大数据时代如何保护自己的隐私？NAS部署极简安全的在线粘贴板『PrivateBin』

哈喽小伙伴们好，我是Stark-C~

在这个大数据时代，很多人在不知情的情况下就暴露了自己的隐私，就比如说在日常社交媒体对话聊天中，自己发出去的信息或者图片可能就已经被不法分子截取了。这种状况不仅影响了个人的安全感，还可能导致各种潜在的危害，如身份盗窃、网络欺诈和不必要的商业营销骚扰等。

今天就为大家分享一个安全和私密的文本分享工具『PrivateBin』，非常适合临时分享文本文档，或者需要一个快速且私密的交流方式，这个项目可能就是你需要的。

关于PrivateBin

PrivateBin 是一个开源的在线文本粘贴工具，它的设计初衷就是提供一个安全、简便和匿名的信息共享平台，所以安全性还是非常可靠得，再加上它还支持私有化部署，让我们自己享有控制权，隐私也进一步加强。

PrivateBin 最大特点是它的数据加密方式，除了可以匿名分享，它所有数据都会在用户的浏览器中进行 AES-256 加密和解密，这就意味着在传输过程中，数据是完全私密和不可访问的。无论是你存储的信息还是分享的链接，PrivateBin 本身都无法读取这些数据，这就确保了用户的隐私。

PrivateBin的界面非常的友好简单，但功能却很实用，除了支持文本内容直接复制粘贴，还支持图片/影视/PDF上传，Markdown 语法的粘贴与预览，最主要的是，它还支持阅后即焚以及自定义时间，时间从最短5分钟到最长一个月。

对了，它还有自己的Demo预览地址：https://privatebin.net/ ，小伙伴们部署之前可以先行体验！

PrivateBin部署

打开极空间的文件管理器（个人空间），在Docker目录下新建一个“privatebin”文件夹。

然后在“privatebin”文件夹“新建文本文档”，并打开。

将以下内容全部复制粘贴到文本文档内后“保存”，几乎没有什么修改的地方（其实是我不懂怎么修改~~）

;project page."

; (optional) notice to display
; notice = "Note: This is a test service: Data may be deleted anytime. Kittens will die if you abuse this service."

; by default PrivateBin will guess the visitors language based on the browsers
; settings. Optionally you can enable the language selection menu, which uses
; a session cookie to store the choice until the browser is closed.
languageselection = false

; set the language your installs defaults to, defaults to English
; if this is set and language selection is disabled, this will be the only language
; languagedefault = "cn"

; (optional) URL shortener address to offer after a new paste is created.
; It is suggested to only use this with self-hosted shorteners as this will leak
; the pastes encryption key.
; urlshortener = "https://shortener.example.com/api?link="

; (optional) Let users create a QR code for sharing the paste URL with one click.
; It works both when a new paste is created and when you view a paste.
; qrcode = true

; (optional) Let users send an email sharing the paste URL with one click.
; It works both when a new paste is created and when you view a paste.
; email = true

; (optional) IP based icons are a weak mechanism to detect if a comment was from
; a different user when the same username was used in a comment. It might get
; used to get the IP of a comment poster if the server salt is leaked and a
; SHA512 HMAC rainbow table is generated for all (relevant) IPs.
; Can be set to one these values:
; "none" / "identicon" (default) / "jdenticon" / "vizhash".
; icon = "none"

; Content Security Policy headers allow a website to restrict what sources are
; allowed to be accessed in its context. You need to change this if you added
; custom scripts from third-party domains to your templates, e.g. tracking
; scripts or run your site behind certain DDoS-protection services.
; Check the documentation at https://content-security-policy.com/
; Notes:
; - If you use any bootstrap theme, you can remove the allow-popups from the
;   sandbox restrictions.
; - If you use the bootstrap5 theme, you must change default-src to 'self' to
;   enable display of the svg icons
; - By default this disallows to load images from third-party servers, e.g. when
;   they are embedded in pastes. If you wish to allow that, you can adjust the
;   policy here. See https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-not-it-load-embedded-images
;   for details.
; - The 'wasm-unsafe-eval' is used to enable webassembly support (used for zlib
;   compression). You can remove it if compression doesn't need to be supported.
; cspheader = "default-src 'none'; base-uri 'self'; form-action 'none'; manifest-src 'self'; connect-src * blob:; script-src 'self' 'wasm-unsafe-eval'; style-src 'self'; font-src 'self'; frame-ancestors 'none'; img-src 'self' data: https:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads"

; stay compatible with PrivateBin Alpha 0.19, less secure
; if enabled will use base64.js version 1.7 instead of 2.1.9 and sha1 instead of
; sha256 in HMAC for the deletion token
; zerobincompatibility = false

; Enable or disable the warning message when the site is served over an insecure
; connection (insecure HTTP instead of HTTPS), defaults to true.
; Secure transport methods like Tor and I2P domains are automatically whitelisted.
; It is **strongly discouraged** to disable this.
; See https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-it-show-me-an-error-about-an-insecure-connection for more information.
; httpwarning = true

; Pick compression algorithm or disable it. Only applies to pastes/comments
; created after changing the setting.
; Can be set to one these values: "none" / "zlib" (default).
; compression = "zlib"

[expire]
; expire value that is selected per default
; make sure the value exists in [expire_options]
default = "1week"

[expire_options]
; Set each one of these to the number of seconds in the expiration period,
; or 0 if it should never expire
5min = 300
10min = 600
1hour = 3600
1day = 86400
1week = 604800
; Well this is not *exactly* one month, it's 30 days:
1month = 2592000
1year = 31536000
never = 0

[formatter_options]
; Set available formatters, their order and their labels
plaintext = "Plain Text"
syntaxhighlighting = "Source Code"
markdown = "Markdown"

[traffic]
; time limit between calls from the same IP address in seconds
; Set this to 0 to disable rate limiting.
limit = 10

; (optional) Set IPs addresses (v4 or v6) or subnets (CIDR) which are exempted
; from the rate-limit. Invalid IPs will be ignored. If multiple values are to
; be exempted, the list needs to be comma separated. Leave unset to disable
; exemptions.
; exempted = "1.2.3.4,10.10.10/24"

; (optional) If you want only some source IP addresses (v4 or v6) or subnets
; (CIDR) to be allowed to create pastes, set these here. Invalid IPs will be
; ignored. If multiple values are to be exempted, the list needs to be comma
; separated. Leave unset to allow anyone to create pastes.
; creators = "1.2.3.4,10.10.10/24"

; (optional) if your website runs behind a reverse proxy or load balancer,
; set the HTTP header containing the visitors IP address, i.e. X_FORWARDED_FOR
; header = "X_FORWARDED_FOR"

[purge]
; minimum time limit between two purgings of expired pastes, it is only
; triggered when pastes are created
; Set this to 0 to run a purge every time a paste is created.
limit = 300

; maximum amount of expired pastes to delete in one purge
; Set this to 0 to disable purging. Set it higher, if you are running a large
; site
batchsize = 10

[model]
; name of data model class to load and directory for storage
; the default model "Filesystem" stores everything in the filesystem
class = Filesystem
[model_options]
dir = PATH "data"

;[model]
; example of a Google Cloud Storage configuration
;class = GoogleCloudStorage
;[model_options]
;bucket = "my-private-bin"
;prefix = "pastes"
;uniformacl = false

;[model]
; example of DB configuration for MySQL
;class = Database
;[model_options]
;dsn = "mysql:host=localhost;dbname=privatebin;charset=UTF8"
;tbl = "privatebin_"    ; table prefix
;usr = "privatebin"
;pwd = "Z3r0P4ss"
;opt[12] = true   ; PDO::ATTR_PERSISTENT

;[model]
; example of DB configuration for SQLite
;class = Database
;[model_options]
;dsn = "sqlite:" PATH "data/db.sq3"
;usr = null
;pwd = null
;opt[12] = true ; PDO::ATTR_PERSISTENT

;[model]
; example of DB configuration for PostgreSQL
;class = Database
;[model_options]
;dsn = "pgsql:host=localhost;dbname=privatebin"
;tbl = "privatebin_"     ; table prefix
;usr = "privatebin"
;pwd = "Z3r0P4ss"
;opt[12] = true    ; PDO::ATTR_PERSISTENT

;[model]
; example of S3 configuration for Rados gateway / CEPH
;class = S3Storage
;[model_options]
;region = ""
;version = "2006-03-01"
;endpoint = "https://s3.my-ceph.invalid"
;use_path_style_endpoint = true
;bucket = "my-bucket"
;accesskey = "my-rados-user"
;secretkey = "my-rados-pass"

;[model]
; example of S3 configuration for AWS
;class = S3Storage
;[model_options]
;region = "eu-central-1"
;version = "latest"
;bucket = "my-bucket"
;accesskey = "access key id"
;secretkey = "secret access key"

;[model]
; example of S3 configuration for AWS using its SDK default credential provider chain
; if relying on environment variables, the AWS SDK will look for the following:
; - AWS_ACCESS_KEY_ID
; - AWS_SECRET_ACCESS_KEY
; - AWS_SESSION_TOKEN (if needed)
; for more details, see https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials.html#default-credential-chain
;class = S3Storage
;[model_options]
;region = "eu-central-1"
;version = "latest"
;bucket = "my-bucket"

;[yourls]
; When using YOURLS as a "urlshortener" config item:
; - By default, "urlshortener" will point to the YOURLS API URL, with or without
;   credentials, and will be visible in public on the PrivateBin web page.
;   Only use this if you allow short URL creation without credentials.
; - Alternatively, using the parameters in this section ("signature" and
;   "apiurl"), "urlshortener" needs to point to the base URL of your PrivateBin
;   instance with "?shortenviayourls&link=" appended. For example:
;   urlshortener = "${basepath}?shortenviayourls&link="
;   This URL will in turn call YOURLS on the server side, using the URL from
;   "apiurl" and the "access signature" from the "signature" parameters below.

; (optional) the "signature" (access key) issued by YOURLS for the using account
; signature = ""
; (optional) the URL of the YOURLS API, called to shorten a PrivateBin URL
; apiurl = "https://yourls.example.com/yourls-api.php"

;[sri]
; Subresource integrity (SRI) hashes used in template files. Uncomment and set
; these for all js files used. See:
; https://github.com/PrivateBin/PrivateBin/wiki/FAQ#user-content-how-to-make-privatebin-work-when-i-have-changed-some-javascript-files
;js/privatebin.js = "sha512-[…]"

之后将文本文档重命名为“conf.php”（请注意后缀也必须和我的一样）。

此项目因为需要给文件夹授权，所以咱们直接启用极空间的SSH，然后使用命令部署更方便。极空间的SSH开启位置在“系统设置--远程协助/SSH”。开启之后还需要使用SSH终端工具连接到极空间，具体的连接方案请看我之前极空间SSH教程的专题介绍，里面也包括关于路径映射的讲解，稍后都会用到。

连接成功之后，需要输入命令“sudo -i”，再输入一遍管理员的密码（输入密码没有显示，输入完成直接回车即可），切换到root账户（提升操作权限）。

然后输入以下命令：

docker run -d --name PrivateBin \

-p 8086:8080 \

-v /Docker/privatebin:/srv/data \

-v /Docker/privatebin/conf.php:/srv/cfg/conf.php \

--restart always \

privatebin/nginx-fpm-alpine

chmod -R 0777 /Docker

以下是你那边需要更改的说明，对照图中我给出的命令格式，请勿直接抄作业：

• -p 8086:8080 -->冒号前面端口不要和本地冲突
• -v /Docker/privatebin:/srv/data -->冒号映射privatebin文件夹的实际路径
• -v /Docker/privatebin/conf.php:/srv/cfg/conf.php -->冒号映射conf.php文件的实际路径
• chmod -R 0777 /Docker/privatebin -->赋予privatebin文件夹所有用户读、写和执行权限，还是注意privatebin文件夹的实际路径

另外就是因为众所周知的原因，目前国内的Docker镜像拉取已经抽风...，这个是和极空间设备无关的。如果遇到Docker镜像拉取问题，可以百度“国内可用Docker镜像加速器”获取最新加速镜像站，或者一劳永逸的科学搞定网络问题。

完成以上之后看到容器显示“运行中”，就说明可以使用了。

PrivateBin体验

PrivateBin打开的方式比较特别，如果你和之前一样直接【IP:端口】打开，就会出现上图中的提示，它需要我们以HTTPS连接才能打开。

想要解决这个问题也非常简单，我们只需要在NAS中安装好Lucky，然后将PrivateBin项目做一个反向代理就可以了。关于极空间上Lucky的部署和用法我之前也出过详细教程，不知道的可以参考下。

搞定之后我们就可以使用反向代理的链接打开项目主页了，可以看到它的页面确实够简洁，并且原生支持中文，我这里随手复制粘贴了我这篇文章的Markdown格式文件，中文显示没有问题。

支持文本预览。

也支持Markdown格式预览，但不知道为什么图片没有显示出来，估计应该是需要修改conf.php文件某个地方。

可以设置有效期，最短5分钟，最长永不过期，或者直接设置阅后即焚，还能设置密码。搞定之后点“创建”。

这样就得到一个以我们自己设置的反代链接为主链接的地址，复制这个地址就可以分享出去了。

因为我设置了密码，所以当分享的这个链接被点开的时候需要输入密码，同时它也提示了文档的过期时间。

打开之后就能看到链接分享过来的内容了。

同时它也支持分享附件，附件可以是图片，办公文件，或者是小短片，我这里尝试发送一个6M的图片。

打开之后图片可以直接显示出来，并且还可以直接下载。

另外它对Docker Compose的代码支持的也非常完美，前提是需要使用源代码模式，我以后就用这个给粉丝分享Docker命令还是很有用的~

最后

极空间最近的更新步伐明显加快，就比如说最近一次的更新除了常规的系统修复和优化，还带来了大家期待已久的新功能。比如说：

• AI字幕：也就是智能字幕生产功能，调用本地AI计算能力，生产字幕文件，支持中文、英语、日语等多种声音的视频；
• DDNS功能：现在我们可以使用自己的个性域名直接访问极空间，支持自动添加DNS记录、泛域名解析、支持IPv6，可选择阿里、腾讯、花生壳三家服务提供商；
• 子账号容量控制：管理员可以手动设定每个子账号在每个存储池可以使用的空间，存储容量分配更灵活方便；
• 原画转码：观影爱好者期待已久，现在终于可以直接在APP端（手机&电视）直接观看原盘无损的电影或纪录片了；
• APP端小窗播放：就像目前市面上的流媒体APP一样，极空间手机端的APP也支持小窗播放功能，观看视频更方便了。

后续我也会单独出更详细的教程，为大家分享这些新功能的介绍和玩法。

还有就是，极空间也在本月正式发布了高性能四盘位NAS私有云Q4与随身智能魔盒T2S两款新品，继续为用户提供更易用、更智能、更安全、更强大的私有云产品与智能存储解决方案。如果你近期有入手NAS的计划，不妨关注下极空间。

好了，以上就是今天给大家分享的内容，我是爱分享的Stark-C，如果今天的内容对你有帮助请记得收藏，顺便点点关注，咱们下期再见！谢谢大家~