Actions

UniStation - A Tor TransparentProxy with only One Machine

From Whonix

(Redirected from OneVM)



Testers only! Testers only!

Introduction[edit]

Whonix ™ needs at least two systems. One running Tor, Whonix-Gateway ™. The other running clients that are routed through Tor, Whonix-Workstation ™. This ensures the highest possible security and isolation. We can implement this using different strategies: Two VMs (Gateway VM and Workstation VM) or bare metal.

A different approach is to run Tor and applications all on the same machine. This can be either a VM or bare metal host.

This site will guide you through all required steps to set up a UniStation. A machine which routes all traffic through the Tor anonymity network. This is an implementation of a Tor TransparentProxy [archive].

Advantages:

  • Only one machine required.
  • Lower system requirements.

Disadvantages:

Prerequisites[edit]

1. Confirm prerequisites are met.

  • Debian buster is installed.
  • User account user exists.

2. Become root. [1] 

su

3. Install sudo and adduser packages.

1. Update the package lists. 

apt-get update

2. Upgrade the system. 

apt-get dist-upgrade

3. Install sudo and adduser packages. 

apt-get install --no-install-recommends sudo adduser

4. Set user rights.

The following commands must be run either by root or using sudo. [2]

Create group console. 

/usr/sbin/addgroup --system console

Add user user to group console. 

/usr/sbin/adduser user console

Add user user to group sudo. 

/usr/sbin/adduser user sudo

5. Reboot. 

/sbin/reboot

Installation[edit]

Packages[edit]

Install gnupg. [3] 

sudo apt install gnupg

Complete the following steps to add the Whonix ™ Signing Key to the system's APT keyring.

Open a terminal.

Install curl, gpg, gpg-agent. [4]

Install curl gpg gpg-agent.

1. Update the package lists. 

sudo apt-get update

2. Upgrade the system. 

sudo apt-get dist-upgrade

3. Install the curl gpg gpg-agent package.

Using apt-get command line parameter --no-install-recommends is in most cases optional. 

sudo apt-get install --no-install-recommends curl gpg gpg-agent

The procedure of installing curl gpg gpg-agent is complete.

Download Whonix ™ Signing Key. [5]

If you are using a Qubes TemplateVM, run. 

curl --proxy http://127.0.0.1:8082/ --tlsv1.3 --proto =https --max-time 180 --output ~/patrick.asc https://www.whonix.org/patrick.asc

If you are using Debian, run. 

curl --tlsv1.3 --proto =https --max-time 180 --output ~/patrick.asc https://www.whonix.org/patrick.asc

Users can check Whonix ™ Signing Key for better security.

Add Whonix ™ signing key to APT trusted keys. 

sudo apt-key --keyring /etc/apt/trusted.gpg.d/derivative.gpg add ~/patrick.asc

The procedure of adding Whonix ™ signing key is now complete.

Add Whonix ™ Repository.

Choose either: Option A, Option B OR Option C.

Option A: Add Whonix ™ Onion Repository.

To add Whonix ™ Repository over Onion please press on expand on the right.

Install apt-transport-tor from the Debian repository. 

sudo apt-get install apt-transport-tor

Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was buster. 

echo "deb tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option B: Add Whonix ™ Clearnet Repository over Tor.

To add Whonix ™ Repository over torified clearnet please press on expand on the right.

Install apt-transport-tor from the Debian repository. 

sudo apt-get install apt-transport-tor

Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was buster. 

echo "deb tor+https://deb.Whonix.org buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option C: Add Whonix Clearnet Repository over clearnet.

To add Whonix ™ Repository over clearnet please press on expand on the right.

Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was buster. 

echo "deb https://deb.Whonix.org buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Install usability-misc.

1. Update the package lists. 

sudo apt-get update

2. Upgrade the system. 

sudo apt-get dist-upgrade

3. Install the usability-misc package.

Using apt-get command line parameter --no-install-recommends is in most cases optional. 

sudo apt-get install --no-install-recommends usability-misc

The procedure of installing usability-misc is complete.

[6] 

sudo apt-get-noninteractive install --no-install-recommends kicksecure-cli whonix-firewall uwt anon-gw-dns-conf ipv4-forward-disable ipv6-disable

Update: Packages anon-gw-dns-conf, ipv4-forward-disable, ipv6-disable are deprecated (merged into anon-gw-anonymizer-config) in Whonix developers repository (upcoming stable) but these packages are so trivial that the 1 config file per package can be manually set up.

Firewall Settings[edit]

Find out your network interface name. You can learn about what interfaces you have by running. 

sudo ifconfig

Edit /etc/whonix_firewall.d/50_user.conf. 

sudoedit /etc/whonix_firewall.d/50_user.conf

Paste.

You might have to change #EXT_IF="eth0" by removing the hash # in front of it and by setting it to the name of your network interface such as wlan0. I.e. the full line might look like this: EXT_IF="wlan0" Include it with the to be pasted text below. [7] 

## 0: disabled
## 1: enabled

## External interface
## defaults to:
#EXT_IF="eth0"

WORKSTATION_TRANSPARENT_TCP=0
WORKSTATION_TRANSPARENT_UDP=0
WORKSTATION_TRANSPARENT_DNS=0
WORKSTATION_ALLOW_SOCKSIFIED=0
CONTROL_PORT_FILTER_PROXY_ENABLE=0

GATEWAY_TRANSPARENT_TCP=1
GATEWAY_TRANSPARENT_UDP=0
GATEWAY_TRANSPARENT_DNS=1
GATEWAY_ALLOW_INCOMING_ICMP=0

If you want port 22 to open for incoming SSH, also paste: 

GATEWAY_ALLOW_INCOMING_SSH=1

Save.

Qubes[edit]

Qubes only. Does not hurt otherwise. 

sudo systemctl mask qubes-iptables

Qubes Debian based VMs would require further /etc/whonix_firewall.d/50_user.conf modifications. See footnote. [8]

torsocks[edit]

torsocks config not required. uwt sets that up for us.

Tor Configuration[edit]

Open Tor configuration file /etc/tor/torrc with root rights. 

sudoedit /etc/tor/torrc

Paste. [9] 

TransPort 127.0.0.1:9041
DnsPort 127.0.0.1:5400
DisableNetwork 0

Save.

Restart Tor. 

sudo systemctl restart tor

APT[edit]

Check if there is something you need in /etc/apt/sources.list.

Move original /etc/apt/sources.list out of the way because /etc/apt/sources.list.d/debian.list by Kicksecure ™ replaces it. 

sudo mv /etc/apt/sources.list ~/

Reboot[edit]

Reboot required. 

sudo reboot

Usage[edit]

check sdwdate[edit]

sudo systemctl status sdwdate --no-pager

Updates[edit]

Update as per usual. See also Operating System Software and Updates.

Thanks to uwt [archive] it is stream isolated (using Tor SocksPort). No need to use torsocks. uwt uses torsocks which is configued to use IsolatePID 1. 

sudo apt update

Transparent DNS Functional[edit]

nslookup torproject.org

Server:		127.0.0.1
Address:	127.0.0.1#53

Non-authoritative answer:
Name:	torproject.org
Address: 95.216.163.36
** server can't find torproject.org: NXDOMAIN

Transparent DNS Functional[edit]

cd /tmp

wget.anondist-orig torproject.org

--2019-12-10 12:25:43--  http://torproject.org/
Resolving torproject.org (torproject.org)... 95.216.163.36
Connecting to torproject.org (torproject.org)|95.216.163.36|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://www.torproject.org/ [following]
--2019-12-10 12:25:45--  https://www.torproject.org/
Resolving www.torproject.org (www.torproject.org)... 116.202.120.165
Connecting to www.torproject.org (www.torproject.org)|116.202.120.165|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 19623 (19K) [text/html]
Saving to: ‘index.html’

index.html                  100%[===========================================>]  19.16K  62.3KB/s    in 0.3s    

2019-12-10 12:25:47 (62.3 KB/s) - ‘index.html’ saved [19623/19623]

Troubleshooting[edit]

Depending on network configuration perhaps /etc/whonix_firewall.d/50_user.conf need to be appended. 

NON_TOR_GATEWAY="\
            127.0.0.0-127.0.0.24 \
            10.137.0.0-10.138.255.255 \
         "

Forum Discussion[edit]

https://forums.whonix.org/t/debian-onevm-anononevm-non-self-contained-host-depending-onevm-unistation-a-tor-transparentproxy-with-only-one-machine/5470 [archive]

Footnotes[edit]

  1. ↑ Other methods are possible.
  2. ↑ It is necessary to use the full path to addgroup, adduser and reboot because when using su the PATH environment variable is not adjusted for use with root rights. See echo "$PATH". user rights PATH: 
    /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games

    root rights PATH: 

    /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

    When using sudo using /full/path/to/application is not required.

  3. ↑ Required for Debian netinst "minimal" (no default system tools).
  4. ↑ gpg is required by apt-key. gpg-agent is required due to the following error message. 
    sudo apt-key --keyring /etc/apt/trusted.gpg.d/derivative.gpg add ~/patrick.asc

    gpg: failed to start agent '/usr/bin/gpg-agent': No such file or directory
gpg: can't connect to the agent: No such file or directory
  5. ↑ See Secure Downloads to understand why curl and the parameters --tlsv1.3 --proto =https are used instead of wget.
  6. ↑ apt-get-noninteractive to avoid asking this question. 
    Setting up anon-base-files (3:4.6-1) ...

Configuration file '/etc/machine-id'
 ==> File on system created by you or by a script.
 ==> File also in package provided by package contributor.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package contributor's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : start a shell to examine the situation
 The default action is to keep your current version.
*** machine-id (Y/I/N/O/D/Z) [default=N] ? i
  7. ↑ VirtualBox: EXT_IF="enp0s3"
  8. ↑ This was required in Qubes to make Whonix-Gateways Own Traffic Transparent Proxy work. In that case, append to /etc/whonix_firewall.d/50_user.conf. 
    NON_TOR_GATEWAY="\
            127.0.0.0-127.0.0.24 \
            10.137.0.0-10.138.255.255 \
         "

  9. ↑ DisableNetwork 0 is required to make sdwdate work because the connectivity check locks at it.
Fosshost is sponsors Kicksecure stage server Whonix old logo.png
Fosshost About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: 1024px-Telegram 2019 Logo.svg.png Discourse logo.png Matrix logo.svg.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png Iconfinder Apple Mail 2697658.png Reddit.jpg Hacker.news.jpg 200px-Mastodon Logotype (Simple).svg.png

Want to make Whonix ™ safer and more usable? We're looking for helping hands. Check out the Open Issues and development forum.

https link onion link Priority Support | Investors | Professional Support

Whonix ™ | © ENCRYPTED SUPPORT LP | Heckert gnu.big.png Freedom Software / Osi standard logo 0.png Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.

Retrieved from "https://www.whonix.org/w/index.php?title=UniStation&oldid=65265"
By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent.
More information