Last update: March 17, 2019. This website uses cookies. By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. More information

 Actions

ZeroNet: Decentralized Censorship-resistant Network

ZeroNet - Decentralized websites

Introduction[edit]

The ZeroNet wiki describes the software design: [1]

ZeroNet uses Bitcoin cryptography and BitTorrent technology to build a decentralized censorship-resistant network. Users can publish static or dynamic websites in ZeroNet and visitors can choose to also serve the website. Websites will remain online even if it is being served by only one peer.

This means users are not identified or reachable by an IP address, since they are identified by a public key - specifically a public Bitcoin address. The private key owner can sign and publish changes, which are propagated through the network. Sites are accessed through an ordinary browser in combination with the Zeronet application. [2] The BitTorrent technology refers to the use of trackers to negotiate peer connections. [3] ZeroNet can be optionally configured to use Tor for anonymity. [4]

The Zeronet wiki describes various features and benefits, including: [1]

  • Password-less authorization - the user account is protected by the same cryptography that applies to Bitcoin wallets.
  • Easy setup. [5]
  • Immediate updating of sites in real time.
  • Works with any browser.
  • Full Tor network support, including onion services.
  • Content cannot be censored (removed) after publication.
  • It is impossible to shut down content, since content is served by any user who wishes to.
  • ZeroNet is fast and works offline.

Connecting to Tor before ZeroNet[edit]

These instructions lead to the following connection scheme in Whonix:

User -> Tor -> ZeroNet -> Internet

Installation[edit]

onion-grater Profile Update[edit]

Download the updated ZeroNet onion-grater profile. [7]

Qubes-Whonix ™: Download to be done in an AppVM anon-whonix and then copy over the profile to the whonix-gw-14 TemplateVM. 

scurl-download https://raw.githubusercontent.com/Whonix/onion-grater/master/usr/share/doc/onion-grater-merger/examples/40_zeronet.yml

Review its contents. 

cat 40_zeronet.yml

Move the updated ZeroNet onion-grater profile.

(Qubes-Whonix ™: TemplateVM whonix-ws-14)

Whonix 14: 

sudo mv 40_zeronet.yml /usr/share/onion-grater-merger/examples/40_zeronet.yml

Whonix 15 and above: [8] 

sudo mv 40_zeronet.yml /usr/share/doc/onion-grater-merger/examples/40_zeronet.yml

onion-grater Adjustments[edit]

Complete the following steps in Whonix-Gateway ™ (sys-whonix).

Extend onion-grater Whitelist

On Whonix-Gateway ™.

Create a new directory. [9] 

sudo mkdir -p /usr/local/etc/onion-grater-merger.d/

Symlink the onion-grater profile to the onion-grater settings folder.

Whonix 14: 

sudo ln -s /usr/share/onion-grater-merger/examples/40_zeronet.yml /usr/local/etc/onion-grater-merger.d/

Whonix 15 and above: 

sudo ln -s /usr/share/doc/onion-grater-merger/examples/40_zeronet.yml /usr/local/etc/onion-grater-merger.d/

Restart onion-grater. 

sudo service onion-grater restart

Modify Firewall Settings[edit]

Modify the Whonix-Workstation ™ (anon-whonix) user firewall settings and reload them.

Modify Whonix-Workstation ™ User Firewall Settings

Note: If no changes have yet been made to Whonix Firewall Settings, then the Whonix User Firewall Settings File /etc/whonix_firewall.d/50_user.conf appears empty (because it does not exist). This is expected.

If using Qubes-Whonix ™, complete these steps.
In Whonix-Workstation ™ AppVM.

Make sure folder /rw/config/whonix_firewall.d exists. 

sudo mkdir -p /rw/config/whonix_firewall.d

Open /rw/config/whonix_firewall.d/50_user.conf with root rights. 

kdesudo kwrite /rw/config/whonix_firewall.d/50_user.conf

If using a graphical Whonix-Workstation ™, complete these steps.

Start Menu -> Applications -> Settings -> User Firewall Settings

If using Non-Qubes-Whonix ™, complete this step.

In Whonix-Workstation ™, open the whonix_firewall configuration file in an editor. 

sudo nano /etc/whonix_firewall.d/50_user.conf

For more help, press on Expand on the right.

Note: This is for informational purposes only! Do not edit /etc/whonix_firewall.d/30_default.conf

The Whonix Global Firewall Settings File /etc/whonix_firewall.d/30_default.conf contains default settings and explanatory comments about their purpose. By default, the file is opened read-only and is not meant to be directly edited. Below, it is recommended to open the file without root rights. The file contains an explanatory comment on how to change firewall settings. 

## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom configuration,
## which will override the defaults found here. When Whonix is updated, this
## file may be overwritten.

See also Whonix modular flexible .d style configuration folders.

To view the file, follow these instructions.

If using Qubes-Whonix ™, complete these steps.

Qubes App Launcher (blue/grey "Q") -> Template: whonix-ws-14 -> Whonix Global Firewall Settings

If using a graphical Whonix-Workstation ™, complete these steps.

Start Menu -> Applications -> Settings -> Global Firewall Settings

If using Non-Qubes-Whonix ™, complete this step.

In Whonix-Workstation ™, open the whonix_firewall configuration file in an editor. 

nano /etc/whonix_firewall.d/30_default.conf

Add. 

EXTERNAL_OPEN_PORTS+=" 15441 "
EXTERNAL_OPEN_PORTS+=" 33750 "

Save.

Reload Whonix-Workstation ™ Firewall.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") -> Whonix-Workstation ™ AppVM (commonly named anon-whonix) -> Reload Whonix Firewall

If you are using a graphical Whonix-Workstation ™, complete the following steps.

Start Menu -> Applications -> System -> Reload Whonix Firewall

If you are using a terminal-only Whonix-Workstation ™, run. 

sudo whonix_firewall

Install Dependencies[edit]

Run the following commands in Whonix-Workstation ™ terminal. (Qubes-Whonix ™: TemplateVM whonix-ws-14)

Update the package lists. 

sudo apt-get update

Install git, python-msgpack and python-gevent. 

sudo apt-get install git python-msgpack python-gevent

Get Signing Key[edit]

Run the following commands in Whonix-Workstation ™ terminal. (Qubes-Whonix ™: AppVM anon-whonix)

Retrieve the ZeroNet signing key. [10] 

gpg --recv-keys "960F FF2D 6C14 5AA6 13E8 491B 5B63 BAE6 CB96 13AE"

Install ZeroNet[edit]

Run the following commands in Whonix-Workstation ™ terminal. (Qubes-Whonix ™: AppVM anon-whonix)

ZeroNet is not yet packaged for Debian, so it must be manually installed. [11] [12]

Download ZeroNet. 

git clone https://github.com/HelloZeroNet/ZeroNet.git

Navigate to the ZeroNet folder. 

cd ZeroNet

Check the ZeroNet signature. 

git log --show-signature

Launch ZeroNet[edit]

Qubes-Whonix ™: 

./zeronet.py --tor always --fileserver_ip $(qubesdb-read /qubes-ip)

Non-Qubes-Whonix ™: 

./zeronet.py --tor always --fileserver_ip 10.152.152.11

Start Tor Browser.

If you are using Qubes-Whonix ™.

Qubes Start Menu -> Whonix-Workstation ™ AppVM (commonly called anon-whonix) -> Tor Browser

If you are using Non-Qubes-Whonix ™.

Start Menu -> Tor Browser

If you are using a terminal (Konsole).

torbrowser

Note: The following steps will no longer be required once Whonix releases a custom Tor Browser for connecting to alternative networks. [13]

Configure Tor Browser to connect to localhost.


In Tor Browser:

  1. Type about:config into the URL bar.
  2. Press Enter
  3. Search for network.proxy.no_proxies_on
  4. Set to 0

Navigate to the ZeroNet web interface. Paste http://127.0.0.1:43110 into Tor Browser's URL field and press enter. For additional tips on visiting sites, see: How does it work?

The process is now complete and ZeroNet should be fully functional in Whonix ™. [14]

Footnotes[edit]

  1. ↑ 1.0 1.1 https://zeronet.readthedocs.io/en/latest/
  2. ↑ ZeroNet acts as a local web server for these pages.
  3. ↑ https://en.wikipedia.org/wiki/ZeroNet
  4. ↑ https://zeronet.io/docs/faq/#how-to-use-zeronet-with-tor
  5. ↑ Although the Chinese government has blocked the ZeroNet website and bittorrent tracker.
  6. ↑ Security considerations:
    • By using Whonix ™, additional protections are in place for greater security.
    • This application requires access to Tor's control protocol.
    • In the Whonix ™ context, Tor's control protocol has dangerous features. The Tor control command GETINFO address reveals the real, external IP of the Tor client.
    • Whonix ™ provides onion-grater, a Tor Control Port Filter Proxy - filtering dangerous Tor Control Port commands.
    • When this application is run inside Whonix ™ with an onion-grater whitelist extension, this will limit application rights to Tor control protocol access only. Non-whitelisted Tor control commands such as GETINFO address are rejected by onion-grater in these circumstances.
    • During the application's normal operations it should not attempt to use dangerous Tor control commands such as GETINFO address. In the event the application or Whonix-Workstation ™ are compromised, this command would be rejected.
    • In comparison, if the application is run on a non-Tor focused operating system like Debian, it will have unlimited access to Tor's control protocol (a less secure configuration).
    • If the (non-)Whonix platform is used to host onion services, then running applications are more vulnerable to attacks against the Tor network compared to when Tor is solely used as a client; see also Onion Services Security.
    In conclusion, Whonix ™ is the safest and correct choice for running this application.
  7. ↑ https://github.com/Whonix/onion-grater/blob/master/usr/share/doc/onion-grater-merger/examples/40_zeronet.yml
  8. ↑ So no longer required after package upgrades.
  9. ↑ Using /usr/local/etc/onion-grater-merger.d/ because that onion-grater settings folder is persistent in Qubes-Whonix ™ TemplateBased ProxyVMs, i.e. Whonix-Gateway ™ (commonly called sys-whonix). Non-Qubes-Whonix ™ users could also use /etc/onion-grater-merger.d/. Qubes-Whonix ™ users could also use /etc/onion-grater-merger.d/ but then users would have to make /etc/onion-grater-merger.d/ persistent, which would require doing this inside the Whonix-Gateway ™ TemplateVM (commonly called whonix-gw-14) and restart their Whonix-Gateway ™ ProxyVM or to use bind-dirs. Both is more complicated than simply using /usr/local/etc/onion-grater-merger.d/ which is persistent either way and even allows multiple Whonix-Gateway ™ ProxyVMs based on the same Whonix-Gateway ™ TemplateVM for lets say one Whonix-Gateway ™ ProxyVM extending and relaxing onion-grater's whitelist and the other Whonix-Gateway ™ ProxyVM with the default more restricted onion-grater whitelist.
  10. ↑ https://github.com/HelloZeroNet/ZeroNet/issues/759
  11. ↑ https://github.com/HelloZeroNet/ZeroNet/issues/241
  12. ↑ http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850474
  13. ↑ Except in the case of YaCy, which needs internet access.
  14. ↑ Functionality was last confirmed in May 2018.

No user support in comments. See Support.

Comments will be deleted after some time. Specifically after comments have been addressed in form of wiki enhancements. See Wiki Comments Policy.


Add your comment
Whonix welcomes all comments. If you do not want to be anonymous, register or log in. It is free.

Random News:

Bored? Want to chat with other Whonix users? Join us in IRC chat (Webchat).

https | (forcing) onion

Share: Twitter | Facebook

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation.

Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian. Debian is a registered trademark owned by Software in the Public Interest, Inc.

Whonix ™ is produced independently from the Tor® anonymity software and carries no guarantee from The Tor Project about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint.

Retrieved from "https://www.whonix.org/w/index.php?title=ZeroNet&oldid=47088"