Shields up! will allow you to test the security of your Internet conection. If you have a firerwall, you will know if it is correctyl configured. If you don’t, you will know what risks you are taking.

I invite you to visit the rest of the web site, too. It covers security aspects linked to an Internet connection (more for personal computers than enterprise networks, though). You will even find good comparisons and selection of tools like personal firewalls. Recommended.

It appears that a hacker introduced itself into our web site through an insecure WordPress plugin. The security defect has been corrected relatively quickly, but it left a wide open gap during a few days. The hacker was able to

1. create several privileged access points into the web site (administrator accounts).
2. modify posts and pages to add a script susceptible to bring a malware infection (that I could not more precisely identify).
3. modify the web site to point back to another infected web site.
4. modify the web site to create himself an additional backdoor entry point.

this most probably happened during the Friday November 9th night (or very early on Saturday November 10th). It hit four of my web sites in a row (on four other sites I caught the infection before it could become extensive or dangerous for the users/visitors).

The corrections I implemented allow me to assure that the incident is now (Sunday November 11th at noon) closed for all four infected web sites.

The consequences for you, the visitors:

1. it is possible (though quite unprobable) that some personal data have been taken, but it was not a clear objective of the hacker.
2. all users with an account on the web site have been informed, their passwords force-modified to a safer value (it appears nobody had really fragile or re-used password – my advice: never re-use one web site password on another web site).
3. during a few tens of hours, Roumazeilles.net was used to propagate one or more malwares to visitors of our pages and posts. My advice: Immediately check your computer with a good anti-virus.

I hope (and I believe) that this is all.

Technical details on this specific attack (we were not alone in the list of victimized web sites).

1. The site to be rebuilt in a matter of hours.
2. Passwords to be changed.
3. Several hours lost for nothing.

There wasn’t much to steal (the users are not very many). But it is impossible to know with certainty if hackers did not leave with a copy of the emails and associated user names. If you want to know what kind of data may have been revealed, you may check it on personal data summary page.

Apparently, the hacker(s) was (were) more interested in switching the user traffic toward a malware-loaded web site in a foreign country (probably hacked too) under the name of a little blue pony. If you remember being directed there, take time to check your computer with a good anti-virus software.

Feel free to contact me if you have questions.

I had explored several on-line options like:

1. Amazon Cloud Drive, which is now quite expensive when you send it several tera-bytes.
2. OVH Cloud Archive, that I failed to configure (even with the help of the OVH excellent support team); I had to look at OVH Cloud which is actually priced very similarly to ACD (the price structure is a bit complex, though probably a bit cheaper in the long run).
3. Hubic, which decided to close its doors to new customers.

So, the only solution left was elsewhere: Archiving to an external USB hard drive, but alternating between two physical disks to allow always keeping one off-site (far from fire and flood).

The configuration is not very complicated but requires a bit of attention and of patience.

Pre-requisites  on Synology DSM

The main advantage of Synology is their comprehensive interface very consistent from one NAS model to another (DSM). So, this will essentially apply to all Synology configurations, large or small.

The general idea is to backup one directory from the Synology server to the USB3 external drive. You need the “Hyper Backup” package installed. It is perfectly apt to backups toward a variety of options (I previously used it with Amazon Drive (now too expensive to my taste) and with the now-dead hubiC).

A simple recommendation: Don’t apply versionning on the NAS itself (it tends to eat a ton of space up and appears difficult/impossible reconfigure later on). On the other hand, you can ask that from Hyper Backup which does it perfectly well. Eat space on low cost external storage rather than on high-cost primary storage.

Configuration

Format the hard disk drive(s)

I have chosen 8 tera-byte disks from Seagate. At first, I was looking at the unusual (but cheap) Seagate Archive 8TB. but they have now been replaced with Seagate Barracuda 8TB 5400rpm (which have about the same read speed but a much better write speed, for a similar cost).

Let’s start with connecting the hard drive (in its USB3 enclosure which has been selected as UASP-capable for best performance) to the Synology. It will be immediately recognized and mounted by DSM as USB Disk 1 (or USB Disk 2, depending on the USB port you used). It is highly recommended to format it with a single EXT4 partition.

In the DSM Configuration Panel, under the “External Devices” category, you will select the USB Disk 1 and click on the “Format” button. then, chose the default options.

Progress will be slow (half an hour is usual) but with no special issue to expect.

Name the hard disk drive

This is not very critical, but much more comfortable to name the disk (Data1 and Data2, if you want; For me, it will be Sciurus vulgaris 1 and 2).

Just after formatting, in the DSM Configuration Panel, under “Shared Folder”, select the usb_share_1 directory (the number may vary), then click on the “Edit” button to access a few options including disk naming.

I recommend (your choice) some options:

1. Hide the directory in “Network locations” and “Hide sub-directories” to limit the attack surface of a potential intruder.
2. Encryption: It may come later.
3. Access control: Limit it to the only user which is running Hyper Backup (Nobody else is supposed to directly access your archive).

Configuration of Synology HyperBackup

As I decided to use HyperBackup, everything will be quite simple from this point. In HyperBackup, click on  +, then “Data backup task”.

You will need to designate a backup on an external drive with “Local folder & USB” in the dialog window shown here.

You will then need to describe your backup(s) from several dialogs that are more or less explicit. First, you must point to the destination (the external USB disk):

Then, you will be invited to point to the directory (possibly several of them) that will be backed up. Then,  HyperBackup may offer to backup the parameters from some of the applications you installed on your Synology NAS (I chose not to do this, but it’s really your choice), before arriving to the main settings dialog:

The most critical is certainly client-side encryption (at the bottom of the dialog) which will allow password-protecting the backup data set. As we are intending to leave the external USB disks on a distant shelf, I strongly recommend to protect it against prying eyes. But, be sure not to forget the password, of course…

Then, you will have the opportunity to set the versioning parameters (to be able to travel back in time in your backups to recover one of the successive version backups of a given file). I chose the SmartRecycle parameter with 64 versions (nine months of protection if I apply a daily backup). But you may want to experiment a little in order to make your own decision.

Don’t forger to do this twice: One task per hard disk drive will allow HyperBackup to keep backing up when disks move out or come back from cold storage, depending on which is stored away (each month, maybe).

Finally…

Never forget that a backup only works if you can use its restore feature. It is best to spend a few hours every 6 months to restore a few files and check that everything is still working.

Of course, the best is to test the whole installation in the first hours after setting it up (at least, if you want to write down the restore procedure; You may need it some time in the future…)

1. A Privacy Policy.
2. When you submit a comment on the site, it is now explicit (through a checkbox) that you understand that this will imply our storing of some of your personal data, and that you consent to it.(« explicit » and « positive » consent).
3. Creation of a Data Protection Officer (that’s me!) in charge of answering questions and requests of modificaiton and removal of your personal data if you ultimately want to revoke your consent.

the objective is to make more explicit and fully compliant, the choices that we already made to respect our visitors, and their privacy. Like we do since the beginning.

For years, I used Google authenticator applet on iOS. I knew that it would be a pain if my phone stopped working (or if I replaced it). The only reason I was OK with this, was that I had setup Google authenticator on two phones (I happen to have one for business and one for personal use – don’t ask why…)

Actually, replacing one of these smartphones pushed me into testing Authy as a replacement for Google. And I should have done this earlier. There is no way I will switch back to Google after this.

Authy provides:

• A cute user interface
• Shared accounts between several phones (and a fast way to switch from one old phone to a new one)
• All the needed 2FA bells and whistles (compatible with the TOTP standard)

In thirty/forty minutes, I recreated all the factors for my accounts (e.g. Google, Outlook, Evernote, Dropbox, or even Ubisoft). And this was needed because I could not transfer this knowledge from the old phone to the new (even though I had both phone working in front of me). But in three/four minutes I could extend it to my other phone. So, any time I need to replace a phone, I can extend/transfer in a matter of minutes, independently of the number of web sites are included in Authy.

I feel much safer. What would have been happening if I had lost/broken my phone with the codes from Google Authenticator? (graceful degradation, no risk of losing access to many web sites at a time in case of a single failure).

I feel much more positive about extending my use of 2FA/two-factor-authentication to  much more web sites because of the added ease of use (longer-term commitment).

Furthermore, Authy is available for several Operating Systems:

• iOS
• Android
• Windows
• Google Chrome

Go and install it!

1. Backups
2. Synchronization between several machines (several PC and several iPhone)

CrashPlan easily provided the backup feature despite a high volume of photo files (more than 2 TB as of today), but was relatively poor interms of synchronization. So, it was time to spend some energy defining the whole need/specification and finding a true solution.

Specification

For backup, my requirements have long been defined:

1. At least three backup copies
2. At least two different technologies (e.g; not to rely only on optical drives or hard drives)
3. At least one off-site location (to be protected against theft, fire hazards, etc., think off-site, or cloud, or external/bank safe box)

For synchronization, previous use of DropBox and Evernote (on small volumes) allowed me to confirm the precise needs I had:

1. Real-time sharing of some critical files with daily updates (as for Evernote note files, or the database for my password management application, etc.)
2. Encryption of all comms (I don’t want to leak my passwords or my bank account data).

Solution

I was clearly influenced by several factors in my choice, and I will try and make these explicit (your solution may not be strictly identical to mine). So, let’s start by what I chose to deploy.

A smal file server (a Synology DS413j) at my home. It hosts 4 hard drives of 3 TB (initially, four Western Digital RED) in SHR/RAID 5 mode for a total capacity of 6 TB.

The large capacity was defintely dictated by the the need to host a large multimedia server and a large quantity of digital photos (Today, we have altogether much more than 100.000 pictures on this server).

The choice of RAID 5 was a very early one because of its optimum balance between overall dedundancy (you can loose one hard drive with no data loss) and cost (you loose less data to redundancy than in other two-disk RAID configurations). The Synology SHR technology is even better because is allows disks with different capacities (the two smaller ones define the maximum capacity. So, you’d better have one 500 GB with three 4 TB bigger ones; It would be a waste) and it accepts (like all RAIDs) to replace one failed drive with a new one (during the rebuilding of RAID/SHR, you have no more data protection but this is temporairy – and you can keep working in paralle).

Going to Synology was even more justified by a single important item rarely listed in RAID sevrer comparisons: The software offering is specially attractive at Synology. DSM (Synology OS) hosts  “packages” for many applications. The complements I installed (see below) are provided as ready-to-use instalations and can be easy to install even if you have minimal understanding of the inner workings of a server.

So, I was able to deploy a two-stage solution:

1. PC-to-Synology synchronization (three PC via Cloud Station Server)
2. Synology-to-Amazon synchronization (Amazon Cloud Drive through Cloud Sync)

Cloud Station Server and Cloud Sync are two applications from Synology which are installed in about 5-6 minutes (including download time) from the  “Packages Center” of Synology DSM.

If we start looking at the synchronization between PC (or iPhone) and Synology, merely opening the Cloud Station Server in the list below (in the management interface of my Synology DS413j DSM) leads us directly to a menu allowing to download the Windows application (or iPhone app) to install before starting synchronizations between PC and Synology cloud server.

A few clicks and it’s done. Nothing could be simpler. a few minutes and synchronization is starting. It runs in background (it does not hinder normal PC activity) and you will only notice the new change to the file icons showing that it is already synched ot the cloud (see examples below) or that it is still waiting for synchronization (blue tag).

At this point, PC are synchronized, via the Synology server. You can consider that this is a backup since I chose to keep all most recent 32 versions of each file modifications and to not let Synology wipe deleted files (they are stored in the server dust-bin). So, this is a Time Machine feature on top of a backup.

Important notice: The synchronisation between PC and Synology cloud server is very fast and does not eat up resource even on a small/old PC (contrary to some backup programs I would not dare name, like Cobian Backup). this is re-assuring: The end-users can forget about the backup running in the background, stopping if the PC goes to sleep and starting again when it wakes up. This whole process has nearly no impact on the PC behaviour.

Similarly, the iPhone and iPad can use synchronization (of some files, I don’t want them overwhelmed) when on the move.

The second feature replicates these data to another location (here, I chose to synchronize with Amazon Cloud Drive aka ACD because its cost is only 70€/an which appears very reasonable and can be reduced if you have Amazon Prime and a lot of photos). I understood that transfer speed would be limited by my RAID server (the DS413j is quite old and has a very cheap ARM CPU, but it defintely did not break the bank) rather than my bandwidth (I have optical fiber broadban) or by Amazon (all users observe that Amazon is going fast).

Synology Cloud Sync provides this in a matter of a few clicks. Just provide your Amazon login and password. Synology will do it all for you. Synchronization will start in a minute at most (I tried it with Google Drive too. this is as simple and as fast – bandwidth is quite high, which is a good thing; I thought about trying c hubic from OVH, but Internet comments and face-to-face talks with past users seem to point to a product without the needed performance and reliability you want here).

Observations

A few remarks I may have to add after some real-life use:

• The DS413j has a very small CPU from ARM. the CPU workload stays very high (~100%) during all the synchronization phase.
• The first synchronization is lenghty (several days or several weeks depending on the data volume). I recommend to build the data set progressively (not to bunch all your data on the first day).
• Next synchros will generally be much faster (nearly instantaneous).
• Recently modified files tend to be synchronized first.
• I used Cloud Sync to link my server to Amazon, but there is also a solution to synchronize from Synology to Synology: Cloud Station Share Sync. I did not try it but it could be worht exploring if you already have to geographical locations (A second home? A company with two offices?) and two Synology servers. It seems to be as simple as synchronizing with Amazon Cloud Drive.

• In order to elevate the RAID server reliability, you’d better choose hard drives designed for 24/7 use. I would point to Western Digital RED (specailly designed for RAID servers) or Hitachi UltraStar (24/7 version of the DeskStar drives). Also, if you can avoid having all 4 or 5 identical drives, it will reduce the risk of seeing them all failing nearly simultaneously. See BackBlaze statistics on hard drives reliability.
• You may ask where are my “three backup copies”. I actually have the following:
  • The original files on a master PC
  • A manually-copied copy on a separate hard drive (at least one, sometimes two or three of them on spare drives)
  • A synchronzied copy on the Synology server
  • A synchronized copy on Amazon Cloud Drive
• While the Synology DS413j is no longer listed, you can stil purchase the DS416j ou DS418j.
• On the Synology NAS server, I ensured that the synchronized directory is not visible to Windows: A ransomware can’t see it, it would have to hack through the Synology software. this is protecting me against those ransomwares which try to encrypt netork drives too. (Anyway, I can still control my data through the web interface of DSM).
• If a ransomware tries to encrpyt my files (they may then be synchronized in encrypted form), I made sure that versioning is enabled on Synology (This way, I could travel back in time and avoid “paying the ransom”).

Now, Roumazeilles.net helps you and can be transparently accessed through both addresses:

https://www.Roumazeilles.net/

http://www.Roumazeilles.net/

For most people, this will change nothing. For those who prefer to keep some of their browsing (a little more) discreet, it may help.

Useful reading: HTTPS Everywhere | Electronic Frontier Foundation

If you really want to go into more gory technical details, I can mention that this move was made possible (easy) by my web hosting provider (OVH) who provides a free SSL certificate that I only needed to enable in my administration interface.

But it may be less nice that that. And much more complicated according to Mike Hearn, one of the designers of Bitcoin.

Food for thought: “The resolution of the Bitcoin experiment” (relatively geek content, but clearly built).

Recommended.

When arriving near Giant’s Castle, we could observe that wild fires are a significant issue handled by the local Fire Department in order to limit oerall risks. But, our drive was crossing the burning area.

The author does no really answer the question he asks but I find it mind-opening to start from his postulate: Daesh is not automatically going to disappear because we want it to (or because this is a monstruous group). It may take much more than that to avoid the group which proclaims itself “Islamic State” or “Califate” really becoming an islamic state, stable and well poised between Irak and Syria, which may be what it is doing despite international efforts.

As Stephen M. Walt, I absolutely do not like this perpsective, but we’d better start exrecising our intellect on the worst hypothesis in front of us. And I hope that some other authors will be able to bring some fairly good/intersting (or even mind-blowing) answers.

1. As all black-and-white approaches, it does not allow understanding,it does not allow determining where Daesh or ISIS is coming. It’s happy with just condemning, preferably in reference to the bloody demonstrations (which are a key part of their own propaganda, which we fall for).
2. Worst, without understanding what ISIS really is, there is little hope to stop them, to contain them or to reduce them.

With this in view, I found two remarkable articles which try and bring some light on this very complex issue. One tries to determine the operating modes of ISIS (a sectarian organisation, but not an arbitrary lack of logic; A rigid organisation directed by rules extracted from the Kuran) in order to define pragmatic orientations to oppose the Islamic State with some efficiency (and which gives explanations on why some strategies are/were so blatanlty inefficient). Written by Graeme Wood, published in The Atlantic, What ISIS really wants is a realtively long paper, but worth all your reading time.

The other looks more specifically into power structures of the organization. This is a barely understood side (even if newspapers sometimes speak about the Coalition efforts to eliminate some of ISIS leaders), and it is written by Adrian Lewis for BBC: Islamic State: How it is run.

Each of these require your taking time and concentration to draw most of their contents, but I believe that they are useful for all who want to understand first, before building an opinion and before proposing an action plan.

I just doubled the memory size made available to the CrashPlan virtual machine, thanks to these indications. The application immediately restarted OK. Instead of exploding after a few seconds, the 7000 file delayed in their backup (thanks to returning from Costa Rica) started to be backed up again by CrashPlan.

Seriously, we would prefer to see Code42 (CrashPlan editor) adding a small code snippet detecting this kind of situation described in the web page and applying by itself the changes without requiring dancing to a tune that is utterly inaudible for most of the users…

There is still to understand the restoration issues on Marion’s PC (it’s much more important to be able to restore than to be able to backup).

My recent experience left me with a few dauting questions that will need to receive quick answer if I want to keep my faith in CrahsPlan. Since I have near me three different computers on three different accounts, backing up on a daily basis, I witnessed two annoying incidents nearly simultaneously.

First, my main desktop computer (which holds all my pictures/photos) no longer can backup anything because the CrashPlan engine keeps crashing (no pun intended) after only a few minutes. Seevral days, no idea why despite multiple reboots. Is the fact that I recently reached 1TB of data (a lot of photos, admittedly) a kind of explanation? Did I hit a limitation? a bug of CrashPlan?

Next, on Marion’s laptop computer, we experienced a dreadful moment (violent crash leading to full Windows re-install without any warning). So, the natural reaction was to say “Merde !” and go quietly to the CrashPlan restore option, to get it all back. But, where restoring a few files had always been pretty easy (you should always test the restore function of your backup solution), an intensive restore is proving very similar to a nightmare. I believe that we will have every back soon, but it’s slow not only because of connection or server speed but because the server keeps disconnecting us and we had to restore bit by bit, very small group of file, by very small directory. Anything big or long (videos?) is nearly impossible to get before the next disconnect every 30 minutes or so). Ugly and painful as hell.

I tried many things. I think that we will be able to restore everything (except Marion’s photo archive – that is already on a local back, thanks to our multi-tier backup strategy). But it is uselessly painful and slow (several hours of tiresome manual work during a full week for less than 10GB; This is too much for a subscription-based solution).

I’ll keep you posted about the way my opinion evolves here.

You can listen to the interview and read more to form your own opinion by visiting Benswann.com article on Snowden and the interview the US government does not want you to see.

The fact that these computers (and associated disk drives) are always on and that I have been buying from different brands, different disk sizes, and that I do not often retire the oldest ones, means that I commonly observe one or two disk failures per year. Of course, I am organized with some backups and redundancy to avoid loosing critical data (you could see my analysis of efficient backup solutions on my photography-oriented web site). But in any case, even if I never lost any critical data, I lost a lot of files I would prefer not to have to recover (e.g. movies or mp3 files).

So, after two incidents in the last 3 months, I checked what other solution I had. And I quickly came to the need to have a NAS drive bay (a device that sit on the Local Area Network and holds the disk drives to share) with RAID-5 technology (that provides redundant disks to ensure that one failure). The main issue here is that you need to pay extra to get what amounts to a box (usually 300€ to 800€ for a NAS holding more than 2 drives) and a bunch of disks (RAID-5 requires at least 4 disks). All this makes it a significant move to start with. But after loosing just two disk drives in 3 months, I was decided.

I just purchased a Synology 413j with four 30 TB HDD. Essentially, because it is one of the cheapest NAS with RAID-5 capability on the market and reviews show that it is definitely not cheaply designed and built. For example, it has two near-silent fans to cool down the box (if one fails, the other will speed up and give some time to repair).

In the process I learned a few things that may be interesting to all who are thinking about doing the same move:

• The disk drives are not equal in a RAID configuration. Most modern drives, when they detect a local error, will usually handle it smoothly, delay the request, correct the error and come back to normal operation. This can take a long time, be detected by the RAID as a disk failure (not only a local corrected error) and lead to the RAID shutting down a disk which, by all means, is still fully operational. Some disks can be configured to make sure that the correction is fast enough, some are already configured and ready for this: Western Digital created such a series of disk drives, the WD Red line.
• Power consumption is more of an issue with a device which is always on. Disk performance is secondary because the RAID configuration is not only securing data but boosting performance. So, a relatively slow disk running at 5400 rpm is great (not too hot, not too power-hogging, not too expensive, etc.)
• Since the NAS is usually designed as a small Linux-based PC, it can do plenty of other things. The DSM software from Synology is great because it includes an impressive list of packaged features that can be installed in a matter of minutes.

I’ll publish a few more thoughts after I have installed and tested the animal here.

Better! The snow has frozen.

Worse: A pilot takes a formula car on a trip around the track and we can have a peek. No speed record for sure but a very unusual show.

But, when you’ve been using so much coke, you need to clean your car. Just don’t try to do it the same way as…

This is what it looks like when you’re fixing a radio antenna on top of the Empire State Building in New York City. I sure does not look like it’s easy not to fall down.