Onionshare
Contents
Introduction[edit]
OnionShare is only available in Whonix 14 and later releases. |
OnionShare is an open source program that allows a file of any size to be shared securely and anonymously using the Tor network. [1] The OnionShare wiki succinctly describes the design: [2]
It works by starting a web server, making it accessible as a Tor Onion Service, and generating an unguessable URL to access and download the files. It does not require setting up a separate server or using a third party file-sharing service. You host the files on your own computer and use a Tor Onion Service to make it temporarily accessible over the internet. The receiving user just needs to open the URL in Tor Browser to download the file.
At the time of writing, the OnionShare package is not packaged in Debian stretch, and the package version available in Debian buster is quite old (v0.9.2.1 from 2017). [3] For these reasons, the following instructions use the most recent version available from github (v1.3). Advanced users may prefer to use APT pinning to install the version from Debian buster instead.
[edit]
1. Optional: Create a Separate Whonix-Workstation (anon-onionshare
AppVM)
Note: This is not strictly necessary, but best practice is to separate anonymous activities of a different nature in alternate VMs (AppVMs). [4]
In Qubes-Whonix, to clone the existing anon-whonix
AppVM: Right-click on anon-vm
-> Select "Clone VM"
-> Rename to "anon-onionshare"
2. Install git in Whonix-Workstation (anon-onionshare
AppVM)
Open a terminal (Konsole) in Whonix-Workstation (anon-onionshare
) and navigate to the persistent home directory.
Next install git which is not available by default in the VM (AppVM). [5]
3. Clone the OnionShare Directory
This will pull the OnionShare source code directly from github.com
Next navigate into the OnionShare directory.
4. Retrieve the OnionShare PGP Signing Key
This step retrieves the OnionShare developer's PGP key using its long key ID. [6]
gpg --keyserver pool.sks-keyservers.net --recv-keys 0x927F419D7EC82C2F149C1BD1403C2657CD994F73
5. Examine and Verify the git Tags and Commit
These steps list the available git tags, and verifies the latest version and its commit (v1.3 at the time of writing).
Good signature messages should appear for each verify command below. Do not proceed if signatures are bad! In that case, remove the OnionShare directory and repeat step 3. |
Qubes-Whonix users should shut down the anon-onionshare
AppVM prior to the next step.
6. Install OnionShare Dependencies
Several dependencies must be installed in Whonix-Workstation (whonix-ws
TemplateVM) for OnionShare to work correctly. In a terminal (Konsole) run.
sudo apt install -y build-essential fakeroot python3-all python3-stdeb dh-python python3-flask python3-stem python3-pyqt5 python-nautilus python3-pytest obfs4proxy
Qubes-Whonix users should shutdown the whonix-ws
TemplateVM after dependencies have installed, and restart the anon-onionshare
AppVM.
7. Extend the onion-grater Whitelist in Whonix-Gateway (sys-whonix
ProxyVM)
Extend onion-grater Whitelist
On Whonix-Gateway.
Create a new directory. [7]
Symlink the onion-grater profile to the onion-grater settings folder.
sudo ln -s /usr/share/onion-grater-merger/examples/40_onionshare.yml /usr/local/etc/onion-grater-merger.d/
Restart onion-grater.
8. Modify the Whonix-Workstation (anon-onionshare
AppVM) User Firewall Settings and Reload Them
Modify Whonix-Workstation User Firewall Settings
Note: If no changes have yet been made to Whonix Firewall Settings, then the Whonix User Firewall Settings File /etc/whonix_firewall.d/50_user.conf appears empty (because it does not exist). This is expected.
If using Qubes-Whonix, complete these steps.
In Whonix-Workstation AppVM.
Make sure folder /rw/config/whonix_firewall.d exists.
Open /rw/config/whonix_firewall.d/50_user.conf with root rights.
If using a graphical Whonix-Workstation, complete these steps.
Start Menu
-> Applications
-> Settings
-> User Firewall Settings
If using a terminal-only Whonix-Workstation, complete these steps.
For more help, press on Expand on the right.
Note: The Whonix Global Firewall Settings File /etc/whonix_firewall.d/30_default.conf contains default settings and explanatory comments about their purpose. By default, the file is opened read-only and is not meant to be directly edited. Below, it is recommended to open the file without root rights. The file contains an explanatory comment on how to change firewall settings.
## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom configuration, ## which will override the defaults found here. When Whonix is updated, this ## file may be overwritten.
See also Whonix modular flexible .d style configuration folders.
To view the file, follow these instructions.
If using Qubes-Whonix, complete these steps.
Qubes App Launcher (blue/grey "Q")
-> Template: whonix-ws
-> Whonix Global Firewall Settings
If using a graphical Whonix-Workstation, complete these steps.
Start Menu
-> Applications
-> Settings
-> Global Firewall Settings
If using a terminal-only Whonix-Workstation, complete these steps.
Add. [8]
Save.
Reload Whonix-Workstation Firewall.
If you are using Qubes-Whonix, complete the following steps.
Qubes App Launcher (blue/grey "Q")
-> Whonix-Workstation AppVM (commonly named anon-whonix)
-> Reload Whonix Firewall
If you are using a graphical Whonix-Workstation, complete the following steps.
Start Menu
-> Applications
-> System
-> Reload Whonix Firewall
If you are using a terminal-only Whonix-Workstation, run.
[edit]
To start OnionShare in Whonix-Workstation (anon-onionshare
) first navigate to the OnionShare folder.
Then either run the command line interface or GUI version, depending on your preference.
Advanced users can also build an OnionShare package to install. [9] [10]
[edit]
On the first run of OnionShare:
- Select the settings button/icon (cog symbol) in the GUI.
- Under “How should OnionShare connect to Tor?” choose “Connect using socket file”, and set the socket file to /var/run/tor/control.
- Under “Tor authentication options” choose “No authentication, or cookie authentication”.
To test OnionShare is running correctly:
- Click the “Test Settings” button. If all steps were completed correctly, Tor will successfully connect.
- The GUI should say it supports both ephemeral onion services and stealth onion services.
- Check “Create stealth onion services” to make OnionShare operations more secure.
[edit]
Once OnionShare has been installed correctly and the Tor check is successful, sharing files anonymously is easy: [11]
Open OnionShare, drag and drop files and folders you wish to share into it, and click Start Sharing. After a moment, it will show you a .onion URL such as http://asxmi4q6i7pajg2b.onion/egg-cain. This is the secret URL that can be used to download the file you're sharing.
Send this URL to the person you're sending the files to. If the files you're sending aren't secret, you can use normal means of sending the URL, like by emailing it, or sending it in a Facebook or Twitter private message. If you're sending secret files then it's important to send this URL securely.
The person who is receiving the files doesn't need OnionShare. All they need is to open the URL you send them in Tor Browser to be able to download the file.
A complete user guide, along with advanced topics and development documentation is available on the official website.
[edit]
AppArmor profiles are available to better contain OnionShare, but they have not yet been tested in Whonix. [12] Whonix community wiki contributions and testing are most welcome!
TODO: Test profiles and expand this section.
Footnotes[edit]
- ↑ https://onionshare.org/
- ↑ https://github.com/micahflee/onionshare/wiki
- ↑ https://tracker.debian.org/pkg/onionshare
- ↑ Qubes-Whonix users should note the
whonix-ws
TemplateVM will pull in over 70Mb of dependencies at step 6. Consider creating a separate clonedwhonix-ws
TemplateVM for this purpose beforehand, prior to completing this step. - ↑ The git installation will not persist in Qubes-Whonix following reboot. This method avoids polluting the
whonix-ws
TemplateVM upon which it is based. - ↑ OnionShare is developed by Micah Lee and the key ID has been taken directly from www.micahflee.com
- ↑
Using
/usr/local/etc/onion-grater-merger.d/
because that onion-grater settings folder is persistent in Qubes-Whonix TemplateBased ProxyVMs, i.e. Whonix-Gateway (commonly calledsys-whonix
). Non-Qubes-Whonix users could also use/etc/onion-grater-merger.d/
. Qubes-Whonix users could also use/etc/onion-grater-merger.d/
but then users would have to make/etc/onion-grater-merger.d/
persistent, which would require doing this inside the Whonix-Gateway TemplateVM (commonly calledwhonix-gw
) and restart their Whonix-Gateway ProxyVM or to use bind-dirs. Both is more more complicated than simply using/usr/local/etc/onion-grater-merger.d/
which is persistent either way and even allows multiple Whonix-Gateway ProxyVMs based on the same Whonix-Gateway TemplateVM for lets say one Whonix-Gateway ProxyVM extending and relaxing onion-grater's whitelist and the other Whonix-Gateway ProxyVM with the default more restricted onion-grater whitelist. - ↑ As per https://labs.riseup.net/code/issues/7870#note-15 OnionShare uses ports 17600 to 17659.
- ↑ https://github.com/micahflee/onionshare/blob/master/BUILD.md#gnulinux
- ↑ To create a .deb on Debian, run:
./install/build_deb.sh
- ↑ https://github.com/micahflee/onionshare/wiki
- ↑ https://github.com/micahflee/onionshare/tree/develop/apparmor
Do you wonder why Whonix will always be free? Check out Why Whonix is Free Software.
https | (forcing) onion
This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! See Conditions for Contributions to Whonix, then Edit! IP addresses are scrubbed, but editing over Tor is recommended. Edits are held for moderation.
Whonix is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Libre Software license as Whonix itself. (Why?)