Installation and Fix of i2p inside Whonix-Workstation by Default

torjunkie · February 6, 2020, 9:37am

I2P packages are available in buster, so why do we have manual download steps on the I2P wiki page?

https://packages.debian.org/buster/i2p
https://packages.debian.org/buster/i2pd

Does package availability help to solve this?

http://forums.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/t/i2p-integration/4981

And presumably issue of “Installing I2P on Whonix-Gateway ™ (I2P and Tor simultaneously)”

HulaHoop · December 9, 2019, 3:08pm

Outdated instructions Great to see them in upstream now.

The main problems this was attempting to solve was to have a preconfigured TBB copy for accessing .i2p domains and other non-clearnet special TLDs and optimizing I2P operation when tunneled over Tor.

There was also the goal of having an I2P GW, but IMO it is too much work for what is likely inferior security.

Patrick · December 9, 2019, 3:08pm

Could you review https://www.whonix.org/w/index.php?title=I2P&oldid=53339&diff=cur please? @HulaHoop

HulaHoop · December 9, 2019, 3:08pm

Excellent. Thanks @torjunkie

Patrick · December 9, 2019, 3:08pm

Removed i2p repository. Using Debian package now.

https://www.whonix.org/wiki/I2P#Installation_and_Setup

But the Tor Browser local connection workaround is broken? Does not work for me.

Got some apparmor denied messages. Had to disable apparmor. Probably upstream issue but nobody else run into that yet? No Debian bug report yet. Or I just messed up.

Could you please get the i2p installation instructions back up to speed? @HulaHoop

torjunkie · December 9, 2019, 3:08pm

No problem

I tidied up the rest of that page, so it’s just Patrick’s query re: local connection workaround which you can hopefully fix.

For installation steps in Qubes-Whonix, I presume steps 1 - 3 are in the TemplateVM, while the others will be in the AppVM (we’ll need to explicitly define that too).

Patrick · December 9, 2019, 3:08pm

Yes, sudo apt-get update, sudo apt-get install i2p, sudo dpkg-reconfigure i2p in TemplateVM in Qubes. I would hope that step sudo dpkg-reconfigure i2p isn’t even required anymore now that there is a package from packages.debian.org.

HulaHoop · December 9, 2019, 3:08pm

The good news is I discovered this new setting that needs to be disabled to access the console on localhost:

network.proxy.allow_hijacking_localhost -> false

The bad news is no eepsites are reachable at all despite tunnels being formed. Maybe this needs privoxy to work? Will dig more.

HulaHoop · December 9, 2019, 3:08pm

Not working with privoxy either or after tweaking a lot of settings. I’m out of ideas. The connectivity is absolute shit. No tunnels are forming to sustain a healthy connection.

Patrick_mobile · December 9, 2019, 3:08pm

Anything in logs? Clock too inaccurate due to sdwdate? Debian package i2p version too outdated for the network?

torjunkie · December 9, 2019, 3:08pm

OK - I can’t connect to any .i2p sites either.

Downloaded sid I2P version (v9.42 instead of v9.38 in Buster stable) (required dependency libjbigi-jni first before installing I2P)
sudo dpkg-reconfigure I2P
couldn’t connect to anything (Nyx logs show “Have tried resolving or connecting to address [scrubbed] at 3 different places. Giving up.”
re-ran sudo dpkg-reconfigure I2P and disable AppArmor setting
service status check on command line shows I2P is running okay
I can see lots of peers etc. but the main error in router config section is “Network ERR-UDP disabled and inbound TCP host/port not set”
They suggest: “You have not configured an inbound TCP with a hostname and port on the Network config page, however you have disabled UDP. Therefore your router cannot accept inbound connections. Please configure a TCP host and port on the Network configuration page or enable UDP”
Played with various I2P router network settings e.g. enable/disable UDP, prefer IPv4 or IPv6, set TCP ports etc. then reset the connection.

But you can never get a connection to work to any I2P site - Tor Browser says “Error connecting to site XYZ. Try again later etc.” Nyx keeps showing the same error “Have tried resolving or connecting to address [scrubbed] at 3 different places. Giving up.” over and over.

Annoying.

Do we have to set up something special in the I2P router network config or something else?
More Tor Browser config tweaks?
Too much clock skew? (they do warn about that needing to be very accurate in their FAQ somewhere - could be the source of the problem)
Maybe we’d have better luck with latest version 9.44 directly from I2P website? But I doubt it.

Doesn’t like something about being tunneled over Tor and/or something in Whonix config.

HulaHoop · December 9, 2019, 3:08pm

It did not use to be that way. Perhaps they changed something that depends on UDP? Can you please try with a VPN (if you can)?

It would have been the case if it was properly connecting but .i2p pages don’t open - but not the case here.

Was a common error, but never fatal in the past.

HulaHoop · December 9, 2019, 6:22pm

Update:

Some progress. Got I2P to connect to its network. Some optimized settings probably help performance and tunnel setup speed. No VPN hack needed.

The TBB -> localhost:4444 step is broken because of some internal changes in Tor Browser. I confirmed it is working in plain firefox.

HulaHoop · December 9, 2019, 6:29pm

I want to see if secbrowser doesn’t need as much work to get it working. I’ve installed it in the WS but no icon for it anywhere appears.

Patrick · December 9, 2019, 7:25pm

That’s a “feature” to avoid showing up in Whonix.

github.com

Whonix/anon-apps-config/blob/master/debian/anon-apps-config.hide#L13




#### meta start
#### project Whonix
#### category apps and security
#### description
## config-package-dev hide the following files


## gajim plugin installer does not cryptographically verify downloads.
/usr/share/gajim/plugins/plugin_installer/__init__.py


## SecBrowser should not be shown in anonymity distributions by default.
## Tor Browser is installed there already.
/usr/bin/secbrowser
/usr/share/applications/secbrowser.desktop
/usr/bin/download-secbrowser


#### meta end

The secbrowser package is just a metapackage. The “hidden” scripts can be run from here for testing:

/usr/share/anon-apps-config/usr++bin++secbrowser
/usr/share/anon-apps-config/usr++bin++download-secbrowser

HulaHoop · December 9, 2019, 9:14pm

Setting:
extensions.torbutton.use_nontor_proxy true

Allows an I2P page to show up with this message:

The website was not reachable. The website is offline, there is network congestion, or your router is not yet well-integrated with peers. You may want to retry.

EDIT:

It works!

After changing:
network.proxy.share_proxy_settings true

Other settings:

network.proxy.http 127.0.0.1
network.proxy.http_port 8118
network.proxy.no_proxies_on 1
network.proxy.socks_remote_dns false

Privoxy installed and configured with forwarding settings from:

HulaHoop · December 9, 2019, 8:45pm

Secbrowser download attempt

user@host:~$ sudo sh /usr/share/anon-apps-config/usr++bin++download-secbrowser
/usr/share/anon-apps-config/usr++bin++download-secbrowser: 10: /usr/share/anon-apps-config/usr++bin++download-secbrowser: source: not found

HulaHoop · December 9, 2019, 9:00pm

Got I2P + TBB working see second post above.

I hope we can get this scripted and have I2P and a configured privoxy included OOTB to transform TBB into a I2P Browser on demand in a dedicated snapshot.

Patrick · December 9, 2019, 9:13pm

It’s bash. Not sh. And thanks to shebang neither sh nor bash needs to be prepended. Running a bash script with sh will break.

source: not found

sh doesn’t know command source.

Also no sudo required.

This approach may be better to restore SecBrowser in Whonix.

sudo dpkg-divert --rename --remove /usr/share/applications/secbrowser.desktop
sudo dpkg-divert --rename --remove /usr/bin/secbrowser
sudo dpkg-divert --rename --remove /usr/bin/download-secbrowser

Won’t survive upgrades.

Patrick · December 9, 2019, 9:18pm

There is i2pbrowser but nobody maintaining it.

github.com

Whonix/tb-starter/blob/master/usr/bin/i2pbrowser

#!/bin/bash

## Copyright (C) 2018 - 2018 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.

export SCRIPTNAME="$(basename "$BASH_SOURCE")"

export IDENTIFIER="i2pbrowser"

## https://forums.whonix.org/t/noscript-with-security-slider-at-safest-permits-around-30-sites/8160
[ -n "$TOR_DEFAULT_HOMEPAGE" ] || export TOR_DEFAULT_HOMEPAGE="/usr/share/tb-profile-i2p/i2p-diffs.html"

[ -n "$ICON" ] || export ICON="/usr/share/icons/anon-icon-pack/tbupdate.ico"
[ -n "$TOR_NO_DISPLAY_NETWORK_SETTINGS" ] || export TOR_NO_DISPLAY_NETWORK_SETTINGS=1
[ -n "$TOR_HIDE_BROWSER_LOGO" ] || export TOR_HIDE_BROWSER_LOGO=1
[ -n "$TOR_SKIP_LAUNCH" ] || export TOR_SKIP_LAUNCH=1
[ -n "$tb_using_i2p" ] || export tb_using_i2p="--i2p"
[ -n "$tb_install_folder" ] || export tb_install_folder="i2pb"
[ -n "$tb_install_folder_dot" ] || export tb_install_folder_dot=".i2pb"
[ -n "$tb_title" ] || export tb_title="i2p Browser"

This file has been truncated. show original

github.com

Whonix/tb-starter/blob/master/usr/bin/torbrowser#L505-L549


tb_i2p() {
   ## i2pbrowser sets tb_2ip="true".


   ## If the i2pmarker file exists and if tb_2ip is not set to
   ## "true" it means that this browser was previously started with
   ## tb_2ip="true". Therefore refuse to start it without
   ## tb_2ip="true" since a browser that was ever used with i2p
   ## should never be used again over Tor to avoid linking the different
   ## identities.
   if test -f "$tb_browser_folder/i2pmarker" ; then
      if [ ! "$tb_2ip" = "true" ]; then
         local MSG="i2p marker file exists and trying to start without i2pbrowser. Aborted. A Tor Browser that was previously started as i2pbrowser should not be started without i2pbrowser."
         $output ${output_opts[@]} --messagex --typex "error" --titlex "$TITLE" --message "$MSG" --done
         $output ${output_opts[@]} --messagecli --typecli "error" --titlecli "$TITLE" --message "$MSG" --done
         exit 2
         return 0
      fi
   fi


   if [ ! "$tb_2ip" = "true" ]; then

This file has been truncated. show original