mirror of
https://github.com/QubesOS/qubes-doc.git
synced 2024-12-27 08:19:24 -05:00
started porting over Whonix documentation QubesOS/qubes-issues#1201 QubesOS/qubes-issues#1202
This commit is contained in:
Brennan Novak
parent
554e5fdcec
commit
c7aa41b6ab
90
en/privacy/customizing-whonix.md
Normal file
90
en/privacy/customizing-whonix.md
Normal file
@ -0,0 +1,90 @@
|
|||||||
|
---
|
||||||
|
layout: doc
|
||||||
|
title: Customizing Whonix
|
||||||
|
permalink: /en/doc/privacy/customizing-whonix/
|
||||||
|
---
|
||||||
|
|
||||||
|
Customizing Whonix
|
||||||
|
==================
|
||||||
|
|
||||||
|
There are numerous ways to customize your Whonix install. All require a degree of technical knowledge and comfort with the command line.
|
||||||
|
|
||||||
|
### Enabling AppArmor
|
||||||
|
|
||||||
|
This is an optional security enhancement (for testers-only). If you're technical & interested, proceed, but do so *at your own risk!*
|
||||||
|
|
||||||
|
Note, if you want to use [Tor bridges](), AppArmor has been known in the past to cause problems with `obfsproxy` [see this issue](https://github.com/Whonix/Whonix/issues/67)
|
||||||
|
|
||||||
|
You will want to complete the following instructions in both the **Whonix Gateway** referred to in Qubes VM Manager as `whonix-gw` and the **Whonix Workstation** or `whonix-ws`. You only need to apply these settings to the TemplateVMs before creating any template based VMs from these Whonix templates.
|
||||||
|
|
||||||
|
[Since Qubes Q3, TemplateBasedVMs inherit the kernelopts setting of their TemplateVM](https://github.com/QubesOS/qubes-issues/issues/1091)
|
||||||
|
|
||||||
|
### Configuring Whonix Gateway
|
||||||
|
|
||||||
|
Launch the `dom0` terminal app `Konsole` from your Qubes App Launcher. Then get a list of current kernel parameters.
|
||||||
|
|
||||||
|
~~~
|
||||||
|
qvm-prefs -l whonix-gw kernelopts
|
||||||
|
~~~
|
||||||
|
|
||||||
|
As of Qubes Q3 RC1, this will show: `nopat`
|
||||||
|
|
||||||
|
Keep those existing kernel parameters and add `apparmor=1 security=apparmor` by entering:
|
||||||
|
|
||||||
|
~~~
|
||||||
|
qvm-prefs -s whonix-gw kernelopts "nopat apparmor=1 security=apparmor"
|
||||||
|
~~~
|
||||||
|
|
||||||
|
When running the command to get a list of current kernel parameters again (just hit the arrow up key twice, so you don't have to type the command again).
|
||||||
|
|
||||||
|
~~~
|
||||||
|
qvm-prefs -l whonix-gw kernelopts
|
||||||
|
~~~
|
||||||
|
|
||||||
|
It should show the old and the new kernel parameters. For example:
|
||||||
|
|
||||||
|
~~~
|
||||||
|
nopat apparmor=1 security=apparmor
|
||||||
|
~~~
|
||||||
|
|
||||||
|
Once you started the VM, you can check if AppArmor is now active.
|
||||||
|
|
||||||
|
```
|
||||||
|
sudo aa-status --enabled ; echo $?
|
||||||
|
```
|
||||||
|
|
||||||
|
It should show: `0`
|
||||||
|
|
||||||
|
### Configuring Whonix Workstation
|
||||||
|
|
||||||
|
In `dom0` terminal Konsole, get a list of current kernel parameters.
|
||||||
|
|
||||||
|
~~~
|
||||||
|
qvm-prefs -l whonix-ws kernelopts
|
||||||
|
~~~
|
||||||
|
|
||||||
|
In current version of Qubes, this will show `nopat` as a response. To keep those existing kernel parameters and add `apparmor=1 security=apparmor` do the following:
|
||||||
|
|
||||||
|
~~~
|
||||||
|
qvm-prefs -s whonix-ws kernelopts "nopat apparmor=1 security=apparmor"
|
||||||
|
~~~
|
||||||
|
|
||||||
|
When running the command to get a list of current kernel parameters again (just hit the arrow up key twice, so you don't have to type the command again).
|
||||||
|
|
||||||
|
~~~
|
||||||
|
qvm-prefs -l whonix-ws kernelopts
|
||||||
|
~~~
|
||||||
|
|
||||||
|
It should show the old and the new kernel parameters. For example:<br />
|
||||||
|
|
||||||
|
~~~
|
||||||
|
nopat apparmor=1 security=apparmor
|
||||||
|
~~~
|
||||||
|
|
||||||
|
Once you started the VM, you can check if AppArmor is now active by typing:
|
||||||
|
|
||||||
|
~~~
|
||||||
|
sudo aa-status --enabled ; echo $?
|
||||||
|
~~~
|
||||||
|
|
||||||
|
It should show: `0`
|
||||||
58
en/privacy/install-whonix.md
Normal file
58
en/privacy/install-whonix.md
Normal file
@ -0,0 +1,58 @@
|
|||||||
|
---
|
||||||
|
layout: doc
|
||||||
|
title: Install Whonix in Qubes
|
||||||
|
permalink: /en/doc/privacy/install-whonix/
|
||||||
|
---
|
||||||
|
|
||||||
|
|
||||||
|
Install Whonix in Qubes
|
||||||
|
=======================
|
||||||
|
|
||||||
|
Installing Whonix in Qubes is simple and only requires a few simple steps.
|
||||||
|
|
||||||
|
### First Time Users
|
||||||
|
|
||||||
|
Using privacy and anonymization tools like Whonix is not a magical solution that instantly makes you anonymous online. Please consider:
|
||||||
|
|
||||||
|
* Do you know what a metadata or a man-in-the-middle attack is?
|
||||||
|
* Do you think nobody can eavesdrop on your communications because you are using Tor?
|
||||||
|
* Do you know how Whonix works?
|
||||||
|
|
||||||
|
If you answered no, have a look at the [about](https://www.whonix.org/wiki/About), [warning](https://www.whonix.org/wiki/Warning) and [do not](https://www.whonix.org/wiki/DoNot) pages (on the Whonix website) to make sure Whonix is the right tool for you and you understand it's limitations.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Install Templates
|
||||||
|
|
||||||
|
Launch the `dom0` terminal `Konsole` from your Qubes App Launcher. Then enter the following command to install the Whonix Gateway and Workstation TemplateVMs.
|
||||||
|
|
||||||
|
~~~
|
||||||
|
sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-whonix-gw qubes-template-whonix-ws
|
||||||
|
~~~
|
||||||
|
|
||||||
|
After doing this, you should see two new TemplateVMs in the VM Manager called `whonix-gw` and `whonix-ws`
|
||||||
|
|
||||||
|
### Configuring Whonix VMs
|
||||||
|
|
||||||
|
Create a **Whonix Gateway** ProxyVM by clicking on `Create a New VM` and select `whonix-gw` as the template and select ProxyVM as the type.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Create a **Whonix Workstation** AppVM by clicking on `Create a New VM` and select `whonix-ws` as the template and select AppVM (should be default) as the type.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Configure the **Whonix Gateway TemplateVM** to use the `sys-whonix` ProxyVM that you just created.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Great. You should be all done installing Whonix into Qubes. Use these two TemplateVMs and the ProxyVM you just added, like you would for any other VMs.
|
||||||
|
|
||||||
|
### Running Applications
|
||||||
|
|
||||||
|
To start an application in the **Whonix Workstation AppVM** that you created, launch it like any other- open the `Qubes App Launcher` and then select an app such as `Privacy Browser` which will then launch the Tor Browser
|
||||||
|
|
||||||
|
|
||||||
|
### Advanced Information
|
||||||
|
|
||||||
|
You can learn more about [customizing Whonix here](/en/doc/privacy/customizing-whonix/)
|
||||||
66
en/privacy/uninstall-whonix.md
Normal file
66
en/privacy/uninstall-whonix.md
Normal file
@ -0,0 +1,66 @@
|
|||||||
|
---
|
||||||
|
layout: doc
|
||||||
|
title: Uninstall Whonix from Qubes
|
||||||
|
permalink: /en/doc/privacy/uninstall-whonix/
|
||||||
|
---
|
||||||
|
|
||||||
|
Uninstall Whonix from Qubes
|
||||||
|
===========================
|
||||||
|
|
||||||
|
If you just want to remove your **Whonix Gateway ProxyVMs** or **Whonix Workstation AppVMs** this would not be the guide for doing that. Just use the Qubes VM Manager or command line tools for doing that.
|
||||||
|
|
||||||
|
*Warning: This guide will completely uninstall your underlying Whonix TemplateVMs. Only do this if you want to stop using Whonix or start over with a clean install of Whonix.*
|
||||||
|
|
||||||
|
### Unset or Remove Whonix TemplateVM from All VMs
|
||||||
|
|
||||||
|
In order to uninstall a Whonix TemplateVM, you first must ensure that no VMs have this TemplateVM set as its underlying template, or else the uninstall will not work. You can accomplish this by either unsetting the TemplateVM from VMs or simply by removing the VMs altogether. You only have to do this for VMs that use the TemplateVM that you will uninstall.
|
||||||
|
|
||||||
|
**Option 1a. Unsetting TemplateVM from VMs**
|
||||||
|
|
||||||
|
This option allows you to keep any VMs and their user storage contents. Note that the root storage will still be lost when uninstalling the TemplateVM, so you may want to backup anything important first.
|
||||||
|
|
||||||
|
```
|
||||||
|
dom0 -> Qubes VM Manager -> right click Whonix VM -> Shutdown VM
|
||||||
|
```
|
||||||
|
|
||||||
|
In Dom0 » Qubes VM Manager:
|
||||||
|
|
||||||
|
```
|
||||||
|
dom0 -> Qubes VM Manager -> right click Whonix VM -> VM Settings -> Basic tab -> Template -> Choose a different TemplateVM from the Template list, such as your Fedora TemplateVM.
|
||||||
|
```
|
||||||
|
|
||||||
|
**Option 1b. Removing VMs with TemplateVM**
|
||||||
|
|
||||||
|
This option will delete your user storage contents, so you may want to backup anything important first.
|
||||||
|
|
||||||
|
```
|
||||||
|
dom0 -> Qubes VM Manager -> right click Whonix VM -> Remove AppVM
|
||||||
|
```
|
||||||
|
|
||||||
|
### Uninstall Whonix TemplateVM
|
||||||
|
|
||||||
|
Note that if you have customized your TemplateVM, these will be lost when uninstalling the TemplateVM, so you may want to backup anything important first.
|
||||||
|
|
||||||
|
**Option 2a. Uninstall Whonix-Gateway TemplateVM**
|
||||||
|
|
||||||
|
Open the `dom0` terminal `Konsole`
|
||||||
|
|
||||||
|
```
|
||||||
|
Qubes App Launcher (blue/grey "Q") -> System Tools -> Konsole
|
||||||
|
```
|
||||||
|
|
||||||
|
Uninstall the qubes-template-whonix-gw template package.
|
||||||
|
|
||||||
|
~~~
|
||||||
|
sudo yum erase qubes-template-whonix-gw
|
||||||
|
~~~
|
||||||
|
|
||||||
|
**Option 2b. Uninstall Whonix-Workstation TemplateVM**
|
||||||
|
|
||||||
|
Open the `dom0` terminal `Konsole`
|
||||||
|
|
||||||
|
Uninstall the qubes-template-whonix-ws template package.
|
||||||
|
|
||||||
|
~~~
|
||||||
|
sudo yum erase qubes-template-whonix-ws
|
||||||
|
~~~
|
||||||
93
en/privacy/updating-whonix.md
Normal file
93
en/privacy/updating-whonix.md
Normal file
@ -0,0 +1,93 @@
|
|||||||
|
---
|
||||||
|
layout: doc
|
||||||
|
title: Updating Whonix in Qubes
|
||||||
|
permalink: /en/doc/privacy/updating-whonix/
|
||||||
|
---
|
||||||
|
|
||||||
|
Updating Whonix in Qubes
|
||||||
|
========================
|
||||||
|
|
||||||
|
It is important to keep your Whonix templates current as to get important security updates.
|
||||||
|
|
||||||
|
### Configure Whonix TemplateVM proxy settings
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
### Open the Whonix Terminals
|
||||||
|
|
||||||
|
Launch `Terminal` for both `whonix-gw` and `whonix-ws` TemplateVMs and then perform the following steps to both TemplateVMs
|
||||||
|
|
||||||
|
~~~
|
||||||
|
sudo apt-get update && sudo apt-get dist-upgrade
|
||||||
|
~~~
|
||||||
|
|
||||||
|
The output should look similar to this.
|
||||||
|
|
||||||
|
~~~
|
||||||
|
Hit http://security.debian.org jessie/updates Release.gpg
|
||||||
|
|
||||||
|
Hit http://security.debian.org jessie/updates Release
|
||||||
|
|
||||||
|
Hit http://deb.torproject.org jessie Release.gpg
|
||||||
|
|
||||||
|
Hit http://ftp.us.debian.org jessie Release.gpg
|
||||||
|
|
||||||
|
Hit http://security.debian.org jessie/updates/main i386 Packages
|
||||||
|
Hit http://deb.torproject.org jessie Release
|
||||||
|
Hit http://security.debian.org jessie/updates/contrib i386 Packages
|
||||||
|
Hit http://ftp.us.debian.org jessie Release
|
||||||
|
Hit http://security.debian.org jessie/updates/non-free i386 Packages
|
||||||
|
Hit http://deb.torproject.org jessie/main i386 Packages
|
||||||
|
Hit http://security.debian.org jessie/updates/contrib Translation-en
|
||||||
|
Hit http://ftp.us.debian.org jessie/main i386 Packages
|
||||||
|
Hit http://security.debian.org jessie/updates/main Translation-en
|
||||||
|
|
||||||
|
Hit http://ftp.us.debian.org jessie/contrib i386 Packages
|
||||||
|
|
||||||
|
Hit http://security.debian.org jessie/updates/non-free Translation-en
|
||||||
|
|
||||||
|
Hit http://ftp.us.debian.org jessie/non-free i386 Packages
|
||||||
|
|
||||||
|
Ign http://ftp.us.debian.org jessie/contrib Translation-en
|
||||||
|
|
||||||
|
Ign http://ftp.us.debian.org jessie/main Translation-en
|
||||||
|
|
||||||
|
Ign http://ftp.us.debian.org jessie/non-free Translation-en
|
||||||
|
|
||||||
|
Ign http://deb.torproject.org jessie/main Translation-en_US
|
||||||
|
|
||||||
|
Ign http://deb.torproject.org jessie/main Translation-en
|
||||||
|
|
||||||
|
Reading package lists... Done
|
||||||
|
~~~
|
||||||
|
|
||||||
|
However, if what you see is different or you see the word `WARNING:` you should look at our troubleshooting documentation for [Debian and Whonix](/en/doc/troubleshooting/debian-and-whonix/).
|
||||||
|
|
||||||
|
### Restart Services after Upgrading
|
||||||
|
|
||||||
|
After upgrading either (easy) reboot.
|
||||||
|
|
||||||
|
~~~
|
||||||
|
sudo reboot
|
||||||
|
~~~
|
||||||
|
|
||||||
|
Or (harder) if you want to omit rebooting, use `checkrestart`. If you are interested in the latter, please click on expand on the right side.
|
||||||
|
|
||||||
|
|
||||||
|
### Restart after Kernel Upgrades
|
||||||
|
|
||||||
|
When `linux-image-...` was upgraded, reboot is required to profit from security updates.
|
||||||
|
|
||||||
|
|
||||||
|
Operating System Updates
|
||||||
|
|
||||||
|
Shutdown Whonix TemplateVM
|
||||||
|
|
||||||
|
~~~
|
||||||
|
Qubes VM Manager -> right clock on TemplateVM -> Shutdown VM
|
||||||
|
~~~
|
||||||
|
|
||||||
|
### Restart / Update Whonix VMs
|
||||||
|
|
||||||
|
If new updates were available and installed, you will need to either simply restart your running Whonix-Gateway ProxyVMs and running Whonix-Workstation AppVMs for them to be updated -- or alternatively apply this same update process again to your running VMs if not wanting to restart them right away.
|
||||||
39
en/privacy/whonix.md
Normal file
39
en/privacy/whonix.md
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
---
|
||||||
|
layout: doc
|
||||||
|
title: Whonix for privacy & anonymizations
|
||||||
|
permalink: /en/doc/privacy/whonix/
|
||||||
|
---
|
||||||
|
|
||||||
|
Whonix for Privacy & Anonymity
|
||||||
|
==============================
|
||||||
|
|
||||||
|
To improve your privacy & anonymity on the internet, you can install the [Whonix Template](/en/doc/templates/whonix/) on your Qubes machine.
|
||||||
|
|
||||||
|
[Whonix](https://www.whonix.org) is based on [Debian](https://www.debian.org) and [Tor](https://www.torproject.org) and utilizes two VMs, a **"gateway"** and a **"workstation"**. Qubes security architecture makes use of Whonix's isolation by using the gateway as a ProxyVM to route all network traffic through Tor, while the workstation is used for making AppVMs.
|
||||||
|
|
||||||
|
### Getting Started with Whonix
|
||||||
|
|
||||||
|
To install Whonix, you must have a working Qubes machine already.
|
||||||
|
|
||||||
|
* [Install Whonix in Qubes](/en/doc/privacy/install-whonix/)
|
||||||
|
* [Updating Whonix in Qubes](/en/doc/privacy/updating-whonix/)
|
||||||
|
|
||||||
|
### Customizing & Uninstalling Whonix
|
||||||
|
|
||||||
|
* [Customizing Whonix](/en/doc/privacy/customizing-whonix/)
|
||||||
|
* [Uninstall Whonix from Qubes](/en/doc/privacy/uninstall-whonix/)
|
||||||
|
|
||||||
|
*The following links are on Whonix's website and are technical.*
|
||||||
|
|
||||||
|
* [Security Advice for after installing Whonix on Qubes](https://www.whonix.org/wiki/Post_Install_Advice)
|
||||||
|
* [How to set up Tor Bridges in Whonix on Qubes](https://www.whonix.org/wiki/Bridges#How_to_use_bridges_in_Whonix)
|
||||||
|
* [Using Multiple Whonix-Workstations with Whonix on Qubes](https://www.whonix.org/wiki/Multiple_Whonix-Workstations#Qubes-Whonix)
|
||||||
|
|
||||||
|
### Support for Whonix
|
||||||
|
|
||||||
|
*The following links are on Whonix's site.*
|
||||||
|
|
||||||
|
* [Whonix Support](https://www.whonix.org/wiki/Support) - General Whonix, Debian, Tor, etc... related issues
|
||||||
|
* [Whonix Qubes Forum](https://www.whonix.org/forum/Qubes) - Whonix specific issues
|
||||||
|
|
||||||
|
You can also use [Qubes support](/en/help/), but not all Qubes users run Whonix.
|
||||||
140
en/troubleshooting/updating-debian-and-whonix.md
Normal file
140
en/troubleshooting/updating-debian-and-whonix.md
Normal file
@ -0,0 +1,140 @@
|
|||||||
|
---
|
||||||
|
layout: doc
|
||||||
|
title: Updating Debian and Whonix
|
||||||
|
permalink: /en/doc/troubleshooting/updating-debian-and-whonix/
|
||||||
|
---
|
||||||
|
|
||||||
|
Updating Debian and Whonix
|
||||||
|
==========================
|
||||||
|
|
||||||
|
Despite Qubes shipping with [Debian Templates](/en/doc/templates/debian/), most of Qubes core components run on Fedora and thus our documentation has better coverage for Fedora. However, Qubes has been working closely with the [Whonix](https://whonix.org) project which is based on Debian.
|
||||||
|
|
||||||
|
This troubleshooting guide is collection of tips about updating Whonix that also pertain to updating the normal Debian package manager. If you plan to use Debian heavily, **we highly recommend you install the Whonix templates and use them to update your normal Debian TemplateVM.**
|
||||||
|
|
||||||
|
*Note: some of the links on this page go to documentation on Whonix's website*
|
||||||
|
|
||||||
|
### Updating Error Messages
|
||||||
|
|
||||||
|
After running the commands to update Debian or Whonix, hopefully everything will complete perfectly.
|
||||||
|
|
||||||
|
~~~
|
||||||
|
sudo apt-get update && sudo apt-get dist-upgrade
|
||||||
|
~~~
|
||||||
|
|
||||||
|
However, if you see something like the following, then something went wrong.
|
||||||
|
|
||||||
|
~~~
|
||||||
|
W: Failed to fetch http://ftp.us.debian.org/debian/dist/jessie/contrib/binary-i386/Packages 404 Not Found
|
||||||
|
|
||||||
|
W: Failed to fetch http://ftp.us.debian.org/debian/dist/jessie/non-free/binary-i386/Packages 404 Not Found
|
||||||
|
|
||||||
|
E: Some index files failed to download. They have been ignored, or old ones used instead.
|
||||||
|
|
||||||
|
Err http://ftp.us.debian.org jessie Release.gpg
|
||||||
|
Could not resolve 'ftp.us.debian.org'
|
||||||
|
Err http://deb.torproject.org jessie Release.gpg
|
||||||
|
Could not resolve 'deb.torproject.org'
|
||||||
|
Err http://security.debian.org jessie/updates Release.gpg
|
||||||
|
Could not resolve 'security.debian.org'
|
||||||
|
Reading package lists... Done
|
||||||
|
W: Failed to fetch http://security.debian.org/dists/jessie/updates/Release.gpg Could not resolve 'security.debian.org'
|
||||||
|
|
||||||
|
W: Failed to fetch http://ftp.us.debian.org/debian/dists/jessie/Release.gpg Could not resolve 'ftp.us.debian.org'
|
||||||
|
|
||||||
|
W: Failed to fetch http://deb.torproject.org/torproject.org/dists/jessie/Release.gpg Could not resolve 'deb.torproject.org'
|
||||||
|
|
||||||
|
W: Some index files failed to download. They have been ignored, or old ones used instead.
|
||||||
|
~~~
|
||||||
|
|
||||||
|
This could be a temporary Tor exit relay or server failure that should fix itself. Here are some simple things to try:
|
||||||
|
|
||||||
|
- Check if your network connection is functional
|
||||||
|
- Try to [change your Tor circuit](https://www.whonix.org/wiki/Arm), then try again
|
||||||
|
- Running [whonixcheck](https://www.whonix.org/wiki/Whonixcheck) might also help diagnose the problem
|
||||||
|
|
||||||
|
Sometimes if you see a message such as:
|
||||||
|
|
||||||
|
~~~
|
||||||
|
Could not resolve 'security.debian.org'
|
||||||
|
~~~
|
||||||
|
|
||||||
|
It helps to running the following command:
|
||||||
|
|
||||||
|
~~~
|
||||||
|
nslookup security.debian.org
|
||||||
|
~~~
|
||||||
|
|
||||||
|
And then trying running the `update` and `upgrade` commands again.
|
||||||
|
|
||||||
|
~~~
|
||||||
|
sudo apt-get update && sudo apt-get dist-upgrade
|
||||||
|
~~~
|
||||||
|
|
||||||
|
*Please note: if you [disabled the Whonix APT Repository](https://www.whonix.org/wiki/Whonix-APT-Repository#Disable_Whonix_APT_Repository) you'll have to manually check for new Whonix releases and [manually install them from source code](https://www.whonix.org/wiki/Dev/Build_Documentation).*
|
||||||
|
|
||||||
|
### Never Install Unsigned Packages
|
||||||
|
|
||||||
|
If you see something like this:
|
||||||
|
|
||||||
|
~~~
|
||||||
|
WARNING: The following packages cannot be authenticated!
|
||||||
|
icedove
|
||||||
|
Install these packages without verification [y/N]?
|
||||||
|
~~~
|
||||||
|
|
||||||
|
Don't proceed! Press `N` and `<enter>`. Running `apt-get update` again should fix it. If not, something is broken or it's a [Man in the middle attack](https://www.whonix.org/wiki/Warning#Man-in-the-middle_attacks), which isn't that unlikely, since we are updating over Tor exit relays and some of them are malicious. Try to [change your Tor circuit](https://www.whonix.org/wiki/Arm#Arm).
|
||||||
|
|
||||||
|
{{Anchor|signature verification errors}}
|
||||||
|
{{Anchor|signature verification warnings}}
|
||||||
|
|
||||||
|
### Signature Verification Warnings
|
||||||
|
|
||||||
|
There should be none at the moment. If there was such a warning, it would look like this:
|
||||||
|
|
||||||
|
~~~
|
||||||
|
W: A error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://deb.torproject.org stable Release: The following signatures were invalid: KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681
|
||||||
|
~~~
|
||||||
|
|
||||||
|
Even though, `apt-get` will automatically ignore repositories with expired keys or signatures, you will not receive upgrades from that repository. Unless the issue is already known/documented, it should be reported so it can be further investigated.
|
||||||
|
|
||||||
|
There are two possible reasons why this could happen, either there is an issue with the repository that the maintainers have to fix, or you are victim of a [Man-in-the-middle_attacks](https://www.whonix.org/wiki/Warning#Man-in-the-middle_attacks). The latter would not be a big issue and might go away after a while automatically or try to [change your Tor circuit](https://www.whonix.org/wiki/Arm#Arm)
|
||||||
|
|
||||||
|
In past various apt repositories were signed with expired key. If you want to see how the documentation looked at that point, please click on expand on the right.
|
||||||
|
|
||||||
|
[The Tor Project's apt repository key was expired](https://trac.torproject.org/projects/tor/ticket/12994). You saw the following warning.
|
||||||
|
|
||||||
|
~~~
|
||||||
|
W: A error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://deb.torproject.org stable Release: The following signatures were invalid: KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681
|
||||||
|
|
||||||
|
W: Failed to fetch http://deb.torproject.org/torproject.org/dists/stable/Release
|
||||||
|
W: Some index files failed to download. They have been ignored, or old ones used instead.
|
||||||
|
~~~
|
||||||
|
|
||||||
|
It had already been [reported](https://trac.torproject.org/projects/tor/ticket/12994). There was no immediate danger. You could have just ignored it. Just make sure, you never install unsigned packages as explained above.
|
||||||
|
|
||||||
|
If you were to see other signature verification errors, those should be reported, but it shouldn't happen at this time.
|
||||||
|
|
||||||
|
### Changed Configuration Files
|
||||||
|
|
||||||
|
If you see something like the following.
|
||||||
|
|
||||||
|
~~~
|
||||||
|
Setting up ifupdown ...
|
||||||
|
Configuration file /etc/network/interfaces
|
||||||
|
==> Modified (by you or by a script) since installation.
|
||||||
|
==> Package distributor has shipped an updated version.
|
||||||
|
What would you like to do about it ? Your options are:
|
||||||
|
Y or I : install the package maintainer's version
|
||||||
|
N or O : keep your currently-installed version
|
||||||
|
D : show the differences between the versions
|
||||||
|
Z : background this process to examine the situation
|
||||||
|
The default action is to keep your current version.
|
||||||
|
*** interfaces (Y/I/N/O/D/Z) [default=N] ? N
|
||||||
|
~~~
|
||||||
|
|
||||||
|
Be careful. If the updated file isn't coming from Whonix specific package (some are called `whonix-...`), then press `n`. Otherwise anonymity/privacy/security settings deployed with Whonix might get lost. If you are an advanced user and know better, you can of course manually check the difference and merge them.
|
||||||
|
|
||||||
|
How could you find out if the file is coming from a Whonix specific package or not?
|
||||||
|
|
||||||
|
* Whonix specific packages are sometimes called `whonix-...`. In the example above it's saying `Setting up ifupdown ...`, so the file isn't coming from a Whonix specific package. In this case, you should press `n` as advised in the paragraph above.
|
||||||
|
* If the package name does include `whonix-...`, it's a Whonix specific package. In that case, your safest bet should be pressing `y`, but then you would loose your customized settings. You can re-add them afterwards. Such conflicts will hopefully rarely happen, if you use [Whonix modular flexible .d style configuration folders].
|
||||||
Loading…
Reference in New Issue
Block a user