This is important because not allowing this in Tor Browser might result in Tor Browser being broken one day. Then we would have to address it with onion-grater… Which could be difficult → onion-grater, a Tor Control Port Filter Proxy - filtering dangerous Tor Control Port commands - Design Documentation - Whonix
Therefore good to mention.
Depends. What was the follow-up of
? Is there no a clockskew related Tor control protocol command or some other change in result of that ticket?
Quote/usr/lib/qubes-whonix/init/network-proxy-setup
## Create a dummy eth1 interface so Tor can bind to it if there
## are no DOMU virtual machines connected at the moment
All. One for each connected Whonix-Workstation.
Dev/Control_Port_Filter_Proxy#onion_client_auth_add is outdated since /usr/share/doc/onion-grater-merger/examples/40_onion_authentication.yml resolved this issue.
Cool.
I separated those points to a functionality support on my edits.
? Is there no a clockskew related Tor control protocol command or some other change in result of that ticket?
There is no commands, only status reports, CLOCK_SKEW and CLOCK_JUMPED
Ok, found how to see the correct interface to listen.
On the Whonix-Gateway:
$ ip r ## routing table
It will show the IP of connected workstations and their interface.
On a side note, this could be useful for other means like automating hosts for onion-grater, but this is for later.
$ ip r | awk '/vif/{print $1 " " $3}'
Wahay profile is not updated, user amnesia, apparmor profile etc.
And there is no Wahay wiki page on Whonix. Should I disregard?
Yes.
Note to self:
Patrick, valid?
Yes.
That page was the blueprint for the onion-grater-merger implementation. Not updated in a long time. Would be good to update, migrate content.
Was the content of that page was updated, moved elsewhere (Dev/onion-grater most likely?) the content of the old page can be replaced by:
#REDIRECT [[Dev/onion-grater]]
The renaming was done as well as updating all redirects and links to that wiki page.
Merged, thanks!
In favor to allow setting hosts and using alternative parsing directories, I opened
Another benefit of the approach above, getting rid of onion-grater-merger means that onion-grater does not need to restart, as no autogenerated files needs to be generated. Instead, onion-grater evaluates the files on the fly without needing to restart. Means that changes on onion-grater-add and onion-grater-remote to restart onion-grater is not necessary anymore.
This is better because the only reason to restart onion-grater is for testing when enabling --debug or --complain mode, less disconnections for workstations that need a profile added on their gateway and onion-grater could ignore the bitcoind ADD_ONION because it was constantly restarted.
restrict-stream-events is set to False for non-local clients
We could restrict stream per client ip if that is fixed.
Commented on the existing thread Tails bug tracker
update example profiles directive:
s/exe-paths/apparmor-profiles/
Passed the relevant information of Dev/Control Port Filter Proxy/tor-controlport-filter/config - Whonix to ttps://www.whonix.org/wiki/Dev/onion-grater#Profile_format.
Most of the information was outdated and not relevant (relevant to onion-grater-merger that is going to be deprecated).
Not sure. In theory it could be done but in practice the meaning of anon- isn’t clearly defined. Does it mean any anonymizing Linux distribution so that in theory Tails could re-use it? There doesn’t seem to be any interest in anon- anyhow. Or use anon- for stuff that is generic and whonix- for things that are really only for Whonix with its split-VM design? Or is it for the purpose of being fork friendly?
That package seems very Whonix specific. Not easy for other distributions to benefit form it unless they fork Whonix.
Due to the effort and unclear benefit, I guess it’s not worth renaming.
The purpose for me is that anon-gw-anonymizer-config exists, so I though other packages were to follow the same pattern.
But yes, very whonix specific, I just prefer patterns.
add onion-grater-list manpage by nyxnor · Pull Request #4 · Whonix/anon-gw-anonymizer-config · GitHub - Thanks, merged!
That package is also a bit imperfect. It has some enhancements that would be useful for Kicksecure too such as the default /etc/torrc.d parsing and some helper scripts such as anon-verify etc. One day it has to be re-organized.
There are four possible directories to be used, slow migration or no migration?
/etc/onion-grater.d/usr/local/etc/onion-grater.d (never used)/etc/onion-grater-meger.d (system)/usr/local/etc/onion-grater-meger.d (users)Does it make sense to ever migrate to non -merger directory because of problems of moving user configuration?
Should we just use with 3 and 4?
I will need to include the merger on the apparmor configuration, because onion-grater was not reading it, instead it was reading only the /etc/onion-grater.d dir with the 30_autogenerated.yml file.
Can I stop supporting the non-merger dir from the apparmor profile perspective?