Onionizing Repositories
Introduction[edit]
When software packages from Debian, Whonix ™, Fedora, Qubes (and others) are downloaded prior to the installation of new packages or upgrades, the package repository sources default to the http / https transport protocol, which is non-ideal for security. Instead, experimental Tor onion services can be configured for a number of platforms, which provides several security and privacy benefits: [1]
- The user cannot be uniquely targeted for malicious updates -- attackers are forced to attack everyone requesting the update.
- The package repository, or observers watching it, cannot track what programs are installed.
- The ISP cannot easily learn what packages are fetched.
- End-to-end authentication and encryption provides protection against man-in-the-middle attacks, like version downgrade attacks.
Be aware that enabling onion repositories may cause system updates to periodically fail due to their unreliability. If this becomes an issue, it is encouraged to Re-enable Clearnet Repositories so packages can be updated.
If the term "comment" is unfamiliar, please follow this link to learn how to comment / uncomment lines in a configuration file.
In this chapter, instructions are provided for onionizing sources on the Debian, Non-Qubes-Whonix ™ and Qubes platforms.
Qubes[edit]
Qubes dom0
and VMs can be onionized by editing the repository configuration files so they point to the corresponding onion mirrors. [2]
Complete the following steps in dom0
and for each template -- not all templates can be completely onionized. The instructions below consider Debian Templates, Whonix TM Templates, and the Fedora Template.
dom0[edit]
dom0
can be updated exclusively over onion services.
1. In a dom0
terminal, open the qubes-dom0.repo
configuration file in a text editor.
- comment the lines that contain
metalink
- uncomment the lines that contain
qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion
Once completed, each of the four code blocks will have http(s) repository lines similar to the following example.
Save and exit.
2. In a dom0
terminal, open the qubes-templates.repo
configuration file in a text editor.
- comment the lines that contain
metalink
- uncomment the lines that contain
qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion
Once completed, each of the two code blocks will have http(s) repository lines similar to the following example.
Save and exit.
3. In dom0
terminal, confirm both onion repositories are functional.
Debian Templates[edit]
Debian templates can be updated exclusively over onion services. Simply edit both Qubes and Debian sources.list files so they point to the respective onion repositories.
Note: to use the tor+http
configuration below, apt-transport-tor must be installed. [3] Remove tor+
from the code block if updates over Tor are unwanted.
Onionize qubes-r4.list[edit]
1. In Debian TempateVM, open the qubes-r4.list
file in a text editor.
2. Comment the first line underneath "Main qubes updates repository".
The first code block should look similar to this.
3. Uncomment the corresponding line underneath "Qubes Tor updates repositories".
The first code block should look similar to this.
Save and exit.
4. Confirm the onionized repositories are functional.
Onionize Debian sources.list[edit]
The sources.list
file can be edited so it points to the Debian onion mirror. [4] This is a more secure method than clearnet for updates and software installation.
1. Open the Debian sources.list
file using an editor with root rights.
2. Reference the onionized Debian repositories.
Cut and paste the following .onion mirrors and comment out (#) the corresponding https repositories.
Save and exit.
3. Confirm the onionized repositories are functional.
Whonix ™ Templates[edit]
Whonix ™ templates can be updated exclusively over onion services by editing the Qubes, Debian [4] and Whonix ™ sources.list
files so they point to the respective onion repositories.
Complete the following steps in both Whonix-Gateway ™ and Whonix-Workstation ™.
Onionize qubes-r4.list[edit]
1. In Whonix ™ TempateVM, open qubes-r4.list
in a text editor.
2. Comment the first line underneath "Main qubes updates repository".
The first code block should look similar to this.
3. Uncomment the corresponding line underneath "Qubes Tor updates repositories".
The first code block should look similar to this.
Save and exit.
4. Confirm the onionized repositories are functional.
Onionize debian.list[edit]
1. Open the Debian sources.list
file using an editor with root rights.
2. Uncomment the onionized Debian repositories.
Uncomment the following .onion mirrors and comment out (#) the corresponding https repositories (except the fasttrack repository).
Save and exit.
3. Confirm the onionized repositories are functional.
Onionize derivative.list[edit]
Follow these steps to point the Whonix ™ sources.list
file to the v3 onion mirror. [5] [6] See Whonix APT Repository overview for details on the four repository choices.
1. Open the Whonix ™ sources.list
file using an editor with root rights.
2. Uncomment the onionized Whonix ™ repository.
Uncomment the following .onion mirror and comment out (#) the corresponding https repository.
Save and exit.
3. Confirm the onionized repository is functional.
Fedora Template[edit]
Note: Updating Fedora templates exclusively over Onion Services is not possible -- only related Qubes repositories can be onionized. The reason is Fedora does not maintain onion service repositories.
1. In Fedora Template, open the qubes-r4.repo
file in a text editor. [7]
- uncomment the lines that contain
qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion
Once completed, each of the four code blocks will have http(s) repository lines similar to the following example.
Save and exit.
2. In Fedora Template, confirm the onion service repositories are functional.
Debian[edit]
Debian hosts and VMs can be onionized by editing the Debian [4] [8] repository configuration files so they point to the corresponding onion mirrors. Complete the following steps on Debian hosts or in Debian VMs.
Note: to use the tor+http
configuration below, apt-transport-tor must be installed. [3] Remove "tor+" from the code block if updates over Tor are unwanted.
1. Open the Debian sources.list
file using an editor with root rights.
2. Reference the onionized Debian repositories.
Cut and paste the following .onion mirrors and comment out (#) the corresponding https repositories.
Save and exit.
3. Confirm the onionized repositories are functional.
Non-Qubes-Whonix ™[edit]
Non-Qubes-Whonix ™ VMs can be onionized by editing both the Debian [4] and Whonix ™ repository configuration files so they point to the corresponding onion mirrors. Complete the following steps in both Whonix-Gateway ™ and Whonix-Workstation ™.
Debian sources.list[edit]
1. Open the Debian sources.list
file using an editor with root rights.
2. Reference the onionized Debian repositories.
Cut and paste the following .onion mirrors and comment out (#) the corresponding https repositories.
Save and exit.
3. Confirm the onionized repositories are functional.
Whonix ™ sources.list[edit]
Follow these steps to point the Whonix ™ sources.list
file to the v3 onion mirror. [5] [9] See Whonix APT Repository overview for details on the four repository choices.
1. Open the Whonix ™ sources.list
file using an editor with root rights.
2. Uncomment the onionized Whonix ™ repository.
Uncomment the following .onion mirror and comment out (#) the corresponding https repository.
Save and exit.
3. Confirm the onionized repository is functional.
Onionize Tor Project Updates[edit]
For enhanced security, advanced users and testers can onionize Tor Project updates; see Tor Versioning for further details.
Footnotes[edit]
- ↑ https://blog.torproject.org/blog/tor-heart-apt-transport-tor-and-debian-onions
- ↑ At present, the available Qubes onion service URLs
are:
Website: www.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion
Yum repo: yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion
Deb repo: deb.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion
ISOs: iso.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion - ↑ 3.0 3.1 For support in downloading APT packages anonymously via the Tor network. To install it:
sudo apt install apt-transport-tor
- ↑ 4.0 4.1 4.2 4.3 https://onion.debian.org/
- ↑ 5.0 5.1 Whonix ™ no longer maintains v2 legacy onion addresses which were deprecated by The Tor Project in October 2021; see here
.
- ↑ The v3 onion protocol has been supported for clients and servers since Tor v0.3.2.1-alpha.
- ↑ At the time of writing Qubes-R4 was the current stable release.
- ↑ Also edit Whonix ™
sources.list
if you are using Whonix ™ Packages for Debian Hosts. - ↑ The v3 onion protocol has been supported for clients and servers since Tor v0.3.2.1-alpha.