UniStation - A Tor TransparentProxy with only One Machine
Introduction[edit]
Whonix ™ needs at least two systems. One running Tor, Whonix-Gateway. The other running clients that are routed through Tor, Whonix-Workstation ™. This ensures the highest possible security and isolation. We can implement this using different strategies: Two VMs (Gateway VM and Workstation VM) or bare metal.
A different approach is to run Tor and applications all on the same machine. This can be either a VM or bare metal host.
This site will guide you through all required steps to set up a UniStation. A machine which routes all traffic through the Tor anonymity network. This is an implementation of a Tor TransparentProxy.
Advantages:
- Only one machine required.
- Lower system requirements.
Disadvantages:
- More difficult to install.
- User might have to set the network interface setting.
- If using VMs: Guest VM can see MAC address of host?
- Less secure than Whonix ™ with Whonix-Gateway and Whonix-Workstation ™.
- This is not as well polished, developed and thought through as Whonix ™ yet.
- Enhancements that come with Whonix-Workstation ™ such as:
- have not been considered yet.
- This will potentially not be maintained as well as Whonix ™.
Prerequisites[edit]
1. Confirm prerequisites are met.
- Debian
bullseye
is installed. - User account
user
exists.
3. Install sudo
and adduser
packages.
1. Update the package lists.
2. Upgrade the system.
3. Install sudo
and adduser
packages.
4. Set user rights.
The following commands must be run either by root or using sudo
.
Create group console
.
Add user user
to group console
.
Add user user
to group sudo
.
5. Reboot. [3]
Installation[edit]
Packages[edit]
Install gnupg. [4]
Complete the following steps to add the Whonix ™ Signing Key to the system's APT keyring.
Open a terminal.
Package curl
needs to be installed.
Install package(s) curl
.
A. Update the package lists and upgrade the system.
B. Install the curl
package(s).
Using apt
command line parameter --no-install-recommends
is in most cases optional.
C. Done.
The procedure of installing package(s) curl
is complete.
2. Download Whonix ™ Signing Key. [5]
If you are using Debian, run.
If you are using a Qubes Debian Template, run.
3. Users can check Whonix ™ Signing Key for better security.
4. Add the Whonix ™ signing key to APT's keyring folder. [6]
5. Done.
The procedure of adding Whonix ™ signing key is now complete.
Add Whonix ™ Repository.
Choose either: Option A, Option B OR Option C.
Option A: Add Whonix ™ Onion Repository.
To add Whonix ™ Repository over Onion please press on expand on the right.
Install apt-transport-tor from the Debian repository.
Add Whonix ™ APT repository for default Whonix ™ using Debian stable. At the time of writing this was bullseye
.
Option B: Add Whonix ™ Clearnet Repository over Tor.
To add Whonix ™ Repository over torified clearnet please press on expand on the right.
Install apt-transport-tor
from the Debian repository.
Add Whonix ™ APT repository for default Whonix ™ using Debian stable. At the time of writing this was bullseye
.
Option C: Add Whonix Clearnet Repository over clearnet.
To add Whonix ™ Repository over clearnet please press on expand on the right.
Add Whonix ™ APT repository for default Whonix ™ using Debian stable. At the time of writing this was bullseye
.
Install package(s) usability-misc
.
A. Update the package lists and upgrade the system.
B. Install the usability-misc
package(s).
Using apt
command line parameter --no-install-recommends
is in most cases optional.
C. Done.
The procedure of installing package(s) usability-misc
is complete.
Update: Packages anon-gw-dns-conf, ipv4-forward-disable, ipv6-disable are deprecated (merged into anon-gw-anonymizer-config) in Whonix ™ developers repository (upcoming stable) but these packages are so trivial that the 1 config file per package can be manually set up.
Firewall Settings[edit]
Find out your network interface name. You can learn about what interfaces you have by running.
Edit /etc/whonix_firewall.d/50_user.conf
.
Paste.
You might have to change #EXT_IF="eth0"
by removing the hash #
in front of it and by setting it to the name of your network interface such as wlan0
. I.e. the full line might look like this: EXT_IF="wlan0"
Include it with the to be pasted text below. [8]
If you want port 22 to open for incoming SSH, also paste:
Save.
Qubes[edit]
Qubes only. Does not hurt otherwise.
Qubes Debian based VMs would require further /etc/whonix_firewall.d/50_user.conf
modifications. See footnote. [9]
torsocks[edit]
torsocks config not required. uwt sets that up for us.
- https://github.com/Whonix/uwt
- https://github.com/Whonix/uwt/blob/master/etc/tor/torsocks.conf.anondist
Tor Configuration[edit]
Open Tor configuration file /etc/tor/torrc
with root rights.
Paste. [10]
Save.
Restart Tor.
APT[edit]
Check if there is something you need in /etc/apt/sources.list
.
Move original /etc/apt/sources.list
out of the way because /etc/apt/sources.list.d/debian.list
by Kicksecure ™ replaces it.
Reboot[edit]
Reboot required.
Usage[edit]
check sdwdate[edit]
Updates[edit]
Update as per usual. See also Operating System Software and Updates.
Thanks to uwt it is stream isolated (using Tor
SocksPort
). No need to use torsocks
. uwt
uses torsocks
which is configued to use IsolatePID 1
.
Transparent DNS Functional[edit]
Server: 127.0.0.1 Address: 127.0.0.1#53 Non-authoritative answer: Name: torproject.org Address: 95.216.163.36 ** server can't find torproject.org: NXDOMAIN
Transparent DNS Functional[edit]
--2019-12-10 12:25:43-- http://torproject.org/ Resolving torproject.org (torproject.org)... 95.216.163.36 Connecting to torproject.org (torproject.org)|95.216.163.36|:80... connected. HTTP request sent, awaiting response... 302 Found Location: https://www.torproject.org/ [following] --2019-12-10 12:25:45-- https://www.torproject.org/ Resolving www.torproject.org (www.torproject.org)... 116.202.120.165 Connecting to www.torproject.org (www.torproject.org)|116.202.120.165|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 19623 (19K) [text/html] Saving to: ‘index.html’ index.html 100%[===========================================>] 19.16K 62.3KB/s in 0.3s 2019-12-10 12:25:47 (62.3 KB/s) - ‘index.html’ saved [19623/19623]
Troubleshooting[edit]
Depending on network configuration perhaps /etc/whonix_firewall.d/50_user.conf
need to be appended.
Forum Discussion[edit]
https://forums.whonix.org/t/debian-onevm-anononevm-non-self-contained-host-depending-onevm-unistation-a-tor-transparentproxy-with-only-one-machine/5470
Footnotes[edit]
- ↑
Parameter
-
is required to set the correct paths to/usr/sbin
. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833256 - ↑ Other methods are possible.
- ↑ Usability. Otherwise after installation is complete, user might not be able to login. Needs further testing if still required. Can be avoided for remote servers.
- ↑ Required for Debian netinst "minimal" (no default system tools).
- ↑
See Secure Downloads to understand why
curl
and the parameters--tlsv1.3 --proto =https
are used instead ofwget
. - ↑
Placing an additional signing key into folder
/usr/share/keyrings
by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder/usr/share/keyrings
using thesigned-by
keyword the signing key will be actually used. Therefore deleting keys in/usr/share/keyrings
is optional if intending to disable an APT repository. See also APT Signing Key Folders. - ↑
apt-get-noninteractive to avoid asking this question.
Setting up anon-base-files (3:4.6-1) ... Configuration file '/etc/machine-id' ==> File on system created by you or by a script. ==> File also in package provided by package contributor. What would you like to do about it ? Your options are: Y or I : install the package contributor's version N or O : keep your currently-installed version D : show the differences between the versions Z : start a shell to examine the situation The default action is to keep your current version. *** machine-id (Y/I/N/O/D/Z) [default=N] ? i
- ↑
VirtualBox:
EXT_IF="enp0s3"
- ↑
This was required in Qubes to make Whonix-Gateways Own Traffic Transparent Proxy work. In that case, append to
/etc/whonix_firewall.d/50_user.conf
.NON_TOR_GATEWAY="\ 127.0.0.0-127.0.0.24 \ 10.137.0.0-10.138.255.255 \ " - ↑
DisableNetwork 0
is required to make sdwdate work because the connectivity check locks at it.