Onionizing Repositories

From Whonix
Jump to navigation Jump to search
Documentation Previous page: Metadata Index page: Documentation Next page: Timezone Onionizing Repositories

The guide explains how to configure experimental Tor onion services for APT repositories. The configuration provides additional security and privacy benefits, such as protection against targeted attacks, man-in-the-middle attacks, and preventing tracking of installed programs, but it may cause system updates to fail due to unreliability.

Introduction

[edit]

When software packages from Debian, Whonix, Fedora, Qubes (and others) are downloaded prior to the installation of new packages or upgrades, the package repository sources default to the http / https transport protocol, which is non-ideal for security. Instead, experimental Tor onion services can be configured for a number of platforms, which provides several security and privacy benefits: [1]

  • The user cannot be uniquely targeted for malicious updates -- attackers are forced to attack everyone requesting the update.
  • The package repository, or observers watching it, cannot track what programs are installed.
  • The ISP cannot easily learn what packages are fetched.
  • End-to-end authentication and encryption provides protection against man-in-the-middle attacks, like version downgrade attacks.

Be aware that enabling onion repositories may cause system updates to periodically fail due to their unreliabilityarchive.org iconarchive.today icon. If this becomes an issue, it is encouraged to Re-enable Clearnet Repositories so packages can be updated.

If the term "comment" is unfamiliar, please follow this linkarchive.org iconarchive.today icon to learn how to comment / uncomment lines in a configuration file.

Platform Specific

[edit]

Select your platform.

Non-Qubes-Whonix VMs

  • What to change: Non-Qubes-Whonix virtual machines (VM) can be onionized by editing both the Debian [2] and Whonix repository configuration files so they point to the corresponding onion mirrors.
  • Where to apply: Complete the following steps in both Whonix-Gateway and Whonix-Workstation.

Debian sources

1. Open the Debian sources file using an editor with root rights.

sudoedit /etc/apt/sources.list.d/debian.sources

2. Enable the onionized Debian repositories and disable the clearnet repositories.

Enable the following .onion mirrors and disable the corresponding https repositories (except the fasttrack repository).

######## ENABLED SOURCES ######## Types: deb URIs: tor+https://deb.debian.org/debian Suites: trixie trixie-updates trixie-backports Components: main contrib non-free non-free-firmware Enabled: no # <<<<< change this line from "yes" to "no" Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg Types: deb URIs: tor+https://deb.debian.org/debian-security Suites: trixie-security Components: main contrib non-free non-free-firmware Enabled: no # <<<<< change this line from "yes" to "no" Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg Types: deb URIs: tor+https://fasttrack.debian.net/debian-fasttrack Suites: trixie-fasttrack trixie-backports-staging Components: main contrib non-free Enabled: yes # <<<<< keep this line saying "yes" Signed-By: /usr/share/keyrings/fasttrack-archive-keyring.gpg ######## DISABLED BY DEFAULT SOURCES ######## #### deb #### Types: deb URIs: tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian Suites: trixie trixie-updates trixie-backports Components: main contrib non-free non-free-firmware Enabled: yes # <<<<< change this line from "no" to "yes" Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg Types: deb URIs: tor+http://5ajw6aqf3ep7sijnscdzw77t7xq4xjpsy335yb2wiwgouo7yfxtjlmid.onion/debian-security Suites: trixie-security Components: main contrib non-free non-free-firmware Enabled: yes # <<<<< change this line from "no" to "yes" Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg ## No onion for fasttrack yet: https://salsa.debian.org/fasttrack-team/support/-/issues/27

3. Save and exit.

derivative sources

Follow these steps to point the Whonix repository to the onion mirror. See Whonix APT Repository overview for details on the four repository choices.

Note: On Whonix, repository-dist configures onion transport for the Whonix repository and the inherited Kicksecure repository (if enabled).

This can be done using repository-dist command line interface (CLI) tool with the --transport onion option.

1. Run the following command:

sudo repository-dist --enable --transport onion

2. Confirm the onionized repository is functional.

upgrade-nonroot

Non-Qubes-Whonix Notes

  • Reminder: Onionize both, Whonix-Gateway and Whonix-Workstation.
  • Host operating system: If you are using a Debian (based) host or Kicksecure, you could optionally also onionize the host operating system. See tab Debian below. If you are using a Kicksecure host, see also Kicksecure logo Kicksecure Onionizing RepositoriesOnion network Logo

Qubes-Whonix Hosts

  • What to change: Qubes dom0 and VMs can be onionized by editing the repository configuration files so they point to the corresponding onion mirrors. [3]
  • Where to apply: Complete the following steps in dom0 and for each template.
  • Limitation: Not all templates can be completely onionized.
  • Templates covered: The instructions below consider Debian Templates, Whonix Templates, and the Fedora Template.

dom0

dom0 can be updated exclusively over onion services.

1. In a dom0 terminal, open the qubes-dom0.repo configuration file in a text editor.

sudoedit /etc/yum.repos.d/qubes-dom0.repo

  • comment the lines that contain metalink
  • uncomment the lines that contain qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion

Once completed, each of the four code blocks will have http(s) repository lines similar to the following example.

#baseurl = https://yum.qubes-os.org/r$releasever/current/host/fc37 baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r$releasever/current/host/fc37 #metalink = https://yum.qubes-os.org/r$releasever/current/host/fc37/repodata/repomd.xml.metalink

2. Save and exit.

3. In a dom0 terminal, open the qubes-templates.repo configuration file in a text editor.

sudoedit /etc/qubes/repo-templates/qubes-templates.repo

  • comment the lines that contain metalink
  • uncomment the lines that contain qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion

Once completed, each of the two code blocks will have http(s) repository lines similar to the following example.

#baseurl = https://yum.qubes-os.org/r$releasever/templates-itl baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r$releasever/templates-itl #metalink = https://yum.qubes-os.org/r$releasever/templates-itl/repodata/repomd.xml.metalink

3. Save and exit.

4. In dom0 terminal, confirm both onion repositories are functional.

Using --show-output --console is optional but recommended because of a Qubes upstream bug. [4]
sudo qubes-dom0-update --show-output --console

Debian Templates

Debian templates can be updated exclusively over onion services. Simply edit the Qubes and Debian sources.list files so they point to the respective onion repositories.

Note: to use the tor+http configuration below, Kicksecure logo apt-transport-torOnion network Logo must be installed. [5] Remove tor+ from the code block if updates over Tor are unwanted.

Onionize qubes-r4.list

1. In Debian TemplateVM, open the qubes-r4.list file in a text editor.

sudoedit /etc/apt/sources.list.d/qubes-r*.list

2. Comment the first line underneath "Main qubes updates repository".

The first code block should look similar to this.

# Main qubes updates repository #deb [arch=amd64] https://deb.qubes-os.org/r4.2/vm trixie main #deb-src https://deb.qubes-os.org/r4.2/vm trixie main

3. Uncomment the corresponding line underneath "Qubes Tor updates repositories".

The first code block should look similar to this.

# Qubes Tor updates repositories # Main qubes updates repository deb [arch=amd64] tor+http://deb.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.2/vm trixie main #deb-src http://deb.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.2/vm trixie main

Save and exit.

4. Confirm the onionized repositories are functional.

sudo apt update && sudo apt full-upgrade

Onionize Debian sources.list

The sources.list file can be edited so it points to the Debian onion mirror. [2] This is a more secure method than clearnet for updates and software installation.

1. Open the Debian sources.list file using an editor with root rights.

sudo nano /etc/apt/sources.list

2. Reference the onionized Debian repositories.

Cut and paste the following .onion mirrors and comment out (#) the corresponding https repositories.

#deb https://deb.debian.org/debian trixie main contrib non-free deb tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian trixie main contrib non-free #deb https://deb.debian.org/debian-security trixie-security main contrib non-free deb tor+http://5ajw6aqf3ep7sijnscdzw77t7xq4xjpsy335yb2wiwgouo7yfxtjlmid.onion trixie-security main contrib non-free #Optional Backports #deb https://deb.debian.org/debian trixie-backports main contrib non-free deb tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian trixie-backports main contrib non-free

Save and exit.

3. Confirm the onionized repositories are functional.

sudo apt update && sudo apt full-upgrade

Whonix Templates

Whonix templates can be updated exclusively over onion services by editing the Qubes, Debian [2] and Whonix sources files so they point to the respective onion repositories.

Complete the following steps in both Whonix-Gateway™ and Whonix-Workstation™.

Onionize qubes-r4.list

1. In Whonix TemplateVM, open qubes-r4.list in a text editor.

sudoedit /etc/apt/sources.list.d/qubes-r*.list

2. Comment the first line underneath "Main qubes updates repository".

The first code block should look similar to this.

# Main qubes updates repository #deb [arch=amd64] https://deb.qubes-os.org/r4.2/vm trixie main #deb-src https://deb.qubes-os.org/r4.2/vm trixie main

3. Uncomment the corresponding line underneath "Qubes Tor updates repositories".

The first code block should look similar to this.

# Qubes Tor updates repositories # Main qubes updates repository deb [arch=amd64] tor+http://deb.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.2/vm trixie main #deb-src tor+http://deb.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.2/vm trixie main

Save and exit.

4. Confirm the onionized repositories are functional.

upgrade-nonroot

Onionize debian.sources

1. Open the Debian sources file using an editor with root rights.

sudoedit /etc/apt/sources.list.d/debian.sources

2. Enable the onionized Debian repositories and disable the clearnet repositories.

Enable the following .onion mirrors and disable the corresponding https repositories (except the fasttrack repository).

######## ENABLED SOURCES ######## Types: deb URIs: tor+https://deb.debian.org/debian Suites: trixie trixie-updates trixie-backports Components: main contrib non-free non-free-firmware Enabled: no # <<<<< change this line from "yes" to "no" Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg Types: deb URIs: tor+https://deb.debian.org/debian-security Suites: trixie-security Components: main contrib non-free non-free-firmware Enabled: no # <<<<< change this line from "yes" to "no" Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg Types: deb URIs: tor+https://fasttrack.debian.net/debian-fasttrack Suites: trixie-fasttrack trixie-backports-staging Components: main contrib non-free Enabled: yes # <<<<< keep this line saying "yes" Signed-By: /usr/share/keyrings/fasttrack-archive-keyring.gpg ######## DISABLED BY DEFAULT SOURCES ######## #### deb #### Types: deb URIs: tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian Suites: trixie trixie-updates trixie-backports Components: main contrib non-free non-free-firmware Enabled: yes # <<<<< change this line from "no" to "yes" Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg Types: deb URIs: tor+http://5ajw6aqf3ep7sijnscdzw77t7xq4xjpsy335yb2wiwgouo7yfxtjlmid.onion/debian-security Suites: trixie-security Components: main contrib non-free non-free-firmware Enabled: yes # <<<<< change this line from "no" to "yes" Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg ## No onion for fasttrack yet: https://salsa.debian.org/fasttrack-team/support/-/issues/27

Save and exit.

3. Confirm the onionized repositories are functional.

upgrade-nonroot

Onionize derivative.sources

Follow these steps to point the Whonix sources file to the onion mirror. See Whonix APT Repository overview for details on the four repository choices.

This can be done using repository-dist command line interface (CLI) tool with the --transport onion option.

1. Run the following command:

sudo repository-dist --enable --transport onion

2. Confirm the onionized repository is functional.

upgrade-nonroot

Fedora Template

Note: Updating Fedora templates exclusively over Onion Services is not possible -- only related Qubes repositories can be onionized. The reason is Fedora does not maintain onion service repositories.

1. In Fedora Template, open the qubes-r4.repo file in a text editor. [6]

sudoedit /etc/yum.repos.d/qubes-r*.repo

  • comment the lines that contain yum.qubes-os.org
  • uncomment the lines that contain qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion

Once completed, each of the four code blocks will have http(s) repository lines similar to the following example.

#baseurl = https://yum.qubes-os.org/r4.2/current/vm/fc$releasever baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.2/current/vm/fc$releasever

Save and exit.

2. In Fedora Template, confirm the onion service repositories are functional.

sudo dnf update

3. Import the Qubes OS signing key if prompted.

Sometimes the following message may appear. Press y and then Enter. [7] [8]

Importing GPG key 0x8E34D89F: Userid : "Qubes OS Release 4.2 Signing Key" Fingerprint: 9C88 4DF3 F810 64A5 69A4 A9FA E022 E58F 8E34 D89F From : /etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4.2-primary Is this ok [y/N]:

Debian Hosts

  • What to change: Debian hosts and VMs can be onionized by editing the Debian [2] [9] repository configuration files so they point to the corresponding onion mirrors.
  • Where to apply: Complete the following steps on Debian hosts or in Debian VMs.
  • Requirement: To use the tor+http configuration below, Kicksecure logo apt-transport-torOnion network Logo must be installed. [5]
  • Optional: Remove "tor+" from the code block if updates over Tor are unwanted.

1. Open the Debian sources.list file using an editor with root rights.

sudo nano /etc/apt/sources.list

2. Reference the onionized Debian repositories.

Cut and paste the following .onion mirrors and comment out (#) the corresponding https repositories.

#deb https://deb.debian.org/debian trixie main contrib non-free deb tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian trixie main contrib non-free #deb https://deb.debian.org/debian-security trixie-security main contrib non-free deb tor+http://5ajw6aqf3ep7sijnscdzw77t7xq4xjpsy335yb2wiwgouo7yfxtjlmid.onion trixie-security main contrib non-free #Optional Backports #deb https://deb.debian.org/debian trixie-backports main contrib non-free deb tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian trixie-backports main contrib non-free

Save and exit.

3. Confirm the onionized repositories are functional.

sudo apt update && sudo apt full-upgrade

Kicksecure Hosts

If your host operating system is Kicksecure, follow the Kicksecure documentation (separate project / separate wiki):

Kicksecure logo Kicksecure Onionizing RepositoriesOnion network Logo

Onionize Tor Project Updates

[edit]

For enhanced security, advanced users and testers can onionize Tor Project updates; see Kicksecure logo Tor VersioningOnion network Logo for further details.

Footnotes

[edit]
  1. ↑ https://blog.torproject.org/tor-heart-apt-transport-tor-and-debian-onionsarchive.org iconarchive.today icon
  2. ↑ 2.0 2.1 2.2 2.3 https://onion.debian.org/archive.org iconarchive.today icon
  3. ↑ At present, the available Qubes onion service URLsarchive.org iconarchive.today icon are:

    Website: www.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion
    Yum repo: yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion
    Deb repo: deb.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion
    ISOs: iso.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion

  4. ↑ qubes-dom0-update shows No updates available in case of network is down / qubes-dom0-update fails to notice if repositories are unreachable / network is downarchive.org iconarchive.today icon
  5. ↑ 5.0 5.1 For support in downloading APT packages anonymously via the Tor network. To install it: sudo apt install --no-install-recommends apt-transport-tor
  6. ↑ At the time of writing Qubes-R4 was the current stable release.
  7. ↑ See: Verifying signaturesarchive.org iconarchive.today icon for further information on signing keys.
  8. ↑ All Qubes OS signing keys can be found herearchive.org iconarchive.today icon.
  9. ↑ Also edit Whonix sources.list if you are using Whonix Packages for Debian Hosts.
Notification image
Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!

Retrieved from "https://www.whonix.org/w/index.php?title=Onionizing_Repositories&oldid=106349"