Tor integration in Whonix

[Patrick]

tor 0.4.7.8 is now in all repositories.

[Patrick]

Stable Release 0.4.5.13, 0.4.6.11 and 0.4.7.9

Urgent: Stable Release 0.4.5.14, 0.4.6.12 and 0.4.7.10

[Patrick]

Prerequisite knowledge: Reading above linked announcements. Therefore skipping 0.4.7.9 (introduced new urgency bug) and waiting for 0.4.7.10.

(Tor integration in Whonix - #19 by Patrick)

[Patrick]

tor 0.4.7.10 is now in the testers repository.

[Patrick]

Keep an eye on Arti (Tor)

Paying some attention to Arti. “Rust is more secure than C. Despite our efforts, it’s all too simple to mess up when using a language that does not enforce memory safety. We estimate that at least half of our tracked security vulnerabilities would have been impossible in Rust, and many of the others would have been very unlikely.” and also think of how it could replace the current Tor C implementation, in a “safe” way, eventually.

[Patrick]

@Patrick

tor 0.4.7.10 is now in the testers repository.

This is in all repositories for a while now. (Since Whonix 16.0.8.2 - for VirtualBox - Point Release!)

[Patrick]

[tor-announce] Tor stable release 0.4.7.11

This is in the testers repository since a few days.

[Patrick]

This is now in the stable repository.

[godofwar]

@Patrick

Today, we release 0.4.7.8 fixing several issues including a High severity security issue only affecting the 0.4.7.x series. You can track this issue with TROVE-2022-001 and CVE-2021-38385

Please note that at the moment, the full details of the security issue are not yet public as we are waiting on the OS distribution packages to be updated and the network to be on its upgrade path.

This security issue is not affecting the safety of the tor host system itself and is categorized as a Denial of Service thus affecting performance and possibly anonymity.

We STRONGLY recommend anyone on an earlier version to upgrade as soon as possible to tor 0.4.7.8 (this release). OS packages are on the way!

do i need to reinstall whonix images or can i just run apt update ?

[Patrick]

See updating documentation:

Operating System Software and Updates

(Whonix is based on Kicksecure.)

[Patrick]

[tor-announce] Tor stable release 0.4.5.16 and 0.4.7.13

[Patrick]

Above is now in the stable-proposed-updates and testers repository.

[Patrick]

@Patrick

Design documentation:

• Whonix ™ Default Application Policy
• Tor integration in Whonix ™ Development Notes

In Debian 12 bookworm, Whonix can switch

• from: the currently used “Versions are downloaded from deb.torproject.org, verified to work, and then migrated to deb.whonix.org”
• to: “Use the Tor LTS version from the official Debian package repository: packages.debian.org.”

This is because while The Tor Project is working on Arti, no major new releases for the old C programming language based Tor package are to be expected.

[Patrick]

@Patrick

[tor-announce] Tor stable release 0.4.5.16 and 0.4.7.13

This is now in the stable repository.

[Patrick]

[FAILED] to start Anonymizing overlay network for TCP - Tor fails to start a few times before succeeding to start

[Patrick]

Whonix 17 (Debian bookworm based) will switch back to acquire Tor from the usual packages.debian.org.

[Patrick]

@Patrick

Whonix 17 (Debian bookworm based) will switch back to acquire Tor from the usual packages.debian.org.

1. Use the Tor LTS version from the official Debian package repository: packages.debian.org

Updated Tor integration in Whonix ™ Development Notes chapter Tor Version in Whonix wiki just now.

[Patrick]

ship systemd-tmpfiles /usr/lib/tmpfiles.d/tor.conf to fix permission issues

[Patrick]

Tor 0.4.8.9-1~d12.bookworm+1 (from deb.torproject.org) is now in the Whonix 17 testers repository.