diff --git a/assets/css/main.css b/assets/css/main.css index b4f3f0e..f87af25 100644 --- a/assets/css/main.css +++ b/assets/css/main.css @@ -534,6 +534,11 @@ text{ width:auto; height:25px; } + +img{ + max-width:100%; +} + .imgRz100{ width:100%; height:auto; diff --git a/opsec/.$OPSEC.drawio.bkp b/opsec/.$OPSEC.drawio.bkp new file mode 100644 index 0000000..59946b0 --- /dev/null +++ b/opsec/.$OPSEC.drawio.bkp @@ -0,0 +1,724 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/opsec/OPSEC.drawio b/opsec/OPSEC.drawio index ac30091..8e806d8 100644 --- a/opsec/OPSEC.drawio +++ b/opsec/OPSEC.drawio @@ -1,6 +1,6 @@ - + @@ -70,11 +70,11 @@ - + - + @@ -118,9 +118,6 @@ - - - @@ -409,9 +406,6 @@ - - - @@ -635,7 +629,7 @@ - + @@ -676,6 +670,54 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/opsec/OPSEC.drawio.png b/opsec/OPSEC.drawio.png index 4f6c02f..466ab21 100644 Binary files a/opsec/OPSEC.drawio.png and b/opsec/OPSEC.drawio.png differ diff --git a/opsec/anonsimplex/20.png b/opsec/anonsimplex/20.png new file mode 100644 index 0000000..2820d77 Binary files /dev/null and b/opsec/anonsimplex/20.png differ diff --git a/opsec/anonsimplex/21.png b/opsec/anonsimplex/21.png new file mode 100644 index 0000000..0268c62 Binary files /dev/null and b/opsec/anonsimplex/21.png differ diff --git a/opsec/anonsimplex/22.png b/opsec/anonsimplex/22.png new file mode 100644 index 0000000..3e637e5 Binary files /dev/null and b/opsec/anonsimplex/22.png differ diff --git a/opsec/anonsimplex/23.png b/opsec/anonsimplex/23.png new file mode 100644 index 0000000..8a1e0bd Binary files /dev/null and b/opsec/anonsimplex/23.png differ diff --git a/opsec/anonsimplex/24.png b/opsec/anonsimplex/24.png new file mode 100644 index 0000000..09d9059 Binary files /dev/null and b/opsec/anonsimplex/24.png differ diff --git a/opsec/anonsimplex/25.png b/opsec/anonsimplex/25.png new file mode 100644 index 0000000..ccfffde Binary files /dev/null and b/opsec/anonsimplex/25.png differ diff --git a/opsec/anonsimplex/26.png b/opsec/anonsimplex/26.png new file mode 100644 index 0000000..5c967ae Binary files /dev/null and b/opsec/anonsimplex/26.png differ diff --git a/opsec/anonsimplex/27.png b/opsec/anonsimplex/27.png new file mode 100644 index 0000000..0f31939 Binary files /dev/null and b/opsec/anonsimplex/27.png differ diff --git a/opsec/anonsimplex/28.png b/opsec/anonsimplex/28.png new file mode 100644 index 0000000..c9b1243 Binary files /dev/null and b/opsec/anonsimplex/28.png differ diff --git a/opsec/anonsimplex/29.png b/opsec/anonsimplex/29.png new file mode 100644 index 0000000..a572237 Binary files /dev/null and b/opsec/anonsimplex/29.png differ diff --git a/opsec/anonsimplex/30.png b/opsec/anonsimplex/30.png new file mode 100644 index 0000000..b165d96 Binary files /dev/null and b/opsec/anonsimplex/30.png differ diff --git a/opsec/anonsimplex/31.png b/opsec/anonsimplex/31.png new file mode 100644 index 0000000..3d83e61 Binary files /dev/null and b/opsec/anonsimplex/31.png differ diff --git a/opsec/anonsimplex/32.png b/opsec/anonsimplex/32.png new file mode 100644 index 0000000..b0b0016 Binary files /dev/null and b/opsec/anonsimplex/32.png differ diff --git a/opsec/anonsimplex/33.png b/opsec/anonsimplex/33.png new file mode 100644 index 0000000..b780183 Binary files /dev/null and b/opsec/anonsimplex/33.png differ diff --git a/opsec/anonsimplex/34.png b/opsec/anonsimplex/34.png new file mode 100644 index 0000000..35a686d Binary files /dev/null and b/opsec/anonsimplex/34.png differ diff --git a/opsec/anonsimplex/35.png b/opsec/anonsimplex/35.png new file mode 100644 index 0000000..64c365c Binary files /dev/null and b/opsec/anonsimplex/35.png differ diff --git a/opsec/anonsimplex/index.html b/opsec/anonsimplex/index.html index 83133f2..fc08f40 100644 --- a/opsec/anonsimplex/index.html +++ b/opsec/anonsimplex/index.html @@ -166,18 +166,356 @@ sudo apt install tor

Step 3. SimpleX Server Setup

-

It's important to note that in theory, it doesn't matter which SimpleX server you connect to, as all communication is end-to-end encrypted. When you connect via Tor, it further ensures that the server itself won't be able to trace your connection back to you. Your anonymity is maintained through the use of Tor, and your conversations are protected by SimpleX's encryption.

-

HackLiberty has a great guide on how to install and configure a +

It's important to note that in theory, it doesn't matter which SimpleX server you connect to, as all communications are end-to-end encrypted. When you connect via Tor, it further ensures that the server itself won't be able to trace your connection back to you. Your anonymity is maintained through the use of Tor, and your conversations are protected by SimpleX's encryption.

+

We're going to make use of HackLiberty's tutorial on how to install and configure a SimpleX server using Docker.

- -

Once you have configured and started your server, carry on with - this guide.

+ + +

First we're going to create the docker-compose.yml file and the .env file as follows:

+

+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ cat docker-compose.yml
+version: '3.7' #this version is obsolete, change me
+
+networks:
+  tor-test:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 10.6.0.0/24
+          gateway: 10.6.0.1
+
+services:
+  simplex-smp-server:
+    image: simplexchat/smp-server:latest
+    container_name:  simplex-smp
+    restart: always
+    user: "1000:1000" #user uid - change if necessary
+    ports:
+      - "127.0.0.1:5223:5223" #this will expose port 5223 to internet
+    volumes:
+      - ./smp/config:/etc/opt/simplex:Z
+      - ./smp/logs:/var/opt/simplex:Z
+    environment:
+      - ADDR=${SIMPLEX_ADDR}
+#     - PASS=${SIMPLEX_PASSWORD} #for non public servers
+    networks:
+      tor-test:
+        ipv4_address: 10.6.0.5
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+  simplex-xftp-server:
+    image: simplexchat/xftp-server:latest
+    container_name:  simplex-xftp
+    user: "1000:1000" #user uid - change if necessary
+    ports:
+      - "127.0.0.1:5233:5233" #port mapping to expose xftp to internet on port 5233
+    restart: always
+    volumes:
+      - ./xftp/config:/etc/opt/simplex-xftp:Z
+      - ./xftp/logs:/var/opt/simplex-xftp:Z
+      - ./xftp/files:/srv/xftp
+    environment:
+      - ADDR=${XFTP_ADDR}
+      - QUOTA=150gb #change to set your own quota
+    networks:
+      tor-test:
+        ipv4_address: 10.6.0.6
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+  tor:
+    image: osminogin/tor-simple
+    container_name: tor-simplex
+    volumes:
+      - ./tor-data:/var/lib/tor
+      - ./tor-data/torrc:/etc/tor
+    networks:
+      tor-test:
+        ipv4_address: 10.6.0.4
+
+[ Wonderland ] [ /dev/pts/15 ] [/srv/simplex]
+→ cat .env
+SIMPLEX_ADDR="nowhere"      #If using FDQN, make sure to set DNS record
+SIMPLEX_PASSWORD="dawiuhwaihyawy4129y89u0u1"
+XFTP_ADDR="nowhere"         #If using FDQN, make sure to set DNS record
+#yes no clearnet at all
+
+
+
+
+

Then we're going to create the folders as follows:

+

+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ mkdir -p  {xftp,smp}/{config,logs}
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ tree .
+.
+├── docker-compose.yml
+├── notes.txt
+├── smp
+│   ├── config
+│   └── logs
+└── xftp
+    ├── config
+    └── logs
+
+7 directories, 2 files
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ mkdir -p xftp/files
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ ls
+docker-compose.yml  notes.txt  smp  xftp
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ cd xftp
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex/xftp]
+→ ls
+config  files  logs
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex/xftp]
+→ cd ..
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ ls
+docker-compose.yml  notes.txt  smp  xftp
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ mkdir -p tor-data/torrc
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ mkdir -p tor-data/{simplex-xftp,simplex-smp}
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ mkdir -p  {xftp,smp}/{config,logs}
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ chmod 700 tor-data/simplex-xftp
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ chmod 700 tor-data/simplex-smp
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ sudo chown 100:65533  tor-data/simplex-xftp
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ sudo chown 100:65533  tor-data/simplex-smp
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ chown -R 100:65533 tor-data/
+
+chmod 777 -R smp
+chmod 777 -R  xftp
+
+
+

Then we're going to configure torrc for the tor docker daemon as follows:

+

+[ Wonderland ] [ /dev/pts/15 ] [/srv/simplex]
+→ vim tor-data/torrc/torrc
+
+[ Wonderland ] [ /dev/pts/15 ] [/srv/simplex]
+→ cat tor-data/torrc/torrc
+ SOCKSPort 0
+ HiddenServiceNonAnonymousMode 1
+ HiddenServiceSingleHopMode 1
+ HiddenServiceDir /var/lib/tor/simplex-smp
+ HiddenServicePort 5223 simplex-smp:5223
+ HiddenServicePort 80 simplex-smp:80
+ HiddenServiceDir /var/lib/tor/simplex-xftp
+ HiddenServicePort 5233 simplex-xftp:5233
+
+
+

Then we're going to run the docker containers so that it creates the tor hostnames for both the smp and xftp services, so that we can use both in the .env file:

+

+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ docker-compose up
+
+[ Wonderland ] [ /dev/pts/15 ] [/srv/simplex]
+→ tree tor-data
+tor-data
+├── simplex-smp
+│   ├── authorized_clients
+│   ├── hostname
+│   ├── hs_ed25519_public_key
+│   └── hs_ed25519_secret_key
+├── simplex-xftp
+│   ├── authorized_clients
+│   ├── hostname
+│   ├── hs_ed25519_public_key
+│   └── hs_ed25519_secret_key
+└── torrc
+    └── torrc
+
+[ Wonderland ] [ /dev/pts/15 ] [/srv/simplex]
+→ cat tor-data/simplex-smp/hostname
+b6geeakpwskovltbesvy3b6ah3ewxfmnhnshojndmpp7wcv2df7bnead.onion
+
+[ Wonderland ] [ /dev/pts/15 ] [/srv/simplex]
+→ cat tor-data/simplex-xftp/hostname
+wg54vc6p3dscshywvt2wninachqoarrodtunapds7t7p47sn5e3qonid.onion
+
+[ Wonderland ] [ /dev/pts/15 ] [/srv/simplex]
+→ vim .env
+
+[ Wonderland ] [ /dev/pts/15 ] [/srv/simplex]
+→ cat .env
+SIMPLEX_ADDR="b6geeakpwskovltbesvy3b6ah3ewxfmnhnshojndmpp7wcv2df7bnead.onion"      #If using FDQN, make sure to set DNS record
+SIMPLEX_PASSWORD="dawiuhwaihyawy4129y89u0u1"
+XFTP_ADDR="wg54vc6p3dscshywvt2wninachqoarrodtunapds7t7p47sn5e3qonid.onion"         #If using FDQN, make sure to set DNS record
+
+
+
+

Then we'll save both the private keys in our keepass and then shred them:

+

+#save both the private keys it in your keepass and then shred it
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ cat smp/config/ca.key
+-----BEGIN PRIVATE KEY-----
+REDACTED
+-----END PRIVATE KEY-----
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ shred -u smp/config/ca.key
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ cat xftp/config/ca.key
+-----BEGIN PRIVATE KEY-----
+REDACTED
+-----END PRIVATE KEY-----
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ shred -u xftp/config/ca.key
+
+
+
+

Then we edit the smp config correctly as we will NOT use the clearnet at all, the config parts regarding port 443 https are to be commented.

+

+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ cat smp/config/smp-server.ini | tail -n3
+#https: 443
+#cert: /etc/opt/simplex/web.crt
+#key: /etc/opt/simplex/web.key
+
+[TRANSPORT]
+# Host is only used to print server address on start.
+# You can specify multiple server ports.
+host: nowhere
+#port: 5223,443 ## we dont need 443!
+port: 5223
+log_tls_errors: off
+
+
+

Then we also configure it so that the simplex smp server goes through the docker tor daemon to connect to other servers:

+

+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ vim smp/config/smp-server.ini
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ cat smp/config/smp-server.ini
+
+[PROXY]
+# Network configuration for SMP proxy client.
+# `host_mode` can be 'public' (default) or 'onion'.
+# It defines prefferred hostname for destination servers with multiple hostnames.
+host_mode: onion
+required_host_mode: on
+
+# The domain suffixes of the relays you operate (space-separated) to count as separate proxy statistics.
+# own_server_domains:
+
+# SOCKS proxy port for forwarding messages to destination servers.
+# You may need a separate instance of SOCKS proxy for incoming single-hop requests.
+socks_proxy: 10.6.0.4:9050
+#socks_proxy: tor-simplex:9050
+
+# `socks_mode` can be 'onion' for SOCKS proxy to be used for .onion destination hosts only (default)
+# or 'always' to be used for all destination hosts (can be used if it is an .onion server).
+socks_mode: always
+
+# Limit number of threads a client can spawn to process proxy commands in parrallel.
+# client_concurrency: 32
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ vim xftp/config/file-server.ini
+
+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ cat xftp/config/file-server.ini
+[STORE_LOG]
+# The server uses STM memory for persistence,
+# that will be lost on restart (e.g., as with redis).
+# This option enables saving memory to append only log,
+# and restoring it when the server is started.
+# Log is compacted on start (deleted objects are removed).
+enable: on
+
+# Expire files after the specified number of hours.
+expire_files_hours: 48
+
+log_stats: off
+
+[AUTH]
+# Set new_files option to off to completely prohibit uploading new files.
+# This can be useful when you want to decommission the server, but still allow downloading the existing files.
+new_files: on
+
+# Use create_password option to enable basic auth to upload new files.
+# The password should be used as part of server address in client configuration:
+# xftp://fingerprint:password@host1,host2
+# The password will not be shared with file recipients, you must share it only
+# with the users who you want to allow uploading files to your server.
+# create_password: password to upload files (any printable ASCII characters without whitespace, '@', ':' and '/')
+
+# control_port_admin_password:
+# control_port_user_password:
+
+[TRANSPORT]
+# host is only used to print server address on start
+host: nowhere
+port: 5233
+log_tls_errors: off
+# control_port: 5226
+
+[FILES]
+path: /srv/xftp
+storage_quota: 10gb
+
+[INACTIVE_CLIENTS]
+# TTL and interval to check inactive clients
+disconnect: off
+# ttl: 21600
+# check_interval: 3600
+
+
+

Then we simply run the docker containers again:

+

+[ Wonderland ] [ /dev/pts/14 ] [/srv/simplex]
+→ docker-compose down ; docker-compose up -d
+
+Starting simplex-xftp ... done
+Starting simplex-smp  ... done
+Starting tor-simplex  ... done
+
+simplex-smp            | Server address: smp://BD4qkVq8lJUgjHt0kUaxeQBYsKaxDejeecxm6-2vOwI=@nowhere
+simplex-xftp           | Server address: xftp://emX7ForsbdpIscNiDZ6b0HTbfFUayn00C1wmeVTofYA=@nowhere
+
+#need to manually change the @nowhere to be the onion urls:
+smp://BD4qkVq8lJUgjHt0kUaxeQBYsKaxDejeecxm6-2vOwI=@b6geeakpwskovltbesvy3b6ah3ewxfmnhnshojndmpp7wcv2df7bnead.onion
+xftp://emX7ForsbdpIscNiDZ6b0HTbfFUayn00C1wmeVTofYA=@wg54vc6p3dscshywvt2wninachqoarrodtunapds7t7p47sn5e3qonid.onion:5233
+
+
+

And from there we simply add the servers in our simplex client:

+ +
@@ -189,34 +527,24 @@ sudo apt install tor

Step 4: Configure SimpleX To Use Your Server

-

After setting up your SimpleX server, you need to configure your - client to route its traffic through it.

-

Open the kebab menu at the bottom left again, and navigate to - Settings > Network and servers, then press - Message servers.

- SimpleX message server settings -

If you desire, you can remove all the default SimpleX instances - individually before proceeding; this ensures that SimpleX will - only ever use your server.

-

Press Add server, then Enter server - manually. Specify your SMP server address and save. - Make sure to check the Use for new connections - option.

- Adding a SimpleX server +

Now from our simplex client we need to make sure that we are using our own simplex servers, which have the following URL:

+

+SMP server:
+smp://BD4qkVq8lJUgjHt0kUaxeQBYsKaxDejeecxm6-2vOwI=@b6geeakpwskovltbesvy3b6ah3ewxfmnhnshojndmpp7wcv2df7bnead.onion
 
-            
Repeat the same steps for your XFTP address by navigating to
-              Settings > Network and servers, then press
-              Media & file servers.

-            
Similarly, you can remove all default instances here if you
-              desire. Then add your XFTP server address by pressing Add
-                server > Enter server manually. Specify your XFTP
-              address and save. Don't forget to tick the Use for new
-                connections option.

-            SimpleX message server settings
-            Adding a SimpleX server
-            
Congratulations!

-            
You have now successfully configured your SimpleX server and
-              client.

+XFTP server:
+xftp://emX7ForsbdpIscNiDZ6b0HTbfFUayn00C1wmeVTofYA=@wg54vc6p3dscshywvt2wninachqoarrodtunapds7t7p47sn5e3qonid.onion:5233
+
+
+ + + + + + + + +

And now that our simplex client is ONLY using our onion-only simplex servers, we can create our own chatrooms:

@@ -228,29 +556,38 @@ sudo apt install tor

How to Create Chatrooms in Incognito mode

-

After configuring your SimpleX client through Orbot and your own - server, you are ready to create and join chatrooms. Here is how to - create a chatroom in Incognito mode:

-

Step 1: Create the Chatroom

-

Press the pen icon in the bottom right of the screen. This will - bring up a menu. Select Create group.

- Creating a group in SimpleX -

Enter a name for your group. You can also add a photo for the +

Now that we are using our own simplex servers, we can create a chatrooms in incognito mode (meaning that our username will simply be a random noun and adjective):

+ + + +

Enter a name for your group. You can also add a photo for the group.

Tick the Incognito option. Doing this ensures your profile name and image is hidden from your group members and allows for anonymous connections with other people without shared data. Once you have filled out the necessary information, press Create group.

- SimpleX incognito mode settings -

Step 2: Invite Members

-

After creating your chatroom, you will be met with an invite - link. You will use this link to invite other people to your - chatroom.

- SimpleX invite link -
+ + +

as noted above, since you are only using tor-only simplex servers, this means that you are forcing the users to use Tor to be able to join your invite links. Here's what the invite link looks like:

+

+https://simplex.chat/contact#/?v=2-7&smp=smp%3A%2F%2FBD4qkVq8lJUgjHt0kUaxeQBYsKaxDejeecxm6-2vOwI%3D%40b6geeakpwskovltbesvy3b6ah3ewxfmnhnshojndmpp7wcv2df7bnead.onion%2FSMvbQfvtczzC7r6Sv3gEgy_s01_ZYPh_%23%2F%3Fv%3D1-3%26dh%3DMCowBQYDK2VuAyEA9kSAhfaJMzC8YWZzkpoCL8mnBmq2U8VE8_v5HYk0nyE%253D&data=%7B%22groupLinkId%22%3A%22zjrwnXSNIBJO9ZhoHcRRkQ%3D%3D%22%7D
+
+
+

as you can see the default invite link looks like that, and as you can see the onion server address appears in the link, which is the reason why if the user that wants to join doesnt have tor connectivity, he won't be able to join. If you don't want to use any of simplex's servers, you can simply replace the https://simplex.chat/ at the beginning with your simplex smp server onion url as follows:

+

+http://b6geeakpwskovltbesvy3b6ah3ewxfmnhnshojndmpp7wcv2df7bnead.onion/contact#/?v=2-7&smp=smp%3A%2F%2FBD4qkVq8lJUgjHt0kUaxeQBYsKaxDejeecxm6-2vOwI%3D%40b6geeakpwskovltbesvy3b6ah3ewxfmnhnshojndmpp7wcv2df7bnead.onion%2FSMvbQfvtczzC7r6Sv3gEgy_s01_ZYPh_%23%2F%3Fv%3D1-3%26dh%3DMCowBQYDK2VuAyEA9kSAhfaJMzC8YWZzkpoCL8mnBmq2U8VE8_v5HYk0nyE%253D&data=%7B%22groupLinkId%22%3A%22zjrwnXSNIBJO9ZhoHcRRkQ%3D%3D%22%7D
+
+
+ + + +

If you want to not contact any simplex server to be able to view the invite link, you can simply replace the server address to simplex:/, which will transform the link as follows:

+

+simplex:/contact#/?v=2-7&smp=smp%3A%2F%2FBD4qkVq8lJUgjHt0kUaxeQBYsKaxDejeecxm6-2vOwI%3D%40b6geeakpwskovltbesvy3b6ah3ewxfmnhnshojndmpp7wcv2df7bnead.onion%2FSMvbQfvtczzC7r6Sv3gEgy_s01_ZYPh_%23%2F%3Fv%3D1-3%26dh%3DMCowBQYDK2VuAyEA9kSAhfaJMzC8YWZzkpoCL8mnBmq2U8VE8_v5HYk0nyE%253D&data=%7B%22groupLinkId%22%3A%22zjrwnXSNIBJO9ZhoHcRRkQ%3D%3D%22%7D
+
+
+
@@ -265,17 +602,16 @@ sudo apt install tor join it by pressing the input field at the bottom of the screen labeled Search or paste SimpleX link.

Paste your invite link into the input field and press Enter.

- Joining a SimpleX chatroom + +

You will be met with a window asking whether you'd like to connect using your current profile or using an Incognito profile.

Select Use new incognito profile.

- Selecting an incognito profile in SimpleX

This is because we don't want to reveal what our simplex username is, we just want to join the chatroom using a random username that is not tied to our identity.

- Simplex group + +

And there as you can see, everyone that joins in in incognito gets a random pseudonym with the format "Random Adjective Random Word" effectively helping the users maintain their anonymity while in the chat.

+ diff --git a/opsec/index.html b/opsec/index.html index 9a4f7dc..e2c8c32 100644 --- a/opsec/index.html +++ b/opsec/index.html @@ -112,6 +112,7 @@
  • ✅ How to have Privacy on your Phone (GrapheneOS)
  • ❌ How to have Privacy on your Router (Openwrt)
  • ✅ Easy Private Chats - SimpleX
    • +
  • ✅ How to setup Qubes OS

    • 💻 File Sharing

    @@ -126,6 +127,7 @@
  • ✅ How to Virtualize Machines (QEMU/KVM Hypervisor)
  • ✅ Password Management 101 (How to use Keepass)
  • ✅ Private Messaging (PGP encryption)
    • +
  • ✅ How to navigate Qubes OS

    • 💻 Privacy from your ISP

      @@ -178,7 +180,6 @@

      💻 Clientside Anonymity (⚠️ Check if your ISP allows Tor or Not!)

      1. ❌ How to get internet access without any KYC ?
        2. -
      2. ❌ How to setup and navigate Qubes OS
      3. ✅ VMs for Long-term Anonymity (Whonix QEMU VMs)
      4. ✅ Tor Web Browser setup
      5. 🟠 How to use the Tor Browser on Mobile
        6. diff --git a/opsec/monero2024/node.html b/opsec/monero2024/node.html index bf08cf6..c272d15 100644 --- a/opsec/monero2024/node.html +++ b/opsec/monero2024/node.html @@ -76,15 +76,17 @@

        Initial Setup

        -

        First install monero from the repositories:

        +

        First install monero and tor from the repositories:

        
 [ nowhere.moe ] [ /dev/pts/0 ] [/srv/nowhere.moe]
-→ apt install monero -y
-	
+→ apt install monero tor -y
+
        +

        Then, create the following systemd service if you want to have a monero node to be publicly accessible via the IP directly:

        +
        
 [ nowhere.moe ] [ /dev/pts/0 ] [/srv/nowhere.moe]
 → vim /etc/systemd/system/moneronode.service
 
-[ nowhere.moe ] [ /dev/pts/0 ] [/srv/nowhere.moe]
+[ Wonderland ] [ /dev/pts/9 ] [/srv]
 → cat /etc/systemd/system/moneronode.service
 [Unit]
 Description=monerod
@@ -92,18 +94,22 @@ After=network.target
 Wants=network.target
 
 [Service]
+
+# sync the monero node without going through Tor
 ExecStart=/usr/bin/monerod --zmq-pub tcp://127.0.0.1:18083 --disable-dns-checkpoints --enable-dns-blocklist --data-dir /srv/XMR --block-sync-size=50 --out-peers 100 --prep-blocks-threads=128 --prune-blockchain --sync-pruned-blocks --rpc-bind-port=18081 --rpc-bind-ip=0.0.0.0 --p2p-bind-ip=0.0.0.0 --p2p-bind-port=18080 --confirm-external-bind --non-interactive
+
+
 Restart=on-failure
 RestartSec=10s
 
-
 StandardOutput=journal
 StandardError=journal
 
 [Install]
 WantedBy=multi-user.target
+
        -

        If you want to have a local-only monero node to use over tor, you can use this config instead:

        +

        However if your users are well-educated and are aware that Chainalysis are running malicious tor nodes, then they are NOT going to connect to non-onion monero nodes (and neither should you). Plus if Monero is illegal in your country, you'll also want to synchronize it via Tor instead, so you can use this config instead:

        
 [ Wonderland ] [ /dev/pts/9 ] [/mnt/md3]
 → cat /etc/systemd/system/moneronode.service
@@ -113,7 +119,10 @@ After=network.target
 Wants=network.target
 
 [Service]
-ExecStart=/usr/bin/monerod --zmq-pub tcp://127.0.0.1:18083 --disable-dns-checkpoints --enable-dns-blocklist --data-dir /mnt/md3/XMR --block-sync-size=50 --out-peers 100 --prep-blocks-threads=128 --prune-blockchain --sync-pruned-blocks --rpc-bind-port=18081 --rpc-bind-ip=127.0.0.1 --p2p-bind-ip=127.0.0.1 --p2p-bind-port=18080 --non-interactive
+
+# sync the monero node while actually going through Tor (in case if Monero is illegal in your country)
+ExecStart=/usr/bin/monerod --zmq-pub tcp://127.0.0.1:18083 --disable-dns-checkpoints --enable-dns-blocklist --data-dir /srv/XMR --block-sync-size=50 --out-peers 100 --prep-blocks-threads=128 --prune-blockchain --sync-pruned-blocks --rpc-bind-port=18081 --rpc-bind-ip=127.0.0.1 --p2p-bind-ip=127.0.0.1 --p2p-bind-port=18080 --non-interactive  --proxy 127.0.0.1:9050 --tx-proxy tor,127.0.0.1:9050
+
 Restart=on-failure
 RestartSec=10s
 
@@ -159,20 +168,7 @@ Jul 09 15:39:07 Datura monerod[8410]: 2023-07-09 13:39:07.182        I Synced 89
 Jul 09 15:39:07 Datura monerod[8410]: 2023-07-09 13:39:07.376        I Synced 89138/2925934 (3%, 2836796 left)
        -

        On a SSD it may take 1 day, and weigh approximately 60 gigs as of writing this tutorial. The synchronisation is a very disk-intensive process, and so it is required to do it on a nvme disk or ssd at least. If you try to do that on a HDD it will take much, much longer. If you don't have a choice, sync it on a nvme somewhere and then rsync it to a server that has only HDDs.

        - -

        Then allow the ports you want from ufw:

        -
        
-root@XMR:~# sudo ufw allow 18080
-Rules updated
-Rules updated (v6)
-
-root@XMR:~# sudo ufw allow 18081
-Rules updated
-Rules updated (v6)
-
-
        -

        Once you've finished setting up your monero instance, make sure you have it listed on https://monero.fail or on https://xmr.nowhere.moe.

        +

        On a NVMe SSD it may take 2 days, and weigh approximately 90 gigs at the time of writing this tutorial. The synchronisation is a very disk-intensive process, and so it is required to do it on a nvme disk or ssd at least. If you try to do that on a HDD it will take much, much longer. If you don't have a choice, sync it on a nvme somewhere and then rsync it to a server that has only HDDs.

        diff --git a/opsec/qubesos/Screenshot From 2024-12-05 11-20-03.png b/opsec/qubesos/Screenshot From 2024-12-05 11-20-03.png new file mode 100644 index 0000000..bf8b0bd Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 11-20-03.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-26-38.png b/opsec/qubesos/Screenshot From 2024-12-05 16-26-38.png new file mode 100644 index 0000000..91276cb Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-26-38.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-28-18.png b/opsec/qubesos/Screenshot From 2024-12-05 16-28-18.png new file mode 100644 index 0000000..067d30b Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-28-18.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-28-40.png b/opsec/qubesos/Screenshot From 2024-12-05 16-28-40.png new file mode 100644 index 0000000..59c61be Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-28-40.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-28-51.png b/opsec/qubesos/Screenshot From 2024-12-05 16-28-51.png new file mode 100644 index 0000000..304f74e Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-28-51.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-29-00.png b/opsec/qubesos/Screenshot From 2024-12-05 16-29-00.png new file mode 100644 index 0000000..1d084e3 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-29-00.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-29-12.png b/opsec/qubesos/Screenshot From 2024-12-05 16-29-12.png new file mode 100644 index 0000000..c4f686a Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-29-12.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-29-23.png b/opsec/qubesos/Screenshot From 2024-12-05 16-29-23.png new file mode 100644 index 0000000..bf44a16 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-29-23.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-29-33.png b/opsec/qubesos/Screenshot From 2024-12-05 16-29-33.png new file mode 100644 index 0000000..b4520e1 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-29-33.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-29-47.png b/opsec/qubesos/Screenshot From 2024-12-05 16-29-47.png new file mode 100644 index 0000000..5b17c3a Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-29-47.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-29-57.png b/opsec/qubesos/Screenshot From 2024-12-05 16-29-57.png new file mode 100644 index 0000000..89dd6b2 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-29-57.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-39-09.png b/opsec/qubesos/Screenshot From 2024-12-05 16-39-09.png new file mode 100644 index 0000000..6575fc8 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-39-09.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-39-27.png b/opsec/qubesos/Screenshot From 2024-12-05 16-39-27.png new file mode 100644 index 0000000..42844c2 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-39-27.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-40-07.png b/opsec/qubesos/Screenshot From 2024-12-05 16-40-07.png new file mode 100644 index 0000000..aa2c7a2 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-40-07.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-40-34.png b/opsec/qubesos/Screenshot From 2024-12-05 16-40-34.png new file mode 100644 index 0000000..d175165 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-40-34.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-40-42.png b/opsec/qubesos/Screenshot From 2024-12-05 16-40-42.png new file mode 100644 index 0000000..0d01052 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-40-42.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 17-40-25.png b/opsec/qubesos/Screenshot From 2024-12-05 17-40-25.png new file mode 100644 index 0000000..78c87f1 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 17-40-25.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 17-40-39.png b/opsec/qubesos/Screenshot From 2024-12-05 17-40-39.png new file mode 100644 index 0000000..54abc3e Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 17-40-39.png differ diff --git a/opsec/qubesos/index.html b/opsec/qubesos/index.html new file mode 100644 index 0000000..b9e2e69 --- /dev/null +++ b/opsec/qubesos/index.html @@ -0,0 +1,228 @@ + + + + + + + + + + + Qubes OS guide + + + + + + + + + + + + + + + + + + + +
        +
        +
        + + The Nihilism Blog +
        +
        + +
        + +
        +
        + + + +
        +
        +
        +
        + Previous Page

        Prism Breaker - 20 / 12 / 2024

        +

        Qubes OS guide

        +

        Official site of Qubes OS https://www.qubes-os.org

        +

        When you land into this tutorial, I assume you already have some Linux experience, if not this might not be suitable for you, since Qubes OS is not very user-friendly. I recommend you to try some normal Linux distribution first How to Install Linux as a beginner

        +

        Qubes OS is a very cutting edge OS that uses virtualization everywhere to compartmentalize your digital life. It is technically not a Linux distribution, it is built on Xen which is a type 1 hypervisor that runs on bare metal, https://en.wikipedia.org/wiki/Xen

        +

        First you have Xen hypervisor booted at startup, then you get separate VM for all of your activities. Because all of your activities are separated by VM, one of them get hacked will not compromise the security of your entire system. It is like manage your personal pc like a server, that is why Qubes OS is a highly secure OS if used correctly

        +

        If you want to dive into the tech details and concepts about Qubes, official document is the best place https://www.qubes-os.org/intro/

        +
        +
        +
        +
        + + +
        +
        +
        +
        +

        Comparison

        +

        Why you should use Qubes OS instead of xyz config I use?

        +

        1.Easier network configuration

        +

        Qubes OS is designed to have a basket of different VMs with different trust level, and has a very easy menu in GUI to manage the network of these VMs. Qubes OS also has built-in firewall function to stop unexpected leaks. In short, it is less likely for you to make mistakes in Qubes

        +

        For example if you want to have many different network configs like below link to satisfy your different online identities, Qubes OS is the right tool.

        +

        Theories about building up your online identities. Check this theory about online identities, with Qubes OS you can easily build up chains of vm for doing whatever you want, for example different combination of vpn/proxy/tor

        + +

        A image that shows Qubes OS with different vm for different functions and identities

        + +

        2.Integrated Whonix

        +

        Qubes OS integrate whonix gateway and workstation by default, thus tor browser works out of the box. You can also use whonix gateway to torrify applications that do not support tor and be guaranteed it is leakproof. You can achieve all of these with some clicks of buttons, and no complicated iptables needed

        +

        For learning what is whonix https://www.whonix.org/wiki/FAQ

        +

        3.Superior safety

        +

        Xen is a hypervisor that has a much smaller codebase than vmware/virtual box/kvm, it is possible to read and audit the entire code base. Besides qubes OS also put networking and usb service stack into VM, this feature greatly increases your host OS security from malicious network and usb. The days when you just plug in a bad usb into your computer and it booms are gone!

        + +
        +
        +
        +
        + +
        +
        +
        +
        +

        Installation preparation



        +

        If you decided to install and try Qubes OS, then you must pick the correct hardware, since Qubes OS is a very cutting edge OS you should expect some compatibility issues.

        +

        For desktop PC actually you should not worry too much, I have installed Qubes OS on many intel/amd platforms, with all kinds of peculiar combination of cpu and gpu, it all works. As long as you are on a quite modern platform with common consumer gpu, you should be fine

        +

        This is the official hardware compatibility list, but be aware it is definitely incomplete, since people runs Qubes OS without problem mostly do not bother to report their config https://www.qubes-os.org/hcl/

        +

        For laptops, you should be careful, you better get a mainstream business laptop. I tried many installations on Lenovo or hp business laptops from recent years, they all worked fine. However, you should especially try to avoid laptops from non-traditional vendors like Xiaomi or whatever Chinese brand, and any gaming laptop with very peculiar gpu setup.

        +

        Next thing is to download the installation ISO, go to their website and download

        + +

        Download the ISO and hash digest

        +

        Next thing is to verify your ISO file is authentic, Qubes OS has a very detailed guide on how to do that so there is no need for me to build the wheel again https://www.qubes-os.org/security/verifying-signatures/

        +

        I will paste the master key fingerprint here for comparison:427F11FD0FAA4B080123F01CDDFA1A3E36879494

        + +

        Next step is to find an usb, make sure it is at least 16GB, then find its path

        + +
        
+$ sudo blkid	
+
        + +

        For example my usb is located at /dev/sda, then we use dd to burn the image into usb

        +
        
+$ sudo dd if=file_name.iso of=/dev/sda status=progress
+
        +

        Warning: dd is a low level tool aka data destroyer, check the parameters carefully and make sure parameters behind "of" points towards your usb, otherwise it might nuke your computer !!!

        +
        +
        +
        +
        + + + +
        +
        +
        +
        +

        Install



        +

        Next thing is to reboot into your computer and enter BIOS(EFI), this is different for every platform so you should find it out on google.

        +

        You need to make two changes in BIOS basically, first you need to turn off secure boot(I know this is sad), but unfortunately secure boot and Xen did not work together on most consumer grade machines. I personally recommend only use qubes at home pc, or those so called "Qubes certified" laptops equipped with heads(What is heads : https://trmm.net/Heads/) that can protect your boot partition and has anti-evil maid features https://www.qubes-os.org/doc/certified-hardware/.

        +

        Next if you are on UEFI mode you need to enable "CSM". https://superuser.com/questions/1284392/what-exactly-is-uefi-with-csm-boot-mode. You also need to find that in your bios menu, it should usually appear below boot options. This can fix a lot of potential troubles later

        +

        Final thing is remembering to turn on vt-x or cpu virtualization support, since this is needed for Qubes. Check your bios, if there is a setting called IOMMU, you also need to enable that

        +

        For example, you can expect something look like this

        + +

        + + +

        Finally, reboot and choose your usb as a boot device

        + +

        If things worked correctly, you should see a menu like this, just click enter and wait

        + +

        At this step, click "continue", if your computer is fully compatible and all bios settings are correct, you should see no warning message, otherwise go back to check bios again. If your computer is not some ancient stuff it should be compatible

        + +

        At this step you need to config the disk, click the installation destination

        + +

        If you are installing on a fresh drive just check the three areas on the pictures

        +

        Next is to choose a disk encryption password, notice this is the password used to encrypt your disk and is the only thing protects you when FBI kicks your door, so make sure it is strong enough

        + +

        Select "delete all" and "reclaim space", make sure you backed up everything!

        + +

        Next create a user with password, this is the password you will use to unlock the screen

        + +

        Next choose "Begin Installation", and just wait until it is completed.

        +
        +
        +
        +
        + +
        +
        +
        +
        +

        Post Install Setup



        +

        You still cannot use your qubes at this step, since you need to run post install setup.

        + +

        These configs in most situation do not need to be changed, however if you are using wired connection you can make sys-net disposable, this increases your security a little bit.

        +

        If you are using wireless network through a usb dongle you might need to choose "Use sys-net qube for both networking and USB devices"

        +

        You can also enable system and template update over tor, but this will make it significantly slower for big updates. And there is no need to touch the advanced configuration.

        +

        Click done and let the scripts run, do not interrupt it by closing your computer, it might seem unresponsive for a while.

        + +

        And finally we get our Qubes, in next tutorial we will start to compartmentalize our online activities by creating different qubes.

        +

        Next tutorial : How to use qubes for different online activities

        +
        +
        +
        +
        + + + + +
        +
        +
        +
        +

        PrismBreaker

        +

        + Shatter the big brother.



        Creative Commons Zero: No Rights Reserved
        + +

        +
        + +
        +

        My Links

        +

        + + RSS Feed
        SimpleX Chat
        + +

        +
        + +
        +

        About Prism Breaker

        +

        Donate XMR: 87iB34vdFvNULrAjyfVAZ7jMXc8vbq9tLGMLjo6WC8N9Xo2JFaa8Vkp6dwXBt8rK12Xpz5z1rTa9jSfgyRbNNjswHKTzFVh


        Contact: prismbreaker@waifu.club (PGP)

        +
        + +
        + +
        +
        + + + + + + + + + diff --git a/opsec/qubesos/qubes-trust-level-architecture.png b/opsec/qubesos/qubes-trust-level-architecture.png new file mode 100644 index 0000000..61950c5 Binary files /dev/null and b/opsec/qubesos/qubes-trust-level-architecture.png differ diff --git a/opsec/qubesosnetwork/6.png b/opsec/qubesosnetwork/6.png new file mode 100644 index 0000000..2e0f3b8 Binary files /dev/null and b/opsec/qubesosnetwork/6.png differ diff --git a/opsec/qubesosnetwork/QubesManager.png b/opsec/qubesosnetwork/QubesManager.png new file mode 100644 index 0000000..a30cdb8 Binary files /dev/null and b/opsec/qubesosnetwork/QubesManager.png differ diff --git a/opsec/qubesosnetwork/appvm.png b/opsec/qubesosnetwork/appvm.png new file mode 100644 index 0000000..53d174b Binary files /dev/null and b/opsec/qubesosnetwork/appvm.png differ diff --git a/opsec/qubesosnetwork/banking.png b/opsec/qubesosnetwork/banking.png new file mode 100644 index 0000000..b413552 Binary files /dev/null and b/opsec/qubesosnetwork/banking.png differ diff --git a/opsec/qubesosnetwork/copy_destination.png b/opsec/qubesosnetwork/copy_destination.png new file mode 100644 index 0000000..fbac7f1 Binary files /dev/null and b/opsec/qubesosnetwork/copy_destination.png differ diff --git a/opsec/qubesosnetwork/copy_in_vm.png b/opsec/qubesosnetwork/copy_in_vm.png new file mode 100644 index 0000000..b0ba094 Binary files /dev/null and b/opsec/qubesosnetwork/copy_in_vm.png differ diff --git a/opsec/qubesosnetwork/create.png b/opsec/qubesosnetwork/create.png new file mode 100644 index 0000000..8c09843 Binary files /dev/null and b/opsec/qubesosnetwork/create.png differ diff --git a/opsec/qubesosnetwork/destination_paste.png b/opsec/qubesosnetwork/destination_paste.png new file mode 100644 index 0000000..0c33fc5 Binary files /dev/null and b/opsec/qubesosnetwork/destination_paste.png differ diff --git a/opsec/qubesosnetwork/disp_whonix.png b/opsec/qubesosnetwork/disp_whonix.png new file mode 100644 index 0000000..36a2079 Binary files /dev/null and b/opsec/qubesosnetwork/disp_whonix.png differ diff --git a/opsec/qubesosnetwork/dom0_exec.png b/opsec/qubesosnetwork/dom0_exec.png new file mode 100644 index 0000000..c76a706 Binary files /dev/null and b/opsec/qubesosnetwork/dom0_exec.png differ diff --git a/opsec/qubesosnetwork/file_arrived.png b/opsec/qubesosnetwork/file_arrived.png new file mode 100644 index 0000000..da9fcfb Binary files /dev/null and b/opsec/qubesosnetwork/file_arrived.png differ diff --git a/opsec/qubesosnetwork/file_await_transfer.png b/opsec/qubesosnetwork/file_await_transfer.png new file mode 100644 index 0000000..aaaf519 Binary files /dev/null and b/opsec/qubesosnetwork/file_await_transfer.png differ diff --git a/opsec/qubesosnetwork/firewall-net.png b/opsec/qubesosnetwork/firewall-net.png new file mode 100644 index 0000000..04313e4 Binary files /dev/null and b/opsec/qubesosnetwork/firewall-net.png differ diff --git a/opsec/qubesosnetwork/firewall-qube.png b/opsec/qubesosnetwork/firewall-qube.png new file mode 100644 index 0000000..67068be Binary files /dev/null and b/opsec/qubesosnetwork/firewall-qube.png differ diff --git a/opsec/qubesosnetwork/firewall-service.png b/opsec/qubesosnetwork/firewall-service.png new file mode 100644 index 0000000..557a064 Binary files /dev/null and b/opsec/qubesosnetwork/firewall-service.png differ diff --git a/opsec/qubesosnetwork/index.html b/opsec/qubesosnetwork/index.html new file mode 100644 index 0000000..3e04ee4 --- /dev/null +++ b/opsec/qubesosnetwork/index.html @@ -0,0 +1,279 @@ + + + + + + + + + + + How to navigate qubes OS and segment your internet uses + + + + + + + + + + + + + + + + + + + +
        +
        +
        + + The Nihilism Blog +
        +
        + +
        + +
        +
        + + + +
        +
        +
        +
        + Previous Page

        Prism Breaker - 20 / 12 / 2024

        +

        How to navigate qubes OS and segment your internet uses

        +

        In this tutorial we will set up the environment for public, private and anonymous online identities, and how to use qubes os.

        +

        If you are still not familiar with the identity model please check this link Theories about building up your online identities

        +
        +
        +
        +
        + + +
        +
        +
        +
        +

        Some glossary

        +

        For Qubes OS there are something you need to know, otherwise you will be really confused when using the OS

        +

        0.Xen: Everything that Qubes OS built on this, a type 2 hyervisor

        +

        1.qube: That is basically a vm, each qube is intended to do a single task for isolation. But it is not quite like the common vm you used to see on vmware or virtualbox

        +

        2.dom0: This is the admin vm, it is still a vm, but it is very special vm with all the tools to control the entire machine. It never connects to the network and no files from other qubes should touch it, once it gets compromised you are done

        + + +

        3.Template VM: Template VM is like the concept of "class" in programming language, you will install all the applications you like in template vm, and appvm will simply share the root partition with the template vm, so appvm only needs to keep its own /home directory, this greatly saves disk space and time you spent on software update.

        +

        Template VM do not connect to network by default for safety, since if they are compromised all the app vm spawned by them are also done. Updates are conducted through a special proxy so attack surface is minimized

        +

        4.App VM: Lightweight VM spawned from template VM, any changes done to root partition will not persist across boot, it is meant to only use software installed from template VM and save your work in /home

        + + +

        5.PVH: a para virtualization mode, which means some costly actions are not performed in the vm, instead they are done in the host through a special interface to make vm runs faster

        +

        Most qubes will run under PVH mode

        +

        6.HVM: Full virtualization, no host assistance. Only used in situation where PCI passthrough is required, or you installed your own special qube like windows

        +

        7.Disposable VM: This is a special App VM, it is spawned from a disposable VM template every time when needed, but is destroyed immediately after the task without anything being saved. Ideal for performing some known dangerous activities

        +

        8.PCI passthrough: By default qubes OS qube do not touch any peripheral devices for example usb or network card, if you want some qube to do something with the hardware, you need to do a PCI passthrough. For example if you want to setup a network qube you need to pass through the network adapter

        +

        9.Standalone qube: These are the qubes that do not depend on template vm, you either copied it from a template or installed it yourself

        +

        This is all the basic concepts you need to know, now we start our exploration

        +
        +
        +
        +
        + +
        +
        +
        +
        +

        Network blueprint



        +

        Qubes already comes with many default qubes, you can find them inside the qubes manager

        +

        On the desktop, right click and choose "Open terminal here", you will get a terminal in dom0

        + +

        Input "qubes-qube-manager", and click enter you will get the qubes manager

        + +

        Now we are going to explain these default qubes

        +

        0.Template qubes

        +

        Qubes with the name "debian-12-xfce", "fedora-40-xfce", "whonix*" are template vms, you can install software in these template qubes, and use them in the app qubes

        +

        1.sys-usb

        + + +

        A qube that did not connect to network, and is responsible for providing usb service only, if you have usb keyboard or mouse it might also proxy the input for you. In some circumstances when you have an usb wifi dongle it also becomes the factual network qube

        +

        This is installed by default and is a disposable vm

        +

        1.sys-net

        + + +

        This is where everything starts, you need to passthrough your Ethernet adapter(wired or wireless) to a qube, and that qube will be used to as a first part in the network chain

        +

        Since it is directly in contact with network adapter and the routers, it should be considered as untrusted because it is exposed to a lot of uncertain stuff

        +

        It is installed by default and only intended to be used as a basic router and nothing else

        +

        2.sys-firewall

        +

        The qube that separate the rest of your network chain from the sys-net for better security, and it is also the qube that enforces firewall rules if you have vpn qube directly behind it.

        +

        If you have any public identity it is best to directly connect it to sys-firewall, for example online banking

        + +

        Each qube can select its own network qube, if none is selected it will not have internet at all. sys-firewall here set sys-net as its network qube

        + +

        And any qube provides network service need to enable provides network in advanced tab below "Run in debug mode"

        + +

        Any qube directly connect to sys-firewall will have your home isp ip address, best suited for public activity, for example online banking

        + + +

        3.vpn qube

        +

        A qube setup with vpn profile, redirect all the traffic to your designated vpn server. Ideal for providing a pseudonymous identity. If applied with firewall rules it can be guaranteed leakproof

        +

        Qubes OS works fine with wireguard and openvpn cli programs, but for vpn vendor's own gui there might be problems, sometimes those apps break the dns setup in qubes

        +

        Mullvad has a very detailed tutorial on how to setup a vpn qube https://mullvad.net/en/help/wireguard-on-qubes-os. However, iptables mentioned in it is already deprecated by Qubes, but it still works without DNS hijack config.

        + +

        If you have any pseudonymous activities it is best to connect behind vpn qube, for example torrenting

        + +

        4.whonix qubes

        +

        Whonix is the best part of qubes, it makes tor very easy to use. Whonix qubes consists of two parts, first is whonix gateway, which onionize all the network traffic behind it. Whonix workstation is a workstation specifically tuned for anonymity, and is usually disposable for increased security

        +

        You can also hook up other non workstation qubes behind whonix gateway in rare circumstances, for example a windows qube, but you should be careful and should have a specialized gateway qube only for this.

        +

        This is the ideal place for all the high risk activities like all the darknet stuff

        +

        You might choose to whether or not to put whonix gateway behind a vpn

        + +
        +
        +
        +
        + +
        +
        +
        +
        +

        Setup the vm according to network blueprint

        +

        Now we are about to setup the qubes according to the previous network blueprint, we are about to setup a banking vm, torrent vm, and darknet vm

        +

        And they fit in different places of our network identity threat model obviously

        + +

        +

        Public Use: Banking VM

        +

        In a public use setup, you can run closed source software, or access service that is directly tied to your real life identity.

        +

        Let's go back to our qubes manager, click "New qube" in the top left corner

        + +

        First name it as "banking", and we assign it with Yellow tag, since it is for banking identities, so yellow is a medium trust score for me. Color tag is a very important feature of qubes, every qube has its own color tag for avoiding you accidentally type something sensitive in a insecure vm. Dom0 always has the special White tag

        +

        For Type and Template I just leave it as AppVM and fedora-40-xfce, since this is exactly what I want

        +

        For networking, I choose "sys-firewall", since I want my bank to see my home ip address instead of my vpn ip and get my account banned

        +

        Now click ok and the qube will be created, you can find your qube app menu on the top left Q icon, then we can open firefox and start banking

        + +

        +

        Private use: Torrent VM

        +

        In a private use setup, you should only use FOSS software, and use a vpn service for hiding your home ip

        +

        First we start a template vm, for example debian in this case, and install transmission

        + +

        After installation enter "sudo poweroff" to shut down the qube, make sure it is shutdown, since your changes in template qube only get reflected when it is shutdown at least once!

        +

        Next go back to qubes manager, and create a new qube called torrent, I assume you already set up a vpn qube according to the mullvad tutorial mentioned above

        + +

        First give it a name called "torrent", and I personally think this qube has a medium trust score, so it is given a yellow tag.

        +

        We still leave it as appvm, and choose template as debian, since this is the template we just installed transmission

        +

        Most importantly set the networking to vpn qube you just setup, if you do not want DMCA notice get sent to your home. Then click ok, and the qube will be created

        +

        For accessing transmission app easily, we will add the transmission app into our "Q" menu which is in the top left corner

        +

        Right click the torrent qube in the manager, choose "settings", and choose "application"

        + +

        Find "Transmission" on the left, click it, and click the ">" icon in the middle, then click ok. Now transmission will be visible in the app menu

        + +

        Now happy torrenting

        +

        +

        Anonymous use: Darknet VM

        +

        Same as private setup, but you should use tor instead of vpn

        +

        Here we use whonix workstation to access dread for exploring the darknet

        +

        If you follow the default setting during the installation config, you should have disposable whonix workstation installed by default, which means we do not need to create anything

        +

        Try to find something named "whonix-workstation-17-dvm" in the qubes Q menu, click "Tor Browser(AnonDist)", and you will get a disposable vm running tor browser. This is great since anything happen inside this vm get destroyed after you shut down the browser

        + +

        If you see something as disp on the vm windows title, then you are on a disposable vm, congrats!

        +
        +
        +
        +
        + + +
        +
        +
        +
        +

        Tips



        +

        There are some tricky problems about qube, like how to copy and paste text between qubes, and how to transfer files, or how to use usb.

        +

        For copy text, there is a master pasteboard in dom0, once you copy some text normally inside a qube, click shift+ctrl+c, then the text get transferred to the master pasteboard, and go to the vm you want to paste, click shift+ctrl+v, then the text is inside the clipboard of your destination vm

        + +

        For example you first copy some text inside a vm, then click SHIFT+CTRL+C

        + +

        Then you will see a message about Global Clipboard

        +

        Go to your destination vm and click CTRL+SHIFT+V, then you will see a message says Global Clipboard wiped

        + +

        Then just paste as normal

        + +

        +

        + +

        For copying file between vm you need to use qvm-copy command inside the vm

        +

        First we created a test file called "new_file"

        + +

        Then we use "qvm-copy" command, and choose "banking" vm in the dom0 prompt.

        +qvm-copy new_file +

        + +

        Then you can see the new_file in banking vm

        + +

        Files from other VM are all located inside ~/QubesIncoming

        +

        Other stuff are inside the official document, no need to rebuild the wheels again

        + +

        All the qubes "how to" guide

        +
        +
        +
        +
        + + + +
        +
        +
        +
        +

        PrismBreaker

        +

        + Shatter the big brother.



        Creative Commons Zero: No Rights Reserved
        + +

        +
        + +
        +

        My Links

        +

        + + RSS Feed
        SimpleX Chat
        + +

        +
        + +
        +

        About Prism Breaker

        +

        Donate XMR: 87iB34vdFvNULrAjyfVAZ7jMXc8vbq9tLGMLjo6WC8N9Xo2JFaa8Vkp6dwXBt8rK12Xpz5z1rTa9jSfgyRbNNjswHKTzFVh


        Contact: prismbreaker@waifu.club (PGP)

        +
        + +
        + +
        +
        + + + + + + + + + diff --git a/opsec/qubesosnetwork/manager.png b/opsec/qubesosnetwork/manager.png new file mode 100644 index 0000000..2a4bcd2 Binary files /dev/null and b/opsec/qubesosnetwork/manager.png differ diff --git a/opsec/qubesosnetwork/master_pasteboard.png b/opsec/qubesosnetwork/master_pasteboard.png new file mode 100644 index 0000000..0c88463 Binary files /dev/null and b/opsec/qubesosnetwork/master_pasteboard.png differ diff --git a/opsec/qubesosnetwork/master_pasteboard_wiped.png b/opsec/qubesosnetwork/master_pasteboard_wiped.png new file mode 100644 index 0000000..8923fdd Binary files /dev/null and b/opsec/qubesosnetwork/master_pasteboard_wiped.png differ diff --git a/opsec/qubesosnetwork/net-qube.png b/opsec/qubesosnetwork/net-qube.png new file mode 100644 index 0000000..261956d Binary files /dev/null and b/opsec/qubesosnetwork/net-qube.png differ diff --git a/opsec/qubesosnetwork/structure.png b/opsec/qubesosnetwork/structure.png new file mode 100644 index 0000000..a5ddbfb Binary files /dev/null and b/opsec/qubesosnetwork/structure.png differ diff --git a/opsec/qubesosnetwork/template_install.png b/opsec/qubesosnetwork/template_install.png new file mode 100644 index 0000000..d9daaa2 Binary files /dev/null and b/opsec/qubesosnetwork/template_install.png differ diff --git a/opsec/qubesosnetwork/template_shutdown.png b/opsec/qubesosnetwork/template_shutdown.png new file mode 100644 index 0000000..86ca106 Binary files /dev/null and b/opsec/qubesosnetwork/template_shutdown.png differ diff --git a/opsec/qubesosnetwork/terminal.png b/opsec/qubesosnetwork/terminal.png new file mode 100644 index 0000000..879e08a Binary files /dev/null and b/opsec/qubesosnetwork/terminal.png differ diff --git a/opsec/qubesosnetwork/text_arrived.png b/opsec/qubesosnetwork/text_arrived.png new file mode 100644 index 0000000..ae5e3d4 Binary files /dev/null and b/opsec/qubesosnetwork/text_arrived.png differ diff --git a/opsec/qubesosnetwork/threat_level.png b/opsec/qubesosnetwork/threat_level.png new file mode 100644 index 0000000..f60c415 Binary files /dev/null and b/opsec/qubesosnetwork/threat_level.png differ diff --git a/opsec/qubesosnetwork/torrent_transmission.png b/opsec/qubesosnetwork/torrent_transmission.png new file mode 100644 index 0000000..3201c21 Binary files /dev/null and b/opsec/qubesosnetwork/torrent_transmission.png differ diff --git a/opsec/qubesosnetwork/torrent_vm.png b/opsec/qubesosnetwork/torrent_vm.png new file mode 100644 index 0000000..40baf0f Binary files /dev/null and b/opsec/qubesosnetwork/torrent_vm.png differ diff --git a/opsec/qubesosnetwork/transmission_on.png b/opsec/qubesosnetwork/transmission_on.png new file mode 100644 index 0000000..247a33b Binary files /dev/null and b/opsec/qubesosnetwork/transmission_on.png differ diff --git a/opsec/qubesosnetwork/usb-qube.png b/opsec/qubesosnetwork/usb-qube.png new file mode 100644 index 0000000..7a4a698 Binary files /dev/null and b/opsec/qubesosnetwork/usb-qube.png differ diff --git a/opsec/qubesosnetwork/vpn-qube.png b/opsec/qubesosnetwork/vpn-qube.png new file mode 100644 index 0000000..5a9cc29 Binary files /dev/null and b/opsec/qubesosnetwork/vpn-qube.png differ diff --git a/opsec/qubesosnetwork/whonix-qube.png b/opsec/qubesosnetwork/whonix-qube.png new file mode 100644 index 0000000..046c57d Binary files /dev/null and b/opsec/qubesosnetwork/whonix-qube.png differ diff --git a/opsec/qubesosnetwork/whonix-usage.png b/opsec/qubesosnetwork/whonix-usage.png new file mode 100644 index 0000000..4a0218c Binary files /dev/null and b/opsec/qubesosnetwork/whonix-usage.png differ diff --git a/opsec/qubesosnetwork/whonix_dread.png b/opsec/qubesosnetwork/whonix_dread.png new file mode 100644 index 0000000..b58174d Binary files /dev/null and b/opsec/qubesosnetwork/whonix_dread.png differ diff --git a/opsec/tutorial/qualitystandard.drawio b/opsec/tutorial/qualitystandard.drawio index 108b8d7..af92203 100644 --- a/opsec/tutorial/qualitystandard.drawio +++ b/opsec/tutorial/qualitystandard.drawio @@ -1,6 +1,6 @@ - + diff --git a/push.sh b/push.sh index a8de56b..c4c5f46 100755 --- a/push.sh +++ b/push.sh @@ -1,6 +1,6 @@ #!/bin/bash -git config --global user.email "nihilist@contact.nowhere.moe" -git config --global user.name "nihilist" +#git config --global user.email "nihilist@contact.nowhere.moe" +#git config --global user.name "nihilist" git add -A git commit