August 2018 - tor-commits - lists.torproject.org

[webwml/staging] onion services: add link to Alec Muffett's Enterprise Onion Toolkit
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit 518d8ffad1894b9b6020af83f5d0f1a50834beed Author: traumschule <traumschuleriebau(a)riseup.net> Date: Tue Aug 21 04:06:06 2018 +0200 onion services: add link to Alec Muffett's Enterprise Onion Toolkit --- docs/en/tor-onion-service.wml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/en/tor-onion-service.wml b/docs/en/tor-onion-service.wml index 4f7929c7..4319ad3c 100644 --- a/docs/en/tor-onion-service.wml +++ b/docs/en/tor-onion-service.wml @@ -225,6 +225,9 @@ HiddenServicePort 22 127.0.0.1:22 </pre> + To set up an onion service on Raspbian have a look at Alec Muffett's + <a href="https://github.com/alecmuffett/eotk">Enterprise Onion Toolkit</a>. + <p>Onion services operators need to practice proper <a href="https://trac.torproject.org/projects/tor/wiki/doc/OperationalSecurity"> operational security</a> and system administration to maintain security.

1 0

[webwml/staging] faq: add update on netflow padding (fixes #22958)
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit 74b08c7a16ef3a21b9148755bcffcd03801924f8 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Tue Aug 21 06:51:47 2018 +0200 faq: add update on netflow padding (fixes #22958) --- docs/en/faq.wml | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/docs/en/faq.wml b/docs/en/faq.wml index 3287072d..70e63620 100644 --- a/docs/en/faq.wml +++ b/docs/en/faq.wml @@ -4112,13 +4112,8 @@ receive a fixed number of cells. This approach is more well-understood in the context of high-latency systems. See e.g. <a href="http://freehaven.net/anonbib/#pet05-serjantov"> Message Splitting Against the Partial Adversary by Andrei Serjantov and -Steven J. Murdoch</a>. - </p> - <p> -But since we don't currently understand what network and padding -parameters, if any, could provide increased end-to-end security, our -current strategy is to minimize the number of places that the adversary -could possibly see. +Steven J. Murdoch</a>. Also see our <a href="SendPadding">update on netflow + padding below</a>. </p> <hr> @@ -4281,6 +4276,26 @@ only solution is to have no opinion. optimistic. </p> + <p> + We did however since + <a href="https://gitweb.torproject.org/torspec.git/tree/proposals/251-netflow-paddin…"> + implement netflow padding</a> to collapse netflow records for improved + security. Now padding is sent between a client's Tor connection and its guard + bidirectionally at a random interval that we control from the consensus, + with a default of 4 to 14 seconds if the connection is idle. This has the + goal of stymying some of the potential traffic analysis attacks out there -- + website fingerprinting, end-to-end correlation, and the things in between. + </p> + + <p>For details see the + <a href="https://blog.torproject.org/blog/network-team-hackfest-wilmington-watch"> + blog post</a> by the Tor network team, the + <a href="https://lists.torproject.org/pipermail/tor-dev/2015-August/009326.html"> + announcement</a> on the tor-dev mailinglist or read further + <a href="https://www.freehaven.net/anonbib/bibtex.html">publications</a> on + padding. + </p> + <hr> <a id="Steganography"></a>

1 0

[webwml/staging] jobs: remove both Project Manager job postings (#27227)
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit a9e57ef33446618acb96167427586d1e74fba88e Author: traumschule <traumschuleriebau(a)riseup.net> Date: Tue Aug 21 07:12:15 2018 +0200 jobs: remove both Project Manager job postings (#27227) --- about/en/jobs.wml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/about/en/jobs.wml b/about/en/jobs.wml index db7f0577..40799633 100644 --- a/about/en/jobs.wml +++ b/about/en/jobs.wml @@ -17,8 +17,6 @@ <p>Specifically, we're looking for the following people currently:</p> <ul> - <li><a href="<page about/jobs-projectmanager-network>">Project Manager for Network Projects</a></li> - <li><a href="<page about/jobs-projectmanager-product>">Project Manager with Product Experience</a></li> <li><a href="<page about/jobs-sysadmin>">Senior Systems Administrator</a></li> <li><a href="<page about/jobs-grantsmanager>">Grants Manager</a></li> <li><a href="<page about/jobs-grantwriter>">Grant Writer</a></li> @@ -44,6 +42,8 @@ <li>Chief Financial and Grants Officer</li> <li>Android OS Developer</li> <li>Fundraising Director</li> + <li>Project Manager for Network Projects</li> + <li>Project Manager with Product Experience</li> </ul> <p>About the company:<br>

1 0

[webwml/staging] Remove strange characters
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit efffbdc9547dbc681927b8236d57452176a7111e Author: hiro <hiro(a)torproject.org> Date: Wed Aug 22 12:33:55 2018 +0200 Remove strange characters --- docs/en/faq.wml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/en/faq.wml b/docs/en/faq.wml index ee197963..69e4568d 100644 --- a/docs/en/faq.wml +++ b/docs/en/faq.wml @@ -3539,7 +3539,7 @@ href="https://www.noisebridge.net/wiki/Noisebridge_Tor">Noisebridge</a> <p> You can read more at <a href="http://freehaven.net/anonbib/#wright02"> An Analysis of the Degradation of Anonymous Protocols</a>, - <a href="http://freehaven.net/anonbib/#wright03">Defending Anonymous + <a href="http://freehaven.net/anonbib/#wright03">Defending Anonymous Communication Against Passive Logging Attacks</a>, and especially <a href="http://freehaven.net/anonbib/#hs-attack06"> Locating Hidden Servers</a>. @@ -3980,7 +3980,6 @@ Perhaps even run separate Tor clients for these applications. spend rethinking their overall approach to privacy and anonymity. </li> </ol> ->>>>>>> faq-datadir <hr>

1 0

[webwml/staging] Fix merge conflicts
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit ac08645cea83c2f900f81b57d70734de3ef9d099 Merge: a9e57ef3 d7568ec6 Author: hiro <hiro(a)torproject.org> Date: Wed Aug 22 12:25:54 2018 +0200 Fix merge conflicts docs/en/faq.wml | 3843 +++++++++++++++++++++++++++---------------------------- 1 file changed, 1912 insertions(+), 1931 deletions(-) diff --cc docs/en/faq.wml index 70e63620,05eaff4e..ee197963 --- a/docs/en/faq.wml +++ b/docs/en/faq.wml @@@ -282,9 -294,21 +295,9 @@@ traffic.</a></li> </ul> - <a id="abuse"></a> - <h4 style="margin-bottom: 18px"><a class="anchor" href="#abuse">Abuse: - </a></h4> - <ul> - <li><a href="#Criminals">Doesn't Tor enable criminals to do bad things? - </a></li> - <li><a href="#RespondISP">How do I respond to my ISP about my exit - relay?</a></li> - <li><a href="#HelpPoliceOrLawyers">I have questions about a Tor IP address - for a legal case.</a></li> - </ul> - <p>For other questions not yet on this version of the FAQ, see the - <a - href="<wikifaq>">wiki FAQ</a> for now.</p> + <a href="<wikifaq>">wiki FAQ</a> for now. + </p> <hr> @@@ -2066,47 -2059,35 +2048,53 @@@ versions #Accept from all interfaces SocksListenAddress 0.0.0.0:9100 </pre> + <p> - You can state multiple listen addresses, in the case that you are - part of several networks or subnets. + You can state multiple listen addresses, in the case that you are + part of several networks or subnets. </p> + <pre> - SocksListenAddress 192.168.x.x:9100 #eth0 - SocksListenAddress 10.x.x.x:9100 #eth1 + SocksListenAddress 192.168.x.x:9100 #eth0 + SocksListenAddress 10.x.x.x:9100 #eth1 </pre> + <p> - After this, your clients on their respective networks/subnets would specify - a socks proxy with the address and port you specified SocksListenAddress - to be. + After this, your clients on their respective networks/subnets would specify + a socks proxy with the address and port you specified SocksListenAddress + to be. </p> + <p> - Please note that the SocksPort configuration option gives the port ONLY for - localhost (127.0.0.1). When setting up your SocksListenAddress(es), you need - to give the port with the address, as shown above. + Please note that the SocksPort configuration option gives the port ONLY for + localhost (127.0.0.1). When setting up your SocksListenAddress(es), you need + to give the port with the address, as shown above. + </p> + <p> - If you are interested in forcing all outgoing data through the central Tor - client/relay, instead of the server only being an optional proxy, you may find - the program iptables (for *nix) useful. + If you are interested in forcing all outgoing data through the central Tor + client/relay, instead of the server only being an optional proxy, you may + find the program iptables (for *nix) useful. </p> + <a id="IPv6"></a> + <h3><a class="anchor" href="#IPv6">How do I use Tor from an IPv6 only host/computer?</a></h3> + <p> + IPv6 is supported since Tor version 0.2.8.x or newer. To activate it add + the following two entries into your torrc file: + </p> + <pre> + ClientUseIPv4 0 + ClientUseIPv6 1 + </pre> + <p> + Note that as of 2018 there aren't many IPv6 users, or IPv6 guards, so Tor over IPv6 + is less anonymous than Tor over IPv4. You can review the IPv6 implemetation status at our + <a href="https://trac.torproject.org/projects/tor/wiki/org/roadmaps/Tor/IPv6Features">IPv6Features</a> + wiki page, known issues can be found with the + <a href="https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~ipv6">ipv6 keyword</a>. + </p> + <hr> <a id="RunningATorRelay"></a> @@@ -3912,111 -3874,105 +3881,106 @@@ Perhaps even run separate Tor clients f Please help on all of these! </p> - <hr> - - <a id="TransportIPnotTCP"></a> - <h3><a class="anchor" href="#TransportIPnotTCP">You should transport all - IP packets, not just TCP packets.</a></h3> - - <p> - This would be handy, because it would make Tor better able to handle - new protocols like VoIP, it could solve the whole need to socksify - applications, and it would solve the fact that exit relays need to - allocate a lot of file descriptors to hold open all the exit - connections. - </p> - - <p> - We're heading in this direction: see <a - href="https://trac.torproject.org/projects/tor/ticket/1855">this trac - ticket</a> for directions we should investigate. Some of the hard - problems are: - </p> - - <ol> - <li>IP packets reveal OS characteristics. We would still need to do - IP-level packet normalization, to stop things like TCP fingerprinting - attacks. Given the diversity and complexity of TCP stacks, along with <a - href="#RemotePhysicalDeviceFingerprinting">device - fingerprinting attacks</a>, it looks like our best bet is shipping our - own user-space TCP stack. - </li> - <li>Application-level streams still need scrubbing. We will still need - user-side applications like Torbutton. So it won't become just a matter - of capturing packets and anonymizing them at the IP layer. - </li> - <li>Certain protocols will still leak information. For example, we must - rewrite DNS requests so they are delivered to an unlinkable DNS server - rather than the DNS server at a user's ISP; thus, we must understand - the protocols we are transporting. - </li> - <li><a - href="http://crypto.stanford.edu/~nagendra/projects/dtls/dtls.html">DTLS - </a> - (datagram TLS) basically has no users, and IPsec sure is big. Once we've - picked a transport mechanism, we need to design a new end-to-end Tor - protocol for avoiding tagging attacks and other potential anonymity and - integrity issues now that we allow drops, resends, et cetera. - </li> - <li>Exit policies for arbitrary IP packets mean building a secure - IDS. Our node operators tell us that exit policies are one of the main - reasons they're willing to run Tor. Adding an Intrusion Detection System - to handle exit policies would increase the security complexity of Tor, - and would likely not work anyway, as evidenced by the entire field of - IDS - and counter-IDS papers. Many potential <a href="<page docs/faq-abuse>">abuse</a> issues are resolved by the - fact that Tor only transports valid TCP streams (as opposed to arbitrary - IP including malformed packets and IP floods), so exit policies become - even <i>more</i> important as we become able to transport IP packets. We - also need to compactly describe exit policies in the Tor directory, - so clients can predict which nodes will allow their packets to exit - — - and clients need to predict all the packets they will want to send in - a session before picking their exit node! - </li> - <li>The Tor-internal name spaces would need to be redesigned. We support - onion service ".onion" addresses by intercepting the addresses when - they are passed to the Tor client. Doing so at the IP level will require - a more complex interface between Tor and the local DNS resolver. - </li> - </ol> - - <hr> - - <a id="HideExits"></a> - <h3><a class="anchor" href="#HideExits">You should hide the list of Tor - relays, so people can't block the exits.</a></h3> - - <p> - There are a few reasons we don't: - </p> - - <ol> - <li>We can't help but make the information available, since Tor clients - need to use it to pick their paths. So if the "blockers" want it, they - can get it anyway. Further, even if we didn't tell clients about the - list of relays directly, somebody could still make a lot of connections - through Tor to a test site and build a list of the addresses they see. - </li> - - <li>If people want to block us, we believe that they should be allowed - to - do so. Obviously, we would prefer for everybody to allow Tor users to - connect to them, but people have the right to decide who their services - should allow connections from, and if they want to block anonymous - users, - they can. - </li> - - <li>Being blockable also has tactical advantages: it may be a persuasive - response to website maintainers who feel threatened by Tor. Giving them - the option may inspire them to <a href="<page docs/faq-abuse>#Bans">stop - and think</a> about whether they really want to eliminate private access - to their system, and if not, what other options they might have. The - time they might otherwise have spent blocking Tor, they may instead - spend rethinking their overall approach to privacy and anonymity. - </li> - </ol> + <hr> + + <a id="TransportIPnotTCP"></a> + <h3><a class="anchor" href="#TransportIPnotTCP">You should transport all + IP packets, not just TCP packets.</a></h3> + + <p> + This would be handy, because it would make Tor better able to handle + new protocols like VoIP, it could solve the whole need to socksify + applications, and it would solve the fact that exit relays need to + allocate a lot of file descriptors to hold open all the exit + connections. + </p> + + <p> + We're heading in this direction: see + <a href="https://trac.torproject.org/projects/tor/ticket/1855">this trac + ticket</a> for directions we should investigate. Some of the hard problems + are: + </p> + + <ol> + <li>IP packets reveal OS characteristics. We would still need to do + IP-level packet normalization, to stop things like TCP fingerprinting + attacks. Given the diversity and complexity of TCP stacks, along with + <a href="#RemotePhysicalDeviceFingerprinting">device fingerprinting + attacks</a>, it looks like our best bet is shipping our own user-space TCP + stack. + </li> + <li>Application-level streams still need scrubbing. We will still need + user-side applications like Torbutton. So it won't become just a matter + of capturing packets and anonymizing them at the IP layer. + </li> + <li>Certain protocols will still leak information. For example, we must + rewrite DNS requests so they are delivered to an unlinkable DNS server + rather than the DNS server at a user's ISP; thus, we must understand + the protocols we are transporting. + </li> + <li><a href="http://crypto.stanford.edu/~nagendra/projects/dtls/dtls.html"> + DTLS</a> (datagram TLS) basically has no users, and IPsec sure is big. Once + we've picked a transport mechanism, we need to design a new end-to-end Tor + protocol for avoiding tagging attacks and other potential anonymity and + integrity issues now that we allow drops, resends, et cetera. + </li> + <li>Exit policies for arbitrary IP packets mean building a secure IDS. Our + node operators tell us that exit policies are one of the main reasons + they're willing to run Tor. Adding an Intrusion Detection System to handle + exit policies would increase the security complexity of Tor, and would + likely not work anyway, as evidenced by the entire field of IDS and + counter-IDS papers. Many potential abuse issues are resolved by the fact + that Tor only transports valid TCP streams (as opposed to arbitrary IP + including malformed packets and IP floods), so exit policies become even + <i>more</i> important as we become able to transport IP packets. We also + need to compactly describe exit policies in the Tor directory, so clients + can predict which nodes will allow their packets to exit — and + clients need to predict all the packets they will want to send in a session + before picking their exit node! + </li> + <li>The Tor-internal name spaces would need to be redesigned. We support + onion service ".onion" addresses by intercepting the addresses when they + are passed to the Tor client. Doing so at the IP level will require a more + complex interface between Tor and the local DNS resolver. + </li> + </ol> + + <hr> + + <a id="HideExits"></a> + <h3><a class="anchor" href="#HideExits">You should hide the list of Tor + relays, so people can't block the exits.</a></h3> + + <p> + There are a few reasons we don't: + </p> + + <ol> + <li>We can't help but make the information available, since Tor clients + need to use it to pick their paths. So if the "blockers" want it, they + can get it anyway. Further, even if we didn't tell clients about the + list of relays directly, somebody could still make a lot of connections + through Tor to a test site and build a list of the addresses they see. + </li> + + <li>If people want to block us, we believe that they should be allowed to + do so. Obviously, we would prefer for everybody to allow Tor users to + connect to them, but people have the right to decide who their services + should allow connections from, and if they want to block anonymous users, + they can. + </li> + + <li>Being blockable also has tactical advantages: it may be a persuasive + response to website maintainers who feel threatened by Tor. Giving them + the option may inspire them to <a href="<page docs/faq-abuse>#Bans">stop + and think</a> about whether they really want to eliminate private access + to their system, and if not, what other options they might have. The + time they might otherwise have spent blocking Tor, they may instead + spend rethinking their overall approach to privacy and anonymity. + </li> + </ol> ++>>>>>>> faq-datadir <hr> @@@ -4095,25 -4028,33 +4063,34 @@@ each connection over many paths.</a></h3> <p> - We don't currently think this is a good idea. You see, the attacks we're - worried about are at the endpoints: the adversary watches Alice (or the - first hop in the path) and Bob (or the last hop in the path) and learns - that they are communicating. + We don't currently think this is a good idea. You see, the attacks we're + worried about are at the endpoints: the adversary watches Alice (or the + first hop in the path) and Bob (or the last hop in the path) and learns + that they are communicating. + </p> + + <p> + If we make the assumption that timing attacks work well on even a few + packets end-to-end, then having *more* possible ways for the adversary to + observe the connection seems to hurt anonymity, not help it. </p> + <p> - If we make the assumption that timing attacks work well on even a few packets - end-to-end, then having *more* possible ways for the adversary to observe the - connection seems to hurt anonymity, not help it. ++ + Now, it's possible that we could make ourselves more resistant to + end-to-end attacks with a little bit of padding and by making each circuit + send and receive a fixed number of cells. This approach is more + well-understood in the context of high-latency systems. See e.g. + <a href="http://freehaven.net/anonbib/#pet05-serjantov"> + Message Splitting Against the Partial Adversary by Andrei Serjantov and + Steven J. Murdoch</a>. </p> + <p> - Now, it's possible that we could make ourselves more resistant to end-to-end - attacks with a little bit of padding and by making each circuit send and - receive a fixed number of cells. This approach is more well-understood in - the context of high-latency systems. See e.g. - <a href="http://freehaven.net/anonbib/#pet05-serjantov"> - Message Splitting Against the Partial Adversary by Andrei Serjantov and - Steven J. Murdoch</a>. Also see our <a href="SendPadding">update on netflow - padding below</a>. + But since we don't currently understand what network and padding + parameters, if any, could provide increased end-to-end security, our + current strategy is to minimize the number of places that the adversary + could possibly see. </p> <hr>

1 0

[webwml/master] Merge branch 'docs-debian-ubuntu'
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit e792f0e6b9493294425fc1877a23f10d35915b02 Merge: a7540965 a08d3216 Author: hiro <hiro(a)torproject.org> Date: Mon Aug 27 12:47:04 2018 +0200 Merge branch 'docs-debian-ubuntu' docs/en/debian.wml | 318 ++++++++++++++++++++++++++++++----------------------- 1 file changed, 179 insertions(+), 139 deletions(-)

1 0

[webwml/master] docs/debian: improve the guide (#27278)
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit 1e529dfdcbf832a1ccb9fee6b817022ec82be54b Author: traumschule <traumschuleriebau(a)riseup.net> Date: Fri Aug 24 01:58:07 2018 +0200 docs/debian: improve the guide (#27278) --- docs/en/debian.wml | 309 +++++++++++++++++++++++++++++------------------------ 1 file changed, 170 insertions(+), 139 deletions(-) diff --git a/docs/en/debian.wml b/docs/en/debian.wml index 30684a4a..16bb8159 100644 --- a/docs/en/debian.wml +++ b/docs/en/debian.wml @@ -15,34 +15,34 @@ </div> <div id="maincol"> <a id="debian"></a> -<h2><a class="anchor" href="#debian">Option one: Tor on Debian Stretch - stable, -Debian Buster - testing, or Debian Sid - unstable</a></h2> +<h2><a class="anchor" href="#debian">Option one: Tor on Debian Stretch - +stable, Debian Buster - testing, or Debian Sid - unstable</a></h2> <br /> <p> If you're using Debian, just run as root: -</blockquote><pre> apt install tor </pre></blockquote> +<blockquote><pre># apt install tor</pre></blockquote> </p> -<p>Debian provides the <a href="https://packages.debian.org/stretch/tor">LTS</a> +<p>Debian provides the +<a href="https://packages.debian.org/stretch/tor">LTS</a> version of Tor. Note that this might not always give you the latest stable Tor version, but you will receive important security fixes. To make sure that you're running the latest stable version of Tor, see option two below. </p> <p> -When Tor is installed and running move on to <a href="<page -docs/tor-doc-unix>#using">step two</a> of the "<a href="<page -docs/tor-doc-unix>">Tor on Linux/Unix</a>" instructions. +When Tor is installed and running move on to +<a href="<page docs/tor-doc-unix>#using">step two</a> of the +"<a href="<page docs/tor-doc-unix>">Tor on Linux/Unix</a>" instructions. </p> <hr /> <a id="ubuntu"></a> <a id="packages"></a> -<h2><a class="anchor" href="#ubuntu">Option two: Tor on Ubuntu or +<h2><a class="anchor" href="#ubuntu">Option two: Tor on Ubuntu or Debian</a></h2> -<br /> <p> <b>Do not use the packages in Ubuntu's universe.</b> In the past they have @@ -51,24 +51,50 @@ and security fixes. </p> <p> -<b>Raspbian is not Debian.</b> Tor might run fine on the Raspberry Pi 2 / 3 but not the first generation Pi. -These packages might be confusingly broken for Raspbian users, since Raspbian called their architecture armhf but -Debian already has an armhf. See <a +<b>Raspbian is not Debian.</b> Tor might run fine on the Raspberry Pi 2 / 3 +but not the first generation Pi. +These packages might be confusingly broken for Raspbian users, since Raspbian +called their architecture armhf but Debian already has an armhf. See <a href="http://tor.stackexchange.com/questions/242/how-to-run-tor-on-raspbian-on-th…">this post</a> for details. </p> <p> -You'll need to set up our package repository before you can fetch -Tor. First, you need to figure out the name of your distribution. A -quick command to run is <tt>lsb_release -c</tt> or <tt>cat /etc/debian_version</tt>. -If in doubt about your Debian version, check <a href="https://www.debian.org/releases/">the Debian website</a>. -For Ubuntu, ask <a href="https://en.wikipedia.org/wiki/List_of_Ubuntu_releases#Table_of_versions">Wikipedia</a>. +<b>Admin access</b>: +To install Tor you need root privileges. Below all commands that need to be run +as root user like apt and dpkg are prepended with '&num;', +while commands to be run as user with '$' resembling the standard +prompt in a terminal. To open a root terminal you have several options: +<code>sudo su</code>, or <code>sudo -i</code>, or <code>su -i</code>. +Note that sudo asks for your user password, while su expects +the root password of your system. +</p> + +<p> +<b>apt-transport-tor</b>: +To use source lines with <tt>https://</tt> in <i>/etc/apt/sources.list</i> the +<a href="https://packages.debian.org/stretch/apt-transport-https">apt-transport-https package</a> +is required. Install it with +<blockquote><pre> +&num; apt install apt-transport-https +</pre></blockquote> +to enable all package managers using the libapt-pkg library to access metadata +and packages available in sources accessible over https (Hypertext Transfer Protocol Secure). +</p> + +<p> +<b>sources.list</b>: +You'll need to set up our package repository before you can fetch Tor. First, +you need to figure out the name of your distribution. A quick command to run is +<tt>lsb_release -c</tt> or <tt>cat /etc/debian_version</tt>. +If in doubt about your Debian version, check +<a href="https://www.debian.org/releases/">the Debian website</a>. +For Ubuntu, ask +<a href="https://en.wikipedia.org/wiki/List_of_Ubuntu_releases#Table_of_versions">Wikipedia</a>. </p> <div id="selector" style="display: none;"> -<blockquote> -I run +<blockquote>I run <select id="distrib"> <option value="jessie">Debian oldstable (jessie)</option> <option value="stretch" selected="selected">Debian stable (stretch)</option> @@ -81,48 +107,38 @@ I run </select> and want <select id="package"></select> -version <select id="version"></select> </blockquote> - <div id="apt-source"> -<p>You need to add the following entries to <code>/etc/apt/sources.list</code> or a new file in -<code>/etc/apt/sources.list.d/</code>:</p> +<p> +You need to add the following entries to <code>/etc/apt/sources.list</code> +or a new file in <code>/etc/apt/sources.list.d/</code>: +</p> -<blockquote><pre id="sources">deb https://deb.torproject.org/torproject.org jessie main +<blockquote><pre id="sources"> +deb https://deb.torproject.org/torproject.org jessie main </pre></blockquote> </div> -<p>Note: To use source lines with https:// in <i>/etc/apt/sources.list</i> the <a -href="https://packages.debian.org/stretch/apt-transport-https">apt-transport-https -package</a> is required. Install it with -<blockquote><pre> -apt install apt-transport-https -</pre></blockquote> -to enable the usage of 'deb https://foo distro main' lines in the /etc/apt/sources.list so that all package managers using the libapt-pkg library can access metadata and packages available in sources accessible over https (Hypertext Transfer Protocol Secure).</p> - -<p>To use Apt with Tor later replace <tt>https://</tt> with <tt>tor://</tt> and run -<blockquote><pre> -apt install apt-transport-tor -</pre></blockquote> -</p> - <div id="sig"> -<p>Then add the gpg key used to sign the packages by running the following commands at your command prompt:</p> +<p>Then add the gpg key used to sign the packages by running the following +commands at your command prompt: <blockquote><pre> -gpg --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 -gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add - -</pre></blockquote> +&num; gpg --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 +&num; gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add - +</pre></blockquote></p> </div> - <div id="apt-get"> -<p>You can install it with the following commands:</p> -<blockquote><pre>apt update -<span id="regular-install">apt install <span id="apt-package">tor</span> deb.torproject.org-keyring</span> -<span id="source-install">$ apt install build-essential fakeroot devscripts -$ apt build-dep tor deb.torproject.org-keyring</span></pre></blockquote> +<p>We provide a Debian package to help you keep our signing key current. It is +recommended you use it. Install it with the following commands:</p> +<blockquote><pre>&num; apt update +<span id="regular-install">&num; apt install <span id="apt-package">tor</span> deb.torproject.org-keyring</span> +<span id="source-install">&num; apt install build-essential fakeroot devscripts +&num; apt build-dep tor deb.torproject.org-keyring +</span> +</pre></blockquote> <div id="source-install2"> <p>Then you can build Tor in ~/debian-packages:</p> @@ -135,7 +151,7 @@ $ cd .. </pre></blockquote> <p>Now you can install the new package:</p> <blockquote><pre> -$ sudo dpkg -i tor_*.deb +&num; dpkg -i tor_*.deb </pre></blockquote> </div> </div> @@ -143,140 +159,155 @@ $ sudo dpkg -i tor_*.deb <noscript> <p> -Then add this line to your -<tt>/etc/apt/sources.list</tt> -file:<br /> -<pre style="margin: 1.5em 0 1.5em 2em"> +Then add this line to your <tt>/etc/apt/sources.list</tt> file:<br /> +<blockquote><pre> deb https://deb.torproject.org/torproject.org <DISTRIBUTION> main -</pre> +/pre></blockquote> where you put the codename of your distribution (i.e. stretch, buster, sid -or whatever it is) -in place of <DISTRIBUTION>. +or whatever it is) in place of <DISTRIBUTION>. </p> <p> -If you want to use the <a href="<page download/download-unix>#packagediff">development branch</a> of Tor instead (more features and more bugs), you need add a different set of lines to your <i>/etc/apt/sources.list</i> file:<br /> -<pre style="margin: 1.5em 0 1.5em 2em"> +If you want to use the +<a href="<page download/download-unix>#packagediff">development branch</a> +of Tor instead (more features and more bugs), you need add a different set of +lines to your <i>/etc/apt/sources.list</i> file:<br /> +<blockquote><pre> deb https://deb.torproject.org/torproject.org <DISTRIBUTION> main deb https://deb.torproject.org/torproject.org tor-experimental-0.3.4.x-<DISTRIBUTION> main -</pre> -</p> - -<p>Note: To use source lines with <tt>https://</tt> in <i>/etc/apt/sources.list</i> the <a -href="https://packages.debian.org/stretch/apt-transport-https">apt-transport-https -package</a> is required. Install it with -<blockquote><pre> -apt install apt-transport-https -</pre></blockquote> -to enable the usage of 'deb https://foo distro main' lines in the /etc/apt/sources.list so that all package managers using the libapt-pkg library can access metadata and packages available in sources accessible over https (Hypertext Transfer Protocol Secure).</p> - -<p>To use Apt with Tor later replace <tt>https://</tt> with <tt>tor://</tt> and run <blockquote><pre> -apt install apt-transport-tor </pre></blockquote> </p> <p> Then add the gpg key used to sign the packages by running the following commands at your command prompt: -<pre style="margin: 1.5em 0 1.5em 2em"> -gpg --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 -gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add - -</pre> +<blockquote><pre> +&num; gpg --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 +&num; gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add - +</pre></blockquote> Now refresh your sources, running the following command (as root) at your command prompt: -<pre style="margin: 1.5em 0 1.5em 2em"> -apt update -</pre> +<blockquote><pre> +&num; apt update +</pre></blockquote> If there are no errors you're good to continue. </p> <p> -We provide a Debian package to help you keep our signing key current. It is -recommended you use it. Install it along with tor using -<pre style="margin: 1.5em 0 1.5em 2em"> -apt install tor deb.torproject.org-keyring -</pre> +We provide a Debian package to help you keep our signing key current. It is +recommended you use it. Install it together with tor: +<blockquote><pre> +&num; apt install tor deb.torproject.org-keyring +</pre></blockquote> </p> </noscript> - -<p> -Now Tor is installed and running. Move on to <a href="<page -docs/tor-doc-unix>#using">step two</a> of the "Tor on Linux/Unix" -instructions. -</p> - -<p style="font-size: small"> -The DNS name <code>deb.torproject.org</code> is actually a set of independent -servers in a DNS round robin configuration. If you for some reason cannot -access it you might try to use the name of one of its part instead. Try -<code>deb-master.torproject.org</code>, -<code>mirror.netcologne.de</code> or -<code>tor.mirror.youam.de</code>. -</p> - -<p><code>deb.torproject.org</code> is also served through now also served via onion service: -<a href="http://sdscoq7snqtznauu.onion">http://sdscoq7snqtznauu.onion/</a> To use the onion service with apt, replace the address in the previously added lines: -<pre style="margin: 1.5em 0 1.5em 2em">. -# For the stable version. -deb tor://sdscoq7snqtznauu.onion/torproject.org buster main - -# For the unstable version. -deb tor://sdscoq7snqtznauu.onion/torproject.org tor-nightly-master-<DISTRIBUTION> main -</pre> -<br /> -See <a href="https://onion.torproject.org/">https://onion.torproject.org</a> for all -torproject.org onion addresses.</p> - <noscript> <hr /> <a id="source"></a> <h2><a class="anchor" href="#source">Building from source</a></h2> -<br /> <p> If you want to build your own debs from source you must first add an appropriate <tt>deb-src</tt> line to <tt>sources.list</tt>. -<pre style="margin: 1.5em 0 1.5em 2em"> -# For the stable version. +</p> +<blockquote><pre> +&num; For the stable version. deb-src https://deb.torproject.org/torproject.org <DISTRIBUTION> main -# For the unstable version. +&num; For the unstable version. deb-src https://deb.torproject.org/torproject.org <DISTRIBUTION> main deb-src https://deb.torproject.org/torproject.org tor-experimental-0.3.4.x-<DISTRIBUTION> main -</pre> -Substitute the name of your distro (stretch, buster, sid, xenial, ...) in place of <DISTRIBUTION>. Now refresh your sources by running (as root): -<pre style="margin: 1.5em 0 1.5em 2em"> -apt update -</pre> +</pre></blockquote> +<p> +Substitute the name of your distro (stretch, buster, sid, xenial, ...) in +place of <DISTRIBUTION>. Now refresh your sources by running (as root): +</p> +<blockquote><pre> +&num; apt update +</pre></blockquote> +<p> You also need to install the necessary packages to build your own debs and the packages needed to build Tor: -<pre style="margin: 1.5em 0 1.5em 2em"> -apt install build-essential fakeroot devscripts -apt build-dep tor -</pre> +</p> +<blockquote><pre> +&num; apt install build-essential fakeroot devscripts +&num; apt build-dep tor +</pre></blockquote> +<p> Then you can build Tor in ~/debian-packages: -<pre style="margin: 1.5em 0 1.5em 2em"> -mkdir ~/debian-packages; cd ~/debian-packages -apt source tor -cd tor-* -debuild -rfakeroot -uc -us -cd .. -</pre> +</p> +<blockquote><pre> +$ mkdir ~/debian-packages; cd ~/debian-packages +$ apt source tor +$ cd tor-* +$ debuild -rfakeroot -uc -us +$ cd .. +</pre></blockquote> +<p> Now you can install the new package: -<pre style="margin: 1.5em 0 1.5em 2em"> -sudo dpkg -i tor_*.deb -</pre> </p> +<blockquote><pre> +&num; dpkg -i tor_*.deb +</pre></blockquote> + +</noscript> <p> -Now Tor is installed and running. Move on to <a href="<page -docs/tor-doc-unix>#using">step two</a> of the "Tor on Linux/Unix" -instructions. +Now Tor is installed and running. Move on to +<a href="<page docs/tor-doc-unix>#using">step two</a> of the +"Tor on Linux/Unix" instructions. +</p> + +<p style="font-size: small"> +The DNS name <code>deb.torproject.org</code> is actually a set of independent +servers in a DNS round robin configuration. If you for some reason cannot +access it you might try to use the name of one of its part instead. Try +<code>deb-master.torproject.org</code>, +<code>mirror.netcologne.de</code> or +<code>tor.mirror.youam.de</code>. +</p> + +<hr /> + +<a id="apt-over-tor"></a> +<h2><a class="anchor" href="#apt-over-tor">Use Apt over Tor</a></h2> + +<p> +<code>deb.torproject.org</code> is also served through via an onion service: +<a href="http://sdscoq7snqtznauu.onion">http://sdscoq7snqtznauu.onion/</a> +</p> + +<p> +To use Apt with Tor the according apt transport needs to be installed: +</p> +<blockquote><pre> +&num; apt install apt-transport-tor +</pre></blockquote> + +<p> +Then replace the address in the lines added before with, for example: +</p> +<blockquote><pre> +&num; For the stable version. +deb tor://sdscoq7snqtznauu.onion/torproject.org <DISTRIBUTION> main + +&num; For the unstable version. +deb tor://sdscoq7snqtznauu.onion/torproject.org tor-nightly-master-<DISTRIBUTION> main +</pre></blockquote> +<p> +Now refresh your sources and try if it's still possible to install tor: +</p> +<blockquote><pre> +&num; apt update +&num; apt install tor +</pre></blockquote> +<p> +See <a href="https://onion.torproject.org/">onion.torproject.org</a> +for all torproject.org onion addresses.</p> </p> -</noscript>  </div>

1 0

[webwml/master] docs/debian: add option for Ubuntu Cosmic
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit a08d3216cd4c646591f98fde6376a168c111c76c Author: traumschule <traumschuleriebau(a)riseup.net> Date: Mon Aug 27 01:24:48 2018 +0200 docs/debian: add option for Ubuntu Cosmic --- docs/en/debian.wml | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/en/debian.wml b/docs/en/debian.wml index a36f613a..9184ae7c 100644 --- a/docs/en/debian.wml +++ b/docs/en/debian.wml @@ -112,6 +112,7 @@ For Ubuntu, ask <option value="xenial">Ubuntu Xenial Xerus (16.04 LTS)</option> <option value="artful">Ubuntu Artful Aardvark (17.10)</option> <option value="bionic">Ubuntu Bionic Beaver (18.04 LTS)</option> +<option value="cosmic">Ubuntu Cosmic Cuttlefish (18.10)</option> </select> and want <select id="package"></select>

1 0

[webwml/master] docs/debian: minor fix
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit b9852566146f2845fbfbd8aa9a2f24d076bff25d Author: traumschule <traumschuleriebau(a)riseup.net> Date: Fri Aug 24 02:38:51 2018 +0200 docs/debian: minor fix --- docs/en/debian.wml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/en/debian.wml b/docs/en/debian.wml index 16bb8159..4ff3c37c 100644 --- a/docs/en/debian.wml +++ b/docs/en/debian.wml @@ -162,7 +162,7 @@ $ cd .. Then add this line to your <tt>/etc/apt/sources.list</tt> file:<br /> <blockquote><pre> deb https://deb.torproject.org/torproject.org <DISTRIBUTION> main -/pre></blockquote> +</pre></blockquote> where you put the codename of your distribution (i.e. stretch, buster, sid or whatever it is) in place of <DISTRIBUTION>. </p>

1 0

[webwml/master] docs/debian: keyserver note for gpg prior v2.1
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit cb39c0a532747d45b1d35ab831370d30ab500399 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Fri Aug 24 04:26:32 2018 +0200 docs/debian: keyserver note for gpg prior v2.1 --- docs/en/debian.wml | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/docs/en/debian.wml b/docs/en/debian.wml index 4ff3c37c..a36f613a 100644 --- a/docs/en/debian.wml +++ b/docs/en/debian.wml @@ -71,6 +71,14 @@ the root password of your system. </p> <p> +<b>GPG</b>: +<a href="https://gnupg.org/">GNU Privacy Guard</a> version 2.1 is needed for +this guide. If you are using an older version, consider upgrading to gnupg2 +or replace 'gpg2' below with <code>gpg --keyserver hkp://pool.sks-keyservers.net</code> +since the keyserver option was mandatory for older versions. +</p> + +<p> <b>apt-transport-tor</b>: To use source lines with <tt>https://</tt> in <i>/etc/apt/sources.list</i> the <a href="https://packages.debian.org/stretch/apt-transport-https">apt-transport-https package</a> @@ -125,8 +133,8 @@ deb https://deb.torproject.org/torproject.org jessie main <p>Then add the gpg key used to sign the packages by running the following commands at your command prompt: <blockquote><pre> -&num; gpg --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 -&num; gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add - +&num; gpg2 --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 +&num; gpg2 --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add - </pre></blockquote></p> </div> @@ -182,8 +190,8 @@ deb https://deb.torproject.org/torproject.org tor-experimental-0.3.4.x-<D Then add the gpg key used to sign the packages by running the following commands at your command prompt: <blockquote><pre> -&num; gpg --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 -&num; gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add - +&num; gpg2 --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 +&num; gpg2 --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add - </pre></blockquote> Now refresh your sources, running the following command (as root) at your command prompt:

1 0