[HOME] [DOWNLOAD] [DOCS] [BLOG] [SUPPORT] [TIPS] [ISSUES] [Priority Support]

Whonix-Gateway Tor 0.2.9.9 (unrecommended) -- No Update...Unsafe?


#1

Running Qubes 3.2 with newest Whonix-Gateway RPM 3.0.6-2016-12182342 [1]

The arm monitor reports the current Tor package at version: 0.2.9.9 (unrecommended)

The (unrecommended) tag is in red, as if to possibly warn the user of an insecure version of Tor.

The Tor Blog reports the newest Tor version in the 3 series as 0.3.0.10 on August 02, 2017 [2]

Running sudo apt-get dist-upgrade has not offered any Tor upgrades in a while.

Why isn’t a newer recommended version of Tor offered in the Whonix-Gateway?

Is running this old 0.2.9.9 version possibly unsafe?

How does one upgrade to a newer recommended version of Tor?

[1] https://yum.qubes-os.org/r3.2/templates-community/rpm/
[2] https://blog.torproject.org/blog/tor-03010-released


Tor Outdated - Whonix Gateway
#2

For future reference you should use the forum search engine at the top right of your screen before you create a new post. If you had entered “tor unrecommended” or "unrecommended " you would have found this duplicate post which still applies to your questions.


#3

boring, now is the whonix update with 0.2.9.10 and the new one with many security fixes is 0.2.9.12.
Why goes Whonix the unsafe way and dont update directly to the newest stable? and then asks for a donation ^^ for his permernent out-of-date product :smiley: pfff


#4

I agree that we should update to 0.2.9.12 as a best practice.

There is one security fix in 0.2.9.11 and one in 0.2.9.12. Both only affect users running onion / hidden services.

0.2.9.11 fixes TROVE-2017-005: “a bug that would allow an attacker to remotely crash a hidden service with an assertion failure.”[1]

0.2.9.12 fixes TROVE-2017-008: “a security bug that affects onion services running with the SafeLogging option disabled.”[2] (SafeLogging is enabled by default.)

[1] https://blog.torproject.org/tor-0308-released-fix-hidden-services-also-are-02429-02514-02612-0278-02814-and-02911
[2] https://blog.torproject.org/new-tor-stable-releases-02815-02912-03011-fix-onion-service-security-issue


Advanced users have several options:

[3] Testers Wanted! Tor - Stable Upgrades


It’s not “his” product. It’s ours. And you’re welcome to support its continued existence by making suggestions like you did at any time. You may also submit pull requests, suggest new tickets, or donate :wink: so others can work on development. How to contribute.


#5

Tor 0.3.0.x introduced an updated directory authentication mechanism as well as new guard selection algorithms. Tor 0.3.1.x introduced compact directory formats and network padding (which requires both clients and relays to be updated to be functional).

Since these are major new features, these clients should be tested before being uploaded to Whonix stable. My guess is that Whonix will stay on 0.2.9.x until Whonix 14. (FYI, 0.2.9.x is an LTS release and will remain officially supported until Jan 2020). If you’d like to help test, simply clone your whonix-gw template and follow the instructions above to upgrade to 0.3.1.x.


#6

https://www.whonix.org/wiki/Security_Guide#Tor_Versioning

It’s time consuming maintaining Whonix stable as well as developing the new version based on a newer version of Debian.

There are no automated tests to make sure upgrades don’t break connectivity for everyone and no code contributions for that sort either.

However… The less time I spend on forum support and wiki, the better the quality by the community. Amazing! (Unfortunately, the same isn’t happening with the code.)

We could also stay on tor 0.2.5.[…] as long as Whonix is jessie based and then tor 0.2.9.[…] as long as Whonix is stretch based, i.e. using the stable versions maintained by Debian, see:

https://www.whonix.org/wiki/Install_Software#Prefer_Packages_from_Debian_Stable_Repository

This was the case in earlier versions of Whonix but then things happened creating a strong urge to use the version from deb.torproject.org. I was wondering if it was best to move Whonix back to that method if possible.


#7

The best option would be if we could pin major version (0.2.9.*) in apt/preferences but torproject’s repo only contains the latest stable version so we would lose updates as soon as 0.3.0.* came out.

Will see if I can find out why they don’t keep all supported versions in their repo (or maybe I’m doing it wrong.)


#8

True.

You probably know but in case anyone is wondering: an automatic 0.2.9 -> 0.3 upgrade of Tor could break connectivity for Whonix users. (Happened in past. AppArmor, configs and whatnot.) That’s why it’s not as easy as enabling torproject’s repository by default for everyone.

Because then we could stay with the version from Debian.


Tor Releases Discussion
#9

Well mr-updates-needed, given 3.1.7 was just uploaded to Jessie proposed updates, you have nothing to complain about.

BTW - working nicely.

@Patrick

Given this version of Tor supports padding, I think we should recommended users set the following in their torrc file for better security against network analysis:

ConnectionPadding 1

Rationale:

https://blog.torproject.org/tor-0317-now-released

Major features (traffic analysis resistance):

Connections between clients and relays now send a padding cell in each direction every 1.5 to 9.5 seconds (tunable via consensus parameters). This padding will not resist specialized eavesdroppers, but it should be enough to make many ISPs’ routine network flow logging less useful in traffic analysis against Tor users.

Padding is negotiated using Tor’s link protocol, so both relays and clients must upgrade for this to take effect. Clients may still send padding despite the relay’s version by setting ConnectionPadding 1 in torrc, and may disable padding by setting ConnectionPadding 0 in torrc.

If you agree, I’ll edit the wiki here (they can add an additional line under the Sandbox 1 entry):

https://www.whonix.org/wiki/Security_Guide#Seccomp


#10

torjunkie:

ConnectionPadding 1

Adding to the wiki: yes, why not.

Changing the default in Whonix: We should mirror what Tor is doing

  • by default, i.e.:
  • /usr/share/tor/tor-service-defaults-torrc
  • ( /etc/tor/torrc )
  • ( /etc/tor.d )

Is this a default by Tor yet? Do they have a ticket making it the
default so we can monitor progress?


#11

-> Added to Security guide (plus I moved a few things around so it is more logical).

I searched but couldn’t find a relevant Trac ticket re: default paths & torrc.

Anyhow, for testing purposes I can report that this Qubes-Whonix system successfully runs in combination:

  • Tor version 0.3.1.7 (with torrc settings Sandbox 1, ConnectionPadding 1)
  • Apparmor profiles in Whonix-WS and Whonix-GW enforced (from latest github commits)
  • Firejailed Tor Browser (both v7.07 and 7.5a6)

Although the Whonix onion has been a bit spotty the last day or so? Could be my shit connection. Seems to run better with latest Tor upgrade.


#12

Hi Patrick

I searched Tor track and could not find anything either.

  1. Would you like me to open a ticket for this? Might be worth a try.

  2. If so, just wanted to clarify, you mean:

    Moving towards making 1 of the paths the torrc default.

Reasons:

  • Simplicity ( less confusion )
  • Projects/Devs mirror Tor default for good reason. This would mean better continuity.

Related: Not sure if you were aware of open ticket to set ConnectionPadding 1 by default.

https://trac.torproject.org/projects/tor/ticket/23955


#13

Done!

https://trac.torproject.org/projects/tor/ticket/24492#ticket