ZeroNet: Decentralized Censorship-resistant Network

From Whonix
Jump to navigation Jump to search
ZeroNet Logo

About this ZeroNet Page
Contributor maintained wiki page.
Support Status unmaintained
Difficulty unknown
Contributor none
Support none

Combining Whonix with ZeroNet. ZeroNet over Tor. Connecting to Tor before ZeroNet.

User → Tor → ZeroNet → Internet

Deprecated Wiki Page[edit]

The original developer of ZeroNet disappeared approximately February 2021. [1] There is a continuation of the ZeroNet project in the form of a software forks like ZeroNetXarchive.org and ZeroNet-Conservancyarchive.org. [2] These are undocumented.

Introduction[edit]

The ZeroNet wiki describes the software design: [3]

ZeroNetarchive.org uses Bitcoin cryptography and BitTorrent technology to build a decentralized censorship-resistant network. Users can publish static or dynamic websites in ZeroNet and visitors can choose to also serve the website. Websites will remain online even if it is being served by only one peer.

This means users are not identified or reachable by an IP address, since they are identified by a public key - specifically a public Bitcoin address. The private key owner can sign and publish changes, which are propagated through the network. Sites are accessed through an ordinary browser in combination with the Zeronet application. [4] The BitTorrent technology refers to the use of trackers to negotiate peer connections. [5] ZeroNet can be optionally configured to use Tor for anonymity?

The Zeronet wiki describes various features and benefits, including: [3]

  • Password-less authorization - the user account is protected by the same cryptography that applies to Bitcoin wallets.
  • Easy setup. [6]
  • Immediate updating of sites in real time.
  • Works with any browser.
  • Full Tor network support, including onion services.
  • Content cannot be censored (removed) after publication.
  • It is impossible to shut down content, since content is served by any user who wishes to.
  • ZeroNet is fast and works offline.

Connecting to Tor before ZeroNet[edit]

These instructions lead to the following connection scheme in Whonix:

User → Tor → ZeroNet → Internet

Installation[edit]

This application requires incoming connections through a Tor onion service. Supported Whonix-Gateway™ modifications are therefore necessary for full functionality; see instructions below.

For better security, consider using Multiple Whonix-Gateway and Multiple Whonix-Workstation™. In any case, Whonix is the safest choice for running it. [7]

onion-grater Adjustments[edit]

Complete the following steps in Whonix-Gateway™ (sys-whonix).

Extend the onion-grater whitelist in Whonix-Gateway™ (sys-whonix).

On Whonix-Gateway.

Add onion-grater profile.

sudo onion-grater-add 40_zeronet

Modify Firewall Settings[edit]

Modify the Whonix-Workstation™ (anon-whonix) user firewall settings and reload them.

1. Modify Whonix-Workstation™ User Firewall Settings

Note: If no changes have yet been made to Whonix Firewall Settings, then the Whonix User Firewall Settings File /etc/whonix_firewall.d/50_user.conf appears empty (because it does not exist). This is expected.

If using Qubes-Whonix™, complete these steps.
In Whonix-Workstation App Qube. Make sure folder /usr/local/etc/whonix_firewall.d exists.

sudo mkdir -p /usr/local/etc/whonix_firewall.d

Qubes App Launcher (blue/grey "Q") → Whonix-Workstation App Qube (commonly called anon-whonix) → Whonix User Firewall Settings

If using a graphical Whonix-Workstation, complete these steps.

Start Menu → Applications → System → User Firewall Settings

If using a terminal-only Whonix-Workstation, complete these steps.

Open file /usr/local/etc/whonix_firewall.d/50_user.conf with root rights.

sudoedit /usr/local/etc/whonix_firewall.d/50_user.conf

For more help, press on Expand on the right.

Note: This is for informational purposes only! Do not edit /etc/whonix_firewall.d/30_whonix_workstation_default.conf.

The Whonix Global Firewall Settings File /etc/whonix_firewall.d/30_whonix_workstation_default.conf contains default settings and explanatory comments about their purpose. By default, the file is opened read-only and is not meant to be directly edited. Below, it is recommended to open the file without root rights. The file contains an explanatory comment on how to change firewall settings. 

## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom configuration,
## which will override the defaults found here. When {{project_name_short}} is updated, this
## file may be overwritten.

Also see: Whonix modular flexible .d style configuration folders.

To view the file, follow these instructions.

If using Qubes-Whonix, complete these steps.

Qubes App Launcher (blue/grey "Q") → Template: whonix-workstation-17 → Whonix Global Firewall Settings

If using a graphical Whonix-Workstation, complete these steps.

Start Menu → Applications → Settings → Global Firewall Settings

If using a terminal-only Whonix-Workstation, complete these steps.

In Whonix-Workstation, open the whonix_firewall configuration file in an editor. nano /etc/whonix_firewall.d/30_whonix_workstation_default.conf

2. Open required external ports.

Add.

EXTERNAL_OPEN_PORTS+=" 15441 " EXTERNAL_OPEN_PORTS+=" 33750 "

Save the file.

3. Reload Whonix-Workstation™ Firewall.

If you are using Qubes-Whonix™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Workstation App Qube (commonly named anon-whonix) → Reload Whonix Firewall

If you are using a graphical Whonix-Workstation, complete the following steps.

Start Menu → Applications → System → Reload Whonix Firewall

If you are using a terminal-only Whonix-Workstation, run. sudo whonix_firewall

Install Dependencies[edit]

Run the following commands in Whonix-Workstation terminal (Qubes-Whonix™: whonix-workstation-17 Template).

Update the package lists.

sudo apt update

Install dependencies. [8]

sudo apt install git python3-pip python3-msgpack

Retrieve the Signing Key[edit]

Run the following command in Whonix-Workstation terminal (Qubes-Whonix: anon-whonix AppVM).

Retrieve the ZeroNet signing key. [9]

  • Digital signatures: A tool enhancing download security. Commonly used across the internet.
  • Learn more: Curious? Learn more about digital software signatures.
  • Optional: Digital signatures are optional. If you've never used them before, there might be no need to start now.
  • No worries: New to digital software signatures? It's okay, no need to worry.
  • Not a requirement: Not mandatory for using Whonix, but an extra security measure for advanced users.

Securely download the signing key.

scurl-download https://zeronet.io/files/tamas@zeronet.io_pub.asc

Display the key's fingerprint.

gpg --keyid-format long --import --import-options show-only --with-fingerprint tamas@zeronet.io_pub.asc

Verify the fingerprint. It should show.

Note: Key fingerprints provided on the Whonix website are for convenience only. The Whonix project does not have the authorization or the resources to function as a certificate authority, and therefore cannot verify the identity or authenticity of key fingerprints. The ultimate responsibility for verifying the authenticity of the key fingerprint and correctness of the verification instructions rests with the user.

Key fingerprint = 960F FF2D 6C14 5AA6 13E8 491B 5B63 BAE6 CB96 13AE

The most important check is confirming the key fingerprint exactly matches the output above. [10]

warning Warning:

Do not continue if the fingerprint does not match! This risks using infected or erroneous files! The whole point of verification is to confirm file integrity.

Add the signing key.

gpg --import tamas@zeronet.io_pub.asc

Install ZeroNet[edit]

Run the following commands in Whonix-Workstation terminal (Qubes-Whonix: anon-whonix AppVM).

ZeroNet is not yet packaged for Debian, so it must be manually installed. [11] [12]

Download ZeroNet.

git clone https://github.com/HelloZeroNet/ZeroNet.git

Navigate to the ZeroNet folder.

cd ZeroNet

Check the ZeroNet signature.

git log --show-signature

Install dependencies of ZeroNet. There is currently no better way than using a third party repository and third party package manager pip. [13]

warning Security warning: Adding a third party repository and/or installing third-party software allows the vendor to replace any software on your system. Including but not limited to the installation of malware, deleting files and data harvesting. Proceed at your own risk! See also Foreign Sources for further information. For greater safety, users adding third party repositories should always use Multiple Whonix-Workstation™ to compartmentalize VMs with additional software.

Whonix default admin password is: changeme Documentation in the Whonix wiki provides guidance on adding third-party software from different upstream repositories. This is especially useful as upstream often includes generic instructions for various Linux distributions, which may be complex for users to follow. Additionally, documentation Whonix usually has a higher focus on security, digital software signatures verification.

The instructions provided here serve as a "translation layer" from upstream documentation to Whonix, offering assistance in most scenarios. Nevertheless, it's important to acknowledge that upstream repositories, software may undergo changes over time. Consequently, the documentation on this wiki might need occasional updates, such as revised signing key fingerprints, to stay current and accurate.

Please note, this is a general wiki template and may not apply to all upstream documentation scenarios.

Users encountering issues, such as signing key problems, are advised to adhere to the Self Support First Policy and engage in Generic Bug Reproduction. This involves attempting to replicate the issue on Debian bookworm, contacting upstream directly if the issue can be reproduced as such problems are likely unspecific to Whonix. In most cases, Whonix is not responsible for, nor capable of resolving, issues stemming from third-party software.

For further information, refer to Introduction, User Expectations - What Documentation Is and What It Is Not.

Should the user encounter bugs related to third-party software, it is advisable to report these issues to the respective upstream projects. Additionally, users are encouraged to share links to upstream bug reports in the Whonix forums and/or make edits to this wiki page. For instance, if there are outdated links or key fingerprints in need of updating, please feel free to make the necessary changes. Contributions aimed at maintaining the currentness and accuracy of information are highly valued. These updates not only improve the quality of the wiki but also serve as a useful resource for other users.

The Whonix wiki is an open platform where everyone is welcome to contribute improvements and edits, with or without an account. Edits to this wiki are subject to moderation, so contributors should not worry about making mistakes. Your edits will be reviewed before being made public, ensuring the integrity and accuracy of the information provided.

sudo python3 -m pip install -r requirements.txt

Launch ZeroNet[edit]

1. Launch the ZeroNet process.

Qubes-Whonix:

./zeronet.py --tor always --fileserver_ip $(qubesdb-read /qubes-ip)

Non-Qubes-Whonix:

./zeronet.py --tor always --fileserver_ip 10.152.152.11

2. Launch Tor Browser.

Start Tor Browser.

If you are using Qubes-Whonix™.

Qubes Start Menu → Whonix-Workstation™ AppVM (commonly called anon-whonix) → Tor Browser

If you are using Non-Qubes-Whonix.

Start Menu → Tor Browser

If you are using a terminal (Konsole).

torbrowser

3. Adjust Tor Browser's configuration.

Note: The following steps will no longer be required once Whonix releases a custom Tor Browser for connecting to alternative networks. [14]

Configure Tor Browser to connect to localhost.

Warning:

  • This step changes the web fingerprint of Tor Browser!
  • Leave all other settings as is!

In Tor Browser:

  1. Type about:config into the URL bar.
  2. Press Enter
  3. Search for network.proxy.no_proxies_on
  4. Set to 0
  5. Search for network.proxy.allow_hijacking_localhost
  6. Set to false

4. Navigate to the ZeroNet web interface.

Paste http://127.0.0.1:43110 The Web Archive into Tor Browser's URL field and press Enter. For additional tips on visiting sites, see: How does it work?archive.org

The process is now complete and ZeroNet should be fully functional in Whonix. [15]

Figure: ZeroNet Homepage in Whonix

Popular ZeroNet Sites[edit]

Some popular ZeroNet sites include: [16]

ZeroHello: http://127.0.0.1:43110/1HeLLo4uzjaLetFx6NH3PMwFP3qbRbTf3Darchive.org

The homepage of ZeroNet.

ZeroMail: http://127.0.0.1:43110/1MaiL5gfBM1cyb4a8e3iiL8L5gXmoAJu27archive.org

End-to-end encrypted, distributed, P2P messaging site. To improve privacy it uses a BitMessage-like solution and will not expose the message recipient.

ZeroBlog: http://127.0.0.1:43110/1BLogC9LN4oPDcruNz3qo1ysa133E9AGg8archive.org

Self publishing blog demo.

ZeroTalk: http://127.0.0.1:43110/1TaLkFrMwvbNsooF4ioKAY9EuxTBTjipTarchive.org

Decentralized, P2P forum demo.

ZeroMe: http://127.0.0.1:43110/1MeFqFfFFGQfa1J3gJyYYUvb5Lksczq7nHarchive.org

Decentralized, Twitter-like P2P social network.

ZeroChat: http://127.0.0.1:43110/1AvF5TpcaamRNtqvN1cnDEWzNmUtD47Npgarchive.org

The finished site for the tutorial of creating a server-less, SQL backed, real-time updated P2P chat application using ZeroNet in less than 100 lines of code.

Footnotes[edit]

  1. ↑
  2. ↑
  3. ↑ 3.0 3.1 https://zeronet.readthedocs.io/en/latest/archive.org
  4. ↑ ZeroNet acts as a local web server for these pages.
  5. ↑ https://en.wikipedia.org/wiki/ZeroNetarchive.org
  6. ↑ Although the Chinese government has blocked the ZeroNet website and bittorrent tracker.
  7. ↑ Security considerations:
    • By using Whonix, additional protections are in place for greater security.
    • This application requires access to Tor's control protocol.
    • In the Whonix context, Tor's control protocol has dangerous features. The Tor control command GETINFO address reveals the real, external IP of the Tor client.
    • Whonix provides onion-grater, a Tor Control Port Filter Proxy - filtering dangerous Tor Control Port commands.
    • When this application is run inside Whonix-Gateway with an onion-grater whitelist extension, this will limit Whonix-Workstation application rights to Tor control protocol access only. Non-whitelisted Tor control commands such as GETINFO address are rejected by onion-grater in these circumstances. In the event Whonix-Workstation, it can't determine its own IP address via requesting to Tor Controller, as onion-grater filters the reply.
    • In comparison, if the application is run on a non-Tor focused operating system like Debian, it will have unlimited access to Tor's control protocol (a less secure configuration).
    • If the (non-)Whonix platform is used to host onion services, then running applications are more vulnerable to attacks against the Tor network compared to when Tor is solely used as a client; see also Onion Services Security.
    In conclusion, Whonix is the safest and correct choice for running this application.
  8. ↑ Is python3-msgpack still reuqired?
  9. ↑
  10. ↑ Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.
  11. ↑ https://github.com/HelloZeroNet/ZeroNet/issues/241archive.org
  12. ↑ https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850474archive.org
  13. ↑ ZeroNet dependencies are not available in Debian.
  14. ↑ Except in the case of YaCy, which needs internet access.
  15. ↑ Functionality was last confirmed in mid-2020.
  16. ↑ https://zeronet.readthedocs.io/en/latest/using_zeronet/sample_sites/archive.org
Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.whonix.org/w/index.php?title=ZeroNet&oldid=99151"