OK - will do.
Great job, @torjunkie !
Shall we include the support
meek_lite, too? It greatly improved the user experience in heavily censored area: http://dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/w/index.php?title=Whonix_Release_Notes&oldid=33415
It can be put under the Major Changes and New Features:
- Tor Pluggable Transport
meek_lite[X] is supported, making Whonix much easier to connect to the Tor network in heavily censored areas, like China.
I am not good at wording. So in your opinion, do you think using word like “tremendous” or “huge number of” will be better than using “many”, @torjunkie ?
It is not exaggerated considering to number of changes from Whonix 13 -> 14.
Please let me know if changes are necessary.
It seems onionshare is not in and will not be in Whonix 14 because of it is not available in Debain Stretch repository.
Thanks to you both. I will get back to this shortly (bit busy today) and fix these things up.
Changes made to suggested Whonix 14 blog release (further above).
If you like it and don’t have any other suggestions, I’ll save it as a draft blog for Patrick.
Tor Browser sandboxed
You sure we need
stretch-backports? In Debian stretch, versions should
be new enough so it might work without any backports.
Could be either installed manually using onionshare homepage
instructions https://onionshare.org/ or perhaps by “cheating” since it
is in Debian
Perhaps by pinning onionshare from buster. Perhaps there is no
dependency hell. (Not pulling lot of packages from buster besides
onionshare.) Needs testing (figuring out) as well as documentation.
Either way, not as easy as if it was in stretch, users will be able to
Great job, @torjunkie !
One more thing before finalizing the draft?
Modify draft as follows:
- Onionshare is not installed by default in Whonix 14 as it is not in the stretch repository. It could be still be manually installed by following this instructions [X].
[X]: link to a Whonix Wiki page containing instructions.
Wiki instruction can be filled out later after testing:
Onionshare could either be installed manually using onionshare homepage instructions https://onionshare.org or perhaps by “cheating” since it is in Debian buster.
Went through the Whonix 14 release blog post. Great work!!
First one is just a suggestion. Obviously ignore if you like.
Next one - I think is a typo. Maybe not?
Whonix 14 is based on the Debian stretch (Debian 9) distribution which was released in June 2017, meaning users have access to numerous updated and new software packages, a modern branch of GnuPG, and more.
meaning users have access to many new software packages in concert with existing packages such as a modern branch of GNuPG, and more.
Desktop shortcuts are no longer available in non-Qubes-Whonix.
Onionshare is unavailable in Whonix 14 as it is not in the stretch repository.
While there may be other problems that exist in this declared stable release, even effort has been made to address major known problems.
every effort has been made to address major know problems
The Qubes wiki/apparmor instructions require updating. More specifically
-l option in
qvm-prefs was replaced with
R4.0 both R3.2, and R4.0.
Also: kernelopts can be listed without an option.
qvm-prefs sys-whonix kernelopts
I would need permissions to edit wiki template?
Thanks all. I will make those blog changes shortly.
@0brand. Good pickup. I ended up protecting all the 250+ templates to deter trolls who were getting a little active in recent months.
I’ve changed the permission on that template so you should be able to edit it now.
No problem - let me test Sandboxed Tor Browser without backports (will purge the other version of Bubblewrap).
Will also change wording on onionshare also i.e. users can manually install it or use Sid package.
Draft instructions to follow here - I’ll give it a crack and you linux pros tell me whether it’s the canonical method or not. To say the online Debian instructions are involved would be an understatement i.e. just installing one package from testing requires a ton of pinning & APT steps.
OK - Sandboxed Tor Browser does not need Bubblewrap from stretch-backports to work correctly, just the normal repos:
Updated wiki text to reflect April 2018 status of sandbox specs.
I’ve tested that both Sandboxed Tor Browser stable and alpha work in Whonix 14 - they do.
Haven’t played with optional configurations like sound etc, so I’ll leave that as an exercise for the interested Whonix user, since it opens up unnecessary attack vectors.
Note the error message around Adawaita theme in Konsole is:
sandbox: Failed to find Adwaita gtk-2.0 theme.
Since this theme is probably installed in standard Tor Browser (the running Sandboxed Tor Browser instance does look a little different), perhaps we should recommend users install it, as it may otherwise pose a fingerprinting vector(?).
Moving on to onionshare…
Adopted your changes for the suggested Whonix 14 blog release wording (further above).
Once we have acceptable OnionShare install instructions with a Whonix wiki reference, it’s ready for saving as a draft blog. Anything else you want to highlight feature-wise?
Thank you for your awesome work! It looks great to me!
Whonix 14 blog release is impeccable. Great work!
What do you think about adding this step by step guide to wiki/Tor? Then have a step in the Whonix 14 testers blog that has users copy and paste Tor State File from sys-whonix-13 to sys-whonix-14. ( and also has a link to these instructions?)
Copying Tor State to secondary sys-whonix
torjunkie: the language in this guide is not complete. Just wanted to get your opinion before I went any further. Aslo these instructions assume sys-whonix is based on Whonix-14 and sys-whonix-13 (obvious)
sudo systemctl stop tor@default
sys-whonixremove Tor State File. Note: Its likely that this command will complain that the process is busy. This can be ignored.
sudo rm -r /var/lib/tor
/var/lib/toris empty. This command should produce no output.
sudo ls /var/lib/tor
sys-whonix-13, stop tor.
sudo systemctl stop tor@default
sys-whonix-13, copy the Tor State File to
sys-whonix. Users must upgrade to a root prompt (root@host:# ) for the command to exit successfully.
Note: If users encounter this error it can be ignored. qfile-agent: Fatal error: stat “VM” (error type: No such file or directory) . Hit “OK” when prompted
qvm-copy /var/lib/tor sys-whonix
sys-whonix, list the QubesIncoming directory to ensure Tor State File was copied over successfully.
The output should include these files:
cached-certs cached-microdescs lock
cached-microdesc-consensus cached-microdescs.new state
sys-whonix, move Tor State File to
sudo mv ~/QubesIncoming/sys-whonix-13/tor/* /var/lib/tor
sys-whonix, ensure all files listed in step 6 are now in
/var/lib/torand have the proper ownership. For Tor to function, files in this directory should be owned by
debian-tor. If files do not have proper ownership, proceed to step 9. Otherwise skip to step 10.
sudo ls -l /var/lib/tor
Note: The first 2 lines of the output should look similar to this. Notice the proper file ownership ‘
-rw------- 1 debian-tor debian-tor 20442 Feb 22 21:22 cached-certs
-rw------- 1 debian-tor debian-tor 1985454 Apr 4 00:04 cached-microdesc-consensus
sys-whonix, change ownership of the Tor State File to
sudo chown debian-tor: -R /var/lib/tor
sys-whonix, verify Tor State file is owned by
sudo ls -l /var/lib/tor
sys-whonix, start Tor.
sudo systemctl start tor@default
sys-whonix, verify Tor is functioning properly.
Excellent work 0brand and great idea to add to the wiki!
Then your blog post only needs to refer to the wiki link. i.e. something like ->
Step X: Copy the Whonix 13 Tor state to the secondary sys-whonix
Users are recommended to copy their Whonix 13 Tor state to the secondary (Whonix 14) sys-whonix to maintain the same Tor entry guard and defend against tracking attempts by advanced adversaries.
Follow the instructions at the following link:
- Steps 1 & 2 have same commands.
- The rest of it looks logical to me, but I haven’t tested it.
Does it work okay for you?
These instructions can live under the Advanced Topics section of the Tor chapter with an appropriate title.
I moved a few things around to group
sys-whonix commands together after this guide was copied to this thread. Didn’t realize step 2 was a repeat of step 1. Fixed!
Thanks for pointing that out!
sys-whonix-13 -> sys-whonix-13
sys-whonix-14 -> sys-whonix-14
sys-whonix-13 -> sys-whonix-14 and visa versa
The first round of testing I kept getting errors and Tor wouldn’t start. After about an hour and a half I realized my mistake. I went back and ran
sudo chown debian-tor: -R /var/lib/tor in all sys-whonix VMs and Tor functioned properly.
I should have this guide completed later today and the testers blog updated.
Or should I wait until this wiki entry is approved by Patrick before adding this step to testers blog?
I will add (Step X: Copy the Whonix 13 Tor state to the secondary sys-whonix) to the blog post with a note stating instructions will be added shortly to the wiki?
Chapter “Copy Tor State File to Fresh sys-whonix VM” added to wiki/Tor.
Not sure if I like chapter title. I saw this terminology used under the “Rotation of Entry Guards” chpater and I tried to copy the language.
On occasion, users may be tempted to create a new Whonix-Gateway (Qubes-Whonix: sys-whonix) because:
- One of the fallback primary entry guards.
- A configured bridge.
- Possibly combine tunnels with Tor.
- Creating a fresh Whonix-Gateway (sys-whonix), and copying across the Tor state file.
Also, In the instructions, what would be the correct terminology to use - Tor state, Tor state file(s), Tor state folder? It seem different terminology should be used depending on the context of the instructions.
If any changes are necessary please let me know.
Almost forgot, Qubes-Whonix 14 Testers blog instructions have been update.