Made a feature request:
Instructions on getting onionshare to work in Whonix progressed far although they are still unfinished: Next - Whonix
Help would be welcome with the following two required control port filter python features that are missing to add onionshare support.
- CONTROL_PORT_FILTER_WHITELIST wildcard feature
- Control Port Filter Proxy does not yet support registering Tor control protocol events
…since I am busy with various stuff, and since @troubadour is busy with various stuff and our new…
source forge help wanted post: https://sourceforge.net/p/forge/helpwanted/programmers/thread/34928768/
Lots of progress has been made. There is a very good chance it will work in Whonix 14.
For reference:
https://phabricator.whonix.org/T561
https://phabricator.whonix.org/T581
https://phabricator.whonix.org/T448
https://phabricator.whonix.org/T446
https://phabricator.whonix.org/T574
https://phabricator.whonix.org/T594
https://phabricator.whonix.org/T445
maybe future work:
https://phabricator.whonix.org/T564
1 Like
ongoing discussion:
decide if we should install onionshare by default in Whonix 14
⚓ T595 install onionshare by default in Whonix 15
Won’t make it into Whonix 14. Unfortunately, it is not available from Debian stretch.
https://packages.debian.org/search?keywords=onionshare
Does anyone know why?
Weird. Its on every Debian version except current stable…
Attempts to build it on Stretch are failing:
3 Likes
Tails is using the onionshare from sid:
It seems Tails is enabling all the repository enabled and then use pin-priority to control where should a package be download and installed from.
cat config/chroot_apt/preferences:
Package: onionshare
Pin: release o=Debian,n=sid
Pin-Priority: 999
Is this a feature that is nice to have in Whonix? Or do we have any concern causing us not to adopt this approach ?
2 Likes
As far I know, Tails doesn’t support full upgrades. Only point release
upgrades. So not comparable wrt upgrades and pinning.
Apt pinning is too complicated and must be avoided. Reasoning:
2 Likes
For those who would like to use or try onionshare…
After cloning Micah’s repository and building the package, there was an issue running it.
I don’t know which version of onionshare the .d onion-grater white list 40_onionshare.yml was written for, but with version 1.2 (as stated in the GUI), I had to add a line to the ADD_ONION command.
Mimicking NEW:BEST Port=
- pattern: 'NEW:RSA1024 Port=80,(176[0-5][0-9])'
replacement: 'NEW:RSA1024 Port=80,{client-address}:{} Flags=DiscardPK'
2 Likes
Btw for those who don’t know (information not connected here), instructions can be found here:
Thanks!
0.9.2 most likely.
1 Like
1 Like
It seems onionshare will land on stretch-backports but not stretch:
1 Like
A regression about showing the Whonix advice if onion-grater profile is not active yet in Whonix 15 / debian buster based.
Added support for OnionShare in “bundled Tor” configuration which is the default in Debian buster version of OnionShare.
This will come through Whonix 15 package upgrades at some point in future.
1 Like
Over on tor-dev, this thread makes it very clear that v2 onions are plain dangerous for various reasons.
https://lists.torproject.org/pipermail/tor-dev/2020-May/014322.html
I note this because the current version of OnionShare from Debian buster (v1.3.2) installed in Whonix defaults to legacy v2 as you can see in my screenshots recently added.
(Which is funny, since if you have a much later Tor version >3.5.X like that provided by Whonix, it is apparently meant to default to v3? Maybe that is only for later OnionShare software version?)
So I guess this might be something where we recommend users default to a later installed version from Sid? (v2.2-2) and take their chances. Bullseye has v2.2. Otherwise they are at real risk of having their ass hacked by capable adversaries.
Debian bullseye = Debian sid = onionshare 2.2-2 at time of writing.
Yes. v2 vs v3 is entirely up to OnionShare, I think. Debian bullseye version uses v3 if I am not mistaken.
Could go back to manual installation instructions.
Outdated, Deprecated, Archived Whonix Documentation.
Can also consider to no longer install by default in Whonix until Whonix is based on Debian bullseye.
1 Like
OnionShare wiki page issues
Why not just use Flatpak for latest version instead (in the appendix part)? Micah has removed build dependencies information for OnionShare - can’t find them anywhere for v2.3.1 They are just pushing snap and flatpak instead for Linux.
This would be easy in non-Qubes-Whonix (only a few steps - see below).
Of course in Qubes-Whonix the AppVM steps would need to be done everytime, but at least you have latest, fully-functional, secure, v3 onions version. The Debian version is ancient and even next testing version is still only v2.2.
With the next Debian release due soon, that means we’ll be stuck with v2.2 for a couple more years - not good enough, because anonymous chat is only available in v2.3 and it is arguably far better/secure than the messengers we recommend in the wiki.
This works →
In whonix-ws-15-onionshare TemplateVM:
sudo apt-get install flatpak
In whonix-ws-15-onionshare AppVM (not allowed in TemplateVM, any way around that?):
Add the Flathub repository:
flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
Install in AppVM (can’t be done in TemplateVM again, any way around that?):
flatpak install flathub org.onionshare.OnionShare
Run in AppVM:
flatpak run org.onionshare.OnionShare
Tested and works nicely with v2.3.1
A pain, but v1.3.2 in Debian is hopelessly out-of-date i.e. doesn’t allow receiving files anonymously, anonymous websites or anonymous chat and only legacy v2 onions i.e. useless by comparison and a security risk.
Also, flatpak instructions are far easier than that build stuff we have on the relevant wikipage right now. If you don’t like the steps above, would this work in both Qubes-Whonix and non-Qubes-Whonix? →
https://docs.onionshare.org/2.3/en/install.html#install-in-linux
You can also download and install PGP-signed .flatpak or .snap packages from Index of /dist/ if you prefer.
I guess for Qubes → download in AppVM, get Micah’s key, verify, copy to TemplateVM, install (for persistence). Dunno, I never use Flatpak.
Random error
Do you see this when trying to run standard onionshare in Whonix 15? (I guess I installed Firejail at some stage…). Doesn’t happen with later OnionShare versions > v1.3.2.
Type: “whonix” for help.
uwt INFO: Stream isolation for some applications enabled. uwt / torsocks will be automatically prepended to some commands. What is that? See:
uwt INFO: Stream Isolation: Easy
user@host:~$ onionshare-gui
Reading profile /etc/firejail/onionshare-gui.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 2023, child pid 2024
Child process initialized in 78.28 ms
/usr/lib/uwtwrapper: line 327: /sbin/ifconfig: Permission denied
Parent is shutting down, bye…
1 Like