diff options
Diffstat (limited to 'feed.org')
| -rw-r--r-- | feed.org | 652 |
1 files changed, 16 insertions, 636 deletions
@@ -8,6 +8,10 @@ #+TOC: headlines 1 * Siddhartha by Hermann Hesse :post:book: +:PROPERTIES: +:ID: 22138706-ea97-4202-8c7f-a50511f31237 +:PUBDATE: 2025-04-05 Sat 00:54 +:END: (This post contains spoilers) @@ -32,129 +36,32 @@ This book has been rattling in my brain since I read it a couple month ago. I wa * The Tor Browser :post:tor: :PROPERTIES: -:ID: 8f5fa802-7b45-4470-b583-39b891351d53 -:PUBDATE: 2025-04-04 Fri 22:59 -:END: -** Intro -:PROPERTIES: -:ID: 0fe80c68-cfe8-4a3a-aaff-9c12055052b6 -:END: - -The immediate threat of government retaliation for speech hasn't been clearer in decades as it is now in the U.S. under the Trump administration. Journalists, law firms, and polling orgs are being targeted in viewpoint-based lawsuits. Legal permanent residents and writers are being held hostage or sent to El Salvidor-ian labor prisons without charges or due process explicitly for their speech. In the cases of targeted individuals, much of the 'evidence' found by the executive--and often the speech retaliated against--happened online. - -When the internet and online social spaces are rife with surveillance, and our activity is so often tied to our personal identifiers (IP address, name, phone #, email, address, etc.), the job of a malicious government is easy. Every time you fedpost about Trump on Instagram, express support for groups the US is opposed to, or write a controversial article with your name at the top of it, you leave a trail of breadcrumbs--no, a trail of loafs--that tons of organizations and governments can use to learn your political persuasions, and potentially persecute you for them. - -When you can't trust your network, your ISP, the sites you're visiting, or your government with your internet activity, the value of anonymity becomes clear. The Tor Browser is a web browser that mitigates many of these threats by making your browsing anonymous. Using it, you can create and maintain accounts on various websites, participate in conversation, publish your writing, and get access to information without being surveilled. - -** Hiding your web traffic with the Tor Network -:PROPERTIES: -:ID: 1ea56e33-c36c-46f6-b479-612feef4b312 -:END: - -The first job of the Tor Browser to hide your traffic from your network, your ISP, and to keep your IP address hidden from the websites you visit, and it solves this problem in a very cool way. When you visit a website through the Tor Browser, your traffic is sent through the Tor Network, which is a network of thousands of servers run by volunteers. Your traffic is encrypted three-fold and sent through a randomly-picked three servers in the network, in such a way where no single node can see both your IP address the IP address you're visiting. - -This means that your network and ISP can't know what website you're visiting; it'll just be a bunch of encrypted traffic into the Tor Network. The website you're visiting also won't know where your connection came from, just the IP address of the exit node. And even the tor nodes your traffic was routed through can't simultaneously know your IP address and the address of the website you were visiting. Your three-node "circuit" will automatically rotate periodically as well. Basically it's a proxy/VPN on steroids. - -Now, as mentioned above, it's important to stress that though your traffic is truly hidden, by default your network and ISP *will* know that you're using Tor for /something/. Using Tor is not illegal anywhere in the US (as far as I know?), but it may be suspicious to your network administrator or possibly blocked on your network. If you're worried about your network and ISP knowing you're using Tor, you can use "bridges", which are a fourth optional random proxy your traffic will go through before entering the Tor Network to further obscure the nature of your connection. You can easily enable this in your "connection settings", which will be available right after starting the browser for the first time. - -Also, because your traffic is being passed through so many servers on the way to its destination, keep in mind that browsing will be significantly slower than you're probably used to. It's comfortable enough on a fast home connection, but trying to stream HD video, or using Tor over a mobile connection or with slower home internet can get painful. - -** Anti-fingerprinting -:PROPERTIES: -:ID: 1baaf1c5-6a3c-4828-b931-0e678567da83 -:END: - -Aside from the network, online surveillance is often done through "fingerprinting", where a website can see/query your browser for all sorts of information to build a profile on your connection. The fonts installed on your computer, browser cookies, browser extensions, your screen size and many more variables can be used to build a unique fingerprint and expose you to tracking. - -To stop these kinds of attacks, the Tor Browser has many anti-fingerprinting protections build-in, that attempt to make your connection look like every other Tor users, so no-one seems unique. - -*** Letterboxing -:PROPERTIES: -:ID: 5d9bac8e-a091-4569-94e6-83d74b547a3b -:END: - -The Browser uses letterboxing, which is a curious little feature that disguises your screen size by having a certain number of pre-chosen website sizes that the window will snap to. This is hard to describe in words but you'll notice it quickly when you use the Browser. You can resize the window as granularly as you wish, but the website will only grow and shrink in certain particular sizes. - -*** No history -:PROPERTIES: -:ID: 42fe608f-9578-4c58-9d8f-7fcd9965355d -:END: - -Every time you close the Tor Browser, all cookies and history is removed, so you'll get a clean start every launch. - -*** Hide everything! -:PROPERTIES: -:ID: 74bb442b-9c5d-494f-bde9-03c308946648 -:END: - -When information about your browser and operating system are typically sent to website, the Tor Browser will lie and claim every user is using the same devices. It will hide your time zone, your installed fonts, and refuse to use many risky APIs that can be privacy-intrusive. - -** Don't make yourself unique -:PROPERTIES: -:ID: 06330165-b798-4e72-9210-5324f50d0086 +:ID: 0ebb418d-f15f-4379-8343-a4c5a9054d7a +:PUBDATE: 2025-04-05 Sat 07:47 :END: - -By default, the Tor Browser will use these network and anti-fingerprinting features to make your browser and your connection look as similar as possible to every Tor user, so everyone's traffic is all mingled and indecipherable and difficult to track, but you can definitely break your anonymity by making mistakes when using it. Here are some things to avoid: - -*** Don't mix Tor and non-Tor traffic/accounts/identities !!! +[[https://skylarcloud.xyz/posts/tor-browser.html][How and why of the Tor Browser, used to browse/publish on the internet anonymously and escape censorship.]] +* 3 Browser extensions I almost always install :note: :PROPERTIES: -:ID: 39fbdcb9-59f7-4ba1-a9e4-3ff9cba44129 -:END: - -- If you create an anonymous online account using Tor, and then access that account on another device without using Tor, you've deanonymized yourself. -- If you use Tor to commit a crime, and in another tab you access a personal social media service using the same Tor connection, you've deanonymized yourself. -- If you start a blog using Tor, and publish a post with your name, you've deanonymized yourself. -- If you're talking to someone on Tor, and you give them your personal email to talk further, you've deanonymized yourself. - -This is the most common class of mistake Tor users make that leads to arrests. Always understand what information you may be accidentally linking together that could connect your anonymous activities to your personal identity. - -*** Don't configure the browser -:PROPERTIES: -:ID: 48a6ee10-1100-4e21-bbad-fae4b5c3094d -:END: - -Because the Tor Browser is designed to make everyone's connection look similar, if you start changing settings or installing extensions, your browser will become more unique and trackable. Just use Tor as it is default. - -**** Exceptions -:PROPERTIES: -:ID: 9a8b296b-e3eb-4d21-87be-6a008f22b644 -:END: - -Now that we know the rule of thumb (don't touch things!), there are a couple things we *can* safely configure. - -***** Security settings -:PROPERTIES: -:ID: 64cbccfa-ee4e-482f-bddd-6b0060a5f923 +:ID: b366ef4e-8747-49af-ba35-a088163c7623 +:PUBDATE: 2025-04-03 Thu 05:40 :END: - -In the browser settings, there are three "security levels" you can choose from. Choosing the "safer" options will restrict websites from more potentially-risky activity, at the cost of many more websites not being able to function. I'd recommend defaulting to the most secure option and lowering it if a particular site demands it. - -***** Connection settings +** uBlock Origin :PROPERTIES: -:ID: a66f272f-040b-44cf-b447-bcf6704c0318 +:ID: 8035be60-1ae7-47bd-a9b8-40d964dc393b :END: +Perhaps the most ubiquitous content/ad blocker, reliable as ever. I recommend this to anyone and everyone. -As mentioned earlier, you can optionally use a bridge to hide the fact that you're using Tor from your network and ISP. -* 3 Browser extensions I almost always install :post: -:PROPERTIES: -:ID: b366ef4e-8747-49af-ba35-a088163c7623 -:PUBDATE: 2025-04-03 Thu 05:40 -:END: ** Vimium C :PROPERTIES: :ID: c6685409-84da-4101-8c74-efa4ddda78c4 :END: This lets do basic navigation in your browser with vim-like keybindings. You can click links, scroll, go back and forth between tabs and through your history, select/copy/search text and more with your keyboard. + ** Dark Reader :PROPERTIES: :ID: 83562b76-589a-470f-a16c-794bef1bf786 :END: -Makes all websites default to a mode, and provides an easy toggle. -** uBlock Origin -:PROPERTIES: -:ID: 8035be60-1ae7-47bd-a9b8-40d964dc393b -:END: -The most ubiquitous content/ad blocker, reliable as ever. +Makes all websites default to a dark mode, and provides an easy toggle bound to Alt-Shift-d. * Prepping for v2 of my salt repo :note:qubes: :PROPERTIES: @@ -259,531 +166,4 @@ I've figured out how to create an RSS feed using ~ox-rss~, which makes it easy t https://git.skylarcloud.xyz now has a repo with the org and html files used for this site. * Convenient torrenting with qBittorrent :post: -:PROPERTIES: -:ID: a3fa9387-fbfd-41dd-9def-a4588c04bc73 -:PUBDATE: 2025-02-28 Fri 14:30 -:END: -** Introduction -:PROPERTIES: -:ID: cf684caf-eab2-489a-aa19-d0d1bd066d42 -:END: -Your access to media should not be limited by money, nor should it be limited by technical ability. I want to demonstrate with this quick guide that torrenting is as accessible and easy as it's ever been, using Free and open-source software. -** Install qBittorrent -:PROPERTIES: -:ID: 3044ceeb-02e4-4564-a3cc-aa45fae23d41 -:END: -qBittorrent is a Free and open-source BitTorrent client that supports tons of features, but you need to know much at all to get started. To install it, go to their downloads page website at https://www.qbittorrent.org/download and select the right option for your computer. It supports Windows, MacOS, and can be installed through most common package managers on Linux. - -After it's downloaded, install it like you would with any other program. -** Enable the search engine -:PROPERTIES: -:ID: fbfaded9-a520-4235-b31f-e902d0941daf -:END: -To let us search for media, we need to turn on qBittorrent's search engine. -- Click the "View" button in the toolbar -- Check the "Search Engine" box - There should now be a "Search" tab next to "Transfers" under the toolbar -- Click the "Search" tab -- Click "Search Plugins" at the bottom right -- Click "Check for updates" -- Click "Ok" and "Close" to exit the search plugins menu -** Search for and download some media -:PROPERTIES: -:ID: 46c62a55-9791-481d-a1f3-73a171f80851 -:END: -- In the "Search" tab, click on the search bar, enter the name of some movie, and press Return. Very quickly, you should see many results, with slightly different titles, sizes, and numbers of "Seeders", among other things. -"Seeders" refers to the computers that are hosting the media you want. In general, you want to download files being seeded by lots of computers to get the fastest download speeds possible -- Pick a result with a name indicating the media, resolution, and episodes/seasons you want. Double-click it -- A download prompt will appear. It has lots of settings, but you can simply click "Ok" to download it normally. -** Now just wait -:PROPERTIES: -:ID: 2a6bbad6-a1d6-4de8-ad8a-0de0a2747918 -:END: -You can track the progress of torrents being downloaded in the "Transfers" tab. When it's 100% complete, you can right-click the file, and click "Preview file" to have it play in your default media player. - -If you're feeling charitable, you can leave qBittorrent running in the background to seed the files for other users. It'll help keep the media accessible for everyone, and improve download speeds for others. Using a VPN is recommended if you plan on leaving the client running for long periods of time. -** Extra tips -:PROPERTIES: -:ID: 7bf124fd-ae71-4f21-b4e2-721ce20898ce -:END: -*** Consider using a VPN -:PROPERTIES: -:ID: c85d4e5c-94cb-4299-a2e7-70dd16b59401 -:END: -Some copyright holders use bots to detects users downloading their media. If you're not using a VPN, these companies can see your IP and potentially send complaints to your ISP. If you download many things and want to keep your ISP happy, using a VPN will ensure your torrenting can't be traced to your IP address. I personally use and recommend Mullvad ($5/month for 5 devices), but there are other reputable ones like Proton and IVPN. -*** Stream Media -:PROPERTIES: -:ID: 2609a1ba-d7a9-45ce-8233-1fb8b6743691 -:END: -When you go to download a torrent and the download prompt pops up, you can optionally select "Download first and last pieces first" and "Download in sequential order". - -This will likely make the total download take longer, but by downloading it in order, you can stream it in real time. Wait until about 5% of the download is complete, then you can watch it while the rest downloads live in the background. -*** Hosting a media server with Jellyfin -:PROPERTIES: -:ID: 3f543081-e392-43b9-bd6f-194624ae90f5 -:END: -Jellyfin is a Free and open-source media-hosting server you can run on your computer. It'll let you sign in to your library on a smart TV, other devices on your local network, or in a browser. - -Setting it up is outside the scope of this post, but I highly recommend it. It basically just consists of downloading the server, configuring your libraries, installing the clients on your other devices, and logging in to your server. - -https://jellyfin.org/ -* QubesOS Saltstack configuration v1 :post:qubes: -:PROPERTIES: -:ID: 9abfb972-27d0-4f05-b55d-05e4398934ec -:PUBDATE: 2025-02-28 Fri 14:30 -:END: -** Notice: -:PROPERTIES: -:ID: 45c1d704-fcb1-4649-ab5d-ab886aa9e911 -:END: - -*The repository is now hosted on this site at https://git.skylarcloud.xyz, not Github! For up-to-date instructions, refer to the new README.org in the new repo, there have been lots of changes since the publishing of this post.* -** Intro -:PROPERTIES: -:ID: 73391422-9bbd-4c1d-813c-31c5daeb587f -:END: - -I'm publishing the janky V1 of my QubesOS configuration written with Saltstack. It'll help set up a window manager, a couple of handy qubes, Doom Emacs, and the 3isec repo to jump-start your QubesOS experience. - -It's not new-user friendly yet, nor is it in a state where anyone can immediately download and apply it. At the very least you'll need to change the references to my username to yours in the salt files, and make sure the Fedora-40-XFCE and the Debian-12-minimal template are installed on your system. - -You can use my configuration almost as-is (just change the username references!) and it does work, but it's not very feature-filled or optimized, and it's probable that the next versions will conflict with it. -*** Link to repo on Github -:PROPERTIES: -:ID: fd5357f6-8310-46ba-a812-43083d60454f -:END: -+https://github.com/bumbleoats/My-QubesOS-Configuration+ <- See the notice at the top of this post -*** Installation -:PROPERTIES: -:ID: 5e78d85f-11da-46a3-a7ea-9240922cf2bd -:END: - -Make sure ~state.user-dirs~ is active, then just move the repo to ~/srv/user_salt/~ in dom0, and apply with ~sudo qubesctl --all state.apply~ - -**** Resources for installation -:PROPERTIES: -:ID: ba3b1d01-250b-445d-9149-0e21df840e55 -:END: -***** Community user guide for user-salt -:PROPERTIES: -:ID: a5a190bb-c473-4a8f-90bb-dc5cb65b5088 -:END: -- https://forum.qubes-os.org/t/qubes-salt-beginners-guide/20126 -- This was the best resource I found as a beginner, I wasn't able to get anything working until I stumbled on it - -***** Issue I sometimes run into from a fresh QubesOS install -:PROPERTIES: -:ID: cfbddb1d-812f-42c4-8d46-4416e235321e -:END: -- https://github.com/QubesOS/qubes-issues/issues/8491 -- TL;DR: This is the solution that's worked for me, pulled from the discussion: -#+begin_src bash -ln -s /srv/salt/qubes/user-dirs.top /srv/salt/_tops/base/user-dirs.top -#+end_src - -** Programs in dom0 -:PROPERTIES: -:ID: c227f54d-d582-4b34-8873-de37bdd2c133 -:END: -My configuration will install a few programs in dom0. It's important that I put this at the top because generally, you want to limit the number of packages in dom0. Every new package is more attack surface on your most critical qube. I trust the programs I've chosen to add, and by using my configuration, you're implicitly trusting them too. - -Look in ~/srv/user_salt/~ to find the related salt files and see the installed programs. -** Window Management -:PROPERTIES: -:ID: a0946e49-a6bf-4eb9-b17f-35bf00909f0f -:END: -*** i3 -:PROPERTIES: -:ID: c63a113c-04b9-48c6-9a99-ca8e127233ea -:END: -i3 is a tiling window manager. It's used primarily through the keyboard, so muscle memory can operate everything very quickly once you get used to it. When a window is opened, it will be 'tiled', maximizing screen space. To open windows, rofi is used to search for applications and qubes. -**** Keybindings -:PROPERTIES: -:ID: 9bdcb7fa-d477-4554-9e20-a6030eb361d5 -:END: -You can navigate i3 with 'vim-like' keybindings, inspired by the vi text editor. Some basic keybindings are shown below, and you can see many more by reading i3's config file at ~/srv/user_salt/dots/i3~ - -- S = Shift key -- mod = Windows/Command key - -| keybinding | function | -|-------------------+----------------------------------------| -| mod + h/j/k/l | move focus left/down/up/right | -| mod + S + h/j/k/l | move focused window left/down/up/right | -| mod + d | search/launch programs with rofi | -| mod + S + d | switch between windows with rofi | -| mod + S + g | window gap settings menu | -*** Misc -:PROPERTIES: -:ID: effb5970-23b2-4a0c-9439-20fd76b86975 -:END: -~wm.sls~ will do a few other smaller things: -- Sets my default wallpaper -- Sets xrandr default screenlayout, replace using ARandR -- Creates X11 touchpad configuration for tap-to-click + natural scrolling -- Sources default .bashrc config into ~/root/~ and ~/home/skylar/~ from ~/srv/user_salt/dots/.bashrc~ -- Prioritize xfce4-terminal in ~/usr/bin/qubes-i3-sensible-terminal~ -- Symlink rofi in place of dmenu -** My qubes -:PROPERTIES: -:ID: 166ecd06-a456-4d18-b3ed-ac633775e03e -:END: -*** Emacs -:PROPERTIES: -:ID: 3774aa41-f05b-4ee4-90c0-e2e40c6b0921 -:END: -If you're a Doom Emacs user (there are dozens of us!) this will hopefully make your life slightly easier. - -A template and app qube for Emacs will be created, Doom Emacs will automatically be installed inside the app qube, and the contents of (in dom0) ~/srv/user_salt/dots/doom-emacs~ will be added to the Doom Emacs qube. - -My personal configuration is in the repository and will be written be default, but it's super simple to replace for your own (just find the directory mentioned above). I've done very little with my configuration, and use it basically as it comes out-of-the-box. -*** Torrenting -:PROPERTIES: -:ID: b83fe70b-f33f-4f7d-8081-de714db5ddd6 -:END: -A template and app qube for qBittorrent will be created. The gruxbox theme that I use will be moved from dom0 to the app qube so it's easy to apply. - -qBittorrent is a torrent client that lets you search for and download large files, particularly media files. You can enable the built-in search utility by doing the following: - -1. Navigate to the "View" menu at the top of the window -2. Enable the "Search Engine" option -3. A new tab should show up slightly below called "Search", click it -4. In the new menu, click "Search plugins..." at the bottom -5. Click "Check for updates" -6. Once the search plugins are installed for a default list of trackers, you can close the window and search for media. - -**** VPN use -:PROPERTIES: -:ID: 9932aa97-5b93-4609-8e39-6c842243a83d -:END: -If you're downloading copyrighted content in an area where it's illegal, I would strongly urge you consider using a VPN to hide your IP address. LE is unlikely to bust down your door for watching Spongebob, but copyright holders can and will send letters to your ISP, which can eventually get your internet service shut off if you continue. Tor can be used, but it's extremely slow, and hogs a lot of bandwidth on the network. - -Personally, I use Mullvad and don't have any complaints. Proton and IVPN are reputable as well. -*** Personal/work email -:PROPERTIES: -:ID: 613c3c82-2920-437c-be50-696e171a9882 -:END: -A template for email will be created, and two app qubes, "email-personal" and "email-work". These just have the Thunderbird email client installed so you can sign into your accounts. -** 3isec -:PROPERTIES: -:ID: 40987107-d090-43ca-b141-6a17c2435cc9 -:END: -The 3isec repo is a handy repository of salt files with some miscellaneous utilities. The repository will be added to dom0, their gpg key will be added from this salt repository, and their graphical interface for it will be installed in dom0. You can start it with 'qubes-task-gui' in dom0. - -I usually install common, mirage-firewall, monitor, mullvad-vpn, and sys-multimedia. -** Post install -:PROPERTIES: -:ID: a0303c81-5674-4394-84bb-5c3b8ef9461d -:END: -Almost everything will be done out of the box, but here are some recommended finishing touches: -- Open Emacs in its app qube, run nerd-icons-install-fonts, and reload your Emacs configuration -- Optionally replace config files with your own ~/srv/user_salt/~ -- Optionally install any packages you'll want with 3isec -- Set the storage and networking settings of your qubes to your preference (by default everything will be routed through your default net-qube, probably sys-firewall) -** What's next? -:PROPERTIES: -:ID: 00633b3c-0d26-41c9-a342-7b6f6033d707 -:END: -This project will develop over time as I learn more about Saltstack and continue to work on my personal configuration. I have lots of plans: - -- Signal! I'm embarrassed to admit that I couldn't figure out how to add the Signal repo/gpg-key to a template to install signal-desktop. It's pretty easy to do imperatively, but it'll be a no-brainer to automate once I know a little bit more about Saltstack. -- Replace more templates with minimal ones to save on startup-time/space/updates -- qmenu scrips with rofi to do more with the keyboard -- Browser configuration. I like to set my browsers up in a similar way almost every time with a couple of favorite extensions and configuration. I want to implement this in Saltstack asap. -- A handful of other simple qubes that I often end up creating over time -- Write and implement bash and elisp scripts to improve various QubesOS/Emacs workflows -- Generally improve at Saltstack to make the config more extendable/robust/optimized - -* Create an anonymous Whonix environment with KVM + NixOS :post:tor: -:PROPERTIES: -:ID: b47779ca-2c6d-4311-9dac-001dd7dc020b -:PUBDATE: 2025-02-28 Fri 14:30 -:END: -** The why -:PROPERTIES: -:ID: 47c11c59-9cb5-4143-ab6c-ad0546a8cecb -:END: -I've spent significant time using QubesOS on various computers, and I've been thoroughly spoiled by the VM magic Zen and the Qubes team have enabled. For a few reasons though, I've recently switched my main laptop from running QubesOS to NixOS. NixOS is great: it's declaratively managed, fast, stable, has tons of fresh packages, but I can't help but feel like my trust in the system has decreased a little bit due to the lack of isolation via virtualization that QubesOS provides. - -(3/1/2025 update: I'm using QubesOS again) - -Luckily, while VMs are fantastic to use especially with QubesOS, it's very much possible to get some of the benefits of QubesOS on a host Linux system like NixOS. - -To demonstrate this, I'll be going through a Whonix installation on NixOS using KVM, nix.configuration, and home-manager. I'll talk a bit about the security trade-offs of using KVM over VirtualBox or on QubesOS, and how Whonix can be a useful tool for elevating your secure posture, protecting your host from malware and your activity from being deanonymized. -** What's Whonix? -:PROPERTIES: -:ID: af64a5d6-33b0-4de7-8efd-b76ebfcd2c3d -:END: -Whonix is a 2-VM setup for compartmentalizing your computing, and uses the Tor Network to keep your activity anonymous. It runs on KickSecure (hardened Debian). - -The Whonix "Gateway" VM creates, maintains, and makes available a 'Tor-ified' network connection for the Workstation. - -The Whonix "Workstation" VM is where you'll do your actual computing. It comes with a graphical XFCE desktop with a suite of applications. You can use the build-in Tor Browser to browse anonymously, or use any of the other included applications and have all of it routed through Tor. - -** KVM vs VirtualBox -:PROPERTIES: -:ID: 9d82e5c7-b961-4770-9626-bac82b968c63 -:END: -Whonix supports 2 type-2 hypervisors: KVM and VirtualBox. KVM is build into the Linux kernel, and is thus fully [[https://www.gnu.org/philosophy/free-sw.en.html][Free Software]]. VirtualBox is developed and maintained by Oracle, and is not Free software. I'll be using KVM for these examples, but there's a [[https://www.whonix.org/wiki/VirtualBox][convenient guide for VirtualBox]]. - -** KVM vs QubesOS Zen -:PROPERTIES: -:ID: cea6e5fc-9506-476e-a5ea-6e91f62e47ac -:END: -*** Hypervisor simplicity -:PROPERTIES: -:ID: ac60546d-e418-49e7-81e4-7dc3f812266f -:END: -KVM is part of the Linux kernel, meaning that the virtualization is being done by a larger, monolithic program than a type-1 hypervisor like Zen, with a larger attack surface. - -*** Type-1 vs type-2 hypervisor -:PROPERTIES: -:ID: a031770f-27c7-42ff-a603-5593e0ba52a0 -:END: -KVM runs on a host Linux system, and therefor the contents of the VM are only as secure as the host system. This is perhaps the biggest downside to running this KVM setup over Qubes in terms of security. I'd recommend delegating any risky activity to VMs like Whonix to try to mitigate the risk of malware running on your host system. - -*** No sys-net/firewall/usb/audio/etc. -:PROPERTIES: -:ID: 639f9acf-94d0-4b49-abd5-e8e239687398 -:END: -QubesOS uses VMs to compartmentalize the hardware, and running Whonix on a Linux host keeps those in the domain of the large Linux kernel. - -*** Performance -:PROPERTIES: -:ID: f733af8a-d33c-487a-b609-40f75cda586a -:END: -Whonix on KVM performs about as well as on QubesOS (varying based on how much virtual CPU/memory you allocate of course), but a big benefit of having a Linux host is that the applications ran in it won't be slowed down by virtualization. Risky activities can be compartmentalized while keeping the main system fast and convenient to use. - -*** Relevant Whonix security documentation -:PROPERTIES: -:ID: 3d6e8f20-0a28-4f09-bfb6-072bd693f0d2 -:END: -The advantages QubesOS has over KVM listed above are just a few basic examples. QubesOS has a much more robust security model in many ways, and if your security is *essential*, you should understand the downsides: -- https://www.whonix.org/wiki/Qubes/Why_use_Qubes_over_other_Virtualizers - -** Installing Whonix on KVM -:PROPERTIES: -:ID: e0335f30-3a55-408f-a6a3-24e022a64bfe -:END: -Make sure to check the relevant NixOS and Whonix documentation to ensure these examples are up-to-date. Always be weary of executing commands from a random blog on the internet, and go to the source whenever possible. - -- [[https://nixos.wiki/wiki/Virt-manager]] -- [[https://www.whonix.org/wiki/KVM]] - -Some of this setup (packages, user groups, dconf settings, the actual virtualization setup) is declaratively configured, but many of the commands to set up Whonix are not. On a fresh NixOS system build with your configuration.nix, you'll still need to download the Whonix images and set them up with the commands outlined below. It's possible more (or even all?) of this could be done declaratively with more NixOS knowledge. - -*** Installing KVM + Virt-manager -:PROPERTIES: -:ID: 120183b6-2495-41d9-93be-0a6a43de95dd -:END: -Enable libvirtd and virt-manager - -#+begin_src nix - # /etc/nixos/configuration.nix - virtualisation.libvirtd.enable = true; - programs.virt-manager.enable = true; -#+end_src - -Add user to the libvirtd group - -#+begin_src nix - # /etc/nixos/configuration.nix - # Replace USER with your username - # extraGroups will likely be populated, just add libvirtd to whatever's already there - users.users.USER = { - extraGroups = [ "libvirtd" ]; - }; -#+end_src - -Enable qemu connection by adding dconf settings through home-manager - -#+begin_src nix - # /etc/nixos/configuration.nix - # Replace USER with your username - home-manager.users.USER = { pkgs, ... }: { - # Point virt-manager to qemu as a source for virtualization - dconf.settings = { - "org/virt-manager/virt-manager/connections" = { - autoconnect = ["qemu:///system"]; - uris = ["qemu:///system"]; - }; - }; - }; -#+end_src - -Start qemu's virtual networking, allowing VMs to communicate - -#+begin_src sh -# Start qemu networking -sudo virsh -c qemu:///system net-autostart default -sudo virsh -c qemu:///system net-start default -#+end_src - -*** Download the Whonix XFCE .qcow archive -:PROPERTIES: -:ID: ae0caa76-6584-4ce4-b34e-1b5485d96e8b -:END: -- You can the most up-to-date versions directly from their website: - - https://www.whonix.org/wiki/KVM#Download_Whonix - - You can optionally append '.torrent' to the direct download URL on their site to download the torrent file. This can be used in any BitTorrent client to download with faster speeds and without using as much of the project's bandwidth. If you have a BitTorrent client I recommend this method. - -*** Extract the archive -:PROPERTIES: -:ID: 84b8a85f-b84c-4924-9613-cc580e0b417d -:END: -Make sure your working directory and archive are both in your home directory. (You may need to src_sh[:exports code]{mv ~/Downloads/Whonix* ~/}) - -#+begin_src sh -# Unpacking archive with gnu tar -[~/]$ tar -xvf Whonix*.libvirt.xz -#+end_src - -*** Agree to the Whonix Binary License Agreement -:PROPERTIES: -:ID: 3b2811df-e300-4ac0-b24f-5d565b794cb8 -:END: -To read the agreement, use: - -#+begin_src sh -# Prints the license agreement -[~/]$ more WHONIX_BINARY_LICENSE_AGREEMENT -#+end_src - -Assuming you agree: - -#+begin_src sh -# Creates an empty file "..._accepted" that tells Whonix you agree -[~/]$ touch WHONIX_BINARY_LICENSE_AGREEMENT_accepted -#+end_src - -*** Setup Whonix virtual networks -:PROPERTIES: -:ID: 672fe99f-cc7d-48bc-b35c-4e19120e3e07 -:END: - -#+begin_src sh -# Add virtual networks -sudo virsh -c qemu:///system net-define Whonix_external*.xml -sudo virsh -c qemu:///system net-define Whonix_internal*.xml - -# Activate the networks -sudo virsh -c qemu:///system net-autostart Whonix-External -sudo virsh -c qemu:///system net-start Whonix-External -sudo virsh -c qemu:///system net-autostart Whonix-Internal -sudo virsh -c qemu:///system net-start Whonix-Internal -#+end_src - -*** Import Whonix Gateway and Workstation images -:PROPERTIES: -:ID: dc4ad386-98de-4a52-8bc3-46c636b88268 -:END: - -#+begin_src sh -# Creates two qemu profiles for the Whonix VMs -sudo virsh -c qemu:///system define Whonix-Gateway*.xml -sudo virsh -c qemu:///system define Whonix-Workstation*.xml -#+end_src - -*** Image File Installation -:PROPERTIES: -:ID: 344f94f8-9ca8-42ab-9310-71fbc52667ba -:END: - -#+begin_src sh -# Assigns those qemu VMs to the Whonix .qcow2 images -[~/]$ sudo mv Whonix-Gateway*.qcow2 /var/lib/libvirt/images/Whonix-Gateway.qcow2 -[~/]$ sudo mv Whonix-Workstation*.qcow2 /var/lib/libvirt/images/Whonix-Workstation.qcow2 -#+end_src - -*** Remove Whonix home clutter -:PROPERTIES: -:ID: d5b6ffb8-dc5c-44e3-9365-ee0395697d2a -:END: - -#+begin_src sh -# WARNING: running this command will delete every file that starts with "Whonix" or "WHONIX" in your working directory. -[~/]$ rm Whonix* -[~/]$ rm -r WHONIX* -#+end_src - -** Post-installation -:PROPERTIES: -:ID: 3181e2ed-fecd-485b-a513-7cc2cc07fc04 -:END: -Use the virt-manager application to start Whonix-Gateway, and open its terminal. We'll use setup-dist to create your Tor connection and otherwise prepare Whonix for use. - -#+begin_src sh -# Whonix Gateway VM -[gateway user ~]% sudo setup-dist -#+end_src - -Upgrade the system to pull the latest packages: - -#+begin_src sh -# Whonix Gateway VM -[gateway user ~]% sudo apt-get dist-upgrade -#+end_src - -Start the Whonix Workstation, and repeat the upgrade step: - -#+begin_src sh -# Whonix Workstation VM -[workstation user ~]% sudo apt-get dist-upgrade -#+end_src - -** Using Whonix -:PROPERTIES: -:ID: 1c369ab2-23e4-4c44-871d-06d24bd2f01e -:END: -Assuming the VMs are booting properly and can receive updates, you should be good to go! You now have a compartmentalized environment where your traffic will be anonymized, and any malware should generally be contained to the VM (sophisticated enough malware could theoretically jump the KVM hypervisor, but if that's part of your threat model you probably shouldn't be getting security advice from this blog :P) - -*** Some tips -:PROPERTIES: -:ID: 12d1b372-d414-4002-b138-26c092b50f6f -:END: -**** Basic applications -:PROPERTIES: -:ID: 0fca1ceb-35b7-4ae2-bbb3-c1367622c2f9 -:END: -- Tor Browser: Fingerprinting-resistant browser made for anonymous internet use -- VLC: Video player capable of playing almost media file you throw at it -- KeePassXC: Offline password manager -- GPA (Gnu privacy assistant): Graphical manager GPG/crypto functions -- Electrum: Bitcoin wallet -- Thunderbird: Mozilla email/calendar/RSS client -- and more! - -**** Staying secure and anonymous -:PROPERTIES: -:ID: 3c1e4ae8-75a9-4813-a966-c0d756d9f270 -:END: -Think before you act! Whonix gives you a good platform for staying anonymous, but you can absolutely de-anonymize yourself if you're not careful. - -- If you're signing into a service over Tor, understand that the service can tie your actions to your current Tor identity. You can't sign into your personal Facebook over Tor and expect that Facebook won't know exactly who you are. -- If you're talking in some IRC channel, be skeptical about sharing information about yourself. -- If you're using Electrum wallet to manage Bitcoin, understand the privacy implications of Bitcoin and where you're sending/receiving from. -- Installing extra extensions in the Tor Browser can affect your footprint and make you stand out from other Whonix users -- etc, etc, etc - -There are an uncountable number of ways you could de-anonymize yourself, so *stay vigilant*. Understand the technology you're using, the information you're putting out, and put yourself in the perspective of an adversary trying to de-anonymize you. - -***** Use a live system when possible -:PROPERTIES: -:ID: 9092acc6-88c3-4f87-824f-874b2609e41c -:END: -When you're booting the Workstation VM, you can select the option to run it 'live'. This means that when you shutdown the VM, everything you did during the session is erased. - -This can be useful, if say, you're vising a sketchy site and end up installing malware. Just reboot the VM and you're back to a clean state. - -Ideally, you should only use Whonix persistantly for updating and installing packages from the Whonix repositories. You may want to also use a persistant session for setting up credentials in your KeePassXC database or setup GPG keys, but keep as much sporatic browsing as possible in the live mode. - -***** Optionally disable Javascript in Tor Browser -:PROPERTIES: -:ID: 85a07874-ab33-4236-99eb-936d7ef366e6 -:END: -Javascript adds a massive attack surface to your browser, and disabling it can remove entire categories of browser-based malware. But, many many sites rely on Javascript for basic functionality. - -Personally, I keep Javascript on because I trust KVM to contain malware relatively well, and I only use the Tor Browser in live mode so any potential malware will be wiped on reboot. - -If you care about further hardening the setup, and are willing to break many websites, Javascript can easily be disabled by setting the Tor Browser security level to the highest option. - +[[https://skylarcloud.xyz/posts/torrenting.html][Straightforward guide for using qBittorrent to search for and download media files]] |