blocking networking until sdwdate finished

Patrick · June 25, 2018, 3:19am

~~sdwdate-gui is not started by default in #Qubes because make sdwdate-gui Qubes friendly is not done.~~

~~Once we have that graphical user interface part done and once we have enable sdwdate-gui systray by default done and a ton of testing we can get a new #anonymity feature:~~

iptables block network access until #sdwdate succeeded.

Instructions for testing:
Network Time Synchronization - Whonix

troubadour · June 25, 2018, 9:03pm

There has been some work on sdwdate-gui for Qubes for a while. I was waiting for Whonix 14 to be officially released before calling for testers. Did not update https://phabricator.whonix.org/T534 (lack of time).

https://github.com/troubadoour/sdwdate-gui

The installation is straightforward for the templates (whonix-gw-14 and whonix-ws-14 for the time being) but some files have to be installed in dom0 too.

I could write some installation instructions for testers, depending on an answer. Will the name of the templates and gateway include version number in Whonix 14 release?

Current status:

sys-whonix menu includes Tor status and Tor control panel, providing https://github.com/troubadoour/tor-control-panel is installed.
the anon vms menu are the same as old sdwdate-gui.
the anon vms are registered when starting.
the anon vms are unregistered when powered off normally, not when killed.

Patrick · June 26, 2018, 2:59am

That’s great! Yes, please write the instructions for testers!

Yes.

whonix-gw-14 and whonix-ws-14

troubadour · June 26, 2018, 6:41pm

Which means sys-whonix-14 too ?

Patrick · June 27, 2018, 1:11am

No. Only templates will be versioned.

Names sys-whonix and anon-whonix stay as is.

Reference:

Patrick · August 19, 2018, 8:11pm

Documentation is now here:
https://www.whonix.org/wiki/Network_Time_Synchronization#Block_Networking_until_sdwdate_Finishes

TNT_BOM_BOM · June 16, 2022, 5:53pm

Iptables now deprecated and replaced with nftables, better to change to nftables for future support and avoiding issues.

Patrick · June 17, 2022, 7:52am

https://phabricator.whonix.org/T509

TNT_BOM_BOM · July 23, 2022, 9:31pm

I used this in qubes it works good except it doesnt resume so well if Tor didnt first time worked properly (like there is no connection at first time, or delayed tor run…) specially in GW, but otherwise works ok.

TNT_BOM_BOM · July 25, 2022, 4:24pm

Side question:

Why it need to be implemented in both WS and GW if tor and internet are only in GW anyway?

Patrick · July 27, 2022, 11:50am

This feature needs more work.

Needs instructions for users how to test this feature.
Enabling this feature using firewall_mode= is quite unusual and weird.

Patrick · July 27, 2022, 11:54am

Whonix-Gateway: The user’s clock might be slow while at the same time an outdated Tor consensus was sent to the user (man-in-the-middle attack) (replay attack). If sdwdate manages to connect to onions to fetch the time and it knows the time is later then the VM clock, it will move the VM clock forward. Tor would notice the time change, disregard the outdated Tor consensus and download a fresh Tor consensus or fail closed. The goal is to wait for a “guarantee” that the user’s system clock isn’t slow before permitting “all” Tor connections. “All” means other than just only Tor and sdwdate over Tor.
Whonix-Workstation: Applications might leak the VM time to remote servers. Therefore wait for sdwdate to set and randomize it so it’s guaranteed to be different form the host (and Whonix-Gateway).

More on all of these technical considerations here: