This and read-only need a name associated with an
authtoken, so the user can adjust its configuration after creating it.)
* address exchange for peering. See [[design/assistant/telehash]].
* Webapp UI to set it upt.
* Pairing via magic wormhole.
* Webapp UI to set it up.
* friend-of-a-friend peer discovery to build more interconnected networks
of nodes
* Discovery of nodes on same LAN, and direct connection to them.