Outdated, Deprecated, Archived [[:Template:Project name]] Documentation.

Tor configuration file.

Open the file /usr/local/etc/torrc.d/50_user.conf in a text editor of your choice with administrative rights.

Sysmaint notice.

Ensure the VM has administrative (sudo / root) access first. See also sysmaint.

Platform specific. Select your platform.

Non-Qubes-Whonix

Requires booting into sysmaint session or unrestricted admin mode.

Graphical Whonix-Gateway USER Session

This is not possible.

Graphical Whonix-Gateway SYSMAINT Session

If you are using a graphical Whonix-Gateway booted into PERSISTENT Mode | SYSMAINT Session, take the following step.

System Maintenance Panel -> Open Terminal -> run /usr/libexec/gateway-shortcuts/torrc

Graphical Whonix-Gateway Unrestricted Admin Mode

If you are using a graphical Whonix-Gateway and enabled unrestricted admin mode, take the following step.

Start Menu -> System Tools -> Tor User Config

Terminal Whonix-Gateway

If you are using Whonix-Gateway with command line interface (CLI), take the following step. sudoedit /usr/local/etc/torrc.d/50_user.conf

Qubes-Whonix

Requires booting into sysmaint session or unrestricted admin mode.

Graphical Qubes-Whonix

If you are using Qubes-Whonix^™ with a graphical desktop, take the following step.

Qubes App Launcher (blue/grey "Q") -> Service -> Whonix-Gateway^™ ProxyVM (commonly named sys-whonix) -> Tor User Config

Terminal Qubes-Whonix

If you are using Qubes-Whonix^™ with a terminal, open a terminal in sys-whonix and run the following command.

sudoedit /usr/local/etc/torrc.d/50_user.conf

And undo the changes in /usr/local/etc/torrc.d/50_user.conf on Template:Gateway product name.

Reload Tor.

After changing Tor configuration, Tor must be reloaded for changes to take effect.

Note: If Tor does not connect after completing all these steps, then a user mistake is the most likely explanation. Recheck /usr/local/etc/torrc.d/50_user.conf and repeat the steps outlined in the sections above. If Tor then connects successfully, all the necessary changes have been made.

If you are using Qubes-Whonix^™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Service → Whonix-Gateway^™ ProxyVM (commonly named 'sys-whonix') → Reload Tor

If you are using a graphical Whonix-Gateway, complete the following steps.

Start Menu → System Tools → Reload Tor

If you are using a terminal Whonix-Gateway, click HERE for instructions.

Complete the following steps.

Reload Tor.

sudo systemctl reload tor@default.service

Check Tor's daemon status.

sudo systemctl status tor@default.service

It should include a a message saying.

Active: active (running) since ...

In case of issues, try the following debugging steps.

Check Tor's config.

sudo -u debian-tor tor --verify-config

The output should be similar to the following.

Sep 17 17:40:41.416 [notice] Read configuration file "/usr/local/etc/torrc.d/50_user.conf".
Configuration was valid

Debugging

In case it won't work for you.

Test if Tor is reachable on 10.152.152.10:9119.

/usr/bin/wget.anondist-orig 10.152.152.10:9119

If it says.

--2013-02-13 13:49:47--  http://10.152.152.10:9119/
Connecting to 10.152.152.10:9119... connected.
HTTP request sent, awaiting response... 501 Tor is not an HTTP Proxy
2013-02-13 13:49:47 ERROR 501: Tor is not an HTTP Proxy.

It means, it is fine and the port is reachable.

Run torchat in a Terminal.

torchat

The following output is an example, how it looks when everything is fine.

~ $ torchat
(0) [config,470,main] python version 2.7.3 (default, Jan  2 2013, 16:53:07) [GCC 4.7.2]
(0) [config,477,main] script directory is /usr/share/torchat
(0) [config,478,main] data directory is /home/user/.torchat
./tor.sh: 6: ./tor.sh: tor: not found
(0) [tc_client,2083,startPortableTor] very strange: portable tor started but hostname could not be read
(0) [tc_client,2084,startPortableTor] will use section [tor] and not [tor_portable]

If you are using [[Multiple Template:Workstation product name short|Multiple Template:Workstation product name]], where the Workstation has another IP than 10.152.152.11 you must edit the following line in torchat.ini.

listen_interface = 10.152.152.11

Did the hidden webserver example from the Onion Services page work for you? Try that first.

You also could try using the TorChat source package, which is still documented on the Deprecated page.

Technical Design

The Dev/anon-ws-disable-stacked-tor package prevents Tor over Tor.

Credits

Thanks to scarp for helping with the TorChat instructions!

OnionCat

Introduction

OnionCat, GarliCat: Tunnel TCP, UDP, ICMP or any other protocol through Tor or I2P; IPv6, VPN-like, TAP/TUN tunneling device

|description=OnionCat, GarliCat: Tunnel TCP, UDP, ICMP or any other protocol through Tor or I2P; IPv6, VPN-like, TAP/TUN tunneling device

image=

Introduction to OnionCat:

Status

OnionCat (Tor) will work with Template:Project name. (Tested.)
GarliCat (I2P) might partially work with Template:Project name. (Untested.)

Over Tor

OnionCat transports any protocol between endpoints inside the Tor network. All involved peers need to run OnionCat. It gives IPv6 addresses to Onion Services, making many applications possible.

IPv6 is currently disabled on Template:Gateway product name, because Tor doesn't support IPv6 yet (except for bridges), and because no one developed more than rudimentary IPv6 firewall rules for Template:Gateway product name yet. Template:Gateway product name firewall blocks all IPv6 traffic including local traffic by default. Anyway, that will not be an issue. IPv6 on Template:Workstation product name, where OnionCat will be running, is enabled. Since only OnionCat's underlying operating system requires IPv6, but not the Tor process there will be no problem. OnionCat on Template:Workstation product name will translate the IPv6 requests to IPv4 to the Tor process which is running on Template:Gateway product name. Therefore no IPv6 on Template:Gateway product name is required.

On your Template:Gateway product name.

If you want to read an introduction about onion services and to learn about about onion service security, see Onion Services.

If you also want to run a hidden web server on the same .onion domain (nice for testing and learning Onion Services basics), see Onion Services.

Tor configuration file.

Open the file /usr/local/etc/torrc.d/50_user.conf in a text editor of your choice with administrative rights.

Sysmaint notice.

Ensure the VM has administrative (sudo / root) access first. See also sysmaint.

Platform specific. Select your platform.

Non-Qubes-Whonix

Requires booting into sysmaint session or unrestricted admin mode.

Graphical Whonix-Gateway USER Session

This is not possible.

Graphical Whonix-Gateway SYSMAINT Session

If you are using a graphical Whonix-Gateway booted into PERSISTENT Mode | SYSMAINT Session, take the following step.

System Maintenance Panel -> Open Terminal -> run /usr/libexec/gateway-shortcuts/torrc

Graphical Whonix-Gateway Unrestricted Admin Mode

If you are using a graphical Whonix-Gateway and enabled unrestricted admin mode, take the following step.

Start Menu -> System Tools -> Tor User Config

Terminal Whonix-Gateway

If you are using Whonix-Gateway with command line interface (CLI), take the following step. sudoedit /usr/local/etc/torrc.d/50_user.conf

Qubes-Whonix

Requires booting into sysmaint session or unrestricted admin mode.

Graphical Qubes-Whonix

If you are using Qubes-Whonix^™ with a graphical desktop, take the following step.

Qubes App Launcher (blue/grey "Q") -> Service -> Whonix-Gateway^™ ProxyVM (commonly named sys-whonix) -> Tor User Config

Terminal Qubes-Whonix

If you are using Qubes-Whonix^™ with a terminal, open a terminal in sys-whonix and run the following command.

sudoedit /usr/local/etc/torrc.d/50_user.conf

Add. ^[88]

HiddenServiceDir /var/lib/tor/onioncat/ HiddenServicePort 8060 10.152.152.11:8060 HiddenServiceVersion 3

Save.

Reload Tor.

After changing Tor configuration, Tor must be reloaded for changes to take effect.

Note: If Tor does not connect after completing all these steps, then a user mistake is the most likely explanation. Recheck /usr/local/etc/torrc.d/50_user.conf and repeat the steps outlined in the sections above. If Tor then connects successfully, all the necessary changes have been made.

If you are using Qubes-Whonix^™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Service → Whonix-Gateway^™ ProxyVM (commonly named 'sys-whonix') → Reload Tor

If you are using a graphical Whonix-Gateway, complete the following steps.

Start Menu → System Tools → Reload Tor

If you are using a terminal Whonix-Gateway, click HERE for instructions.

Complete the following steps.

Reload Tor.

sudo systemctl reload tor@default.service

Check Tor's daemon status.

sudo systemctl status tor@default.service

It should include a a message saying.

Active: active (running) since ...

In case of issues, try the following debugging steps.

Check Tor's config.

sudo -u debian-tor tor --verify-config

The output should be similar to the following.

Sep 17 17:40:41.416 [notice] Read configuration file "/usr/local/etc/torrc.d/50_user.conf".
Configuration was valid

Reminder: To get your onion service url.

sudo cat /var/lib/tor/onioncat/hostname

Reminder: Always backup the onion service key. This is necessary in order to restore it on another machine, on a newer Whonix-Gateway^™, after HDD/SSD failure, etc. Follow the instructions below to find its location; root permission is required to access it.

/var/lib/tor/onionchat/private_key

Qubes-Whonix^™

The following example shows how to copy the /var/lib/tor/onionchat/private_key from the sys-whonix VM to the vault VM (which should be started beforehand) using qvm-copy. A dialog will appear asking for the destination VM.

sudo qvm-copy /var/lib/tor/onionchat/private_key

When the dialog appears asking to confirm, select vault. This copies the Tor onion service private key file to the QubesIncoming folder of the vault VM.

/home/user/QubesIncoming/sys-whonix/{{{file_name}}}

Consider moving the file from the QubesIncoming folder to another preferred location.

Qubes VM Manager can be used to conveniently backup the vault and/or other VMs. Please refer to the Qubes backups documentation for necessary steps to accomplish that.

Non-Qubes-Whonix

Notes

Security

There are two possible ways to authenticate and control who is allowed to connect to you Onioncat instance and the applications running on top of it.

1. The simpler and more robust approach is to setup Tor to perform authentication of clients connecting to your Onion Service. If they do not possess a certain randomly generated cryptographic secret, they cannot connect to your Onion Service.

For information on how to do this see Onion Services#Onion Service Authentication.

2. The second approach does this process at the higher level through delegating authentication to Onioncat.

For official documentation on security read the reference at the end of this sentence. ^[90]

Onioncat Authentication Notes and Definitions:

Bi-directional mode is what was used for OC since the beginning. That means that one established circuit (TCP session through Tor) is being used to send AND transmit packets. Thus, it is called bi-directional.

Uni-directional mode means that there are two separate circuits: one for sending and one for receiving.

So what's the implications:
Circuits are established through Tor and are identified and authenticated by the network through the onion hostname (= OC IPv6 address). But this authentication is just one-ended. That means that the client (the one initiating the circuit) can authenticate the server but the server can't authenticate the client. As a consequence the client could spoof its IP address. In Tor/OnionCat context, IP spoofing means to use any IPv6 address but not the one which is associated to the onion ID (that's actually what -R does). Although this is technically no problem there's a security risk which could be that someone takes over the IPv6 address from someone else and could thereby attract (steal) packets. The risk is still very low.

Uni-directional mode addresses exactly that problem. It forces the server to not reuse an incoming connection but establish a new circuit to the supposed client. Thus spoofing is defeated because it requires for the client to own the private key as well.

Uni-directional mode is on by default since revision 556, but this change may be subject to change in future releases.

Uni-directional mode and -R (i.e. starting onioncat in 'client' mode) are incompatible! That means an OnionCat using -R will not be able to communicate with an OnionCat in uni-directional mode.

OnionCats with -R can only talk to bi-directional OnionCats having -U set as noted above.

Source / Credits of this chapter:
These are Onioncat dev, Bernhard Fischer's words with modifications by the Template:Project name team. All credit goes to him.

Tunneling IPv4

Many programs do not support IPv6 and so to use IPv4 with Onioncat, IPv4 will need to be tunneled over IPv6.^[91] This option is preferred to Onioncat's native IPv4 forwarding designated by the -4 parameter, which is deprecated and could not have guaranteed the authenticity of the communicating endpoints as the tunneling method can.

Most operating systems should support IP-IP6 tunneling. IPv6 supports encapsulation of IPv4 or IPv6, hence, tunneling is not a big deal. An IP-IP6 tunnel is a point-to-point tunnel between two IPv6 nodes. The tunnel endpoints are virtual network interfaces. IP addresses are assigned to them and routing has to be set up as usual (as if those interfaces where ethernets). Before configuring a tunnel you need to know the two IPv6 addresses of the IPv6 nodes. Those will be the IPv6 OnionCat addresses. There are a few steps necessary on Linux. First insert the IPv6 tunneling kernel module, then setup the tunnel interface by connecting it to the two IPv6 addresses. Next configure the IPv4 addresses to the tunnel endpoints, bring them up and add the necessary routes (... and don't forget to update your firewall rules - but this is not needed with Template:Project name Workstation's default settings).

sudo su modprobe ip6_tunnel ip -6 tunnel add iptun0 mode ipip6 local fd87:d87e:eb43:1f53:c75:3b27:7adc:c9a5 remote fd87:d87e:eb43:8733:3338:21f6:a2b8:eebf ifconfig iptun0 192.168.100.1 up route add -net 192.168.100.0/24 dev iptun0

On the other end do the same thing except that you have to swap the two IPv6 addresses and use another IP address on the tunnel endpoint, e.g. 192.168.100.2. If Tor, OnionCat, and the tunnel is up on both ends you should be able to ping the remote end.

Useful Commands

Check connectivity between endpoints using ping:

ping6 onioncat-address

Replies should come immediately if everything is working.

To derive the OnionCat IPv6 address from your Onion Service address run:

ocat -i onion.address

Running ifconfig can show helpful information on active network interfaces:

sudo ifconfig

Debugging

Your support makes
all the difference!

To terminate onionat you could use.

sudo kill -sigint $(pgrep ocat)

Miscellaneous

To make Onioncat to autostart with the system using the parameters listed above. editing its configuration file: sudoedit /etc/default/onioncat

Enable the autostart comment by removing '#':

ENABLED=yes

Add your settings:

DAEMON_OPTS="Paramters go here"

Over I2P

GarliCat over I2P might only work, if you use ip2 over Tor.

There was the idea to create an I2PBOX, but it never came to live due to lack of community interest, which means GarliCat directly over I2P will not be supported by Template:Project name.

As soon as I2P over Tor is working in Template:Workstation product name, you can probably follow the instructions on cryptoanarchy.org (webarchive; webcitation) without modifications.

General Debugging Hints

There at multiple sources for issues, you might stumble upon.
Therefore it is recommended, before you try using OnionCat with Template:Project name, if that doesn't endanger you, try first to successfully test OnionCat without Template:Project name.
As soon as you learnt that, it eliminated one source for possible issues (OnionCat) and can start learning how to use it with Template:Project name (which might introduce new issues, but enhanced security will be your reward).
You also have to learn first, how to use onion services with Template:Project name, see hosting onion services for reference.

Footnotes

Template:Reflist

Whonix

The most watertight privacy operating system in the world.

Dark mode

Supported by Power Up Privacy

Whonix is proudly supported until 2026 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint

2012- 2026 ENCRYPTED SUPPORT LLC

We believe security software like Whonix needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 14 year success story and maybe DONATE!

Tor Access

These instructions break sending emails to other domains that are not riseup.

Some email services provide access via Onion Service addresses. This provides better end to end security properties for authenticating to the server and conceals when you check your inbox.

In Thunderbird go to:

Settings -> Preferences -> Account Settings

Server Settings Tab, set the IMAP address to: imap.<address>.onion

Outgoing Server (SMTP) Tab, Edit: smtp.<address>.onion

The service providers may or may not enable TLS/STARTTLS connection security for their Onion domain since it is redundant. Its best to leave turned on by default and only disable it if problems arise.

Leave your Default Identity with the clearnet domain to avoid confusing recipients when replying to you.

Pidgin

For instant messaging in Template:Project name you can install the Pidgin^[92] Instant Messenger. It is a multi-protocol client, so you could run MSN, ICQ, IRC, AIM, XMPP/Jabber and many other protocols at the same time, even with several instances of the same protocol.

All of these chat systems are unsafe if not used together with OTR. Even when used with OTR, expect to be exposing your social graph. Privacy hackers isolate parts of the social graph by running several accounts for groups of people on each popular server, thus avoiding the insecure XMPP federation (adding people on servers that is not your own).

For more detailed documentation refer to the official Pidgin user guide.

You can install it using Start menu -> Applications -> System -> Terminal.

sudo apt-get update sudo apt-get install pidgin

There is also a Torchat plugin available for pidgin official libpurple-torchat pidgin plugin, which could be implemented to allow p2p encrypted end-to-end communications although there is no known documentation on getting this done specifically in Template:Project name. It works seamless on standard pidgin/linux distro's with tor, the code is over a year without any changes/updates, hopefully because it simply works without any need for changes.

Some protocols that are problematic in context of privacy/anonymity are disabled by default. ^[93]

To get a list of those, you could run.

sudo dpkg-divert --list

To re-enable all of them, you could run.

sudo /var/lib/dpkg/info/pidgin-improved-privacy.prerm remove

After a restart of Pidgin, the protocols will be available.

OTR encryption

Of course the issue of end-to-end encryption arises again. As we mentioned earlier, we have Off-the-record messaging^[94] (commonly called OTR) for instant messaging, and Pidgin and many other instant messengers have support for that. There are several resources on how it works and how to use it on their web site. Basically all you need to do is choose "Start private conversation" in the OTR menu and a key will be generated automatically if you do not have one already. After that OTR will establish a private conversation if the other end's instant messenger supports it.

If you didn't authenticate your partner with something like a shared secret there can be a man in the middle recording your chat, even if you are using the same server (the server or the TLS connection to the server may be corrupted).

OTR and other Pidgin plugins are enabled in the "Tools menu -> Plug-ins" section. Simply check the appropriate box for enabling any plugin you want, and possibly you might also want to configure it by pressing the "Configure Plug-in" button. When this is done for the OTR plugin a window that can be used to manage your keys will open. The use of OTR is recommended as many instant messaging protocols normally sends your messages in plaintext. Force your friends to migrate to clients with support for OTR!

NOTE: /me is not encrypted when used in a OTR private conversation! Also /msg in XMPP chatrooms is not – it goes through the chatroom server!

Read also those various other resources about OTR.

You can install it using Start menu -> Applications -> System -> Terminal.

sudo apt-get update sudo apt-get install pidgin-otr

Jitsi

Jacob Appelbaum (Tor researcher) recommends^[95] Jitsi^[96] (this applies if _not_ using Tor). It supports OTR encryption and ZRTP and is available in Debian Testing.

Jitsi supports push to talk.

Jitsi is the most feature-rich Free Software VoIP client. The team behind it is very innovative, constantly focusing on adding new functionality. It supports many protocols and advanced features like Multi-party video conferencing - in which someone's client will be running into server mode for that purpose because of latency management.^[97]

Its stability leaves more to be desired however. Alpha stage clients are available for Android.

Unfortunately it is not usable with Tor, because the Tor network does not support UDP and because Jitsi does not support TCP for audio/video at time of writing (April 2014).

TODO: write a guide on how to connect to a free public server, having a secure ZRTP encrypted conversation with someone using the same client (note: impossible as of April 2014 without revealing the ip numbers of the corresponding parties to both eavesdroppers and the server).

sflphone

Nathan Freitas (Tor Orbot developer) likes^[98] sflphone^[99]. Can be installed from Debian package sources.

It does not support OTR. You would have to keep that in mind and use another way to exchange encrypted text. This is not a reason, not to use it, if you are aware of that.

TODO: research, does sflphone support push to talk?

TODO: write a guide how to connect to a free public server, having a secure ZRTP encrypted conversation with someone using the same client.

OnionPhone

OnionPhone ^[100] is the successor to TOR Fone, improving the ciphers used among other problems^[101]. Repo here ^[102]

The main improvement is that OnionPhone can now be used as a VoIP plugin that integrates it with with TorChat, using the Tor network to protect and anonymize your communication in this mode. It is also the only mode that makes sense in terns of usability because otherwise its a command line utility.

OnionPhone works on Linux and Windows, with Android support planned.

Other modes of operation include using the Tor network as a decentralized and secure alternative for SIP signalling. The call streams are then initiated directly using either TCP or UDP (for NAT traversal). Note that metadata is not concealed in that mode.

It can be run standalone with direct connections with OnionCat.

TODO: Encourage Debian Packaging TODO: Build, test and document usage instructions with TorChat

linphone

Introduction

Linphone is one of the most feature-rich Free Software clients available, second only to Jitsi in that respect, but second to none is stability and performance from testing. It can also support conferencing (audio only as of 2014).^[103] Additionally it has fully developed clients for all desktop and mobile operating systems.

Should an Android port of Onioncat ever become a reality by the Guardian Project, Linphone can be used for anonymous VoIP between all combinations of device form factors. There is headway on that front.^[104]

Setup with Template:Project name

Technically, only one member of the chat party needs to configure a Tor Onion Service (be a callee). Others can run Onioncat in 'client' only mode (be ca caller).

Bidirectional communication can only be established after the client party (caller) connects to the one running an onion service 'server' mode (callee), because the latter can accept incoming connections while the former cannot.

	callee	caller
Can make outgoing calls	Yes	Yes
Can initially receive incoming calls	Yes	No
Needs to host a Tor onion service	Yes	No
Difficulty setup	medium	easy

Setup as Both, Callee or Caller

You only have to read this, if you want to use linphone as both, callee or caller. As a caller, you can only make outgoing calls. As a callee (that includes ability of being a caller), you can make outgoing calls and receive incoming calls. Only one of both calling parters has to follow these instructions. However, it doesn't matter if both calling partners follow these following instructions. If you are interested, click on Expand on the right.

On your Template:Gateway product name.

If you want to read and introduction about onion services and to learn about about onion service security, see Onion Services.

If you also want to run a hidden web server on the same .onion domain (nice for testing and learning Onion Services basics), see Onion Services.

Open your /usr/local/etc/torrc.d/50_user.conf.

sudoedit /usr/local/etc/torrc.d/50_user.conf

Add. ^[105]

HiddenServiceDir /var/lib/tor/linphone_service/
HiddenServicePort 64739 10.152.152.11 :64739
HiddenServiceVersion 3

Reload Tor.

sudo service tor reload

Reminder: To get your onion service url.

sudo cat /var/lib/tor/linphone_service/hostname

Reminder: Backup your onion service key, in case you want to be able to restore it, on another machine, on a newer Template:Gateway product name, after hdd failure, etc. You can find it here and need sudo to access it.

/var/lib/tor/linphone_service/private_key

Update your package lists

sudo apt-get update

Install onioncat and linphone.

sudo apt-get install onioncat linphone

Start onioncat. Replace address.onion with your actual onion service url from above.

sudo ocat address.onion -U -l 10.152.152.11 :64739

As of onioncat r555 (only applies to Jessie onwards) onioncat starts in unidirection 'client' mode by default. To accept incoming connections -U must be used. Mutual authentication is also available in this newer version which is needed to ensure that the identities of all endpoints engaged in a transaction are verified. ^[106]

Find out your onioncat IPv6 address.

ip addr show dev tun0

Open Linphone settings and select IPv6. Apply and restart Linphone.

Setup only as Caller

You only have to read this, if you want to use linphone caller only. As a caller, you can only make outgoing calls. Only one of both calling parters can follow these instructions. If both calling partners would follow these instructions, would not be able to call each other. If you are interested, click on Expand on the right.

Update your package lists

sudo apt-get update

Install onioncat and linphone.

sudo apt-get install onioncat linphone

Start onioncat.

sudo ocat -R

Open Linphone settings and select IPv6. Apply and restart Linphone.

Calling

At this point you should have exchanged IPv6 addresses of the callee. To call someone put in the call box. You can keep user. Must use brackets. Replace onioncat IPv6 address with the actual IPv6 of your calling partner.

user@[onioncat ipv6 address]

Debugging

http://pinger.mixmin.net/from.html

To terminate onioncat you could use.

sudo kill -sigint $(pgrep ocat)

Miscellaneous

To make Onioncat to autostart with the system using the parameters listed above. editing its configuration file: sudoedit /etc/default/onioncat

Enable the autostart comment by removing '#':

ENABLED=yes

Add your settings:

DAEMON_OPTS="Paramters go here"

Credits

Credits go to HulaHoop for researching how to use Linphone with Tor for sharing instructions in Template:Project name User Forum.

Development Ideas

OnionCat

OnionCat could be useful if tunneling UDP and/or ICMP tunneling over Tor should be required. It should be avoided if possible, because it add complexity to the setup. Does it introduce more latency because connection always goes from onion service to onion service?

OpenBazaar

OpenBazaar supports both TCP and UDP. The latter was added to aid those using it on the clearnet that had difficulties connecting from behind their routers. ^[107] When using Tor you don't have to worry about that.

A community demo for OpenBazaar was done with Tor by hosting seed nodes as Onion Services.

Hosting ANY Onion Services

You can provide any server service, which relies on TCP, such as web servers, IRC servers, chat servers and so forth. UDP and IPv6 are not supported by the Tor network, but if required you could use OnionCat as a workaround.

OnionCat

See OnionCat.

^[108]

^[109]

^[110]

Syncthing with OnionCat

Syncthing is a libre software solution for private file synchronization.

This section will cover file syncing with peers inside the Tor network.

TO-DO: Test Syncthing without OnionCat since SOCKS support was added recently.^[111]

1. Set up OnionCat on Template:Project name Gateway. All parties involved will need to configure a Onion Service with OnionCat because syncing is bidirectional. Make sure you can successfully ping all OnionCat addresses before proceeding.

Security warning: Adding a third-party repository and/or installing third-party software allows the vendor to replace any software on your system, including but not limited to the installation of malware, file deletion, and data harvesting. Proceed at your own risk! See also Foreign Sources for further information. For greater safety, users adding third-party repositories should always use Multiple Whonix-Workstation^™ to compartmentalize VMs with additional software.

Documentation in the Whonix wiki provides guidance on adding third-party software from various upstream repositories. This is especially useful since upstream often includes generic instructions for different Linux distributions, which may be complex for users to follow. Additionally, documentation in Whonix usually places a higher emphasis on security and verifying digital software signatures.

The instructions provided here serve as a "translation layer" from upstream documentation to Whonix, offering assistance in most scenarios. Nevertheless, it's important to recognize that upstream repositories and software may change over time. Consequently, the documentation on this wiki might require occasional updates, such as revised signing key fingerprints, to remain current and accurate.

Please note, this is a general wiki template and may not apply to all upstream documentation scenarios.

Users encountering issues, such as signing key problems, are advised to follow the Self Support First Policy and engage in Generic Bug Reproduction. This involves attempting to replicate the issue on Debian trixie, and contacting upstream directly if the issue can be reproduced, as such problems are likely unspecific to Whonix. In most cases, Whonix is not responsible for, nor capable of resolving, issues stemming from third-party software.

For further information, refer to Introduction, User Expectations - What Documentation Is and What It Is Not.

Should the user encounter bugs related to third-party software, it is advisable to report these issues to the respective upstream projects. Additionally, users are encouraged to share links to upstream bug reports in the Whonix forums and/or make edits to this wiki page. For example, if there are outdated links or key fingerprints that need updating, please feel free to make the necessary changes. Contributions aimed at maintaining the accuracy and currency of information are highly valued. These updates not only improve the quality of the wiki but also serve as a useful resource for other users.

The Whonix wiki is an open platform where everyone is welcome to contribute improvements and edits, with or without an account. Edits to this wiki are subject to moderation, so contributors should not worry about making mistakes. Your edits will be reviewed before being made public, ensuring the integrity and accuracy of the information provided.

2. Before adding the repo^[112], fetch the key and verify^[113] fingerprints. Always check the fingerprint for yourself. The output at the moment is:

pub  2048R/0xD26E6ED000654A3E 2014-12-29 Syncthing Release Management <release@syncthing.net>
      Key fingerprint = 37C8 4554 E7E0 A261 E4F7  6E1E D26E 6ED0 0065 4A3E

Download key with scurl to home folder.

scurl -o syncthing-pubkey.asc https://syncthing.net/release-key.txt

Check fingerprints/owners without importing anything.

gpg --keyid-format long --with-fingerprint syncthing-pubkey.asc

If it looks good import into trusted.gpg.d.

gpg --no-default-keyring --keyring ./syncthing-pubkey.gpg --import syncthing-pubkey.asc sudo cp syncthing-pubkey.gpg /etc/apt/trusted.gpg.d/syncthing-pubkey.gpg sudo sh -c 'echo deb http://apt.syncthing.net/ syncthing release > /etc/apt/sources.list.d/syncthing-release.list' sudo apt-get update -qq sudo apt-get install syncthing

3. Launch Syncthing: syncthing

Do not close the running terminal or Syncthing will shutdown. Answer 'No' if asked to 'Allow Anonymous Usage Reporting'.

Template:FoxyProxy

To open the WebGUI, open Tor Browser and paste: http://127.0.0.1:8384/

4. At this point Syncthing back-end should have generated your unique Device ID. Go to:

Actions > Show ID

Share the Device ID along with your OnionCat address. As long as one side shares this information the other can add and find them.

5. Once ID information is exchanged, go to

Add Device

and paste the other endpoint's Device ID. Then under Addresses change dynamic to

[OnionCat-address]:22000

Note that you MUST write the OnionCat IPv6 address within brackets for it to work.

Select the default directory under Share Folders With Device.

6. Syncing more than two endpoints can quickly become tedious so select at least one node to be an Introducer by selecting the option. The Introducer node will inform the new device about all nodes attached to it.

7. Finally drag and drop any files you want to sync to the 'Sync' folder under your Home directory.

Done.

Note: No one can connect to your swarm without you adding them but you may still want to make your virtual network more private. This is done using HiddenServiceAuthorizeClient - a Tor feature.

Torrenting over OnionCat

This section will cover torrenting with anonymous peers inside the Tor network. This is a trackerless setup.

Seeding

1. Set up OnionCat on Template:Project name Gateway. All parties involved will need to configure a Onion Service with OnionCat because torrenting is bidirectional.

2. Next install qBittorrent: sudo apt-get install qbittorrent

3. Create your torrent:

Tools > Torrent creator

Add the file/folder you want to share. Leave the Tracker information boxes empty. Insert your OnionCat IPv6 IP into the Comment section.

Check Start seeding after creation then create and save the torrent file.

4. Share the torrent file on your personal Onion Site blog or some other channel as you normally would.

Downloading

1. Add the torrent file in qBittorrent

2. Select the the torrent from the list and go to the General tab. Copy the OnionCat IPv6 address from the Comment section.

3. Click the Peers tab and right-click into the empty tab. Click Add a new peer... and paste the IPv6 address. Note that the default listening port for incoming connections is set to 6881 and nothing needs to be done.

Done.

For a private sharing environment you will need to configure Tor to use the HiddenServiceAuthorizeClient option. More on that here.

Tunnel Freenet over OnionCat

Some Freenet users have successfully experimented with connecting over OnionCat. Note that all communicating parties need to set this up for this to work. Follow this guide to connect to other Darknet peers. No connections to the public datastore possible with this method.^[114]

Template:Project name specific caveats to the above instructions.

Adjust OnionCat to connect to the Gateway with socat.

TO-DO: Create and add socat template to all relevant onion service guides

Pond

Removed because upstream dead.

Pond is a forward secure, asynchronous messaging system that uses Tor to conceal metadata. Pond messages not a record; they expire automatically a week after they are received.

Add Debian Experimental to repos sources lists.

sudo su -c "echo -e 'deb http://httpredir.debian.org/debian experimental main' > /etc/apt/sources.list.d/debian-experimental.list"

Install Pond and its dependencies.

sudo apt-get update sudo apt-get install golang libgtk-3-dev libgtkspell3-3-dev libtspi-dev sudo apt-get -t experimental install pond

Run Pond.

cd mkdir gopkg export GOPATH=$HOME/gopkg $GOPATH/usr/bin/pond-client

The server's file path: /usr/bin/pond-server

Optionally set a passphrase and keep the default server selected.

For usage instructions read help --all to understand the options.

HugePages

Huge memory pages improve performance for some virtualized workloads such as running databases. They are not enabled by default in Linux because the amount of memory to be allocated this way depends on the different needs from one user/admin to another. ^[115]

On the host you need to activate the nr_hugepages setting in the proc filesystem:

echo 1054 > /proc/sys/vm/nr_hugepages

NOTE: To make the above value persistent, you'd need to set:

echo "vm.nr_hugepages=1054" > /etc/sysctl.d/50_hugepages

Then, `grep` for the HugePages_Total:

grep -i HugePages_Total /proc/meminfo

Should show.

HugePages_Total:    1054

The total system RAM allocated as hugepages can be calculated as:

2Mb * 1054 = 2108 ≈ 2GiB

Then, boot a libvirt virtual machine with 2 GB memory with appropriate XML setting as noted in the example below:

  <memory unit='KiB'>2000896</memory>
  <currentMemory unit='KiB'>2000000</currentMemory>
  <memoryBacking>
    <hugepages>
      <page size='2048' unit='KiB' nodeset='0'/>
    </hugepages>
  </memoryBacking>
  <vcpu placement='static'>8</vcpu>

Clipboard Sharing

SPICE allows accelerated graphics and clipboard sharing. The clipboard is disabled by default for security reasons ^[116] but could be enabled.

When editing using xml, search for.

<clipboard copypaste='no'/>

And change to.

<clipboard copypaste='yes'/>

KSM

The security assumptions about virtual environments is that each vm is a completely isolated instance that knows nothing about what's happening outside it. It posses a privacy problem for an isolated multi-workstation setup.

In a single workstation-to-gateway scenario, KSM is not problematic because technically, nothing going on, on the gateway, even if known would endanger privacy. However should someone run multiple workstation vms, each with the intent that they are all separated - each with its own internal network for isolation for example, then with KSM all similar activities or processes running in the other vms, would register to an attacker who has compromised one of them. For example, information that the same website has been visited in another vm too. This would allow cross-vm activity correlation.

Its not really a weakness unique to KSM, but a common problem shared by using the equivalent feature on other hypervisors too (Xen's TPS - Transparent Page Sharing). ^[117]

Quote Memory Deduplication as a Threat to the Guest OS:

4.3 Detection of Downloaded Files

The memory disclosure attack can also be applied to find an opened file on a victim’s VM. We have tried to detect a logo file when Firefox shows a home page.

We confirmed that the Google logo file was detected if page caching is enabled on Firefox. When the page cache was set to 0, detection failed. If an attacker leads a victim to a malicious home page which includes an identifiable logo file, the attacker can detect the page view from the victim’s VM.

This disclosure attack is dangerous because it detects a page view even if the network is encrypted by TLS/SSL. Especially in a multi-tenant data center, this attack is serious, because it does not violate any SLA statements on cloud computing.

Wiping the storage used by a guest domain

A volume used by a domain can contain confidential data, hence it is necessary to wipe it before removal. Libvirt offers a helping hand for such cases:

virsh vol-wipe <volume>

which truncates and extends the volume to its original size. This in fact fills the file with zeroes. This ensures that data previously stored on volume is not accessible to reads anymore. After this, you can remove volume :

virsh vol-delete <volume>

Source ^[118]

Template:Install Backport

Upgrade your system as usual. ^[119]

Create a file /etc/apt/sources.list.d/user.list. Open file /etc/apt/sources.list.d/user.list in an editor with administrative ("root") rights.

Select your platform.

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.

Open the file with root rights.

sudoedit /etc/apt/sources.list.d/user.list

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.
Template requirement: When using Qubes-Whonix, this must be done inside the Template.

Open the file with root rights.

sudoedit /etc/apt/sources.list.d/user.list

Notes.

Shut down Template: After applying this change, shut down the Template.
Restart App Qubes: All App Qubes based on the Template need to be restarted if they were already running.
Qubes persistence: See also Qubes Persistence
General procedure: This is a general procedure required for Qubes and is unspecific to Qubes-Whonix.

Notes.

Example only: This is just an example. Other tools could achieve the same goal.
Troubleshooting and alternatives: If this example does not work for you, or if you are not using Whonix, please refer to Open File with Root Rights.

Open the file with root rights.

sudoedit /etc/apt/sources.list.d/user.list

Add the following content.

deb http://ftp.us.debian.org/debian jessie-backports main contrib non-free

Save.

Update your package lists.

sudo apt-get update

Install a package from jessie-backports. Example.

sudo apt-get install -t jessie-backports {{{package}}}

Note:

Don't forget the -t jessie-backports, which does the trick here.

Mounting Shared Folders in KVM Guests

Run the following command in terminal (Start Menu -> Applications -> System -> Terminal).

sudo mount -t 9p -o trans=virtio shared /mnt/shared -oversion=9p2000.L

To automatically mount this every time at boot, modify /etc/fstab.

Open file /etc/fstab in a text editor of your choice as a regular, non-root user.

If you are using a graphical environment, run. featherpad /etc/fstab

If you are using a terminal, run. nano /etc/fstab

Add.

shared /mnt/shared    9p  trans=virtio,version=9p2000.L,rw    0   0

Save.

SELinux

SELinux is more robust than Apparmor because its label based vs file-path based. But his comes at the expense of being difficult to write policies. The good news is if you are a KVM user and want to harden your GNU/Linux host, its as simple as enabling SELinux and libvirt will automatically take advantage of it without any further effort needed on your part.

These instructions apply to Template:Project name and could be easily replicated for your Debian host. First disable Apparmor if you are using it. Both MAC systems cannot be run simultaneously run. This is not supported by LSM and may also be a source of conflicts.

AppArmor is disabled, and the kernel module unloaded by entering the following^[120]:

sudo /etc/init.d/apparmor stop
sudo update-rc.d -f apparmor remove

To enable SELinux follow these steps.^[121] The cited guide also includes steps for writing custom policy for hardening.

    # aptitude install selinux-basics selinux-policy-default
    # selinux-activate
    # reboot

    # sudoedit /etc/default/grub

    Replace all mention of apparmor in settings for GRUB_CMDLINE_LINUX with selinux=1 and the enforcing=1 parameter to the Linux kernel. The audit=1 parameter enables SELinux logging which records all the denied operations.

    Remove the line under it that starts with: GRUB_CMDLINE_LINUX_DEFAULT

    # update-grub

Updating Tor

Tor was installed on Template:Project name according to official instructions for Ubuntu. You can update Tor (and the rest of the system) using apt-get update and apt-get dist-upgrade.

If you run in the following error message when running apt-get update on the Gateway...

W: GPG error: http://deb.torproject.org precise Inrelease: The following signature were invalid: Keyexpired 1346668560

...or into the following error message on the Gateway when running apt-get dist-upgrade:

Warning: The following packages cannot be authenticated!
deb.torproject.org-keyring tor
Install these packages without varification?

...please use the workaround below. Please do not install without verification for your own safety!

Temporary fix. Run these two commands. (Check if they are still current and genuine in official instructions for Ubuntu.)

gpg --keyserver keys.gnupg.net --recv 886DDD89

gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -

(If they fail for the first time, perhaps because you are on a slow network or slow Tor circuit, run them a few times until the succeed.)

,, Technical problem: The latest Template:Project name release is a few days ago and in meanwhile there is a new deb.torproject.org-keyring got renewed while the old torproject deb keys expired. Fixing the problem requires a new Template:Project name release. It will be fixed in 0.3.0.

Nymserver QuickSilver Mail How-To

This guide is for QuickSilver Lite, a Freedom Software GUI for Mixmaster. QuickSilver Lite was written for Windows but is fully compatible with Wine. The paranoici Zax-type Nymserver is used for this example. Credit goes to Template:Project name user mirimir whose instructions this work is based on.^[122]^[123]


## Generate your GPG keypair using KGpg. Fill in the nym you chose for the Email field. Use something likely not taken:
KGpg -> Keys -> Generate Key Pair... ->

Name: John Doe (or any alias of choice)
Email: yournym@nymphet.paranoici.org
Keysize: 4096 bits
    
OK -> Enter passphrase for key -> OK.


## Import Nymserver key from KGpg.
KGpg -> Open Keyserver Dialog -> Search for 'send@nymphet.paranoici.org' -> Import


## Always check the fingerprint for yourself. The output at the moment is:

pub  4096R/0x5CE8D7B97340F3A7 2013-01-06 Nymserver <send@nymphet.paranoici.org>
      Key fingerprint = B91A FAEE 998D 5134 5AFE  E104 5CE8 D7B9 7340 F3A7


## In KGpg, highlight your key, and set Trust level on Nymserver key to 'Marginal' and sign it with your own key.

Right-click on Nymserver key -> Key Properties

Owner Trust: Marginally

-> Apply -> OK


Right-click on Nymserver key -> Continue -> Select your nym's secret key to use for signing -> OK -> Enter passphrase



## Download QuickSilver's signing keys with scurl to home folder.
scurl -ko quicksilver.asc https://www.quicksilvermail.net/quicksilver.asc

## Check fingerprints/owners without importing anything. 
gpg --keyid-format long --with-fingerprint quicksilver.asc

## Always check the fingerprint for yourself. The output at the moment is:

pub  4096R/0x1B04C05145FF11B1 2013-09-08 QuickSilver <admin@quicksilvermail.net>
      Key fingerprint = 6BC3 5E3D 7473 E416 F423  E845 1B04 C051 45FF 11B1

## Import key:
gpg --import quicksilver.asc

## To avoid ''unsafe ownership'' key warnings
gpg --fingerprint
chmod --recursive 700 ~/.gnupg



## Download archives.
wget -r --no-check-certificate --no-parent -A 'QSLite*.zip' https://www.quicksilvermail.net/qslite/
wget -r --no-check-certificate --no-parent -A 'QSLite*.zip.sig' https://www.quicksilvermail.net/qslite/
wget -r --no-check-certificate --no-parent -A 'QSAam*.zip' https://www.quicksilvermail.net/qsaam/
wget -r --no-check-certificate --no-parent -A 'QSAam*.zip.sig' https://www.quicksilvermail.net/qsaam/


## Move files into Home folder.
mv /home/user/www.quicksilvermail.net/qslite/QSLite*.zip /home/user
mv /home/user/www.quicksilvermail.net/qslite/QSLite*.zip.sig /home/user
mv /home/user/www.quicksilvermail.net/qsaam/QSAam*.zip /home/user
mv /home/user/www.quicksilvermail.net/qsaam/QSAam*.zip.sig /home/user


## Verify archive. Fingerprint should match the key above.
gpg --verify-options show-notations --verify QSLite*.zip.sig QSLite*.zip
gpg --verify-options show-notations --verify QSAam*.zip.sig QSAam*.zip


## Install Wine.
sudo apt-get install wine

## Run Wine to create its directories. Cancel Wine Mono Installer.
wine run

## Create folder for QS components and transfer them.
mkdir /home/user/.wine/drive_c/QS/
unzip QSLite*.zip -d /home/user/.wine/drive_c/QS/
unzip QSAam*.zip -d /home/user/.wine/drive_c/QS/

## Select 'Replace All' when prompted for duplicate files.
A

## Open Terminal and create links to allow QSL and QSA to use Debian gpg:
mkdir .wine/drive_c/QS/gpg-links
link '/home/user/.gnupg/pubring.gpg' '/home/user/.wine/drive_c/QS/gpg-links/pubring.gpg'
link '/home/user/.gnupg/secring.gpg' '/home/user/.wine/drive_c/QS/gpg-links/secring.gpg'

## Run QSL. This way is needed only for the initial run it applies to QSA too. Access QSL from the desktop shortcut afterwards.
cd /home/user/.wine/drive_c/QS
wine qsl.exe

## Setup QSL.
Setup -> Draw randomly in window until "OK" appears ... click "OK" -> Check: Create desktop shortcut | Email Address: yournym@nymphet.paranoici.org -> SMTP Server: gbhpq7eihle4btsn.onion -> Leave SMTP Proxy setings unchanged -> Leave HTTP Proxy setings unchanged -> Finish

(Note: Mixnym's SMTP Onion Service used. Tor Transport used - stream isolation unnecessary)


## Configure QSL.
Open Tools | Options.
...In General tab:
......Under "User Mode", check "Expert".
......Under "On Start-up", check "Open Template Dialog".
...In PGP tab:
......Check "PGP Public Key Encryption".
......For "Private Keyring", use "C:\QS\gpg-links\secring.gpg".
......For "Public Keyring", use "C:\QS\gpg-links\pubring.gpg".
......Click "Default key" and select it (will be just your new one).
......If desired, choose to cache private-key passphrases for five minutes or so.
...In Mix tab:
......Select "once a day" for "Update remailer stats".
...Click "Ok" to finish.
Open Tools | Stats manager.
...Click "Update".
...When you see "done!" click "Ok".
...If it stalls, there's something wrong with your Tor setup.
......Check with Firefox, and also check Tor config in Tools | Proxies.
Open Tools | Allpingers manager.
...Click "Update".
...When you see "done!" click "Ok".


Now you'll configure the message that QSL uses to create a Mixnym nym.
In the main compose pane, customize the message to look like the following:

Code:

Fcc: nyms
Host: gbhpq7eihle4btsn.onion
From: nobody@nowhere.net
Chain: *,*,*; copies=2;
To: send@nymphet.paranoici.org
Subject:

hsub: New Mail For Jude!

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFFP2l4BEACXJDUM6SxyjUk8K+MJ4fRJ5VMaE6hSsAD6n8eO04l9HMzSx26X
<snip>
wnOpR4sYYD9MFLura6+YiHWtT8ih
=ndP9
-----END PGP PUBLIC KEY BLOCK-----

~~

In the above:
...Replace "Jude" in "hsub: New Mail For Jude!" with your fake first name.
...Replace the public key block with your public key that you exported above. Get it by exporting it from KGpg then copy-paste the contents.
...Be very careful near line ends ... Unix vs DOS newline can be buggy here.
...The "~~" at the bottom, preceeded by two blank lines, is crucial!
Save as "nym create template".
...You can reuse it with edits for creating other nyms.
Click the PGP lock and signing icons.
......The mixnym server will only accept signed configuration requests.
Now click "Send" 
"PGP Enrypt to Recipients..." prompt will appear. 
...Choose the Nymserver key from the top pane then click "OK"
Enter your key passphrase when prompted to sign message.
After it finishes, you should see:

Code:

0 in message queue
0 in problem queue
2 sent

All mail sent!

If it worked, the next step is configuring QSA.
If it hangs, cancel out and go back through everything looking for errors.
Close QSL when you're done (and ignore the crash error that you may see).

You can't get a reply from the Nymserver until you configure QSA.


## Run QSA.
cd /home/user/.wine/drive_c/QS
wine qsa.exe

## Setup QSA.
Check: Create desktop shortcut... click "OK" 

If your Nymserver name and type is not listed you must add it first before you can add AAM subject lines encrypted to you.

Open Tools | Nymservers.
...New:
......Nymserver Domain: nymphet.paranoici.org.
......Type: Zax
...Click "OK" then "Done"
Open Tools | AAM Subject Lines.
...New:
...In AAM Subject Line Tab:
......Nym, select your nym's private-key".
......Subject (HSUB), use the one you set or "New Mail For Jude!" if you are following the example above.
...Click "OK" then "Done".
Only one AAM Subject Line can be configured to find your hsub. Be sure to enter it exactly as you did before or else QSA won't find it.
Click "Get Mail" from the main interface. Replies take a while.

## Clean-Up
rm -rf /home/user/www.quicksilvermail.net
rm QSLite*.zip
rm QSLite*.zip.sig
rm QSAam*.zip
rm QSAam*.zip.sig
rm /home/user/Desktop/"QuickSilver Lite.lnk"
rm /home/user/Desktop/"QuickSilver Aam.lnk"

From: Header Support

For a list of remailers that accept From: headers.^[124]

KVM GUI Instructions

No longer applies as we are now using vm xml templates for a standard configuration. The rest of the instructions for shared folders and spice have been moved into a readme file distributed with the images.

sudo apt-get update
sudo apt-get install virt-manager

Make sure folder /var/lib/libvirt/images/ exists.

sudo mkdir -p /var/lib/libvirt/images/

Do not use unxz! Extract the images using tar to /var/lib/libvirt/images/.

Before starting the new vm wizard we must create an internal isolated network that connects the workstation with the gateway.

Go to the VMM GUI --> Edit --> Connection Details --> Add button Choose Template:Project name as network name Edit subnet range to 10.0.0.2/24 Uncheck the dhcpv4 option Ignore anything to do with ipv6 Keep the default option of: Isolated Virtual Network selected and click finish.

The next steps may need more work to customize vm devices and clock to safe defaults. Work in this area not final.

Create a Template:Project name Gateway vm first and choose to edit it before installation. Customize the first NIC that is included to be in default NAT mode. Click to add hardware and chose another NIC. This new NIC must have the newly created isolated virtual network 'whonix' selected as the network device. Finalize and launch. Must enable disk controller as SATA Must select qcow2 as storage format.

Create Template:Project name Workstation vm and make sure you select the isolated int. network for the only NIC this machine has. Launch. Disk Controller works only with IDE Must select qcow2 as storage format

Don't forget to take snapshot.

Done!

-SPICE is enabled for graphics by default but needs a vdagent to be installed in the guest vms for accelerated 2D in vm to happen. Not included in workstation install by default which impacts performance greatly.

http://www.linux-kvm.org/page/SPICE

It should be safe for use unless you Adrelanos determine otherwise. 2D and 3D in VBox have an insecure architecture and even the manuals admit to this. 2D in VBox is not even available for anything but windows guests which is not recommended and insecure of course. Everything Linux based is designed from the ground up with security considerations in mind.

Clock disabling for vms on host is recommended. Still haven't done it yet, and it seems to need command line.

Enabling SPICE

SPICE allows accelerated graphics and clipboard sharing. Its implications for security are an open question that needs a detailed answer rather than a vague clear cut one.

1. Enable SPICE by selecting it from the VMM GUI. (It is the default option if you decide not select VNC when creating the VM).

Not enabling SPICE from the beginning, will prevent the spice channel device from being added which impacts performance. To fix this add a channel device and select SPICE. This steps is not necessary if you leave the defaults as they are at the beginning.

2. QXL is the GPU model that should be attached.

3. Install vdagent in guest and reboot.

.qcow file size too big?

Short:
It won't really take up 101 GB. Just ~ 2.6 GB. This is an issue with file managers, not Template:Project name.

Long:
^[125]

KVM Shared Folders

To move data between the guest and host follow these steps:

1. Set the following settings for shared folders in virt-manager:

The file sharing mode 'mapped' is just an example, using squash or passthrough is possible by selecting them from the drop down menu.

Driver:Default

Mode: Mapped

Source Path: [This is the path of the folder on the Host you are sharing with the Guest]

Target Path: [A custom tag for the shared directory that is used when running the mounting commands within the guest. for example: /tmpshare]

2. Run terminal as root in Guest then use the following command:

mount -t 9p -o trans=virtio [mount tag] [mount point] -oversion=9p2000.L

Mount tag is: /tmpshare

Mount point is the path of the directory that you will share in the Guest with the Host. If it doesn't exist you must create that folder.

Note: you replace the parentheses in the command, they are just a placeholder in this example and should not be typed in.

3. To automatically mount this every time at boot, add the following to your guest's /etc/fstab:

sudoedit /etc/fstab [mount tag] [mount point] 9p trans=virtio,version=9p2000.L,rw 0 0

cpfpy

Debugging start command.

sudo service control-port-filter-python start

Debugging stop command.

sudo service control-port-filter-python stop

To find any eventual leftovers, stale processes, try this.

ps aux | grep cpfpd

or

ps aux | grep python

On the gateway, talk to cpfpy directly.

telnet 10.152.152.10 9052

To check if the port is free, if cpfpy really has shut down.

sudo lsof -i :9052

COMMAND   PID       USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
cpfpd 27653 debian-tor    4u  IPv4  73153      0t0  TCP 10.152.152.10:9052 (LISTEN)

Footnotes

[1] http://wiki.qemu.org/Documentation/9psetup#Starting_the_Guest_using_libvirt Template:Reflist

VirtualBox Guest Additions

Introduction

Written and tested with Template:Project name 0.2.1 (Ubuntu precise). Many things can go wrong and none or the very least of them will be caused by Template:Project name. This has only limited support by the Template:Project name developers, because 1. it is not recommended for security reasons and 2. the guest additions related bugs and instructions are somewhat out of the scope of the Template:Project name project.

Installation is somewhat difficult and no packages exist. Just search the internet and you'll see, that loads of people having issues installing the VirtualBox guest additions. People having problems for years. VMware is of no alternative, people are also having trouble installing the VMware tools into Linux guests. The issue with the guest additions is ridiculous. For years no solution has been found. With each kernel update, recompilation is required, and quite often, due to some updates, complication becomes difficult or impossible for a long time.

Also see article, [VirtualBox Kernel Driver Is Tainted Crap].

If you are having trouble, than in most cases not because of Template:Project name. The Template:Project name setup is a regular Ubuntu Linux and VirtualBox. You can try asking the regular VirtualBox and Ubuntu resources if you have trouble.

TorChat source package

HowTo

EXPERIMENTAL Experimental as in it is difficult to install. Only use it in case you trust TorChat. There shouldn't be any anonymity leaks and it should be as safe as other onion services in general and in Template:Project name.

Learn about Onion Services in Template:Project name first and learn how to set up the hidden webserver. This will ease following this guide.

Open your /usr/local/etc/torrc.d/50_user.conf.

sudoedit /usr/local/etc/torrc.d/50_user.conf

Add.

HiddenServiceDir /var/lib/tor/torchat_service/
HiddenServicePort 11009 10.152.152.11:11009
HiddenServiceVersion 3

Save. Reload Tor.

sudo service tor reload

Install dependencies.

sudo apt-get install python python-wxgtk2.8

Get your onion address.

nano /var/lib/tor/torchat_service/hostname

Backup your key, if you want to ever restore it one another machine, a newer Template:Workstation product name or after hdd failure.

/var/lib/tor/torchat_service/private_key

Download the latest Python version of TorChat source code, for example as time of writing torchat-source-0.9.9.553.zip - Python source code (classic standalone 0.9.9 version) from (https://github.com/prof7bit/TorChat/downloads) and store it in /home/user.

Unpack.

unzip torchat-source-0.9.9.553.zip

Get into the torchat source folder. For example.

cd /home/user/torchat-source-0.9.9.553/

Get into the src folder.

cd src

Get into the Tor folder.

cd Tor

Rename tor.sh.

mv tor.sh backup_tor.sh

Go back to the src folder.

cd ..

Create torchat.ini.

nano torchat.ini

Add the following content.

[client]
listen_interface = 10.152.152.11 
listen_port = 11009
own_hostname = <your onion hostname without .onion>

[tor]
tor_server = 10.152.152.10
tor_server_control_port = 9154
tor_server_socks_port = 9154

[tor_portable]
tor_server = 10.152.152.10
tor_server_control_port = 9154
tor_server_socks_port = 9154

Make torchat executable.

chmod +x torchat.py

Run torchat.

./torchat

Alternative

After installing the dependencies we could also force install the torchat deb package.

sudo dpkg -i --force-depends torchat-0.9.9.553.deb

And then configure the files inside /home/user/.torchat. I don't know if that may be the better way.

Mixmaster

MX capable DNS resolver

No longer required.

Mixmaster needs to resolve MX DNS records, while Tor does not support that. We have to install a DNS resolver capable of doing that. It still comes with caveats.

Required knowledge:

Introduction chapter of Secondary DNS Resolver

The Example with CZ.NIC Labs DNS resolver worked in this case.

Security considerations when replacing the system wide DNS resolver:

The third party DNS resolver traffic goes through its own circuit, which is good.
All (custom installed) applications not configured to use a SocksPort (see [Stream Isolation]), would resolve their DNS through the system wide DNS resolver, which would be the third party resolver, giving too much power to it, because it is always the same, only one service provider, not changing like Tor circuits but static. ## Install Postfix ##

sudo apt-get install postfix ## configure postfix as sattelite system, default settings

Technical background: Mixmaster requires either - a) An (open) smtp server SMTPRELAY in /etc/mixmaster/remailer.conf. Unfortunately, I haven't found any open smtp server (search term: open relay). A mailserver where the user registers first would probably work, but this would defeat the original idea: sending e-mails without depending on registration. Or, - b) a mta (mail transfer agent), which speaks to the remailer directly. TODO: Are there enough Tor exit relays, which allow the SMTP port and does their ISP allow to speak SMTP? If there are too few servers, it could be bad for anonymity.

Open /etc/postfix/main.cf.

lxsudo mousepad /etc/postfix/main.cf

Replace the content with the following.

# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = host.localdomain
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = host, host.localdomain, localhost.localdomain, localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_command = 
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = loopback-only
inet_protocols = all

relayhost = 1.1.1.1
#relayhost = 2.2.2.2

Debugging Postfix

Looking into the mail log.

tail -f /var/log/mail.info

Should contain something like this.

<date> <time> debian postfix/pickup[id]: id2: uid=1000 from=<user>
<date> <time> debian postfix/cleanup[id]: id2: message-id=<id3.id4@host.localdomain>
<date> <time> debian postfix/qmgr[id]: id2: from=<user@host.localdomain>, size=30000, nrcpt=1 (queue active)
<date> <time> debian postfix/smtp[300]: id2: to=<remailer@breaka.net>, relay=mail.breaka.net[202.75.54.8]:25, delay=30, delays=0.30/0.01/30/3.0, dsn=2.0.0, status=sent (250 OK id=id5-id6-id7)
<date> <time> debian postfix/qmgr[id]: id2: removed

Reading local mail.

## Either with cli tool mail.
mail

## Or using gui tool Icedove (Debian version of Mozilla Thunderbird)
## using movemail.

If all went well, there will be no local mail. Only error messages result in local mails.

Bugs

In Template:Project name 0.4.5, due to a Tor Browser upstream bug (they forgot to update the changelog) and because the keyserver is/was down, the torbrowser and whonixcheck script in Template:Project name can no longer find out which Tor Browser version is locally installed. (Template:Project name Bug Report) The Update Tor Browser chapter contains a workaround and a fix is available for testers.

Attack matrix in different order

attack	TBB	TBB in a VM	Tails	Tails in a VM	Template:Project name Standard Download version host+vm+vm	Template:Project name Physical Isolation
(1) Protocol IP leak	fail	fail	fail	fail	safe	safe
(2) exploit + Unsafe Browser	fail	fail	fail	fail	safe	safe
(3) exploit + root exploit + Unsafe Browser	fail	fail	fail	fail	safe	safe
(4) root exploit + Unsafe Browser	fail	fail	fail	fail	safe	safe
(5) exploit + vm exploit + Unsafe Browser	fail	fail	fail	fail	fail	safe
(6) exploit + vm exploit + exploit against physically isolated Template:Gateway product name	fail	fail	fail	fail	fail	fail
(7) vm exploit	safe	fail	safe	fail	fail	safe
(8) vm exploit + exploit against physically isolated Template:Gateway product name	safe	fail	safe	fail	fail	fail
(9) exploit against Tor process	fail	fail	fail	fail	fail	fail
(10) attack against the Tor network	fail	fail	fail	fail	fail	fail

E-Mail Notification

Users, who have an (anonymous) sourceforge.net account, could go to the Template:Project name sf.net Project Page, scroll down to Update Notifications and hit the Subscribe to Updates button. They would receive notifications about new releases sent to their (anonymous) [E-Mail] address.

There is currently no way for users to subscribe to sf.net blogs or wiki, but such a feature has been requested.

Sourceforge.net E-Mail Notification

Didn't work reliable.

E-mail notification: For users having an account on sf.net, there is on sf.net git is an E-Mail subscribe button: M.

This is an example how such a mail could look like:

experimental: comment by adrelanos http://sourceforge.net/p/whonix/code/ci/a1740dfcd391cedfa625d72b990b2a587620df30/

experimental: Template:Workstation product name_packages: added gtk3-engines-oxygen by adrelanos http://sourceforge.net/p/whonix/code/ci/7375070a7986230028bf4e82a6ab3ecb420bfd60/

---

Sent from sourceforge.net because you indicated interest in https://sourceforge.net/p/whonix/code/

To unsubscribe from further messages, please visit https://sourceforge.net/auth/prefs/

Restrict Flash Settings

You can skip this chapter. It is no longer of use, because if you use BetterPrivacy as recommended above, you won't need this.

Flash applications can set cookies, so-called Local Shared Objects (LSO), independently of the browser's settings. These cookies are able to save data up to 100 Kb. Usually, they save settings but they may be used to track surfers as well.

In order to manage the settings of your Adobe Flash Player, Macromedia offers a Flash application on its website. There you may e.g. configure the rules concerning the data storage and the rights for using camera and microphone. The settings are spread over several flash applications. Deactivate all functions that allow sharing and saving of data. The storage of LSOs may be deactivated on the Global Storage Settings panel.

Hint: Only in case you previously deactivated JavaScript: You must have Javascript enabled for adobe.com and macromedia.com temporary to run the Flash application.

Furthermore, the cookies already saved have to be deleted. This functionality may be found on the Website Storage Settings panel.

Personal side note: you see how ridiculous that plugin is, if the usage of the Flash settings manager depends on their website being reachable.

Build Documentation dpkg-source commit

To dpkg commit changes, run the debian upstream tarball creation script.

./help-steps/make-debian-package-upstream-tarball

Then run.

dpkg-source --commit

When it asks "Enter the desired patch name:" just enter anything you wish, for example "buildconfig". In the following window, you don't have to fill out anything. Just save and close the editor. ^[126] You only have to do this once and won't be asked again to do this, unless you add another change which needs to be dpkg-source committed.

If you want to undo the dpkg-source committed change, check the contents of the .pc and the debian/patches folder and delete it.

Build Documentation - Override Template:Project name Version

Since the Template:Project name debian package version number is auto derived from git describe and used for [[Download#Template:Project name_Version_Check_and_Template:Project name_News|Template:Project name News]] download, it is recommended to override it. ^[127] You could add a file to buildconfig.d, for example buildconfig.d/50_version and add for example.

temp="$WHONIX_BUILD_CLOSEST_GIT_TAG"

## Using `export`, so whonix_shared/usr/share/whonix/chroot-scripts-post.d/70_log_build_version can read it.
export WHONIX_BUILD_WHONIX_VERSION_NEW="$(echo "$temp" | sed 's/-/./g')"

echo "WHONIX_BUILD_WHONIX_VERSION_NEW: $WHONIX_BUILD_WHONIX_VERSION_NEW"

WHONIX_BUILD_NEW_CHANGELOG_VERSION=""$WHONIX_BUILD_WHONIX_VERSION_NEW""-debpackage""$WHONIX_BUILD_NEW_DEB_REVISION_VERSION""

echo "WHONIX_BUILD_NEW_CHANGELOG_VERSION: $WHONIX_BUILD_NEW_CHANGELOG_VERSION"

While building, check if WHONIX_BUILD_NEW_CHANGELOG_VERSION looks sane. ^[128]

If you added a new file to buildconfig.d, for example buildconfig.d/50_target_arch, those have to be dpkg-source committed before building Template:Project name. Otherwise you'll get an error message. (Which looks like this:^[129]).

Template:Project name 0.5.6 Download Matrix

Version: Template:Version

Note: You need to download both Gateway and Workstation virtual machine images.

	Template:Gateway product name short	Template:Workstation product name	Anonymous Download possible ^[130]	Download Security without [[#Verify the Template:Project name images\|Verification]]	Download Security with [[#Verify the Template:Project name images\|Verification]]
	<html><a href="http://sourceforge.net/projects/whonix/files/whonix-</html>Template:Version<html>/Template:Gateway product name short.ova/download" target="_blank">Download</a></html>	<html><a href="http://sourceforge.net/projects/whonix/files/whonix-</html>Template:Version<html>/Template:Workstation product name short.ova/download" target="_blank">Download</a></html>	Yes ^[130]	Low ^[131]	High ^[132]
	<html><a href="/download/</html>Template:Version<html>-sig/Template:Gateway product name short.ova.sig">OpenPGP Signature</a></html>	<html><a href="/download/</html>Template:Version<html>-sig/Template:Workstation product name short.ova.sig">OpenPGP Signature</a></html>	Yes ^[130]	-	-
	Verify the images using the Signing Key		Yes ^[130]	-	-
^[133]	<html><a href="/download/</html>Template:Version<html>-torrent/Template:Gateway product name short.ova.torrent">Torrent Download</a></html>	<html><a href="/download/</html>Template:Version<html>-torrent/Template:Workstation product name short.ova.torrent">Torrent Download</a></html>	No	Medium ^[134]	High ^[132]
^[135]	<html><a href="magnet:?xt=urn:btih:fba5ace7a163afae54aa1677cf92540a38d5914c&dn=Template:Gateway product name short.ova&tr=http%3A%2F%2Fannounce.torrentsmd.com%3A6969%2Fannounce&as=http%3A%2F%2Fwebseed.whonix.org%3A8008%2FTemplate:Gateway product name short-0.5.6.ova">Magnet Link</a></html>	<html><a href="magnet:?xt=urn:btih:7255075def146b6f5d7b6e23121e1e5a5bedf13d&dn=Template:Workstation product name short.ova&tr=http%3A%2F%2Fannounce.torrentsmd.com%3A6969%2Fannounce&as=http%3A%2F%2Fwebseed.whonix.org%3A8008%2FTemplate:Workstation product name-0.5.6.ova">Magnet Link</a></html>	No	Medium ^[134]	High ^[132]
	Build from source code		See Build Anonymity	Excellent ^[136]

XChat

All XChat plugins have been deactivated (hardening) and moved to /usr/lib/xchat/plugins.disabled. If you really need a plugin, such as perl for SASL, you can use the example below.

sudo mv /usr/lib/xchat/plugins.disabled/perl.so /usr/lib/xchat/plugins/

Manually updating Tor Browser (Template:Project name 0.5.6)

(1) Go to https://www.torproject.org/ and/or http://idnxcnkne4qt76tg.onion/ and download the Tor Browser Bundle for Linux 32 bit. Store it in /home/user/.

(2) Read https://www.torproject.org/docs/verifying-signatures.html.en and/or http://idnxcnkne4qt76tg.onion/docs/verifying-signatures.html.en and learn about gpg verification.

(3) Go to https://www.torproject.org/docs/signing-keys.html.en and/or http://idnxcnkne4qt76tg.onion/docs/signing-keys.html.en to get the gpg keys.

(4) Verify the Tor Browser Bundle download.

(5) Go into /home/user/ with the file manger. (Dolphin)

(6) Extract the Tor Browser Bundle. Right click on the downloaded archive -> extract -> extract archive here.

(7) In case you downloaded another version than en-US, rename the tor-browser_lang folder to tor-browser_en-US. This is important, because the paths in the following script are hardcoded.

(8) Go into the /home/user/tor-browser_en-US folder.

(9) Delete start-tor-browser or move it to the /home/user/tor-browser_en-US/Docs folder.

(10) Create a new file within the /home/user/tor-browser_en-US/ folder called start-tor-browser with the following content.

#!/bin/bash
## {{project name}} Tor Browser start script

export TOR_SKIP_LAUNCH=1
    
cd ~
~/tor-browser_en-US/App/Firefox/firefox --profile ~/tor-browser_en-US/Data/profile
    
## End of {{project name}} Tor Browser start script

(11) Make the start-tor-browser script executable. Right click on start-tor-browser -> Properties -> Permissions -> enable the Is executable box -> ok.

(12) Go to /home/user/tor-browser_en-US/Data/profile/ and create a file user.js with the following content.

## Begin of patched user.js.

## If you edit this file while Firefox is running, your changes will be
## overwritten, when you close Firefox.

## How to create the user.js network settings:
## 1. Make a backup of prefs.js.
## 1. Start Tor Browser with the patched start script.
## 2. Apply proxy settings using the Tor Button settings dialog..
## 3. Make a diff from the old and the new pref.js.
## 4. Copy the relevant changes to user.js.

## network settings
## (Are now set in /etc/environment - or not...)
## (See /etc/environment.)
user_pref("extensions.torbutton.use_privoxy", false);
user_pref("extensions.torbutton.settings_method", "custom");
user_pref("extensions.torbutton.socks_host", "10.152.152.10");
user_pref("extensions.torbutton.socks_port", 9100);
user_pref("network.proxy.socks", "10.152.152.10");
user_pref("network.proxy.socks_port", 9100);
user_pref("extensions.torbutton.custom.socks_host", "10.152.152.10");
user_pref("extensions.torbutton.custom.socks_port", 9100);

## End of {{project name}} user.js.

(13) If you want to make 100% sure you never have Tor over Tor, you must shut down Template:Gateway product name while doing the following.

(14) Delete /home/user/my_tor-browser_en-US/App/tor.

(15) If there is no green Vidalia icon in the task bar, everything is fine.

(16) Start Tor Browser and run

ps aux | grep tor

If you see something like.

109 /usr/sbin/tor

Or.

/home/user/my_tor-browser_en-US/App/tor

Something went wrong and you're running Tor over Tor, which is recommended against.

(17) If the tests results are as expected, everything went fine.

(18) Don't forget to restart Template:Gateway product name, if you shut it down in step (13).

(19) Done.

DummyTor

Introduction

Template:Workstation product name has an empty Tor package installed by default, called Dummy Tor package. It contains no files, besides some default files^[137], which are required to create a dummy package. Debian packages are standard Unix ar archives, auditors can unpack and check them.

The reason for installing the Dummy Tor package inside Template:Workstation product name is to prevent installing the Tor package from the upstream (Debian or The Tor Project) repository, to prevent running Tor over Tor. This allows installation of packages, which depend on Tor, such as TorChat and parcimonie on Template:Workstation product name.

To prevent the package from upgrading

echo "tor hold" | sudo dpkg --set-selections

has been run while building Template:Project name from source code.

To check the status an auditor could run.

dpkg --get-selections | grep tor

To undo holding the packing a user could run.

echo "tor install" | sudo dpkg --set-selections

Implementation

Everything is inside the whonix_workstation/usr/local/share/whonix/dummytor/ folder in Template:Project name source code
and subsequently in /usr/local/share/whonix/dummytor/ in Whoix-Workstation.
.deb package format
/usr/local/share/whonix/dummytor/tor is the control file
/usr/local/share/whonix/dummytor/tor_1.0_all.deb is the package which was installed using dpkg by whonix_workstation/usr/local/share/whonix_internal_install_script.
whonix_workstation/usr/local/share/whonix/dummytor/dummytor is the "build script" for the package, which is actually only a single "equivs-build ./tor" command.

How it would look...

...if a Tor version higher than 1.0 was released.

sudo apt-get dist-upgrade

Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
The following packages have been kept back:
  tor

Tor Browser

FoxyProxy Sandboxing Warning

Tor Browser will soon ship with sandboxing on an opt-in basis. Unfortunately, the initial sandbox versions are incompatible with this configuration and it must not be enabled. ^[138] Users with AppArmor enabled may see Tor Browser profile warning messages. These messages can be safely ignored, since they do not prevent FoxyProxy functioning at this time.

Remove Proxy Settings - Template:Project name 0.5.6

It is best to get a fresh copy of Tor Browser, which has never been started before.

Template:Project name modifies user.js as documented in the [[Tor_Browser#Template:Project name_Proxy_Settings_.2F_user.js|Tor Browser chapter]].

Open /home/user/tor-browser_en-US_my/Data/profile/user.js.

kwrite /home/user/tor-browser_en-US_my/Data/profile/user.js

Comment out all network settings.^[139] ^[140]

## network settings
#user_pref("extensions.torbutton.use_privoxy", false);
#user_pref("extensions.torbutton.settings_method", "custom");
#user_pref("extensions.torbutton.socks_host", "10.152.152.10");
#user_pref("extensions.torbutton.socks_port", 9100);
#user_pref("network.proxy.socks", "10.152.152.10");
#user_pref("network.proxy.socks_port", 9100);
#user_pref("extensions.torbutton.custom.socks_host", "10.152.152.10");
#user_pref("extensions.torbutton.custom.socks_port", 9100);

You could use Tor Button's settings dialog to set it to any other proxy or transparent torification. The latter means "no proxy", which will result in Tor Browser using whatever the operating system provides and if you don't have a VPN installed inside Template:Workstation product name, it will go through Tor's TransPort.

If you are using the transparent torification option in Tor Button, you could point a socksifier to start-tor-browser and it should work as usual.

If you are having problems, it is most likely a problem with Tor Browser / Tor Button's proxy settings. In Tor Browser open the pseudo url "about:config" and search for "network.proxy" and check if these settings are sane.

Warning

Don't use Tor Browser's Internal Updater. For now. Use [[#Tor Browser Updater (Template:Project name)|Tor Browser Updater (Template:Project name)]]. More information below.

There are various update mechanisms. Not all are equally secure. Template:Project name recommends against using Tor Browser's internal updater for security reasons. ^[141] Using Tor Browser Updater (Template:Project name) is recommended. To enable you to distinguish them, here are some screenshots of the various updaters.

Forum Help Thread

Warning2

Don't this Tor Browser's internal updater. For now. Why? See #Warning. Below you see a screenshot of Tor Browser's Internal Updater.

Language

Method 4 - Command Line Parameter Method

Template:Workstation product name ONLY!

Currently broken. Will be fixed in Template:Project name 10.

Not a good method, because tb-starter would miss this setting.

~~Please TEST and leave feedback.~~

Available languages as in May 2014:

ar
de
en-US
es-ES
fa
fr
it
ko
nl
pl
pt-PT
ru
tr
vi
zh-CN

To check if further languages are supported visit https://www.torproject.org/dist/torbrowser/ or http://idnxcnkne4qt76tg.onion/dist/torbrowser/.

Syntax.

update-torbrowser --update --language <language code>

Example.

update-torbrowser --update --language vi

Replace "vi" with "zh-CN" for Chinese and so on.

Template:Project name 0.5.6 Disable Auto Login

4. adrelanos' homepage on torproject.org wiki

OPTIONAL. Only in case you want to do that.

If you aren't using Physical Isolation, i.e. if you use the Default-Download-Version (Virtual Machines), it is probably better to use the desktop locking mechanism of your host operating system.

These features are inherited from Debian and its packages.

1. On Template:Gateway product name and Template:Workstation product name

Open /etc/inittab:

sudoedit /etc/inittab

Look for:

## If you do not want this,
## comment in the next line and comment out the second one.

Below you'll see:

#1:2345:respawn:/sbin/getty 38400 tty1
1:2345:respawn:/sbin/getty --autologin user 38400 tty1

Change it to:

1:2345:respawn:/sbin/getty 38400 tty1
#1:2345:respawn:/sbin/getty --autologin user 38400 tty1

2. On Template:Workstation product name

Start Menu -> System Settings -> Login Screen -> Convenience -> Disable "Enable Auto Login"

Tor Browser in Template:Project name 0.5.6

Introduction

The regular Tor Browser Bundle and Tor Browser in Template:Project name slightly differ. Tor Browser has been slightly modified by Template:Project name to work behind the Template:Gateway product name. The network and browser fingerprint however, is the same.

Tor Browser's internal update check mechanism is untouched and works fine. Default homepage is untouched and still https://check.torproject.org.

New Identity Button

Note that, if you are using the Tor Browser, which comes with Template:Project name, that the New Identity button of Tor Button is defunct (greyed out). This is because Tor Button can not access Tor's control port. Due to Template:Project name Technical Design, Tor Browser and Tor are isolated from each other, which means there is no way to fix this without loosing the added security by Template:Project name.

When using the regular Tor Browser Bundle (not Whonix!), the New Identity button unlinks your old identity, changes your circuit (exit relay IP) and creates a fresh identity.

As a workaround close Tor Browser, change your circuit with Arm and start Tor Browser again.

This is not a big issue, since the New Identity button is not perfect yet anyway, there are open bugs.^[142]

(New Identity Button will be fixed in Template:Project name 6 and above.)

Template:Project name Proxy Settings / user.js

When running torbrowser -update, the update script creates a user.js file, for example ~/tor-browser_en-US/Data/profile/user.js. User.js is used to override some Tor Button defaults, namely the SocksProxy settings and other minor misc settings. ^[143] See also the Tor Browser sub chapter on the Stream Isolation page.

More than one Tor Browser in Template:Project name

For better isolation of different identities. For advanced users. Moved to the [[Advanced_Security_Guide#More_than_one_Tor_Browser_in_Template:Project nameAdvanced Security Guide]].

Manually updating Tor Browser

(1) Go to https://www.torproject.org/ and/or http://idnxcnkne4qt76tg.onion/ and download the Tor Browser Bundle for Linux 32 bit. Store it in /home/user/.

(2) Read https://www.torproject.org/docs/verifying-signatures.html.en and/or http://idnxcnkne4qt76tg.onion/docs/verifying-signatures.html.en and learn about gpg verification.

(3) Go to https://www.torproject.org/docs/signing-keys.html.en and/or http://idnxcnkne4qt76tg.onion/docs/signing-keys.html.en to get the gpg keys.

(4) Verify the Tor Browser Bundle download.

(5) Go into /home/user/ with the file manger. (Dolphin)

(6) If you still have the old version of TBB opened (because you are probably reading this from the old TBB), close it. (copy the next steps to Kwrite if necessary)

(7) Rename your old TBB /home/user/tor-browser_en-US to something else.

(8) Extract the Tor Browser Bundle. Right click on the downloaded archive -> extract -> extract archive here.

(9) In case you downloaded another version than en-US, rename the tor-browser_lang folder to tor-browser_en-US. This is important, because the paths in the following script are hardcoded.

(10) Go into the /home/user/tor-browser_en-US folder.

(11) Delete start-tor-browser or move it to the /home/user/tor-browser_en-US/Docs folder.

(12) Create a new file within the /home/user/tor-browser_en-US/ folder called start-tor-browser with the following content.

#!/bin/bash
## {{project name}} Tor Browser start script

export TOR_SKIP_LAUNCH=1
    
cd ~
~/tor-browser_en-US/App/Firefox/firefox --profile ~/tor-browser_en-US/Data/profile
    
## End of {{project name}} Tor Browser start script

(13) Make the start-tor-browser script executable. Right click on start-tor-browser -> Properties -> Permissions -> enable the Is executable box -> ok.

(14) If you want to make 100% sure you never have Tor over Tor, you must shut down Template:Gateway product name while doing the following.

(15) Delete /home/user/my_tor-browser_en-US/App/tor.

(16) If there is no green Vidalia icon in the task bar, everything is fine.

(17) Start Tor Browser and run

ps aux | grep tor

If you see something like.

109 /usr/sbin/tor

Or.

/home/user/my_tor-browser_en-US/App/tor

Something went wrong and you're running Tor over Tor, which is recommended against.

(18) If the tests results are as expected, everything went fine.

(19) Don't forget to restart Template:Gateway product name, if you shut it down in step (13).

(20) Done.

More than one Tor Browser in Template:Project name

WARNING: "More than one Tor Browser in Whonix" instructions have not been updated for TBB 3.x yet!

As the Warning page stated, [[Warning#Template:Project name_doesn.27t_magically_separate_your_different_contextual_identities | Template:Project name doesn't magically separate your different contextual identities]] and since Tor Browser and Tor Button do not yet solve this, for further separation of identities you could use [[Multiple Template:Workstation product name short|Multiple Template:Workstation product name]], which would be more secure.

Alternatively, less secure than Multiple Template:Workstation product name, you could start multiple instances of Tor Browser and run them through different SocksPorts. The instructions in the Manually Downloading Tor Browser article need minimal changes.

Instead of

#!/bin/bash
## {{project name}} Tor Browser start script

~/tor-browser_en-US/App/Firefox/firefox --profile ~/tor-browser_en-US/Data/profile

## End of {{project name}} Tor Browser start script

Use

#!/bin/bash
## {{project name}} Tor Browser start script

## Adjust the path!
~/tor-browser_2/App/Firefox/firefox --profile ~/tor-browser_2/Data/profile -no-remote

## End of {{project name}} Tor Browser start script

Only -no-remote was added to the start script. Otherwise Tor Browser would connect to the already running Tor Browser and this is not what you want. And don't forget to adjust the path to the other Tor Browser.

You also have to use a different SocksPort, see Change/Remove Proxy Settings. (See Stream Isolation page for explanation why you should use different SocksPorts.)

Trusting the key

Download the key from multiple sources

A simple technique to increase the trust you can put in the Template:Project name signing key would be to download it several times, from several locations, several computers, possibly several countries, etc.

You could also use this technique to compare keys downloaded by your friends or other people you trust.

Downloading the key from the same server only lowers the possibility of a man-in-the-middle attack for a part of the route. The following figure illustrates that best:

user <-> user ISP <-> internet <-> sourceforge.net ISP <-> sourceforge.net server
MITM less likely for this route |  no help for this route

For this reasons adrelanos' homepage, which describes and contains adrelanos' OpenPGP key is mirrored at six different places. Download adrelanos' key from all those places and store it as adrelanos1.asc, adrelanos2.asc, adrelanos3.asc, etc.

1. adrelanos' homepage on github; (key download)

Github.com is accessible over SSL. ^[144]

2. adrelanos' key page on sourceforge; (key download)

SSL available for users logged into sourceforge.net. ^[144]

3. adrelanos' homepage on gitorious; (key download)

Gitorious.org is accessible over SSL. ^[144]

SSL available. ^[144] Anyone can edit the torproject.org wiki and exchange content with malicious one. Therefore check the history feature. Obviously, I do trust Tor and torproject.org. My wiki account "proper" should be genuine, therefore changes by "proper" should be legit.

5. adrelanos OpenPGP key mirror on savannah.gnu.org profile page

SSL available. ^[144] The following command is recommended to enforce downloading the key over SSL:

## Not forced through Tor, unless you are using [[:Template:Project name]], torsocks or similar. curl --tlsv1.3 --output adrelanos.asc.4 https://savannah.gnu.org/people/viewgpg.php?user_id=89289

6. adrelanos' OpenPGP key mirror on OpenPGP keyserver

No SSL. Should really be only used as a mirror.

## Not forced through Tor, unless you are using {{project_name}}, torsocks or similar.
gpg --keyserver x-hkp://pool.sks-keyservers.net --recv-key 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA

7. adrelanos' OpenPGP key in Template:Project name 6 and above

gpg --import /usr/share/whonix/keys/whonix-keys.d/adrelanos.asc

Verify:

gpg --recv-key 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA

Should show.

pub   4096R/2EEACCDA 2014-01-16 [expires: 2015-01-16]
      Key fingerprint = 916B 8D99 C38E AF5E 8ADC  7A2A 8D66 066A 2EEA CCDA
uid                 [ unknown] Patrick Schleizer <adrelanos@riseup.net>
sub   4096R/0x3B1E6942CE998547 2014-01-16 [expires: 2015-01-16]
sub   4096R/0x10FDAC53119B3FD6 2014-01-16 [expires: 2015-01-16]
sub   4096R/0xCB8D50BB77BB3C48 2014-01-16 [expires: 2015-01-16]

Each time you re-import the key from a different source:

gpg --import adrelanos.asc 
gpg --import adrelanos1.asc 
gpg --import adrelanos2.asc 
...

It should always show:

gpg: key 2EEACCDA: "Patrick Schleizer <adrelanos@riseup.net>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

And:

gpg --fingerprint

Should always show the same fingerprint and only contain: (Besides keys you imported knowingly earlier, perhaps your friends keys.)

pub   4096R/0x8D66066A2EEACCDA 2014-01-16 [expires: 2015-01-16]
      Key fingerprint = 916B 8D99 C38E AF5E 8ADC  7A2A 8D66 066A 2EEA CCDA
uid                 [ unknown] Patrick Schleizer <adrelanos@riseup.net>
sub   4096R/0x3B1E6942CE998547 2014-01-16 [expires: 2015-01-16]
sub   4096R/0x10FDAC53119B3FD6 2014-01-16 [expires: 2015-01-16]
sub   4096R/0xCB8D50BB77BB3C48 2014-01-16 [expires: 2015-01-16]

Unless the new key is signed with the old key, something fishy is going on.

Template:Project name 7 Download Table (Deprecated)

Version: Template:Version

Note: You need to download both Gateway and Workstation virtual machine images.

	Template:Gateway product name short (1.2 GiB)	Template:Workstation product name (1.3 GiB)	Anonymous Download possible ^[130]	Download Security without [[#Verify the Template:Project name images\|Verification]]	Download Security with [[#Verify the Template:Project name images\|Verification]]
	<html><a href="http://mirror.whonix.org/Whonix-</html>Template:Version<html>/Template:Gateway product name short-</html>Template:Version<html>.ova" target="_blank">Download</a></html>	<html><a href="http://mirror.whonix.org/Whonix-</html>Template:Version<html>/Template:Workstation product name-</html>Template:Version<html>.ova" target="_blank">Download</a></html>	Yes ^[130]	Very Low ^[145]	High ^[132]
	<html><a href="http://sourceforge.net/projects/whonix/files/current/</html>Template:Version<html>/Template:Gateway product name short-</html>Template:Version<html>.ova/download" target="_blank">Download</a></html>	<html><a href="http://sourceforge.net/projects/whonix/files/current/</html>Template:Version<html>/Template:Workstation product name-</html>Template:Version<html>.ova/download" target="_blank">Download</a></html>	Yes ^[130]	Very Low ^[146]	High ^[132]
	<html><a href="https://jhcloos.com/whonix/7/Template:Gateway product name short-7.ova" target="_blank">Download</a></html>	<html><a href="https://jhcloos.com/whonix/7/Template:Workstation product name-7.ova" target="_blank">Download</a></html>	Yes ^[130]	Low ^[147]	High ^[132]
	<html><a href="/download/current/</html>Template:Version<html>-sig/Template:Gateway product name short-</html>Template:Version<html>.ova.asc">OpenPGP Signature</a></html>	<html><a href="/download/current/</html>Template:Version<html>-sig/Template:Workstation product name-</html>Template:Version<html>.ova.asc">OpenPGP Signature</a></html>	Yes ^[130]	-	-
	Verify the images using the Signing Key		Yes ^[130]	-	-
^[148]	<html><a href="/download/</html>Template:Version<html>-torrent/Template:Gateway product name short-</html>Template:Version<html>.ova.torrent">Torrent Download</a></html>	<html><a href="/download/</html>Template:Version<html>-torrent/Template:Workstation product name-</html>Template:Version<html>.ova.torrent">Torrent Download</a></html>	No	Medium ^[134]	High ^[132]
^[149]	<html><a href="magnet:?xt=urn:btih:405e051b5309fb66fd7ba9a04066936de64ce478&dn=Template:Gateway product name short-7.ova&tr=http%3A%2F%2Fannounce.torrentsmd.com%3A6969%2Fannounce&as=http%3A%2F%2Fwebseed.whonix.org%3A8008%2FTemplate:Gateway product name short-7.ova">Magnet Link</a></html>	<html><a href="magnet:?xt=urn:btih:13ec8c33dd9b58fe4e5120002dad7b4c683c2b78&dn=Template:Workstation product name-7.ova&tr=http%3A%2F%2Fannounce.torrentsmd.com%3A6969%2Fannounce&as=http%3A%2F%2Fwebseed.whonix.org%3A8008%2FTemplate:Workstation product name-7.ova">Magnet Link</a></html>	No	Medium ^[134]	High ^[132]
	Build from source code		See Build Anonymity	Very High ^[150]	Best ^[150] ^[151]

Template:Project name 7 OLD Known Issues

=== Connection Issues - Tor stops working after an Upgrade and needs a Workaround ===When upgrading to Tor 0.2.4.19-1~d79.jessie+1 (using sudo apt-get dist-upgrade), your Tor connection may go down. There is a temporary workaround.

Open /etc/default/tor.

## If you are using a graphical {{gateway_product_name}}, use:
kdesudo kate /etc/default/tor

## Or alternatively, if you are using a terminal-only {{gateway_product_name}}, use:
sudoedit /etc/default/tor

Scroll down, near bottom comment in (by removing the # in front of it).

USE_AA_EXEC="no"

Then try:

sudo service tor restart

You should keep that in mind and undo that change when Template:Project name or Tor fixes that bug. We'll keep you posted. (See Download#Stay_tuned and Security_Guide#Recommendation_to_install_latest_security_updates_on_all_systems.)

Forum help thread: Special:AWCforum/st/id287/new_tor_and_debian_updates_today....html

=== Virtual Box Shared Folder Issues ===Shared Folders aren’t working with the latest Linux kernel. (This is a Debian/Virtual Box issue, not caused by Template:Project name. Has already been reported to upstream by a Debian user.)

Possible workarounds, more information, etc. can be found in the Template:Project name User Help Forum discussion thread: Special:AWCforum/st/id261/VirtualBox_shared_directories_on....html

=== Tor Browser Starter (Template:Project name) ===After manually upgrading Tor Browser (see above)... To start Tor Browser, got to your /home/user/tor-browser_en-US folder and double click start-tor-browser. Or type in terminal (Konsole).

/home/user/tor-browser_en-US/start-tor-browser

=== Tor Browser Updater (Template:Project name) ===Currently broken due to changes by torproject.org. You have to manually update Tor Browser in meanwhile.

Forum help thread: Special:AWCforum/st/id262/updating_TOR_browser_error...html

=== Enigmail Encryption ===When using OpenPGP encryption in Thunderbird / Enigmail you might get "encryption command failed".

Thunderbird has been updated in Debian Testing in meanwhile. Upgrade it.

sudo apt-get update
sudo apt-get dist-upgrade

You should then install enigmail as usual:

sudo apt-get install enigmail

=== Defunct Desktop Shortcuts ===The desktop shortcuts Tor Browser, Contribute, Forum, Documentation, Donate won't work until there is an upgrade of Template:Project name. Please manually visit these pages. How to start Tor Browser has already been explained above.

Template:Gateway product name: Err: http://deb.torproject.org tor-0.2.4.x-jessie/main i386 Packages 404 Not Found

Short answer:
Update and upgrade your underlying Debian system (Template:Project name is a derivative of Debian).

sudo apt-get update
sudo apt-get dist-upgrade

See also Security_Guide#Recommendation_to_install_latest_security_updates_on_all_systems. This bug will be fixed with next Template:Project name upgrade (will take some time). No other action strictly required for now.

Long answer:
This is because torproject deprecated that repository. That was to be expected. The repository we're using now is already preconfigured (in /etc/apt/sources.list.d/torproject.list).

Taking action is not important at this stage. You can comment it out (by putting a # in front of it) in /etc/apt/sources.list.d/torproject.list if you want. (kdesudo kate /etc/apt/sources.list.d/torproject.list for graphical Template:Gateway product name or sudoedit /etc/apt/sources.list.d/torproject.list for terminal-only Template:Gateway product name) If you don't do it, it will be auto fixed with next upgrade of Template:Project name.

There is no public key available for the following key IDs

The message "There is no public key available for the following key IDs" is not necessarily an error. It might be just a warning/information.

sudo apt-get update
...
Reading package lists... Done
...
W: There is no public key available for the following key IDs:
9C131AD3713AAEEF

Check the exit code of apt-get.

echo $?
0

When it is 0, there is no problem. This is due to key transition, because Template:Project name repository is currently signed with the old and the new signing key.

Reasons for Staying Anonymous Developer

Security and trust shouldn't depend on showing a face:

Tails (w)

KVM

Convert

Converting is only required if you want to use the stable version of Template:Project name. No longer required for testers-only versions, see:
https://www.whonix.org/blog/category/testers-wanted/

1. Extract the downloaded Template:Project name ova images to obtain the VMDK virtual storage files.

tar -xvf ~/{{project_name_short}}.ova

As of now, VMDK files cannot be directly used by KVM or converted to a file type supported by KVM.

VBoxManage clonehd --format VDI vmdk_file vdi_file

(You need to adjust the names vmdk_file and vdi_file.)

2. Use qemu-img to convert the vdi to qcow2. Why qcow2? Because it supports snapshotting, which is very useful for reverting Template:Workstation product name to a known clean state. You must not revert gateway snapshots of the gateway vm as that will change your guard nodes which is not good for anonymity. This would increase your chances of having a rogue guard node and exit.

qemu-img convert -p -O qcow2 ~/whonix.vdi ~/whonix.qcow2

System Requirements

- - Lucid has been reported, not to work. Since it is only supported until 2013-04 it won't be fixed.

Mirror

| {{GrayBackground}}| [[File:SSL_Symbol.png|40px]] {{Anchor|signature}}
| <html><a href="https://jhcloos.com/whonix/{{project_name_short}}-</html>{{VersionNew}}<html>/{{gateway_product_name_short}}-</html>{{VersionNew}}<html>.ova" target="_blank">Download</a></html>
| <html><a href="https://jhcloos.com/whonix/{{project_name_short}}-</html>{{VersionNew}}<html>/{{workstation_product_name}}-</html>{{VersionNew}}<html>.ova" target="_blank">Download</a></html>
|{{Yes}} <ref name=anonymousdownload />
| style="background-color: {{Red}}"| Low <ref>[[Warning#Man-in-the-middle_attacks|Man-in-the-middle attacks]] could poison the download.</ref>
| style="background-color: {{Green}}"| High <ref name=openpgpverification>It does not matter if you did the bulk download over an insecure channel, if you use OpenPGP verification at the end.</ref>
|- style="height: 47px"

Magnet Link

| {{GrayBackground}}| [[File:Magnet_icon.svg.png|20px]] <ref>Magnet link clients known to work: gtk-gnutella. Check this [https://en.wikipedia.org/wiki/Magnet_URI_scheme#Clients_table clients table]. If nobody is [http://wiki.answers.com/Q/What_are_seeders_and_leechers seeding] at the time, only clients with the [https://en.wikipedia.org/wiki/Magnet_URI_scheme#Normal_.28as.29 "as"] feature can be used, because we are providing a [https://en.wikipedia.org/wiki/BitTorrent#Web_seeding webseed].</ref>
| <html><a href="magnet:?xt=urn:btih:b8969f87015c994f2c4dd93b3ed7c62861c27477&dn={{gateway_product_name_short}}-8.ova&tr=http%3A%2F%2Fannounce.torrentsmd.com%3A6969%2Fannounce&as=http%3A%2F%2Fwebseed.whonix.org%3A8008%2F{{gateway_product_name_short}}-8.ova">Magnet Link</a></html>
| <html><a href="magnet:?xt=urn:btih:7a6a5294ebebef5e5edcb05aa2caf66ebaeaf300&dn={{workstation_product_name}}-8.ova&tr=http%3A%2F%2Fannounce.torrentsmd.com%3A6969%2Fannounce&as=http%3A%2F%2Fwebseed.whonix.org%3A8008%2F{{workstation_product_name}}-8.ova">Magnet Link</a></html>
|{{No}}
| style="background-color: {{Yellow}}"| Medium <ref name=atleastssl />
| style="background-color: {{Green}}"| High <ref name=openpgpverification />
|- style="height: 47px"

Download / Snapshot

Take a snapshot for both Template:Gateway product name and Template:Workstation product name on VirtualBox. So you can easily restore the original snapshot whenever you need a clean state.

Mediawiki Install

Get and install the mediawiki web app.

sudo su
cd /var/www
wget http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.3.tar.gz
tar -xvzf mediawiki-1.22.3.tar.gz
mv mediawiki-1.22.3 wiki

Start iceweasel.

Setup mediawiki. Go to http://127.0.0.1/wiki/mw-config/index.php.

Use the following settings.

Database name: wiki
Datebase password: what you remembered above
No more questions.
Otherwise use the defaults.
Name of wiki:
Whonix

Download LocalSettings.php, safe as /home/user/LocalSettings.php.

Tor Browser Recommended

When you start Tor Browser Recommended, there is a shortcut on the desktop, see , it will open both Template:Project name News Blogs in a privacy friendly way.

I2P

Clock Skew Issues

Template:Project name 9:
Should have no issues.

In Template:Project name 8:
I2P-0.9.11 this doesn't work - I2P complains about clock skews even after disabling both sdwdate and bootclockrandomization.

sudo service sdwdate stop
sudo chmod -x /etc/init.d/sdwdate

It is still possible to fix the clock manually. For example, if I2P reports a clock skew of 60 seconds at startup, use this command to change system time:

sudo date -s now-60sec

then restart I2P.

However, time sync management in Template:Project name is a complex issue, so before changing the default way of time management in Template:Project name, make sure to read Dev/TimeSync and understand the implications.

old known issues

gpg keyserver unreachable

Open gpg.conf.

kwrite ~/.gnupg/gpg.conf

Search for all instances of "keyserver". And comment them out, i.e.

#keyserver ...

Add a functional keyerver at the bottom. In Template:Project name 9 we will be using the following one as default.

keyserver hkp://qdigse2yzvuglcix.onion

libtorsocks Warning

During running apt-get dist-upgrade, you may see a warning similar to the following one.

15:36:37 libtorsocks(12225): sendmsg: Connection is a UDP or ICMP stream, may be a DNS request or other form of leak: rejecting.
Cannot talk to rtnetlink: No such file or directory
acpid: error talking to the kernel via netlink

Sounds scary, but is of no concern. See footnote for technical explanation. ^[152]

No Network after Upgrade to Template:Project name 12

If whonixcheck fails with "tor.pid does not exist" after upgrade from Template:Project name 11 to Template:Project name 12...

On your Template:Gateway product name. And on your Template:Workstation product name.

Make sure /etc/network/interfaces looks like this.

# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

(The comments starting with # are actually not important. You can skip them if you wish.)

Open file /etc/network/interfaces in an editor with administrative ("root") rights.

Select your platform.

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.

Open the file with root rights.

sudoedit /etc/network/interfaces

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.
Template requirement: When using Qubes-Whonix, this must be done inside the Template.

Open the file with root rights.

sudoedit /etc/network/interfaces

Notes.

Shut down Template: After applying this change, shut down the Template.
Restart App Qubes: All App Qubes based on the Template need to be restarted if they were already running.
Qubes persistence: See also Qubes Persistence
General procedure: This is a general procedure required for Qubes and is unspecific to Qubes-Whonix.

Notes.

Example only: This is just an example. Other tools could achieve the same goal.
Troubleshooting and alternatives: If this example does not work for you, or if you are not using Whonix, please refer to Open File with Root Rights.

Open the file with root rights.

sudoedit /etc/network/interfaces

Then make sure /etc/network/interfaces.d/30_non-qubes-whonix looks like this:

Forum discussion:
whonixcheck fail: tor.pid does not exist after upgrade from Template:Project name 11 to Template:Project name 12

Upgrade from Testers repository

Template:Project name testers-only repository contains a fix. If you like to volunteer as a tester, see Project-APT-Repository on how to [[Project-APT-Repository#Change_Template:Project name_APT_Repository|enable]] it, so this change can move soon into Template:Project name stable repository. After enabling it, upgrade.

VirtualBox spoof the initial virtual hardware clock offset

Moved back to Advanced_Security_Guide#Spoof_the_Initial_Virtual_Hardware_Clock_Offset.

Physical Isolation

Install Basic Packages

This step is only required up to and including Template:Project name 8. Versions higher than Template:Project name 8 do not require this manual step anymore.

Make sure you have all packages installed which are listed in the file grml_packages. You can do that using the following command.

sudo apt-get install $(grep -vE "^\s*#" grml_packages | tr "\n" " ")

Why was Template:Project name 7 based on Debian Testing, not Debian Stable?

Contains python-stem, which is a Tor controller library. It is in use to ask for Tor's bootstrap status. This is required for whonixcheck (diagnosing connection issues) and TimeSync (TimeSync starts as soon as Tor is bootstrapped). See this ticket for more details. The alternative, uploading python-stem to Template:Project name APT Repository is not doable given Template:Project name contributor size. (It would require keeping up with the original package and updating when they update. And implementing the feature, allowing builders to build Template:Project name from source code without touching Template:Project name APT repository for Trust reasons would also have been more difficult.)
Being based on stable and incorporating a few packages from testing is difficult, see this ticket for details.
Contains build dependency config-package-dev with debhelper support. (We could probably build on stable and just get the config-package-dev with debhelper support elsewhere, but it is simpler just to require Debian testing as build operating system.
Stable (Wheezy) contains only obfs2 (obfsproxy 0.1.4), while Testing (Jessie) contains obfs3 (obfsproxy 0.2.3), and obfsproxy has been recently removed from torproject's apt repository.

Template:Project name 9 OLD Issues

KEYEXPIRED Error

You might see this error when attempting to update existing Template:Project name versions (build version 9.4 and below.)

W: GPG error: http://sourceforge.net wheezy Release: The following signatures were invalid: KEYEXPIRED 1421449064 KEYEXPIRED 1421449064 KEYEXPIRED 1421449064 KEYEXPIRED 1421449659 KEYEXPIRED 1421449659 KEYEXPIRED 1421449064 KEYEXPIRED 1421449064 KEYEXPIRED 1421449064 KEYEXPIRED 1421449659 KEYEXPIRED 1421449064 KEYEXPIRED 1421449064 KEYEXPIRED 1421449064 KEYEXPIRED 1421449659

To fix this issue, open a terminal

fpr="916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA"
gpg --recv-keys "$fpr"
gpg --fingerprint "$fpr" 
gpg --export "$fpr" | sudo apt-key add -

Then update your system as usual.

After that you will be able to update Tor Browser as well.

It will be fixed out of the box in Template:Project name 9.6 and above.

Forum support thread:
https://forums.whonix.org/t/issue-t100-error-signatures-were-invalid-keyexpired-1421449064/810

Tor Browser Startup Issues

This has been fixed out of the box in Template:Project name 9.3 and above.

After the upgrade to Tor Browser 4.x, it can be no longer started.

Template:Project name stable repository contains a fix. Upgrade. After upgrading, reboot is required. ^[153]

Forum discussion:
https://forums.whonix.org/t/after-updating-to-tor-browser-4-0-browser-doesnt-start/599

Connection Issues - Tor stops working after an Upgrade and needs a Workaround

This is fixed in Template:Project name 9.2 above.

In Template:Project name 9... When upgrading to Tor 0.2.5.8-rc-1~d70.wheezy+1 (using sudo apt-get dist-upgrade) in Template:Project name 9, your Tor connection may go down. There is a workaround.

Open /etc/apparmor.d/local/system_tor.

## If you are using a graphical {{gateway_product_name}}, use:
kdesudo kate /etc/apparmor.d/local/system_tor

## Or alternatively, if you are using a terminal-only {{gateway_product_name}}, use:
sudoedit /etc/apparmor.d/local/system_tor

Scroll down until you see.

/usr/bin/obfsproxy rix,

Comment out (by adding a # in front of it).

#/usr/bin/obfsproxy rix,

Then reboot.

sudo reboot

You should keep that in mind. When Template:Project name fixes that bug, you'll get an interactive dpkg conflict resolution dialog. This is explained in Security Guide#Updates. Just choose to install the new /etc/apparmor.d/local/system_tor file then.

Forum discussion:
https://forums.whonix.org/t/after-last-apt-get-upgrade-gateway-doesnt-connect-to-tor-anymore/532

AppArmor Warning during Boot

If you wonder during boot about following warning.

Warning /etc/apparmor.d/... network rules not enforced.

This is not a security issue. Template:Project name installs AppArmor and the apparmor-profiles package by default, but does not enforce AppArmor by default. We are not there yet and Debian also does not enforce AppArmor by default yet either. The apparmor-profiles package gets installed by default for better usability, to make enforcing AppArmor easier. This warning only reflects, that the profile is not enforced by default.

Forum discussion dovecot:
https://forums.whonix.org/t/apparmor-errors-functional-/628

Debian bug report:
please provide an option to hide or deactivate all the noisy, scary warnings during boot

VirtualBox Guest Additions

New Instructions for Debian Wheezy

Installation from Debian apt repository

Inside your VirtualBox virtual machine.

Very simple.

Searching^[154] for Debian packages containing VirtualBox was a wise thing. In past it was sometimes a real pain to install the guest additions. The search brought up, that honorable people created a debian package with the tools.

1. Update your operating system.

2. Install. Easy:

sudo apt-get install virtualbox-guest-x11

Advanced security? See footnote or skip: ^[155]

3. Reboot.

4. NOTE: Sometimes after reboot the Workstation guest fails to pick up a new resolution. Try to change the screen resolution manually a few times, from KDE settings. Once it succeeds to change to fullscreen, the change will stay persistent across reboots.

Installing using VirtualBox Instructions

Alternatively, above #Installation from Debian apt repository fails, which should not, you could also refer to the upstream documentation, VirtualBox: Chapter 4. Guest Additions.

Instructions for Debian Jessie

Template:Project name 10 is based on Debian Wheezy. So unless you are using a Template:Custom workstation product name based on Debian Jessie, you most likely want to use above instructions. Otherwise press expand on the right side.

Not sure if the jessie instructions are still up to date. Maybe the ones for wheezy also work for jessie just fine.

Inside your VirtualBox virtual machine.

This version is difficult to get working with guest additions and vbox shares. Debian Jessie has the issue that Template:Project name installs with Kernel 3.10 and the distro is at 3.12, and the 3.10 headers are not available. Therefore, it is dangerous (and unsafe) to get the Kernel headers on a different repository. Additionally, there are reports that updating the kernel can cause issues (and is also unsafe).

Noteː It has been reported that reverting Virtualbox 2 versions back with 3.10 can also solve issues. Update this wiki with your results.

Build Warnings

Short: Don't install apt-listchanges as custom package during VM image builds or don't have it installed during --target root builds.

Long: Because likely might change the build process from a non-interactive one to an interactive one. You're better off purging apt-listchanges.

sudo apt-get purge apt-listchanges

Alternatively, you could use a non-interactive frontend for apt-listchanges such as text. To do so, you would have to edit /etc/apt/listchanges.conf.

sudoedit /etc/apt/listchanges.conf

[apt]
frontend=text

After Template:Project name has been build, you're free to reinstall apt-listchanges.

Tor Browser

Change/Remove Proxy Settings

This is an advanced topic. You most likely only need it for advanced tunneling scenarios.

You could either:

Use Tor Button's -> Preferences to set it to any other proxy or no proxy. Transparent Torification means, "no proxy" or in other words it means "use whatever the system provides".

1) Click on Tor Button.
2) Click on Preferences.

3) Choose Transparent Torification.

4) Click OK.

For an alternative method, setting Transparent Torification which does not involve Tor Button's graphical user interface, see footnote ^[156].
Forget about Tor Button's -> Open Network Settings. See footnote, if you want to know why.^[157]

Grub Fix

Introduction

The following instructions differ for 686-pae and 486 kernel users.

Are you are 686-pae kernel kernel or 486 kernel user?

If you previously did not choose any options right after starting Template:Project name in the grub boot menu, if you don't know what this is about, then you're very likely a 686-pae Kernel User.
If you are used to picking the 486 kernel as per [[Starting_Whonix#Boot_Options|page Starting Template:Project name, chapter Boot Options]], then you already know, that you're a 486 Kernel User.

686-pae Kernel Users

Remove the 486 and 586 kernel meta packages.

sudo apt-get remove linux-image-*-486 linux-image-*-586

Remove the 486 and 586 kernel packages.

sudo apt-get remove linux-image-3.*-486 linux-image-3.*-586

Make sure a kernel is installed.

sudo apt-get install linux-image-686-pae

Proceed with #Install Grub chapter!

486 Kernel Users

Remove the 686-pae kernel meta packages.

sudo apt-get remove linux-image-686-pae

Remove the 686-pae kernel packages.

sudo apt-get remove linux-image-3.*-686-pae

Make sure a kernel is installed.

sudo apt-get install linux-image-486

Proceed with #Install Grub chapter!

Stream Isolation

Limited workarounds for Tor Browser

Possible

1. Weakest: On Tor Browser, click on the Torbutton and then click on "New Identity". However your current browser session will be lost.

2. Better: Install a second browser and configure it to use its own SocksPort, see [[Tor_Browser#More_than_one_Tor_Browser_in_Template:Project nameMore than one Tor Browser in Template:Project name]].

3. Even better: Use [[multiple Template:Workstation product name short]].

IsolateDestAddr and IsolateDestPort for Tor Browser (Recommended against!)

(Recommended against!) If you are interested anyway, see footnote ^[158].

Qubes

Torified dom0 Updates

Now in Qubes wiki.

Go to Qubes VM Manager -> System -> Global Settings. See the UpdateVM setting. Choose your desired Template:Gateway product name ProxyVM from the list. For example: sys-whonix.

Qubes VM Manager -> System -> Global Settings -> UpdateVM -> sys-whonix

^[159] ^[160]

[[Qubes-Whonix|Template:Q project name]] Gnome Workstation

OR, to install Workstation with complete Gnome applications that are installed in Qubes Fedora templates:
For Gnome, read security notes on Other Desktop Environments.

Input command:
sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-whonix-ws-gnome

2. Increase Update Size

The Gnome version of the Template:Workstation product name TemplateVM may be too large and will you need to increase the allowed update size to accommodate installing it.

In Dom0 -> Terminal:

Input command:
export UPDATES_MAX_BYTES=$[ 4 * 1024 ** 3 ]

AppArmor

At the moment, if you want to use this, you must apply these settings to the TemplateVMs as well as the TemplateBasedVMs. Once Qubes Q3 gets released, TemplateBasedVMs will inherit the kernelopts setting of their TemplateVM.

Edit Firewall Rules

2. Edit Template:Workstation product name Firewall Rules

In Dom0 » Qubes VM Manager:

Select Template:Workstation product name AppVM:
- Edit VM firewall rules:
  - Select: Deny network access except...
  - Disable: Allow ICMP traffic
  - Disable: Allow DNS queries
  - Disable: Allow connections to Updates Proxy
  - Press: OK

Misc

This guide will create a new instance of a Template:Gateway product name ProxyVM, which routes all internet traffic through Tor, that you can then connect your Template:Workstation product name AppVMs to.

You can repeat this guide multiple times and create as many Template:Gateway product name ProxyVM instances as you need, for greater Tor isolation. Note that using multiple Template:Gateway product name ProxyVMs simultaneously will reveal a pattern of connecting to multiple sets of Tor guard nodes, which may or may not be a unique usage indicator.

This guide will create a new instance of a Template:Workstation product name AppVM, which serves as an AnonVM application environment, that you connect to Tor through a Template:Gateway product name ProxyVM of yours.

You can repeat this guide multiple times and create as many Template:Workstation product name AppVM instances as you need, for greater Tor and data isolation. You can connect multiple Template:Workstation product name AppVMs to the same or different instances of Template:Gateway product name ProxyVMs.

If connecting this AppVM to the internet, you will need an existing Template:Gateway product name ProxyVM instance to connect to. You may need to [[Qubes/Create_Gateway_ProxyVMs|create a Template:Gateway product name ProxyVM]] before proceeding.

If you wish to keep your version of Template:Project name up-to-date you should also enable the Template:Project name Repository. You should apply this process to all of your Template:Project name TemplateVMs. In otherwords, make sure you follow these directions for both your Template:Gateway product name (commonly called whonix-gw) and Template:Workstation product name (commonly called whonix-ws).

When running the Template:Project name, Whonixcheck will automatically tell you if Debian package updates are available (Debian is the version of Linux that Template:Project name is built upon).

3. Enable Template:Project name repository

When first running a Template:Project name TemplateVM, a window called "Template:Project name Setup Wizard" should automatically pop up.

In Template:Project name Setup Wizard:

* Select "Yes. Automatically install updates from the {{project name}} team"
* Click <Next>
* Choose which {{project name}} Repository (recommended: {{project name}} Stable Repository)
* Click <Next> 
* Click <Finish>

To Manually Restart Template:Project name Repository Tool

You may also manually start the Template:Project name Repository Tool to change your settings in the future by doing the following from your respective Template:Project name TemplateVMs (i.e. Template:Workstation product name, Template:Gateway product name, etc.)

In a terminal:

sudo whonix_repository

Or by running:

Start Menu -> Applications -> System -> {{project name}} Repository.

You may need to first [[Qubes/Create_Gateway_ProxyVMs|create a Template:Gateway product name ProxyVM]] to use, if one does not exist yet.

Note: If you are installing Template:Project name on top of Qubes OS, you do not need to worry about disabling ICMP timestamps at this stage. You will do that after you install the Template:Gateway product name and Template:Workstation product name TemplateVMs when you create your Template:Project name VMs (done through the Qubes VM Manger). For more information on this, refer to the links provided under the Next Steps section (point's a and b) in the Install Guide for installing Template:Project name onto Qubes.

Template:Project name 10 TemplateVM Update

With the advent of Template:Project name 11, the update guide for Template:Project name 10 is now deprecated If you are still using Template:Project name 10, you are advised to install [[Qubes/Install|Template:Project name 11]] If you are still interested in updating Template:Project name 10, click on Expand on the right.

This guide explains how to update your Template:Project name TemplateVMs using the update repositories.

You should regularly apply this update process to all of your Template:Gateway product name and Template:Workstation product name TemplateVMs.

1. Attach Template:Project name TemplateVM to a Template:Gateway product name ProxyVM (commonly called sys-whonix)

You may need to first [[Qubes/Create_Gateway_ProxyVMs|create a Template:Gateway product name ProxyVM]] to use, if one does not exist yet.

In Dom0 » Qubes VM Manager:

Select Template:Project name TemplateVM » VM Settings » Basic tab » NetVM:
- Choose an existing Template:Gateway product name ProxyVM from the NetVM list for downloading updates.

2. Start Template:Project name TemplateVM

In Dom0 » Qubes VM Manager:

Select Template:Project name TemplateVM:
- Start selected VM

3. Launch TemplateVM Terminal

In Dom0 » Application Launcher Menu:

For your Template:Project name TemplateVM's launcher menu, click on the "Terminal" app to launch it.

4. Enable Template:Project name Repository

Qubes and Debian updates install by default. If you would also like to install Template:Project name updates this way, then ensure you have the Template:Project name repository enabled -- (or disabled if you prefer). This setting will remain in your TemplateVM for later. On first run of template you will be presented with the Template:Project name repository options, but you may change them at any time.

In Template:Project name TemplateVM » Terminal:

Input command: sudo whonix-setup-wizard repository
- Choose: Yes. Automatically install updates from the Template:Project name team.
- Press: OK
- Choose: Template:Project name Stable Repository (unless you are a tester or developer and understand what you are doing).
- Press: OK

5. Check and Install Updates

In Template:Project name TemplateVM » Terminal:

Input command: sudo apt-get update && sudo apt-get dist-upgrade -y

OR, You can right click the Template:Project name templateVM in Qubes Manager and select Update

6. Clear Terminal History

In Template:Project name TemplateVM » Terminal:

Input command: history -cw

7. Shutdown Template:Project name TemplateVM

In Dom0 » Qubes VM Manager:

Select Template:Project name TemplateVM:
- Shutdown selected VM

8. Restart/Update Template:Project name VMs

If new updates were available and installed, you will need to either simply restart your running Template:Gateway product name ProxyVMs and running Template:Workstation product name AppVMs for them to be updated -- or alternatively apply this same update process again to your running VMs if not wanting to restart them right away.

qubes-release package

In dom0, upgrade qubes-release to Qubes' dom0 current testing repository. ^[161]

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing qubes-release

Qubes R3.2 Only

In Qubes R3.2, users must manually update the TemplateVM setting for Template:Gateway product name vm and anon-whonix:

Qubes VM Manager -> sys-whonix -> right click -> VM settings -> Template -> Template:Whonix-gw -> OK
Qubes VM Manager -> anon-whonix -> right click -> VM settings -> Template -> Template:Whonix-ws -> OK

Download the Template:Project name Templates

Only the Qubes R3.2 version of Template:Project name requires manual downloading of templates with qubes-dom0-update, which downloads Template:Project name from Qubes' dom0 templates-community-testing repository.

Reinstall see footnote: ^[162]
Testers see footnote: ^[163]

Download Template:Gateway product name (Template:Whonix-gw) TemplateVM.

sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-[[:Template:Whonix-gw]]

Download Template:Workstation product name (Template:Whonix-ws) TemplateVM.

sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-[[:Template:Whonix-ws]]

Before installing

First you need to have the Qubes OS installed on your system. A helpful Installation Guide for Qubes OS 3.0 is found here

However, before installing Qubes OS on your system, after you have downloaded the Qubes ISO, make sure that you follow the Qubes OS security advice for verifying the signatures of the Qubes ISO found here

After you have Qubes OS up and running on your system, before you install Template:Project name you must next

Refer to the Computer Security Education chapters here and apply relevant steps.

Enigmail / gpg / keyserver

Since enigmail just calls gpg. And since everything is torified in Template:Project name anyway, and since gpg is stream isolated (by uwt wrapper) anyhow, there is no need for this setting in Template:Project name.

(Minor security notice: ^[164])

Source Code Verification Wheezy

git tag -v {{VersionNew}}-stable

git log --show-signature -1 "$(git rev-list --max-count 1 {{VersionNew}}-stable)"

Using Tor / Pluggable Transports from the Tor Browser Bundle

Untested!

Unfinished!

TODO:
Figure out and document below here how to use TBB as "system Tor" inside Template:Gateway product name. (ticket)

Install the Tor Browser Updater by Template:Project name developers (tb-updater). ^[165] ^[166] ^[167]

sudo apt-get install --no-install-recommends tb-updater

Create a new home folder for user debian-tor.

sudo mkdir /home/user/debian-tor

Fix permissions.

sudo chown --recursive debian-tor:debian-tor /home/user/debian-tor

Allow login as user debian-tor by modifying it is default shell false to /bin/bash.

sudo usermod debian-tor -s /bin/bash

Login as user debian-tor.

sudo su debian-tor

Change directory into /home/debian-tor. (Do not use ~. ^[168])

cd /home/debian-tor

Download and install Tor Browser.

update-torbrowser

Security warning: Do not start Tor Browser on Template:Gateway product name for any purpose other than configuring Tor. Use Template:Workstation product name to browse the web using Tor Browser.

Apply Template:Project name Tor config to TBB.

cp /usr/share/tor/tor-service-defaults-torrc /home/debian-tor/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults

TODO for developers:

Install tb-updater by default on Template:Gateway product name?
Install Tor Browser by default on Template:Gateway product name?

mv /home/debian-tor/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults /home/user/debian-tor

Eventual apparmor issues? Copy is better?

ln -s /usr/share/tor/tor-service-defaults-torrc /home/debian-tor/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults

Future work:
Simplify this setup for users by installing this by default. Ticket: make TBB usable as "system Tor", so latest pluggable transports and the tor-launcher graphical user interface can be used in Template:Project name

https | Template:Mirror nyud net | Template:Mirror tor2web org |

Infrastructure

File Hosting

Files are still hosted on sourceforge.net.

Negative:

No direct download links (hotlinking).
No SSL.
Advertisements.

Positive:

Unlimited quota and traffic. (Although we should remove old releases from time to time.)

Bug / Feature Request Tracker

Now hosted on github: https://github.com/Whonix/Whonix/issues

A bit suboptimal, since people have to create a second account just for github and it probably won't scale well enough in long term. Positive points are, that it works for many big projects such as Bitcoin and attracts a lot pull requests (for them). So let's see how that works.

Old Criteria and Plan for Web Hosting

Requirements for Good Hosting

Requirements

Some webspace and sufficient traffic.
Needs a wiki, a forum, a blog, a mailing list.
We can either use free project hosting or own hosting.
Tor friendly.
No tracking scripts. (Google analytics etc.)
Permit to sign up and to use the page exclusively over Tor.
A wiki on that site (media wiki). (And spoilers.) (And flagged revisions.)
A free SSL certificate.
All parts off the website reachable over SSL without any warnings.
- sourceforge.net does not offer that (SSL warnings).
- startssl.com offers free SSL certificates. You simply have to prove, that you have control over the domain - but that's not possible with subdomains.
Hosting and domain.
- Censor resistant in sense of "Template:Project name will not get deleted."
- Free - if that is possible. No one is willing to pay and in the beginning there are no donations.
We allow guest/anonymous postings (bug report, feedback, etc.) and moderate it very non-restrictive. (Allow any critique. Only delete off topic talk such as warez.)
- It is still desired to have the less critical parts of the wiki open for guest edits.
- Where no random trolls/crackers can modify anything important.
- A wiki where guest edits are allowed only works when having a feature for Flagged revisions Sighted versions, where admins review changes and manually make the edited version the default visible page for everyone. To my knowledge, only mediawiki has such a feature.

Answered Questions

Is there a free project hosting fulfilling all requirements?
- Last time checked, no.

Links, that may be helpful

Comparison of open source software hosting facilities

Ideal Hosting offers additionally...

We better don't choose something based in non-free countries, such as US.
Fully accessible by text mode browsers.
Fully accessible without JavaScript.
Optionally reachable by an onion service.

Reviewed Hosting Services

sourceforge.net

In past, all components of Template:Project name were hosted on sourceforge.net. Template:Project name still uses sourceforge.net as primary bulk file download service. Unfortunately, sourceforge does not provide direct download links (hotlinking).

The internal wiki, forum and the mailing list and download mirrors provided by sf.net provide unlimited traffic, which is very good.

The forum provided by sourceforge.net was not very well suited for Template:Project name. Most users are expected to post to the forums over Tor. sourceforge.net doesn't handle changing IP's very well. Registered users often had to post twice until their message got stored. And if they haven't stored their draft beforehand it was lost, which was really annoying. Positive points were, that the forum was viewable over SSL, but only for registered users. Let's say user's managed to successfully post a message, then it was still confusing because the message had to be manually moderated due to automatic spam scripts targeting Template:Project name forum. Sourceforges wiki was unfortunately not viewable over SSL, which was very bad.

sf.net generally provides two different categories of hosting. Allura with "some" SSL, i.e. the wiki, forum, mailing list, download mirrors on the other hand project web.

Project web (no SSL) has somewhat low limited traffic, but according to their support will be manually increased.

One of the major issues with sf.net is, that is does not support SSL everywhere. In past, the Contribute page contained a Vote chapter and one of the votes users are encouraged to, was Idea #721: Allow SSL for SourceForge pages whenever possible. Unfortunately, very few users voted.

A very strong point for sf.net is, that big files (virtual machine images) and unlimited traffic are allowed. Another strong one of course is, that sf.net allows Template:Project name to be hosted on sf.net.

Sourceforge.net blocks users from "Cuba, Iran, North Korea, Sudan, Syria".

Other severe usability bugs:

Google Code

Google Code blocks users from "Cuba, Iran, North Korea, Sudan, Syria".
No file downloads.

wikimedia / wikpedia

Last time we checked wikipedia (wikimedia) derivatives and wikia weren't Tor friendly.

savannah

https://savannah.nongnu.org (with SSL) looked promising and they are expected to be gone soon or to do any other stupid stuff (banning countries etc.).
They offer homepages, for example http://www.nongnu.org/qwe/ but seems like there are no subdomains (qwe.nongnu.org) with SSL (for nongnu.org). That's the minimum requirement.
Support direct download links (hotlinking).
Can't provide file hosting for Template:Project name, because it would cause too much traffic. ^[169]

github

Already using github as main git repository.
github.com offers sub domains, but they are not reachable over SSL.
github triggers a scary, error message. After either many pages trigger that error so it doesn't matter any more or until this message gets fixed in Tor Browser, we shouldn't use the github as issue tracker or website to avoid FUD. When that got somehow a non-problem, we could think about using github as issue tracker.
How autocreate table of contents using markdown on github? But...
Github also supports mediawiki syntax.
- Seems it automatically creates a table of contents, good!
- Bug: Mediawiki Pictures now shown in Github Wiki, unless this bug gets fixed, we could think about using the github source code hosting as website, see example.
- We haven't found out yet how to use \[\[include ref=WikiHeader\]\] for github mediawiki pages. It is an important feature for Template:Project name pages.
- Looks like mediawiki support is just a gimmick. More advanced formatting like font size, syntax highlighting and so on doesn't work.
No file hosting service.

gitorious

Nice as a git mirror. In use as a git mirror.
SSL for the whole page including the wiki.
The wiki supports less features, no html (not that important) and no tables. The side bar takes too much space and leaves too less page for the wiki. The wiki is more suited for smaller documentation but not as a whole website replacement like Template:Project name needs.
No file hosting service.

self hosted onion service

Adrelanos is not willing to do it.

free onion hosting service

We could host a website on third party (free) onion service webspace service.
Risky, because those services can go away any time without notice. - Looks like a valid risk, two just went down. ^[170]
Can they handle the load when we release a new version? Not talking about bandwidth. Just about page views.
Clearnet users could only access them through onion.to and tor2web.
- onion.to has a scary landing page.
- tor2web does not yet appear in search engines

mirror.fsf.org

http://mirror.fsf.org/
Providing direct download links (hotlinking).
Probably it will not be possible. They have a quite firm policy (Guidelines for Free System Distributions) and if Debian didn't manage to fulfill it, surely Template:Project name can't either.
In theory, an option could be to base Template:Project name on a distribution which is on their list already, but that might not be doable for technical reasons. (Questions open up, such as: Are they in sync with Debian unstable? Are they in sync with Debian testing? How long does it take until they deploy updates from security.debian.org? How up to date are their packages? How are they different from Debian?)
Template:Project name contacted FSF to be their list. Thes declined, because Template:Project name is not standalone. (Does not fulfill point "Complete Distros", since physical isolation users have to install Debian first.)

seul.org

Sent registration request for seul.org. They don't accept new registrations, but Roger Dingledine (surprise, surprise) said in private mail, he's seeding Tails already and would volunteer to seed Template:Project name, if there was an announcement mailing list or if we mailed him new releases. Doing this.

Conclusion

In summary there where no open source hosting sites, which offer SSL everywhere and unlimited download of big files. An open source hosting facility providing free webspace and SSL everywhere would be much desirable, but doesn't exist.

Hosting Services to be reviewed

General Questions

Download traffic?
Quota?
Direct download links (hotlinking) possible?
Optional: SSL downloads?

Mirror Providers

There are a few lists

of mirror providers. We could contact them and ask if there were willing to provide direct download links (hotlinking) (+SSL) for Template:Project name.

When they are able to sponsor sourceforge, in comparison, sponsoring Template:Project name would be only peanuts to them. The question is, if they provide service for individual requests.

codeplex

Seem to offer direct download links. Just stored some random download links to see how long the direct link is valid.
https://kinectmultipoint.codeplex.com/downloads/get/692328
http://download-codeplex.sec.s-msft.com/Download/Release?ProjectName=kinectmultipoint&DownloadId=692328&FileTime=130174287196930000&Build=20602

bitbucket

Seem to offer direct download links. Just stored some random download links to see how long the direct link is valid.
https://bitbucket.org/pypy/pypy/downloads
http://cdn.bitbucket.org/pypy/pypy/downloads/pypy-2.1-beta1-arm-armhf-raspbian.tar.bz2

autistici

https://vpn.autistici.org could be asked, if they were willing to act as webseed.

alioth

http://alioth.debian.org could be asked, if they accepted Template:Project name as a new project, related enough to Debian, then they might be used as webseed.

Links, that may be helpful

Comparison of open source software hosting facilities

Asked

http://linux.psu.ru/ linux at psu.ru
- November 2013: wants to test Template:Project name for a few months and then decide

November 2013: mirror.aarnet.edu.au
- asked where their sourceforge folder is
- and if they tell us: asked if we may use them as master mirror for other mirrors

November 2013: mirrorservice.org
- asked if we are allowed to directly download from them
- asked if we may use them as master mirror for other mirrors

Answer:

We have no problem with you direct linking to us or you suggesting other
sites using us to mirror from (we offer rsync too).

But bear in mind that the data in that mirror is controlled by
SourceForge. They don't ship all files to all mirrors - each mirror
specifies how much data it can take, and they put stuff on up to that
limit based on popularity (presumably). Their delivery mechanism knows
which files are on which mirrors, so end users don't get pointed at a
mirror that doesn't contain the file they're after.

So it is possible that we may not have a complete copy of all your files,
and it may change in the future without any intervention from us.

If you're happy with that situation then go ahead and link to us.

Answer to follow up email:

We don't have any upload facilities I'm afraid. We only offer downloads.

One solution is to run a private rsync server yourselves that only
certain mirrors can access. It doesn't have to be that quick.

You may find other mirrors do offer an upload facility though.

November 2013: switch.ch
- asked for an upload account
- asked for master rsync capabilities

Answer:

Dear Sir 

Thank you for your e-mail of 25th November 2013 regarding {{project_name}}. 

Sorry, we are not interested in your offer.

Forum Header

<center><b>Welcome to the new {{project name}} forums!</b></center>
<center><b>As part of the transition, everyone will have to reset their passwords, as they didn't come over in the transisition process. (<a href=https://forums.whonix.org/t/discourse-bug-report-thread/1612>forum thread</a>)</b></center>

Template:Project name APT Repository URI Sourceforge

To use the sourceforge location uri rather than mirror.whonix.de uri, use the following command line switch. Example.

sudo whonix_repository --baseuri http://sourceforge.net/projects/whonixdevelopermetafiles/files/internal/ --repository testers --enable

XChat

All HexChat plugins have been deactivated (hardening) and deactivated using dpkg-divert. To re-enable them, use one of the following commands depending on which plugin you need.

sudo dpkg-divert --rename --remove /usr/lib/xchat/plugins/python.so sudo dpkg-divert --rename --remove /usr/lib/xchat/plugins/tcl.so sudo dpkg-divert --rename --remove /usr/lib/xchat/plugins/perl.so

Those commands are reverted when Template:Project name Debian Packages get updated. TODO: Document how to prevent that.

VPN sysvinit

sysvinit: (Legacy. Prefer the systemd method below.) ^[171]

Repository Location URI

There are two repository location URI's.

mirror.whonix.de
- Default: yes. ^[172]
- Download speed: fast.
- Agility: After uploading new packages, it takes ~1 hour until all mirrors on the mirror.whonix.de mirror system upgraded.
- Target audience: most users.
sourceforge
- Default: no. ^[173]
- Download speed: slow.
- Agility: After uploading new packages, packages are available almost instantly.
- Target audience: developers, perhaps testers.

To use the whonix.org location uri rather than mirror.whonix.de uri, use the following command line switch. Example.

VPN DNS Configuration

Currently only manual.

Open file /etc/resolv.conf in an editor with administrative ("root") rights.

Select your platform.

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.

Open the file with root rights.

sudoedit /etc/resolv.conf

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.
Template requirement: When using Qubes-Whonix, this must be done inside the Template.

Open the file with root rights.

sudoedit /etc/resolv.conf

Notes.

Shut down Template: After applying this change, shut down the Template.
Restart App Qubes: All App Qubes based on the Template need to be restarted if they were already running.
Qubes persistence: See also Qubes Persistence
General procedure: This is a general procedure required for Qubes and is unspecific to Qubes-Whonix.

Notes.

Example only: This is just an example. Other tools could achieve the same goal.
Troubleshooting and alternatives: If this example does not work for you, or if you are not using Whonix, please refer to Open File with Root Rights.

Open the file with root rights.

sudoedit /etc/resolv.conf

Comment out.

#nameserver 10.152.152.10

Add.

## Riseup.net OpenVPN DNS server
nameserver 172.27.100.1

If you are not using riseup, you need to replace 172.27.100.1 and enter the virtual LAN IP address of your VPN providers DNS server. You might be able to obtain it from your VPN provider. You can also try to infer it after successfully connecting to the VPN from running "sudo route". The first destination default gateway should function as DNS server also.

Save.

If you want to be sure, that /etc/resolv.conf does not get overwritten by other packages. (Such as DHCP or resolvconf.)

sudo chattr +i /etc/resolv.conf

If you ever want to remove it, use -i.

(A more usable way is TODO research, help welcome. As possible starting point, see footnote. ^[174])

merged chroot-scripts

anon-shared-build-apt-sources-tpo

./packages/anon-shared-build-apt-sources-tpo/usr/lib/anon-dist/chroot-scripts-post.d/40_add_torprojects_key
./packages/anon-shared-build-apt-sources-tpo/usr/lib/anon-dist/chroot-scripts-post.d/50_update_tpo_package_list
./packages/anon-shared-build-apt-sources-tpo/usr/lib/anon-dist/chroot-scripts-post.d/60_install_deb.torproject.org-keyring

Details: Adds The Tor Projects's (TPO) APT repository to Anonymity Linux Distributions during build. - Useful, because TPO's repository sometimes contains better/more recent versions of Tor, obfsproxy, torsocks, etc.
Used by default in Template:Project name build script: Yes.
Negligible for Template:Project name installations from repository: Not essential, but probably better not neglected.
Convertible into postinst script: If you have any ideas? Running "apt-get update" to include TPO's repository while from within a maintainer script apt-get/dpkg is already running is not possible.
package: https://github.com/Whonix/anon-shared-build-apt-sources-tpo
script:

anon-gw-build-upgrade-tor

./packages/anon-gw-build-upgrade-tor/usr/lib/anon-dist/chroot-scripts-post.d/70_update_tor_and_obfsproxy

Details: Upgrading Tor on Anonymity Distributions from The Tor Project's APT repository, because that sometimes contains better/more recent versions of Tor.
Used by default in Template:Project name build script: Yes.
Negligible for Template:Project name installations from repository: Not essential, but probably better not neglected.
Convertible into postinst script: If you have any ideas? Requires that the #anon-shared-build-apt-sources-tpo chroot-script has been already applied. Running "apt-get install" from a maintainer script while dpkg/apt-get is running is impossible.
package: https://github.com/Whonix/anon-gw-build-upgrade-tor
script: https://github.com/Whonix/anon-gw-build-upgrade-tor/blob/master/usr/lib/anon-dist/chroot-scripts-post.d/70_update_tor_and_obfsproxy

anon-shared-build-upgrade-torsocks

./packages/anon-shared-build-upgrade-torsocks/usr/lib/anon-dist/chroot-scripts-post.d/70_update_torsocks

Details: Upgrading torsocks on Anonymity Distributions from The Tor Projects repository because that sometimes contains better/more recent versions of torsocks (which is required for Stream Isolation and by uwt.
Used by default in Template:Project name build script: Yes.
Negligible for Template:Project name installations from repository: Not essential, but probably better not neglected.
Convertible into postinst script: Same situation as #anon-gw-build-upgrade-tor.
package: https://github.com/Whonix/anon-shared-build-upgrade-torsocks
script: https://github.com/Whonix/anon-shared-build-upgrade-torsocks/blob/master/usr/lib/anon-dist/chroot-scripts-post.d/70_update_torsocks

anon-shared-build-ban-nonfree

./packages/anon-shared-build-ban-nonfree/usr/lib/anon-dist/chroot-scripts-post.d/75_vrms

Details: Check for nonfree packages during build of Anonymity Distributions to make sure none are installed - for legal reasons.
Used by default in Template:Project name build script: Yes.
Negligible for Template:Project name installations from repository: Up to you.
Convertible into postinst script: Probably not? For this script to have a chance of being effective, it must run after installation of all packages is done.
package: https://github.com/Whonix/anon-shared-build-ban-nonfree
script: https://github.com/Whonix/anon-shared-build-ban-nonfree/blob/master/usr/lib/anon-dist/chroot-scripts-post.d/75_vrms

anon-shared-build-inst-tb

./packages/anon-shared-build-inst-tb/usr/lib/anon-dist/chroot-scripts-post.d/70_torbrowser

Short description: installs Tor Browser during build
Details: Installs Tor Browser in Anonymity Linux Distributions during build using tb-updater. (Only interesting for own custom builds that are not supposed to be redistributed.)
Used by default in Template:Project name build script: No. [Used by qubes-template-whonix by default: Yes.]
Negligible for Template:Project name installations from repository: Yes.
Convertible into postinst script: Not required, because not used by default in Template:Project name build script and because for legal reasons it is best if users download TBB themselves.
package: https://github.com/Whonix/anon-shared-build-inst-tb
script: https://github.com/Whonix/anon-shared-build-inst-tb/blob/master/usr/lib/anon-dist/chroot-scripts-post.d/70_torbrowser

anon-shared-build-log-build-version

./packages/anon-shared-build-log-build-version/usr/lib/anon-dist/chroot-scripts-post.d/70_log_build_version

Details: Logs build version during build. TODO: Why important.
Used by default in Template:Project name build script: Yes.
Negligible for Template:Project name installations from repository: Ideally, no.
Convertible into postinst script:
package: https://github.com/Whonix/anon-shared-build-log-build-version
~~script: https://github.com/Whonix/anon-shared-build-log-build-version/blob/master/usr/lib/anon-dist/chroot-scripts-post.d/70_log_build_version~~ (Deprecated in Template:Project name 13. Replaced by anon-base-files postinst.)

flashproxy

Untested!
Might work. In short: just forget about it. ^[175]

Flash Proxy Bridges. This has NOTHING to do with Adobe Flash.

If you would like to see the unfinished documentation, please press on expand on the right.

Should work in Template:Gateway product name as well, but require some fiddling. See also Forum topic.

1. Set up a Port Forwarding from your Router to your Computer

https://trac.torproject.org/projects/tor/wiki/FlashProxyHowto#Settingupportforwarding

2. Enable port forwarding from your host operating system to Template:Gateway product name. Enter this command in a terminal on the host.

Qubes:

TODO

part of the solution might be:
https://www.qubes-os.org/doc/qubes-firewall/#tocAnchor-1-1-5

KVM:

TODO

VirtualBox:

VBoxManage modifyvm "[[:Template:Gateway product name short]]" --natpf1 "9000",tcp,127.0.0.1,9000,,9000

3. Modify Whonix-Gateway User Firewall Settings.

Note: If no changes have yet been made to Whonix Firewall Settings, then the Whonix User Firewall Settings File /usr/local/etc/whonix_firewall.d/50_user.conf appears empty (because it does not exist). This is expected.

Select your platform.

Graphical Whonix-Gateway

Start Menu → Applications → Settings → User Firewall Settings

Terminal Whonix-Gateway

In Whonix-Gateway, open the whonix_firewall configuration file in an editor.

sudoedit /usr/local/etc/whonix_firewall.d/50_user.conf

Qubes-Whonix

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway App Qube (commonly called sys-whonix) → User Firewall Settings

For more help, press on Expand on the right.

Note: This is for informational purposes only! Do not edit /etc/whonix_firewall.d/30_whonix_gateway_default.conf.

Note: The Whonix Global Firewall Settings File /etc/whonix_firewall.d/30_whonix_gateway_default.conf contains default settings and explanatory comments about their purpose. By default, the file is opened read-only and is not meant to be directly edited. Below, it is recommended to open the file without root rights. The file contains an explanatory comment on how to change firewall settings.

## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom configuration,
## which will override the defaults found here. When {{project_name_short}} is updated, this
## file may be overwritten.

To view the file, follow these instructions.

If using Qubes-Whonix, complete these steps.

Qubes App Launcher (blue/grey "Q") → Template: whonix-gateway-18 → Global Firewall Settings

If using a graphical Whonix-Gateway, complete these steps.

Start Menu → Applications → Settings → Global Firewall Settings

If using a terminal Whonix-Gateway, complete these steps.

In Whonix-Gateway, view the global firewall configuration file in an editor. nano /etc/whonix_firewall.d/30_whonix_gateway_default.conf

4. Add the following content.

GATEWAY_ALLOW_INCOMING_FLASHPROXY=1 FLASHPROXY_PORT=9000

5. Save.

6. Reload Whonix-Gateway Firewall.

Select your platform.

Graphical Whonix-Gateway

Start Menu → Applications → System → Reload Firewall

Terminal Whonix-Gateway

sudo whonix_firewall

Qubes-Whonix

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ProxyVM (commonly named sys-whonix) → Reload Firewall

7. Install flashproxy. ^[176]

sudo apt-get install flashproxy-client

8. Tor configuration file.

Open the file /usr/local/etc/torrc.d/50_user.conf in a text editor of your choice with administrative rights.

Sysmaint notice.

Ensure the VM has administrative (sudo / root) access first. See also sysmaint.

Platform specific. Select your platform.

Non-Qubes-Whonix

Requires booting into sysmaint session or unrestricted admin mode.

Graphical Whonix-Gateway USER Session

This is not possible.

Graphical Whonix-Gateway SYSMAINT Session

If you are using a graphical Whonix-Gateway booted into PERSISTENT Mode | SYSMAINT Session, take the following step.

System Maintenance Panel -> Open Terminal -> run /usr/libexec/gateway-shortcuts/torrc

Graphical Whonix-Gateway Unrestricted Admin Mode

If you are using a graphical Whonix-Gateway and enabled unrestricted admin mode, take the following step.

Start Menu -> System Tools -> Tor User Config

Terminal Whonix-Gateway

If you are using Whonix-Gateway with command line interface (CLI), take the following step. sudoedit /usr/local/etc/torrc.d/50_user.conf

Qubes-Whonix

Requires booting into sysmaint session or unrestricted admin mode.

Graphical Qubes-Whonix

If you are using Qubes-Whonix^™ with a graphical desktop, take the following step.

Qubes App Launcher (blue/grey "Q") -> Service -> Whonix-Gateway^™ ProxyVM (commonly named sys-whonix) -> Tor User Config

Terminal Qubes-Whonix

If you are using Qubes-Whonix^™ with a terminal, open a terminal in sys-whonix and run the following command.

sudoedit /usr/local/etc/torrc.d/50_user.conf

9. Add. ^[177]

UseBridges 1 # The address and port are ignored by the client transport plugin. Bridge flashproxy 0.0.1.0:1 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD Bridge flashproxy 0.0.1.0:2 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD Bridge flashproxy 0.0.1.0:3 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD Bridge flashproxy 0.0.1.0:4 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD Bridge flashproxy 0.0.1.0:5 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD # Change the second number here (9000) to the number of a port that can # receive connections from the Internet (the port for which you # configured port forwarding). ClientTransportPlugin flashproxy exec /usr/bin/flashproxy-client --register :0 :9000

10. Save.

11. Reload Tor.

After changing Tor configuration, Tor must be reloaded for changes to take effect.

Note: If Tor does not connect after completing all these steps, then a user mistake is the most likely explanation. Recheck /usr/local/etc/torrc.d/50_user.conf and repeat the steps outlined in the sections above. If Tor then connects successfully, all the necessary changes have been made.

If you are using Qubes-Whonix^™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Service → Whonix-Gateway^™ ProxyVM (commonly named 'sys-whonix') → Reload Tor

If you are using a graphical Whonix-Gateway, complete the following steps.

Start Menu → System Tools → Reload Tor

If you are using a terminal Whonix-Gateway, click HERE for instructions.

Complete the following steps.

Reload Tor.

sudo systemctl reload tor@default.service

Check Tor's daemon status.

sudo systemctl status tor@default.service

It should include a a message saying.

Active: active (running) since ...

In case of issues, try the following debugging steps.

Check Tor's config.

sudo -u debian-tor tor --verify-config

The output should be similar to the following.

Sep 17 17:40:41.416 [notice] Read configuration file "/usr/local/etc/torrc.d/50_user.conf".
Configuration was valid

12. Done.

scramblesuit

Quote intrigeri (Tails developer):

On tor-talk we've been told "You shouldn't prioritise ScrambleSuit because it is superseded by obfs4", and there are now pressing plans in the Tor Project to deprecate obfs2 and obfs3 in favour of obfs4. Hence rejecting this ticket, and focusing on #7980 [obfs4 support] instead.

Also see Tor Announcement under heading "obfs4 and scramblesuit"

ClientTransportPlugin obfs2,obfs3,scramblesuit exec /usr/bin/obfsproxy managed Bridge scramblesuit 141.201.27.48:420 gliberish password=more-gliberish

AppArmor issue. Probably not been reported anywhere yet.

audit: type=1400 audit(1439818522.818:9): apparmor="DENIED" operation="mkdir" profile="/usr/bin/obfsproxy" name="/var/lib/tor/pt_state/scramblesuit/" pid=11163 comm="obfsproxy" requested_mask="c" denied_mask="c" fsuid=106 ouid=106

Bridges

obfs3

Example of using obfs3 bridges: You cannot use the example bridge 141.201.27.48:420 below, because it is only an example. You still need to find your own bridges as explained in the section above, titled Finding a bridge and choosing the right protocol.

UseBridges 1 ClientTransportPlugin obfs2,obfs3 exec /usr/bin/obfsproxy managed bridge obfs3 141.201.27.48:420 4352e58420e68f5e40bf7c74faddccd9d1349413

obfs4

Example using obfs4 bridges.

You cannot use the example bridge 141.201.27.48:420 below, because it is only an example. You still need to find your own bridges as explained in the section above, titled Finding a bridge and choosing the right protocol. UseBridges 1 ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy managed bridge obfs4 161.217.177.95:10703 B3B8009D01BB7E5FDFAEC cert=4RaIqGiOytEXm6Hw iat-mode=0

CVE-2016-1252

Deprecated/CVE-2016-1252

Dev/Mirrors

Original discussion: https://github.com/Whonix/Whonix/issues/96

List of all mirrors.

dig mirror.whonix.de ANY +noall +answer

Test.

curl -H 'Host: mirror.whonix.de' -k http://109.230.212.53/whonixdevelopermetafiles/internal/news_v4/whonix_news.tar.xz.asc

issues

ssl support: https://phabricator.whonix.org/T145
onion support
lag until global dns is updated (when mirrors [temporarily] do not work)
lag after uploading files
cannot have any kind of download statistics
mirrors are less trusted than whonix.org server

Moving away from mirror network to whonix.org:
https://www.whonix.org/blog/upcoming-usability

Firejail

3. Optional - edit janondisttorbrowser.desktop in an editor with root rights.

Open file /usr/share/applications/janondisttorbrowser.desktop in an editor with administrative ("root") rights.

Select your platform.

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.

Open the file with root rights.

sudoedit /usr/share/applications/janondisttorbrowser.desktop

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.
Template requirement: When using Qubes-Whonix, this must be done inside the Template.

Open the file with root rights.

sudoedit /usr/share/applications/janondisttorbrowser.desktop

Notes.

Shut down Template: After applying this change, shut down the Template.
Restart App Qubes: All App Qubes based on the Template need to be restarted if they were already running.
Qubes persistence: See also Qubes Persistence
General procedure: This is a general procedure required for Qubes and is unspecific to Qubes-Whonix.

Notes.

Example only: This is just an example. Other tools could achieve the same goal.
Troubleshooting and alternatives: If this example does not work for you, or if you are not using Whonix, please refer to Open File with Root Rights.

Open the file with root rights.

sudoedit /usr/share/applications/janondisttorbrowser.desktop

4. Optional - prepend the Exec= line with "firejail"

   Exec=firejail torbrowser %u

Save and exit.

Note:

3. Optional - edit firefox-esr.desktop in an editor with root rights:

Open file /usr/share/applications/firefox-esr.desktop in an editor with administrative ("root") rights.

Select your platform.

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.

Open the file with root rights.

sudoedit /usr/share/applications/firefox-esr.desktop

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.
Template requirement: When using Qubes-Whonix, this must be done inside the Template.

Open the file with root rights.

sudoedit /usr/share/applications/firefox-esr.desktop

Notes.

Shut down Template: After applying this change, shut down the Template.
Restart App Qubes: All App Qubes based on the Template need to be restarted if they were already running.
Qubes persistence: See also Qubes Persistence
General procedure: This is a general procedure required for Qubes and is unspecific to Qubes-Whonix.

Notes.

Example only: This is just an example. Other tools could achieve the same goal.
Troubleshooting and alternatives: If this example does not work for you, or if you are not using Whonix, please refer to Open File with Root Rights.

Open the file with root rights.

sudoedit /usr/share/applications/firefox-esr.desktop

4. Optional - prepend the Exec= line with "firejail"

   Exec=firejail /usr/lib/firefox-esr/firefox-esr %u

Note: Instead of launching sand-boxed applications from the terminal, both Template:Project name and [[Qubes-Whonix|Template:Q project name]] users can edit the relevant .desktop file that launches a process and prepend the executable path with the firejail command. This process can be repeated with every .desktop application file if desired.^[178]

onionshare from git with Debian jessie

Developers only!

Preparation

You need newer control port filter / upgrade to Template:Project name 14 developers-only. You get it by upgrading to Template:Project name 14 developers-only.

Upgrade both Template:Gateway product name and Template:Workstation product name to Template:Project name 14 developers-only. For instructions see: [[Upgrading_Template:Project name_13_to_Template:Project name_14]]

Or use Template:Project name 13.0.0.1.4 developers-only from https://forums.whonix.org/t/whonix-13-0-0-1-4-developers-only/3486/3 or newer (if existing).

Configure Control Port Filter Proxy