UniStation - A Tor TransparentProxy with only One Machine
From Whonix
Testers only!
Contents
Introduction[edit]
Whonix ™ needs at least two systems. One running Tor, Whonix-Gateway ™. The other running clients that are routed through Tor, Whonix-Workstation ™. This ensures the highest possible security and isolation. We can implement this using different strategies: Two VMs (Gateway VM and Workstation VM) or bare metal.
A different approach is to run Tor and applications all on the same machine. This can be either a VM or bare metal host.
This site will guide you through all required steps to set up a UniStation. A machine which routes all traffic through the Tor anonymity network. This is an implementation of a Tor TransparentProxy [archive].
Advantages:
- Only one machine required.
- Lower system requirements.
Disadvantages:
- More difficult to install.
- User might have to set the network interface setting.
- If using VMs: Guest VM can see MAC address of host?
- Less secure than Whonix ™ with Whonix-Gateway ™ and Whonix-Workstation ™.
- This is not as well polished, developed and thought through as Whonix ™ yet.
- Enhancements that come with Whonix-Workstation ™ such as:
- have not been considered yet.
- This will potentially not be maintained as well as Whonix ™.
Prerequisites[edit]
- Debian
busterinstalled. - User account
userexists.
Become root. [1]
su
Install sudo and adduser.
Install sudo adduser.
1. Update the package lists.
sudo apt-get update
2. Upgrade the system.
sudo apt-get dist-upgrade
3. Install the sudo adduser package.
sudo apt-get install sudo adduser
The procedure of installing sudo adduser is complete.
The following commands need to be run either by root or use sudo.
Create group console.
addgroup --system console
Add user user to group console.
adduser user console
Add user user to group sudo.
adduser user sudo
Reboot.
reboot
Installation[edit]
Packages[edit]
Install gnupg. [2]
sudo apt install gnupg
Complete the following steps to add the Whonix Signing Key to the system's APT keyring. [3]
Open a terminal.
Install curl, gpg, gpg-agent. [4]
Install curl gpg gpg-agent --no-install-recommends.
1. Update the package lists.
sudo apt-get update
2. Upgrade the system.
sudo apt-get dist-upgrade
3. Install the curl gpg gpg-agent --no-install-recommends package.
sudo apt-get install curl gpg gpg-agent --no-install-recommends
The procedure of installing curl gpg gpg-agent --no-install-recommends is complete.
Download Whonix Signing Key. [5]
If you are using a Qubes TemplateVM, run.
curl --proxy http://127.0.0.1:8082/ --tlsv1.2 --proto =https --max-time 180 --output ~/patrick.asc https://www.whonix.org/patrick.asc
If you are using Debian, run.
curl --tlsv1.2 --proto =https --max-time 180 --output ~/patrick.asc https://www.whonix.org/patrick.asc
Users can check Whonix Signing Key for better security.
Add Whonix signing key to APT trusted keys.
sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg add ~/patrick.asc
The procedure of adding Whonix signing key is now complete.
Add Whonix ™ Repository.
Choose either: Option A, Option B OR Option C.
Option A: Add Whonix ™ Onion Repository.
To add Whonix ™ Repository over Onion please press on expand on the right.
Install apt-transport-tor from the Debian repository.
sudo apt-get install apt-transport-tor
Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was buster.
echo "deb tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/whonix.list
Option B: Add Whonix ™ Clearnet Repository over Tor.
To add Whonix ™ Repository over torified clearnet please press on expand on the right.
Install apt-transport-tor from the Debian repository.
sudo apt-get install apt-transport-tor
Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was buster.
echo "deb tor+https://deb.Whonix.org buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/whonix.list
Option C: Add Whonix Clearnet Repository over clearnet.
To add Whonix ™ Repository over clearnet please press on expand on the right.
Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was buster.
echo "deb https://deb.Whonix.org buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/whonix.list
Install usability-misc.
1. Update the package lists.
sudo apt-get update
2. Upgrade the system.
sudo apt-get dist-upgrade
3. Install the usability-misc package.
sudo apt-get install usability-misc
The procedure of installing usability-misc is complete.
sudo apt-get-noninteractive install --no-install-recommends kicksecure-cli whonix-firewall uwt anon-gw-dns-conf ipv4-forward-disable ipv6-disable
Update: Packages anon-gw-dns-conf, ipv4-forward-disable, ipv6-disable are deprecated (merged into anon-gw-anonymizer-config) in Whonix developers repository (upcoming stable) but these packages are so trivial that the 1 config file per package can be manually set up.
Firewall Settings[edit]
Find out your network interface name. You can learn about what interfaces you have by running.
sudo ifconfig
Edit /etc/whonix_firewall.d/50_user.conf.
sudoedit /etc/whonix_firewall.d/50_user.conf
Paste.
You might have to change #EXT_IF="eth0" by removing the hash # in front of it and by setting it to the name of your network interface such as wlan0. I.e. the full line might look like this: EXT_IF="wlan0" Include it with the to be pasted text below. [7]
## 0: disabled ## 1: enabled ## External interface ## defaults to: #EXT_IF="eth0" WORKSTATION_TRANSPARENT_TCP=0 WORKSTATION_TRANSPARENT_UDP=0 WORKSTATION_TRANSPARENT_DNS=0 WORKSTATION_ALLOW_SOCKSIFIED=0 CONTROL_PORT_FILTER_PROXY_ENABLE=0 GATEWAY_TRANSPARENT_TCP=1 GATEWAY_TRANSPARENT_UDP=0 GATEWAY_TRANSPARENT_DNS=1 GATEWAY_ALLOW_INCOMING_ICMP=0
If you want port 22 to open for incoming SSH, also paste:
GATEWAY_ALLOW_INCOMING_SSH=1
Save.
Qubes[edit]
Qubes only. Does not hurt otherwise.
sudo systemctl mask qubes-iptables
Qubes Debian based VMs would require further /etc/whonix_firewall.d/50_user.conf modifications. See footnote. [8]
torsocks[edit]
torsocks config not required. uwt sets that up for us.
- https://github.com/Whonix/uwt [archive]
- https://github.com/Whonix/uwt/blob/master/etc/tor/torsocks.conf.anondist [archive]
Tor Configuration[edit]
Open Tor configuration file /etc/tor/torrc with root rights.
sudoedit /etc/tor/torrc
Paste. [9]
TransPort 127.0.0.1:9041 DnsPort 127.0.0.1:5400 DisableNetwork 0
Save.
Restart Tor.
sudo systemctl restart tor
APT[edit]
Check if there is something you need in /etc/apt/sources.list.
Move original /etc/apt/sources.list out of the way because /etc/apt/sources.list.d/debian.list by Kicksecure ™ replaces it.
sudo mv /etc/apt/sources.list ~/
Reboot[edit]
Reboot required.
sudo reboot
Usage[edit]
check sdwdate[edit]
sudo systemctl status sdwdate --no-pager
Updates[edit]
Update as per usual. See also Operating System Software and Updates.
Thanks to uwt [archive] it is stream isolated (using Tor SocksPort). No need to use torsocks. uwt uses torsocks which is configued to use IsolatePID 1.
sudo apt update
Transparent DNS Functional[edit]
nslookup torproject.org
Server: 127.0.0.1 Address: 127.0.0.1#53 Non-authoritative answer: Name: torproject.org Address: 95.216.163.36 ** server can't find torproject.org: NXDOMAIN
Transparent DNS Functional[edit]
cd /tmp
wget.anondist-orig torproject.org
--2019-12-10 12:25:43-- http://torproject.org/ Resolving torproject.org (torproject.org)... 95.216.163.36 Connecting to torproject.org (torproject.org)|95.216.163.36|:80... connected. HTTP request sent, awaiting response... 302 Found Location: https://www.torproject.org/ [following] --2019-12-10 12:25:45-- https://www.torproject.org/ Resolving www.torproject.org (www.torproject.org)... 116.202.120.165 Connecting to www.torproject.org (www.torproject.org)|116.202.120.165|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 19623 (19K) [text/html] Saving to: ‘index.html’ index.html 100%[===========================================>] 19.16K 62.3KB/s in 0.3s 2019-12-10 12:25:47 (62.3 KB/s) - ‘index.html’ saved [19623/19623]
Troubleshooting[edit]
Depending on network configuration perhaps /etc/whonix_firewall.d/50_user.conf need to be appended.
NON_TOR_GATEWAY="\
127.0.0.0-127.0.0.24 \
10.137.0.0-10.138.255.255 \
"
Forum Discussion[edit]
https://forums.whonix.org/t/debian-onevm-anononevm-non-self-contained-host-depending-onevm-unistation-a-tor-transparentproxy-with-only-one-machine/5470 [archive]
Footnotes[edit]
- ↑ One way or another.
- ↑ Required for Debian netinst "minimal" (no default system tools).
- ↑
The following is unreliable due to gpg connectivity bugs [archive].
sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg adv --keyserver hkp://ipv4.pool.sks-keyservers.net:80 --recv-keys 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA
- ↑
gpgis required byapt-key.gpg-agentis required due to the following error message.sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg add ~/patrick.asc
gpg: failed to start agent '/usr/bin/gpg-agent': No such file or directory gpg: can't connect to the agent: No such file or directory
- ↑
See Secure Downloads to understand why
curland the parameters--tlsv1.2 --proto =httpsare used instead ofwget. - ↑
apt-get-noninteractive to avoid asking this question.
Setting up anon-base-files (3:4.6-1) ... Configuration file '/etc/machine-id' ==> File on system created by you or by a script. ==> File also in package provided by package contributor. What would you like to do about it ? Your options are: Y or I : install the package contributor's version N or O : keep your currently-installed version D : show the differences between the versions Z : start a shell to examine the situation The default action is to keep your current version. *** machine-id (Y/I/N/O/D/Z) [default=N] ? i - ↑
VirtualBox:
EXT_IF="enp0s3" - ↑
This was required in Qubes to make Whonix-Gateways Own Traffic Transparent Proxy work. In that case, append to
/etc/whonix_firewall.d/50_user.conf.NON_TOR_GATEWAY="\ 127.0.0.0-127.0.0.24 \ 10.137.0.0-10.138.255.255 \ " - ↑
DisableNetwork 0is required to make sdwdate work because the connectivity check locks at it.
Whonix ™ is Supported by Evolution Host DDoS Protected VPS. Stay private and get your VPS with Bitcoin or Monero.
Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki
We are looking for video makers to help create demonstration, promotional and conceptual videos or tutorials.
This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.
Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)
Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].
Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.
By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.