diff --git a/opsec/anonymity/16.png b/opsec/anonymity/16.png deleted file mode 100644 index ac0b0bd..0000000 Binary files a/opsec/anonymity/16.png and /dev/null differ diff --git a/opsec/anonymity/17.png b/opsec/anonymity/17.png deleted file mode 100644 index d719ac8..0000000 Binary files a/opsec/anonymity/17.png and /dev/null differ diff --git a/opsec/anonymity/21.png b/opsec/anonymity/21.png deleted file mode 100644 index b9adcb2..0000000 Binary files a/opsec/anonymity/21.png and /dev/null differ diff --git a/opsec/anonymity/22.png b/opsec/anonymity/22.png deleted file mode 100644 index a537562..0000000 Binary files a/opsec/anonymity/22.png and /dev/null differ diff --git a/opsec/anonymity/23.png b/opsec/anonymity/23.png deleted file mode 100644 index ee16c38..0000000 Binary files a/opsec/anonymity/23.png and /dev/null differ diff --git a/opsec/anonymity/24.png b/opsec/anonymity/24.png deleted file mode 100644 index b57f470..0000000 Binary files a/opsec/anonymity/24.png and /dev/null differ diff --git a/opsec/anonymity/25.png b/opsec/anonymity/25.png deleted file mode 100644 index 2169c3e..0000000 Binary files a/opsec/anonymity/25.png and /dev/null differ diff --git a/opsec/anonymity/26.png b/opsec/anonymity/26.png deleted file mode 100644 index 98b55af..0000000 Binary files a/opsec/anonymity/26.png and /dev/null differ diff --git a/opsec/anonymity/27.png b/opsec/anonymity/27.png deleted file mode 100644 index 6cfddd6..0000000 Binary files a/opsec/anonymity/27.png and /dev/null differ diff --git a/opsec/anonymity/28.png b/opsec/anonymity/28.png deleted file mode 100644 index ca7f98e..0000000 Binary files a/opsec/anonymity/28.png and /dev/null differ diff --git a/opsec/anonymity/29.png b/opsec/anonymity/29.png deleted file mode 100644 index c09d540..0000000 Binary files a/opsec/anonymity/29.png and /dev/null differ diff --git a/opsec/anonymity/31.png b/opsec/anonymity/31.png deleted file mode 100644 index 819d4f0..0000000 Binary files a/opsec/anonymity/31.png and /dev/null differ diff --git a/opsec/anonymity/32.png b/opsec/anonymity/32.png deleted file mode 100644 index 53bb169..0000000 Binary files a/opsec/anonymity/32.png and /dev/null differ diff --git a/opsec/anonymity/33.png b/opsec/anonymity/33.png deleted file mode 100644 index 2f02f4d..0000000 Binary files a/opsec/anonymity/33.png and /dev/null differ diff --git a/opsec/anonymity/34.png b/opsec/anonymity/34.png deleted file mode 100644 index 2e0885e..0000000 Binary files a/opsec/anonymity/34.png and /dev/null differ diff --git a/opsec/anonymity/35.png b/opsec/anonymity/35.png deleted file mode 100644 index ceec400..0000000 Binary files a/opsec/anonymity/35.png and /dev/null differ diff --git a/opsec/anonymity/36.png b/opsec/anonymity/36.png deleted file mode 100644 index 3f7dd1d..0000000 Binary files a/opsec/anonymity/36.png and /dev/null differ diff --git a/opsec/anonymity/37.png b/opsec/anonymity/37.png deleted file mode 100644 index 2ee2c8a..0000000 Binary files a/opsec/anonymity/37.png and /dev/null differ diff --git a/opsec/anonymity/38.png b/opsec/anonymity/38.png deleted file mode 100644 index 1a19105..0000000 Binary files a/opsec/anonymity/38.png and /dev/null differ diff --git a/opsec/anonymity/39.png b/opsec/anonymity/39.png deleted file mode 100644 index c922a06..0000000 Binary files a/opsec/anonymity/39.png and /dev/null differ diff --git a/opsec/anonymity/41.png b/opsec/anonymity/41.png deleted file mode 100644 index 0d22ad0..0000000 Binary files a/opsec/anonymity/41.png and /dev/null differ diff --git a/opsec/anonymity/42.png b/opsec/anonymity/42.png deleted file mode 100644 index 942b175..0000000 Binary files a/opsec/anonymity/42.png and /dev/null differ diff --git a/opsec/anonymity/43.png b/opsec/anonymity/43.png deleted file mode 100644 index 9e1bfc4..0000000 Binary files a/opsec/anonymity/43.png and /dev/null differ diff --git a/opsec/anonymity/44.png b/opsec/anonymity/44.png deleted file mode 100644 index ef30e1f..0000000 Binary files a/opsec/anonymity/44.png and /dev/null differ diff --git a/opsec/anonymity/45.png b/opsec/anonymity/45.png deleted file mode 100644 index 6a462d5..0000000 Binary files a/opsec/anonymity/45.png and /dev/null differ diff --git a/opsec/anonymity/index.html b/opsec/anonymity/index.html deleted file mode 100644 index f73db36..0000000 --- a/opsec/anonymity/index.html +++ /dev/null @@ -1,927 +0,0 @@ - - - - - - - - - - - Anonymity Management - - - - - - - - - - - - - - - - - - - -
-
-
- - The Nihilism Blog -
-
- -
- -
-
- - - -
-
-
-
- Previous Page

nothing@nowhere - 2023-10-12

-

Anonymity Management (DISCLAIMER: i need to redo that tutorial!)

-

In this tutorial we're going to take a look at how to manage your online Anonymity.

- -
DISCLAIMER: we're using only harddrives (HDDs) here, because using SSDs are not a secure way to have Plausible Deniability, that is due to hidden Volumes being detectable on devices that utilize wear-leveling -

-source: https://anonymousplanet.org/guide.html#understanding-hdd-vs-ssd
-
-regarding wear leveling:
-"Also as mentioned earlier, disabling Trim will reduce the lifetime of your SSD drive and will significantly impact its performance over time (your laptop will become slower and slower over several months of use until it becomes almost unusable, you will then have to clean the drive and re-install everything). But you must do it to prevent data leaks that could allow forensics to defeat your plausible deniability. The only way around this at the moment is to have a laptop with a classic HDD drive instead."
-
-
- -

This tutorial is based on my previous explanation on OPSEC make sure that you take it into account before proceeding.

- -

So, we basically want 3 ways to access websites. The first being while using tor, for complete anonymity, to do that we'll use whonix. The second is to do the same but to masquerade it with a non-KYC VPN which will also be acquired anonymously to be used only in the case of a website blocking tor exit nodes, and the last one is without any protection, for websites you cannot use without KYC.

- -

As a safety measure for Anonymity, there will be a veracrypt hidden partition in use for plausible deniability.

- -

To prepare the computer for those tasks, we will rely on opensource software to avoid any tracking, we'll remove logs from linux.

-

And lastly, we're going to take a look at how to keep track of your accesses to the websites you access anonymously

- - -
-
-
-
- - -
-
-
-
-

Initial Setup

-

First let's make sure all logs get erased upon system shutdown as described in my previous tutorial on host OS hardening (by piping all logs to go to the /tmp/ folder):

- -

We also make sure that the script to remove logs also includes shutting down the VMs and closes the veracrypt volume just like the emergency shutdown script we detailed in the previous tutorial on homeserver physical security:

-

-
-[ mainpc ] [ /dev/pts/2 ] [~/logremover]
-→ cat /etc/systemd/system/reboot_logremover.service
-[Unit]
-Description=Shutdown Anti forensics
-DefaultDependencies=no
-Before=shutdown.target reboot.target halt.target
-
-[Service]
-Type=oneshot
-ExecStart=/root/shutdown.sh
-TimeoutStartSec=0
-
-[Install]
-WantedBy=shutdown.target reboot.target halt.target
-
-[ mainpc ] [ /dev/pts/2 ] [~/logremover]
-→ cat shutdown.sh
-#!/bin/bash
-
-#remove VMs
-
-sudo virsh -c qemu:///system destroy Whonix-Gateway
-sudo virsh -c qemu:///system destroy Whonix-Workstation
-sudo virsh -c qemu:///system undefine Whonix-Gateway
-sudo virsh -c qemu:///system undefine Whonix-Workstation
-sudo virsh -c qemu:///system net-destroy Whonix-External
-sudo virsh -c qemu:///system net-destroy Whonix-Internal
-sudo virsh -c qemu:///system net-undefine Whonix-External
-sudo virsh -c qemu:///system net-undefine Whonix-External
-
-#then unmount veracrypt volumes
-
-sudo veracrypt -d  -f
-
-# then cleanup logs
-
-sudo rm -rf /dev/shm/*
-sudo rm -rf /var/log/*
-sudo dmesg -c
-
-
-

In the shutdown.sh script we also make sure that the VMs are removed, and that the veracrypt volumes are unmounted, before clearing up the logs.

- -

Next we're going to install libvirt as seen in our previous tutorial on host os hardeninghere:

-

-sudo pacman -S libvirt qemu-full virt-manager dnsmasq bridge-utils
-	
-sudo systemctl enable --now libvirtd
-
-#####################vault.sh:#######################################
-#!/bin/bash
-echo "[+] MOUNTING VAULTS..."
-
-sudo cryptsetup luksOpen /dev/nvme1n1p1 VAULT
-sudo mkdir /run/media/nihilist/VAULT 2>/dev/null
-sudo mount /dev/mapper/VAULT /run/media/nihilist/VAULT
-
-echo "[+] VAULTS MOUNTED"
-###################################################################
-
-usermod -a -G libvirt nihilist
-usermod -a -G kvm nihilist
-
-[root@nowhere ~]# vim /etc/libvirt/libvirtd.conf 
-[root@nowhere ~]# cat /etc/libvirt/libvirtd.conf  | grep sock_group
-unix_sock_group = "libvirt"
-unix_sock_rw_perms = "0770"
-
-sudo chmod 770 -R VMs 
-sudo chown nihilist:libvirt -R VMs 
-
-cat /etc/libvirt/qemu.conf
-group = "libvirt"
-user = "nihilist"
-
-systemctl restart libvirtd.service
-
-virt-manager
-
-
- -

Next step we create the veracrypt drives, so use the /dev/sdb harddrive for it:

-

-[ 10.99.99.9/24 ] [ /dev/pts/2 ] [~/Nextcloud/Obsidian]
-→ lsblk
-NAME          MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
-sda             8:0    0   1.8T  0 disk
-└─sda1          8:1    0   1.8T  0 part
-sdb             8:16   0 447.1G  0 disk
-sdc             8:32   0   3.6T  0 disk
-└─VAULTBACKUP 253:1    0   3.6T  0 crypt /mnt/VAULTBACKUP
-zram0         254:0    0     4G  0 disk  [SWAP]
-nvme1n1       259:0    0   1.8T  0 disk
-└─nvme1n1p1   259:1    0   1.8T  0 part
-  └─VAULT     253:0    0   1.8T  0 crypt /mnt/VAULT
-nvme0n1       259:2    0 465.8G  0 disk
-├─nvme0n1p1   259:3    0   511M  0 part  /boot
-└─nvme0n1p2   259:4    0 465.3G  0 part  /
-	
-
- -

Be aware that the 3 VMs we need to place in a veracrypt container all weigh 100GB each so you need 300Gb for all 3 VMs, so you need at least 2x300Gb to replicate the setup in the decoy partition, so pick a 1.2TB harddrive instead, with some additional space so preferably a 1.8TB one just to be safe, unlike as shown below (a 500gb disk which is not enough!)

-

So let's now setup the hidden partition there:

-

-[ 10.99.99.9/24 ] [ /dev/pts/2 ] [~/Nextcloud/Obsidian]
-→ sudo pacman -S veracrypt
-	
-
- - - - - - - - - - - - - - - - - - - - - - - - - - -

Now that's done, let's setup the whonix and workstations templates, we will then copy them in the veracrypt harddrive afterward to edit them. So let's go here to download whonix for QEMU:

- - -

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ mv ~/Downloads/Whonix-Xfce-17.0.3.0.Intel_AMD64.qcow2.libvirt.xz .
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ tar -xvf Whonix-Xfce-17.0.3.0.Intel_AMD64.qcow2.libvirt.xz
-WHONIX_BINARY_LICENSE_AGREEMENT
-WHONIX_DISCLAIMER
-Whonix-Gateway-Xfce-17.0.3.0.xml
-Whonix-Workstation-Xfce-17.0.3.0.xml
-Whonix_external_network-17.0.3.0.xml
-Whonix_internal_network-17.0.3.0.xml
-Whonix-Gateway-Xfce-17.0.3.0.Intel_AMD64.qcow2
-Whonix-Workstation-Xfce-17.0.3.0.Intel_AMD64.qcow2
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ touch WHONIX_BINARY_LICENSE_AGREEMENT_accepted
-
-

Next we edit the XML files to have the working VMs, for which we will give 2GB of ram for the gateway, and 4GB of ram for the workstation while also specifying the path to their .qcow2 volumes:

-

-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ vim Whonix-Workstation-Xfce-17.0.3.0.xml
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ cat Whonix-Workstation-Xfce-17.0.3.0.xml | grep GiB
-  <memory dumpCore='off' unit='GiB'>4
-  <currentMemory unit='GiB'>4
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ cat Whonix-Workstation-Xfce-17.0.3.0.xml| grep source
-      <source file='/mnt/VAULT/ISOs/whonix/Whonix-Workstation-Xfce-17.0.3.0.Intel_AMD64.qcow2'/>
-
-
-
-
-
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ vim Whonix-Workstation-Xfce-17.0.3.0.xml
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ cat Whonix-Gateway-Xfce-17.0.3.0.xml | grep GiB
-  <memory dumpCore='off' unit='GiB'>2
-  <currentMemory unit='GiB'>2
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ cat Whonix-Gateway-Xfce-17.0.3.0.xml| grep source
-      <source file='/mnt/VAULT/ISOs/whonix/Whonix-Gateway-Xfce-17.0.3.0.Intel_AMD64.qcow2'/>
-
-
-

and now to make things easier let's put a refreshvms.sh script in there to remove and restart the VMs:

-

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ vim refreshvms.sh
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ cat refreshvms.sh
-#!/bin/bash
-
-#remove VMs
-
-sudo virsh -c qemu:///system destroy Whonix-Gateway
-sudo virsh -c qemu:///system destroy Whonix-Workstation
-sudo virsh -c qemu:///system undefine Whonix-Gateway
-sudo virsh -c qemu:///system undefine Whonix-Workstation
-sudo virsh -c qemu:///system net-destroy Whonix-External
-sudo virsh -c qemu:///system net-destroy Whonix-Internal
-sudo virsh -c qemu:///system net-undefine Whonix-External
-sudo virsh -c qemu:///system net-undefine Whonix-External
-
-echo '[+] VMs removed, re-install them ? (ctrl+c to exit)'
-read
-
-#install VMs
-
-sudo virsh -c qemu:///system net-define Whonix_external*.xml
-sudo virsh -c qemu:///system net-define Whonix_internal*.xml
-sudo virsh -c qemu:///system net-autostart Whonix-External
-sudo virsh -c qemu:///system net-start Whonix-External
-sudo virsh -c qemu:///system net-autostart Whonix-Internal
-sudo virsh -c qemu:///system net-start Whonix-Internal
-sudo virsh -c qemu:///system define Whonix-Gateway*.xml
-sudo virsh -c qemu:///system define Whonix-Workstation*.xml
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ chmod +x refreshvms.sh
-
-
-

then run it:

-

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ ./refreshvms.sh
-error: Failed to destroy domain 'Whonix-Gateway'
-error: Requested operation is not valid: domain is not running
-
-error: Failed to destroy domain 'Whonix-Workstation'
-error: Requested operation is not valid: domain is not running
-
-Domain 'Whonix-Gateway' has been undefined
-
-Domain 'Whonix-Workstation' has been undefined
-
-Network Whonix-External destroyed
-
-Network Whonix-Internal destroyed
-
-Network Whonix-External has been undefined
-
-error: failed to get network 'Whonix-External'
-error: Network not found: no network with matching name 'Whonix-External'
-
-[+] VMs removed, re-install them ? (ctrl+c to exit)
-
-Network Whonix-External defined from Whonix_external_network-17.0.3.0.xml
-
-error: Failed to define network from Whonix_internal_network-17.0.3.0.xml
-error: operation failed: network 'Whonix-Internal' already exists with uuid 48298ccf-9352-4b21-b6c4-17ad13ad1d6d
-
-Network Whonix-External marked as autostarted
-
-Network Whonix-External started
-
-Network Whonix-Internal marked as autostarted
-
-Network Whonix-Internal started
-
-Domain 'Whonix-Gateway' defined from Whonix-Gateway-Xfce-17.0.3.0.xml
-
-Domain 'Whonix-Workstation' defined from Whonix-Workstation-Xfce-17.0.3.0.xml
-
-
-

Then launch the VMs from virt-manager:

- -

let's start with the Gateway:

- - - - - -

Now that's done you can also finish the initial setup for the workstation:

- - -

So from here you can use whonix regularly to browse with the tor browser, don't forget to disable javascript and to always keep the browser up to date like so:

- -

As suggested above, we'll also upgrade the VMs, and to go further we'll install unattended upgrades (note whonix's default system credentials are user:changeme:

-

-$ passwd
-$ sudo -i
-# apt update -y ; apt upgrade -y ; apt autoremove -y
-# apt install unattended-upgrades apt-listchanges -y
-# dpkg-reconfigure -plow unattended-upgrades 
-
-^ select yes there
-	
-
-

Next step is to have the second workstation which will be used as the vpn over tor setup later on so let's copy the .xml and .qcow2 after shutting down the existing workstation:

-

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ ls
-refreshvms.sh                             Whonix_external_network-17.0.3.0.xml            Whonix-Workstation-Xfce-17.0.3.0.Intel_AMD64.qcow2
-WHONIX_BINARY_LICENSE_AGREEMENT           Whonix-Gateway-Xfce-17.0.3.0.Intel_AMD64.qcow2  Whonix-Workstation-Xfce-17.0.3.0.xml
-WHONIX_BINARY_LICENSE_AGREEMENT_accepted  Whonix-Gateway-Xfce-17.0.3.0.xml                Whonix-Xfce-17.0.3.0.Intel_AMD64.qcow2.libvirt.xz
-WHONIX_DISCLAIMER                         Whonix_internal_network-17.0.3.0.xml	
-
- 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ cp Whonix-Workstation-Xfce-17.0.3.0.xml Whonix-Workstation2-Xfce-17.0.3.0.xml
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ cp Whonix-Workstation-Xfce-17.0.3.0.Intel_AMD64.qcow2 Whonix-Workstation2-Xfce-17.0.3.0.Intel_AMD64.qcow2
-
-
-

Then edit the new xml file to match the new VM name:

-

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ vim Whonix-Workstation2-Xfce-17.0.3.0.xml
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ cat Whonix-Workstation2-Xfce-17.0.3.0.xml | grep Workstation2
-  <name>Whonix-Workstation2</name>
-      <source file='/mnt/VAULT/ISOs/whonix/Whonix-Workstation2-Xfce-17.0.3.0.Intel_AMD64.qcow2'/>
-	
-
-

Then we include it in the refreshVMs.sh script:

-

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ cat refreshvms.sh
-#!/bin/bash
-
-#remove VMs
-
-sudo virsh -c qemu:///system destroy Whonix-Gateway
-sudo virsh -c qemu:///system destroy Whonix-Workstation
-sudo virsh -c qemu:///system destroy Whonix-Workstation2
-
-sudo virsh -c qemu:///system undefine Whonix-Gateway
-sudo virsh -c qemu:///system undefine Whonix-Workstation
-sudo virsh -c qemu:///system undefine Whonix-Workstation2
-
-
-sudo virsh -c qemu:///system net-destroy Whonix-External
-sudo virsh -c qemu:///system net-destroy Whonix-Internal
-sudo virsh -c qemu:///system net-undefine Whonix-External
-sudo virsh -c qemu:///system net-undefine Whonix-Internal
-
-
-
-
-echo '[+] VMs removed, re-install them ? (ctrl+c to exit)'
-read
-
-#install VMs
-sudo virsh -c qemu:///system net-define Whonix_external*.xml
-sudo virsh -c qemu:///system net-define Whonix_internal*.xml
-
-
-sudo virsh -c qemu:///system net-autostart Whonix-External
-sudo virsh -c qemu:///system net-start Whonix-External
-
-sudo virsh -c qemu:///system net-autostart Whonix-Internal
-sudo virsh -c qemu:///system net-start Whonix-Internal
-
-sudo virsh -c qemu:///system define Whonix-Gateway*.xml
-sudo virsh -c qemu:///system define Whonix-Workstation2*.xml
-sudo virsh -c qemu:///system define Whonix-Workstation-*.xml
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ ./refreshvms.sh
-error: Failed to destroy domain 'Whonix-Gateway'
-error: Requested operation is not valid: domain is not running
-
-error: Failed to destroy domain 'Whonix-Workstation'
-error: Requested operation is not valid: domain is not running
-
-error: Failed to destroy domain 'Whonix-Workstation2'
-error: Requested operation is not valid: domain is not running
-
-Domain 'Whonix-Gateway' has been undefined
-
-Domain 'Whonix-Workstation' has been undefined
-
-Domain 'Whonix-Workstation2' has been undefined
-
-Network Whonix-External destroyed
-
-Network Whonix-Internal destroyed
-
-Network Whonix-External has been undefined
-
-Network Whonix-Internal has been undefined
-
-[+] VMs removed, re-install them ? (ctrl+c to exit)
-
-Network Whonix-External defined from Whonix_external_network-17.0.3.0.xml
-
-Network Whonix-Internal defined from Whonix_internal_network-17.0.3.0.xml
-
-Network Whonix-External marked as autostarted
-
-Network Whonix-External started
-
-Network Whonix-Internal marked as autostarted
-
-Network Whonix-Internal started
-
-Domain 'Whonix-Gateway' defined from Whonix-Gateway-Xfce-17.0.3.0.xml
-
-Domain 'Whonix-Workstation2' defined from Whonix-Workstation2-Xfce-17.0.3.0.xml
-
-Domain 'Whonix-Workstation' defined from Whonix-Workstation-Xfce-17.0.3.0.xml
-
-
-

Then edit the new workstation VM to have the 10.152.152.12 ip by default (since the other one has the 10.152.152.11 ip):

- - -

Now that our VM templates are done, let's put them on our veracrypt harddrive:

-

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ ./refreshvms.sh
-[sudo] password for nothing:
-Domain 'Whonix-Gateway' destroyed
-
-Domain 'Whonix-Workstation' destroyed
-
-Domain 'Whonix-Workstation2' destroyed
-
-Domain 'Whonix-Gateway' has been undefined
-
-Domain 'Whonix-Workstation' has been undefined
-
-Domain 'Whonix-Workstation2' has been undefined
-
-Network Whonix-External destroyed
-
-Network Whonix-Internal destroyed
-
-Network Whonix-External has been undefined
-
-Network Whonix-Internal has been undefined
-
-[+] VMs removed, re-install them ? (ctrl+c to exit)
-^C
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ ls
-refreshvms.sh                             Whonix-Gateway-Xfce-17.0.3.0.Intel_AMD64.qcow2       Whonix-Workstation-Xfce-17.0.3.0.Intel_AMD64.qcow2
-WHONIX_BINARY_LICENSE_AGREEMENT           Whonix-Gateway-Xfce-17.0.3.0.xml                     Whonix-Workstation-Xfce-17.0.3.0.xml
-WHONIX_BINARY_LICENSE_AGREEMENT_accepted  Whonix_internal_network-17.0.3.0.xml                 Whonix-Xfce-17.0.3.0.Intel_AMD64.qcow2.libvirt.xz
-WHONIX_DISCLAIMER                         Whonix-Workstation2-Xfce-17.0.3.0.Intel_AMD64.qcow2
-Whonix_external_network-17.0.3.0.xml      Whonix-Workstation2-Xfce-17.0.3.0.xml
-	
-
- - -

Once mounted, let's copy them here and launch them:

-

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [VAULT/ISOs/whonix]
-→ cd /media/veracrypt1
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ cp /mnt/VAULT/ISOs/whonix/* .
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ ls -lash
-total 21G
-4.0K drwxr-xr-x 2 nothing nothing 4.0K Oct  8 13:35 .
-4.0K drwxr-xr-x 3 root    root    4.0K Oct  8 13:34 ..
-4.0K -rwxr-xr-x 1 nothing nothing 1.2K Oct  8 13:35 refreshvms.sh
- 40K -rw-r--r-- 1 nothing nothing  39K Oct  8 13:35 WHONIX_BINARY_LICENSE_AGREEMENT
-   0 -rw-r--r-- 1 nothing nothing    0 Oct  8 13:35 WHONIX_BINARY_LICENSE_AGREEMENT_accepted
-8.0K -rw-r--r-- 1 nothing nothing 4.1K Oct  8 13:35 WHONIX_DISCLAIMER
-4.0K -rw-r--r-- 1 nothing nothing  172 Oct  8 13:35 Whonix_external_network-17.0.3.0.xml
-5.2G -rw-r--r-- 1 nothing nothing 101G Oct  8 13:35 Whonix-Gateway-Xfce-17.0.3.0.Intel_AMD64.qcow2
-4.0K -rw-r--r-- 1 nothing nothing 2.4K Oct  8 13:35 Whonix-Gateway-Xfce-17.0.3.0.xml
-4.0K -rw-r--r-- 1 nothing nothing   97 Oct  8 13:35 Whonix_internal_network-17.0.3.0.xml
-6.9G -rw-r--r-- 1 nothing nothing 101G Oct  8 13:35 Whonix-Workstation2-Xfce-17.0.3.0.Intel_AMD64.qcow2
-4.0K -rw-r--r-- 1 nothing nothing 2.3K Oct  8 13:35 Whonix-Workstation2-Xfce-17.0.3.0.xml
-7.0G -rw-r--r-- 1 nothing nothing 101G Oct  8 13:35 Whonix-Workstation-Xfce-17.0.3.0.Intel_AMD64.qcow2
-4.0K -rw-r--r-- 1 nothing nothing 2.3K Oct  8 13:35 Whonix-Workstation-Xfce-17.0.3.0.xml
-1.3G -rw-r--r-- 1 nothing nothing 1.3G Oct  8 13:35 Whonix-Xfce-17.0.3.0.Intel_AMD64.qcow2.libvirt.xz
-
-
-

Now that's done, you need to edit each XML to make sure it has the correct path in it:

-

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ vim Whonix-Gateway-Xfce-17.0.3.0.xml
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ vim Whonix-Workstation2-Xfce-17.0.3.0.xml
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ vim Whonix-Workstation-Xfce-17.0.3.0.xml
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ cat Whonix-Gateway-Xfce-17.0.3.0.xml| grep source
-      <source file='/media/veracrypt1/Whonix-Gateway-Xfce-17.0.3.0.Intel_AMD64.qcow2'/>
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ cat Whonix-Workstation2-Xfce-17.0.3.0.xml | grep source
-      <source file='/media/veracrypt1/whonix/Whonix-Workstation2-Xfce-17.0.3.0.Intel_AMD64.qcow2'/>
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ cat Whonix-Workstation-Xfce-17.0.3.0.xml | grep source
-      <source file='/media/veracrypt1/whonix/Whonix-Workstation-Xfce-17.0.3.0.Intel_AMD64.qcow2'/>
-	
-
-

Then you can use the VMs using the refreshvms.sh script:

-

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ ./refreshvms.sh
-[sudo] password for nothing:
-error: failed to get domain 'Whonix-Gateway'
-
-error: failed to get domain 'Whonix-Workstation'
-
-error: failed to get domain 'Whonix-Workstation2'
-
-error: failed to get domain 'Whonix-Gateway'
-
-error: failed to get domain 'Whonix-Workstation'
-
-error: failed to get domain 'Whonix-Workstation2'
-
-error: failed to get network 'Whonix-External'
-error: Network not found: no network with matching name 'Whonix-External'
-
-error: failed to get network 'Whonix-Internal'
-error: Network not found: no network with matching name 'Whonix-Internal'
-
-error: failed to get network 'Whonix-External'
-error: Network not found: no network with matching name 'Whonix-External'
-
-error: failed to get network 'Whonix-Internal'
-error: Network not found: no network with matching name 'Whonix-Internal'
-
-[+] VMs removed, re-install them ? (ctrl+c to exit)
-
-
-Network Whonix-External defined from Whonix_external_network-17.0.3.0.xml
-
-Network Whonix-Internal defined from Whonix_internal_network-17.0.3.0.xml
-
-Network Whonix-External marked as autostarted
-
-Network Whonix-External started
-
-Network Whonix-Internal marked as autostarted
-
-Network Whonix-Internal started
-
-Domain 'Whonix-Gateway' defined from Whonix-Gateway-Xfce-17.0.3.0.xml
-
-Domain 'Whonix-Workstation2' defined from Whonix-Workstation2-Xfce-17.0.3.0.xml
-
-Domain 'Whonix-Workstation' defined from Whonix-Workstation-Xfce-17.0.3.0.xml
-	
-
-

Now with this if you are forced to give away the password for that harddrive, you can give them this decoy partition, and they'll find the whonix VMs you've copied there.

-

So now dismount the veracrypt partition, to do that you need to first remove the VMs with the script, and then you need to EXIT the folder, otherwise it'll complain and tell you that the target drive is busy and can't be unmounted:

-

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ ./refreshvms.sh
-error: Failed to destroy domain 'Whonix-Gateway'
-error: Requested operation is not valid: domain is not running
-
-error: Failed to destroy domain 'Whonix-Workstation'
-error: Requested operation is not valid: domain is not running
-
-error: Failed to destroy domain 'Whonix-Workstation2'
-error: Requested operation is not valid: domain is not running
-
-Domain 'Whonix-Gateway' has been undefined
-
-Domain 'Whonix-Workstation' has been undefined
-
-Domain 'Whonix-Workstation2' has been undefined
-
-Network Whonix-External destroyed
-
-Network Whonix-Internal destroyed
-
-Network Whonix-External has been undefined
-
-Network Whonix-Internal has been undefined
-
-[+] VMs removed, re-install them ? (ctrl+c to exit)
-^C
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ cd ..
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media]
-→
-
- -

Now that's done for the decoy partition, we do the same for the hidden partition:

- - -

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media]
-→ cd veracrypt1
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ cp /mnt/VAULT/ISOs/whonix/* .
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ ls
-refreshvms.sh                             Whonix-Gateway-Xfce-17.0.3.0.Intel_AMD64.qcow2       Whonix-Workstation-Xfce-17.0.3.0.Intel_AMD64.qcow2
-WHONIX_BINARY_LICENSE_AGREEMENT           Whonix-Gateway-Xfce-17.0.3.0.xml                     Whonix-Workstation-Xfce-17.0.3.0.xml
-WHONIX_BINARY_LICENSE_AGREEMENT_accepted  Whonix_internal_network-17.0.3.0.xml                 Whonix-Xfce-17.0.3.0.Intel_AMD64.qcow2.libvirt.xz
-WHONIX_DISCLAIMER                         Whonix-Workstation2-Xfce-17.0.3.0.Intel_AMD64.qcow2
-Whonix_external_network-17.0.3.0.xml      Whonix-Workstation2-Xfce-17.0.3.0.xml
-	
-
-

Then edit the paths again:

-

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ vim Whonix-Gateway-Xfce-17.0.3.0.xml
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ vim Whonix-Workstation2-Xfce-17.0.3.0.xml
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ vim Whonix-Workstation-Xfce-17.0.3.0.xml
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ cat Whonix-Gateway-Xfce-17.0.3.0.xml| grep source
-      <source file='/media/veracrypt1/Whonix-Gateway-Xfce-17.0.3.0.Intel_AMD64.qcow2'/>
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ cat Whonix-Workstation2-Xfce-17.0.3.0.xml | grep source
-      <source file='/media/veracrypt1/whonix/Whonix-Workstation2-Xfce-17.0.3.0.Intel_AMD64.qcow2'/>
-
-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ cat Whonix-Workstation-Xfce-17.0.3.0.xml | grep source
-      <source file='/media/veracrypt1/whonix/Whonix-Workstation-Xfce-17.0.3.0.Intel_AMD64.qcow2'/>
-	
-
-

Then start the VMs:

-

-[ 10.99.99.9/24 ] [ /dev/pts/23 ] [/media/veracrypt1]
-→ ./refreshvms.sh
-[sudo] password for nothing:
-error: failed to get domain 'Whonix-Gateway'
-
-error: failed to get domain 'Whonix-Workstation'
-
-error: failed to get domain 'Whonix-Workstation2'
-
-error: failed to get domain 'Whonix-Gateway'
-
-error: failed to get domain 'Whonix-Workstation'
-
-error: failed to get domain 'Whonix-Workstation2'
-
-error: failed to get network 'Whonix-External'
-error: Network not found: no network with matching name 'Whonix-External'
-
-error: failed to get network 'Whonix-Internal'
-error: Network not found: no network with matching name 'Whonix-Internal'
-
-error: failed to get network 'Whonix-External'
-error: Network not found: no network with matching name 'Whonix-External'
-
-error: failed to get network 'Whonix-Internal'
-error: Network not found: no network with matching name 'Whonix-Internal'
-
-[+] VMs removed, re-install them ? (ctrl+c to exit)
-
-Network Whonix-External defined from Whonix_external_network-17.0.3.0.xml
-
-Network Whonix-Internal defined from Whonix_internal_network-17.0.3.0.xml
-
-Network Whonix-External marked as autostarted
-
-Network Whonix-External started
-
-Network Whonix-Internal marked as autostarted
-
-Network Whonix-Internal started
-
-Domain 'Whonix-Gateway' defined from Whonix-Gateway-Xfce-17.0.3.0.xml
-
-Domain 'Whonix-Workstation2' defined from Whonix-Workstation2-Xfce-17.0.3.0.xml
-
-Domain 'Whonix-Workstation' defined from Whonix-Workstation-Xfce-17.0.3.0.xml
-	
-
-

You need to keep in mind that currently we have not given out any information about ourselves, other than we've used Tor. We won't stop there, and in order to use a VPN anonymously, you need to acquire it through Tor, buy it with Monero, and force the VPN Connection itself through Tor. Cherry on top is that we're going to use a well-used VPN service, so we won't be the only user with that public VPN ip. But what matters is that we do not give any information about us to the VPN provider. If the VPN provider forces you to provide anything personal (if the vpn provider blocks tor connections, or forces you to buy it with something else than monero), then it would not truly be a non-KYC VPN provider, and thus it's against your privacy. That's the only way you can find out which ones are all just marketing.

- -

Now that's done we can go find a vpn provider for the workstation2, let's try out the very praised mullvad vpn provider here, Firstly because it's a non-KYC VPN provider (meaning you can acquire it and use it through Tor, and pay with Monero), also due to the fact that we won't be the only ones using that service, it means we won't need to change the VPN server when we want to have another identity online. On top of that, mullvad gives us the ability to connect to a random server of theirs, via openvpn via TCP on port 443, which is definitely neat because it mimicks web HTTPS traffic, and isn't blockable by tor exit node hosters (which is definitely a trend, most of them block ports that are suceptible to abuse, 443 https being the least likely of them):

- - -

now to not loose your accesses , make sure to save credentials in a local keepass database on the VM.

- - - -

Now let's add time to our account, and of course we will pay with the only cryptocurrency that's used:

- - -

To get some monero you can buy it on localmonero.co, and make sure it arrives on your monero wallet inside the whonix VM, never trust centralised exchanges with your assets, always keep them locally.

- -

Once it finishes installing, create your monero wallet:

- -

Then say no to mining and use an onion-based monero daemon, like the one i'm hosting, you can find a full list of other ones here:

- -

Wait for it to finish synchronizing, then get some monero from a vendor on localmonero.co (by giving them a wallet address you'd have created:

- - -

Once you've paid, download the .ovpn file to connect via vpn:

- -

Then unzip and let's now make sure the vpn goes through tor:

- - -

To do that we need to make sure the VPN goes through the local SOCKS port 9050, and to mention the entry node which is the gateway 10.152.152.10:

- -

before we launch it keep in mind this:

- -

Then launch the VPN and you can then see that you no longer have a tor exit node IP:

- - -

Now check your ip from Firefox, not the tor browser:

- -

You can also check if there are any DNS leaks:

- -

here we see the test revealed a dns ip leak, but upon checking (in shodan.io) we see that it's a tor exit IP address:

- -

We can also check if there are any WebRTC leaks:

- -

and there we see that there are no webRTC leaks either, so it's all good.

-

To make sure the vpn is started automatically we can make it a systemd service:

-

-root@workstation:~# cat /etc/systemd/system/vpn.service
-[Unit]
-Description=VPN
-After=network-online.target
-Wants=network-online.target
-
-[Install]
-WantedBy=multi-user.target
-
-[Service]
-Type=simple
-WorkingDirectory=/home/user/Desktop/mullvad_config_linux_nl_ams/
-ExecStart=/usr/sbin/openvpn /home/user/Desktop/mullvad_config_linux_nl_ams/mullvad_nl_ams.conf
-ExecStop=kill -9 $(pidof openvpn)
-Restart=always
-
-root@workstation:~# systemctl daemon-reload ; systemctl enable --now vpn.service ; systemctl restart vpn.service
-
-
- -

Now thanks to that, you can still browse websites anonymously in case if they block tor exit nodes.

-
-
-
-
- -
-
-
-
- -
-
-
-
- - - -
-
-
-
-

Anonymity management



-

To implement Anonymity Management, simply ask yourselves the following questions:

-

First question to answer is "Is the activity Sensitive, and will I need to be able to deny it's existence ?" If the answer is no, then we have the following questions:

- -

If the website requires you to give it your home address like Amazon for example, you can forget trying to be anonymous because you'll anyway need to de-anonymize yourself with your actions, no matter how you accessed the website.

-

If the website doesn't block tor exit nodes, browse it via the Whonix VMs. But if it does, then use the VPN through Tor setup to circumvent the blockage.

-

And lastly, for all websites you browsed to anonymously, make sure you log it to have an global view of your online anonymity.

- -

If your activities are sensitive enough that you need to be able to deny their existence, then we make use of veracrypt's plausible deniability features, and we open the whonix VMs from inside the hidden partition.

-

And there the same questions apply, but you better remain anonymous while you conduct said sensitive activities.

- -
-
-
-
- - - -
-
-
-
-

Nihilism

-

- Until there is Nothing left.



Creative Commons Zero: No Rights Reserved
- -

-
- -
-

My Links

-

- - RSS Feed
SimpleX Chat
- -

-
- -
-

About nihilist

-

Donate XMR: 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8


Contact: nihilist@contact.nowhere.moe (PGP)

-
- -
- -
-
- - - - - - - diff --git a/opsec/anonymity/old.html b/opsec/anonymity/old.html deleted file mode 100644 index 2c17c3f..0000000 --- a/opsec/anonymity/old.html +++ /dev/null @@ -1,309 +0,0 @@ - - - - - - - - - - - anonymity Setup - - - - - - - - - - - - - - - - - - - -
-
-
- - The Nihilism Blog -
-
- -
- -
-
- - - -
-
-
-
- Previous Page

nothing@nowhere - 2023-09-24

-

anonymity Setup

-

In this tutorial we're going to take a look at how to manage your online Anonymity.

- -

We want 3 ways to access websites. The first being while using tor, for complete anonymity. The second is to do the same but to masquerade it with a non-KYC VPN which will also be acquired anonymously, and the last is without any protection.

- -

As a preventive measure, we're going to separate each VMs using VLANs, so that there's a clear separation between any KYC VMs, and VMs used for anonymity. To do so there will be 3 separate VLANs, one being for Anonymity purposes, and the others for KYC use. -For Anonymity, there will be a veracrypt hidden partition in use for plausible deniability.

- -

To prepare the computer for those tasks, we will rely on opensource software to avoid any tracking, we'll remove logs from arch linux, and from pfsense.

-

And lastly, we're going to take a look at how to keep track of your accesses to the websites you access anonymously

- - -
-
-
-
- - -
-
-
-
-

Initial Setup

-

First let's make sure all logs get erased upon system shutdown (by piping all logs to go to the /tmp/ folder):

-

-[ 10.99.99.9/24 ] [ /dev/pts/31 ] [/var]
-→ sudo rm -rf log
-[sudo] password for nothing:
-
-[ 10.99.99.9/24 ] [ /dev/pts/31 ] [/var]
-→ sudo ln -s /tmp/ /var/log
-
-[ 10.99.99.9/24 ] [ /dev/pts/31 ] [/var]
-→ ls -lash log
-0 lrwxrwxrwx 1 root root 5 Sep 24 18:43 log -> /tmp/
-	
-
- -

Next we're going to install libvirti as seen here:

-

-sudo pacman -S libvirt qemu virt-manager dnsmasq bridge-utils
-	
-sudo systemctl enable --now libvirtd
-
-virt-manager
-
-
-

Then create the 2 separate LANs for the VMs in virt-manager like so:

- - - -

Then you're going to need to create the pfsense VM, so first get the iso from the official website:

- -

-[ 10.99.99.9/24 ] [ /dev/pts/31 ] [/var]
-→ cd /mnt/VAULT/ISOs
-
-[ 10.99.99.9/24 ] [ /dev/pts/31 ] [/mnt/VAULT/ISOs]
-→ mv ~/Downloads/pfSense-CE-2.7.0-RELEASE-amd64.iso.gz .
-
-[ 10.99.99.9/24 ] [ /dev/pts/31 ] [/mnt/VAULT/ISOs]
-→ ls -lash | grep pfSense
-730M -rw-r--r--  1 nothing      nothing      730M Sep 24 19:16 pfSense-CE-2.7.0-RELEASE-amd64.iso
-	
-
-

Then create the VM:

- - - - -

Before installing the VM we will setup the 3 network cards it will handle: The default WAN, and the 2 LANs

- - - - -

Now let's start installing the pfsense VM:

- - - - - - - -

And now that's done, next step is to make sure pfsense handles the 2 VLANs properly:

- - - - -

Then we set the ip addresses of each interface, starting with the LAN-KYC VLAN:

- - - - -

Then do the same for the LAN-ANON VLAN:

- - - -

For this next step, we're going to put a VM in the KYC vlan to finish the pfsense router setup

- - -

From there, it's a matter of setting up pfsense:

- - - - - -

To change the pfsense theme to a dark theme, go in System > General Setup > webConfiguratior > Theme > set to pfsense-dark

- -

As you've seen above, we've set 2 temporary public dns servers, so next we're going to setup 2 local TOR DNS servers, which will allow the VMs to resolve any domain anonymously.

- -

Once done, we make sure that pfsense takes these 2 dns servers, and only uses them, will also setup firewall rules to deny any other dns traffic.

- -

Here you can see it's working fine:

- -

Then shutdown the VM, clone it and you'll have the 2 tor DNSes working.

- -

Next just put them in the anon VLAN:

- - -

Once in there, we make sure that they are DHCP reserved so their ip won't change over time:

- - - -

Then do the same for the other tordns:

- - -

Then from the firewall, we allow the whole subnet to communicate to tordns1 and 2, because they will also be the bridge nodes, and we allow the tordns 1 and 2 servers to connect anywhere with any protocol. -That way, the only traffic that can escape from the anon subnet, will only be through these 2 servers, that will prevent any data leak from happening.

-

-	
-
-

-

-	
-
-

-

-	
-
-

-

-	
-
-

-

-	
-
-
-
-
-
- -
-
-
-
-

Setup



-

- -

-	
-
- -

- -

-	
-
- -

- -

-	
-
- -
-
-
-
- - - -
-
-
-
-

Setup



-

-

-	
-
- -

-

-	
-
- -

-

-	
-
- -
-
-
-
- - - -
-
-
-
-

Nihilism

-

- Until there is Nothing left.



Creative Commons Zero: No Rights Reserved
- -

-
- -
-

My Links

-

- - RSS Feed
SimpleX Chat
- -

-
- -
-

About nihilist

-

Donate XMR: 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8


Contact: nihilist@contact.nowhere.moe (PGP)

-
- -
- -
-
- - - - - - - diff --git a/opsec/anonymity/old/10.png b/opsec/anonymity/old/10.png deleted file mode 100644 index 175578e..0000000 Binary files a/opsec/anonymity/old/10.png and /dev/null differ diff --git a/opsec/anonymity/old/11.png b/opsec/anonymity/old/11.png deleted file mode 100644 index 79ffa76..0000000 Binary files a/opsec/anonymity/old/11.png and /dev/null differ diff --git a/opsec/anonymity/old/12.png b/opsec/anonymity/old/12.png deleted file mode 100644 index 7a742c2..0000000 Binary files a/opsec/anonymity/old/12.png and /dev/null differ diff --git a/opsec/anonymity/old/13.png b/opsec/anonymity/old/13.png deleted file mode 100644 index 1963335..0000000 Binary files a/opsec/anonymity/old/13.png and /dev/null differ diff --git a/opsec/anonymity/old/14.png b/opsec/anonymity/old/14.png deleted file mode 100644 index 04648c7..0000000 Binary files a/opsec/anonymity/old/14.png and /dev/null differ diff --git a/opsec/anonymity/old/15.png b/opsec/anonymity/old/15.png deleted file mode 100644 index b21c44c..0000000 Binary files a/opsec/anonymity/old/15.png and /dev/null differ diff --git a/opsec/anonymity/old/16.png b/opsec/anonymity/old/16.png deleted file mode 100644 index e5a3970..0000000 Binary files a/opsec/anonymity/old/16.png and /dev/null differ diff --git a/opsec/anonymity/old/17.png b/opsec/anonymity/old/17.png deleted file mode 100644 index 45b3b4c..0000000 Binary files a/opsec/anonymity/old/17.png and /dev/null differ diff --git a/opsec/anonymity/old/18.png b/opsec/anonymity/old/18.png deleted file mode 100644 index 4016034..0000000 Binary files a/opsec/anonymity/old/18.png and /dev/null differ diff --git a/opsec/anonymity/old/19.png b/opsec/anonymity/old/19.png deleted file mode 100644 index 91cedf2..0000000 Binary files a/opsec/anonymity/old/19.png and /dev/null differ diff --git a/opsec/anonymity/old/20.png b/opsec/anonymity/old/20.png deleted file mode 100644 index d411970..0000000 Binary files a/opsec/anonymity/old/20.png and /dev/null differ diff --git a/opsec/anonymity/old/21.png b/opsec/anonymity/old/21.png deleted file mode 100644 index dac75ea..0000000 Binary files a/opsec/anonymity/old/21.png and /dev/null differ diff --git a/opsec/anonymity/old/22.png b/opsec/anonymity/old/22.png deleted file mode 100644 index 866ad5a..0000000 Binary files a/opsec/anonymity/old/22.png and /dev/null differ diff --git a/opsec/anonymity/old/23.png b/opsec/anonymity/old/23.png deleted file mode 100644 index b350210..0000000 Binary files a/opsec/anonymity/old/23.png and /dev/null differ diff --git a/opsec/anonymity/old/24.png b/opsec/anonymity/old/24.png deleted file mode 100644 index a03884a..0000000 Binary files a/opsec/anonymity/old/24.png and /dev/null differ diff --git a/opsec/anonymity/old/25.png b/opsec/anonymity/old/25.png deleted file mode 100644 index c5bba9b..0000000 Binary files a/opsec/anonymity/old/25.png and /dev/null differ diff --git a/opsec/anonymity/old/26.png b/opsec/anonymity/old/26.png deleted file mode 100644 index f49616e..0000000 Binary files a/opsec/anonymity/old/26.png and /dev/null differ diff --git a/opsec/anonymity/old/27.png b/opsec/anonymity/old/27.png deleted file mode 100644 index ba6a8f5..0000000 Binary files a/opsec/anonymity/old/27.png and /dev/null differ diff --git a/opsec/anonymity/old/28.png b/opsec/anonymity/old/28.png deleted file mode 100644 index a7020d9..0000000 Binary files a/opsec/anonymity/old/28.png and /dev/null differ diff --git a/opsec/anonymity/old/29.png b/opsec/anonymity/old/29.png deleted file mode 100644 index 007363b..0000000 Binary files a/opsec/anonymity/old/29.png and /dev/null differ diff --git a/opsec/anonymity/old/3.png b/opsec/anonymity/old/3.png deleted file mode 100644 index ebbeae8..0000000 Binary files a/opsec/anonymity/old/3.png and /dev/null differ diff --git a/opsec/anonymity/old/30.png b/opsec/anonymity/old/30.png deleted file mode 100644 index ce3c2e5..0000000 Binary files a/opsec/anonymity/old/30.png and /dev/null differ diff --git a/opsec/anonymity/old/31.png b/opsec/anonymity/old/31.png deleted file mode 100644 index 608430b..0000000 Binary files a/opsec/anonymity/old/31.png and /dev/null differ diff --git a/opsec/anonymity/old/32.png b/opsec/anonymity/old/32.png deleted file mode 100644 index 14b03c4..0000000 Binary files a/opsec/anonymity/old/32.png and /dev/null differ diff --git a/opsec/anonymity/old/33.png b/opsec/anonymity/old/33.png deleted file mode 100644 index 350cd59..0000000 Binary files a/opsec/anonymity/old/33.png and /dev/null differ diff --git a/opsec/anonymity/old/34.png b/opsec/anonymity/old/34.png deleted file mode 100644 index 3e604c4..0000000 Binary files a/opsec/anonymity/old/34.png and /dev/null differ diff --git a/opsec/anonymity/old/35.png b/opsec/anonymity/old/35.png deleted file mode 100644 index 9c41364..0000000 Binary files a/opsec/anonymity/old/35.png and /dev/null differ diff --git a/opsec/anonymity/old/36.png b/opsec/anonymity/old/36.png deleted file mode 100644 index b02e830..0000000 Binary files a/opsec/anonymity/old/36.png and /dev/null differ diff --git a/opsec/anonymity/old/37.png b/opsec/anonymity/old/37.png deleted file mode 100644 index 0f9c045..0000000 Binary files a/opsec/anonymity/old/37.png and /dev/null differ diff --git a/opsec/anonymity/old/38.png b/opsec/anonymity/old/38.png deleted file mode 100644 index 946b210..0000000 Binary files a/opsec/anonymity/old/38.png and /dev/null differ diff --git a/opsec/anonymity/old/39.png b/opsec/anonymity/old/39.png deleted file mode 100644 index dc0972b..0000000 Binary files a/opsec/anonymity/old/39.png and /dev/null differ diff --git a/opsec/anonymity/old/4.png b/opsec/anonymity/old/4.png deleted file mode 100644 index 5953921..0000000 Binary files a/opsec/anonymity/old/4.png and /dev/null differ diff --git a/opsec/anonymity/old/40.png b/opsec/anonymity/old/40.png deleted file mode 100644 index d00dcef..0000000 Binary files a/opsec/anonymity/old/40.png and /dev/null differ diff --git a/opsec/anonymity/old/41.png b/opsec/anonymity/old/41.png deleted file mode 100644 index 5340a17..0000000 Binary files a/opsec/anonymity/old/41.png and /dev/null differ diff --git a/opsec/anonymity/old/42.png b/opsec/anonymity/old/42.png deleted file mode 100644 index ad84fd8..0000000 Binary files a/opsec/anonymity/old/42.png and /dev/null differ diff --git a/opsec/anonymity/old/43.png b/opsec/anonymity/old/43.png deleted file mode 100644 index bc28fb6..0000000 Binary files a/opsec/anonymity/old/43.png and /dev/null differ diff --git a/opsec/anonymity/old/44.png b/opsec/anonymity/old/44.png deleted file mode 100644 index 8b5fade..0000000 Binary files a/opsec/anonymity/old/44.png and /dev/null differ diff --git a/opsec/anonymity/old/45.png b/opsec/anonymity/old/45.png deleted file mode 100644 index 05d2d5c..0000000 Binary files a/opsec/anonymity/old/45.png and /dev/null differ diff --git a/opsec/anonymity/old/46.png b/opsec/anonymity/old/46.png deleted file mode 100644 index bec0028..0000000 Binary files a/opsec/anonymity/old/46.png and /dev/null differ diff --git a/opsec/anonymity/old/47.png b/opsec/anonymity/old/47.png deleted file mode 100644 index 07e2756..0000000 Binary files a/opsec/anonymity/old/47.png and /dev/null differ diff --git a/opsec/anonymity/old/48.png b/opsec/anonymity/old/48.png deleted file mode 100644 index 5b913f9..0000000 Binary files a/opsec/anonymity/old/48.png and /dev/null differ diff --git a/opsec/anonymity/old/49.png b/opsec/anonymity/old/49.png deleted file mode 100644 index a603176..0000000 Binary files a/opsec/anonymity/old/49.png and /dev/null differ diff --git a/opsec/anonymity/old/5.png b/opsec/anonymity/old/5.png deleted file mode 100644 index 50447f1..0000000 Binary files a/opsec/anonymity/old/5.png and /dev/null differ diff --git a/opsec/anonymity/old/50.png b/opsec/anonymity/old/50.png deleted file mode 100644 index ed8bb23..0000000 Binary files a/opsec/anonymity/old/50.png and /dev/null differ diff --git a/opsec/anonymity/old/51.png b/opsec/anonymity/old/51.png deleted file mode 100644 index a3ccf35..0000000 Binary files a/opsec/anonymity/old/51.png and /dev/null differ diff --git a/opsec/anonymity/old/52.png b/opsec/anonymity/old/52.png deleted file mode 100644 index 1b44848..0000000 Binary files a/opsec/anonymity/old/52.png and /dev/null differ diff --git a/opsec/anonymity/old/53.png b/opsec/anonymity/old/53.png deleted file mode 100644 index 9b3988b..0000000 Binary files a/opsec/anonymity/old/53.png and /dev/null differ diff --git a/opsec/anonymity/old/54.png b/opsec/anonymity/old/54.png deleted file mode 100644 index 5be8a52..0000000 Binary files a/opsec/anonymity/old/54.png and /dev/null differ diff --git a/opsec/anonymity/old/55.png b/opsec/anonymity/old/55.png deleted file mode 100644 index ac98c7d..0000000 Binary files a/opsec/anonymity/old/55.png and /dev/null differ diff --git a/opsec/anonymity/old/56.png b/opsec/anonymity/old/56.png deleted file mode 100644 index c5b6740..0000000 Binary files a/opsec/anonymity/old/56.png and /dev/null differ diff --git a/opsec/anonymity/old/57.png b/opsec/anonymity/old/57.png deleted file mode 100644 index 3969f97..0000000 Binary files a/opsec/anonymity/old/57.png and /dev/null differ diff --git a/opsec/anonymity/old/6.png b/opsec/anonymity/old/6.png deleted file mode 100644 index ffb449e..0000000 Binary files a/opsec/anonymity/old/6.png and /dev/null differ diff --git a/opsec/anonymity/old/7.png b/opsec/anonymity/old/7.png deleted file mode 100644 index 8e4c87f..0000000 Binary files a/opsec/anonymity/old/7.png and /dev/null differ diff --git a/opsec/anonymity/old/8.png b/opsec/anonymity/old/8.png deleted file mode 100644 index 70927c7..0000000 Binary files a/opsec/anonymity/old/8.png and /dev/null differ diff --git a/opsec/anonymity/old/9.png b/opsec/anonymity/old/9.png deleted file mode 100644 index 42fa57e..0000000 Binary files a/opsec/anonymity/old/9.png and /dev/null differ diff --git a/opsec/index.html b/opsec/index.html index 53234f4..083c793 100644 --- a/opsec/index.html +++ b/opsec/index.html @@ -174,7 +174,7 @@
  • ✅ How to use the Tor Browser on Mobile
  • ✅ Tails OS QEMU VM for Temporary Anonymity
  • ✅ VMs for Long-term Anonymity (Whonix QEMU VMs)
    • -
  • ❌ How to Anonymously access websites that block Tor
    • +
  • ✅ How to Anonymously access websites that block Tor
  • ✅ Easy Anonymous Chats - SimpleX

    • diff --git a/opsec/whentorisblocked/0.png b/opsec/whentorisblocked/0.png new file mode 100644 index 0000000..365dcea Binary files /dev/null and b/opsec/whentorisblocked/0.png differ diff --git a/opsec/anonymity/1.png b/opsec/whentorisblocked/1.png similarity index 100% rename from opsec/anonymity/1.png rename to opsec/whentorisblocked/1.png diff --git a/opsec/anonymity/10.png b/opsec/whentorisblocked/10.png similarity index 100% rename from opsec/anonymity/10.png rename to opsec/whentorisblocked/10.png diff --git a/opsec/anonymity/100.png b/opsec/whentorisblocked/100.png similarity index 100% rename from opsec/anonymity/100.png rename to opsec/whentorisblocked/100.png diff --git a/opsec/anonymity/101.png b/opsec/whentorisblocked/101.png similarity index 100% rename from opsec/anonymity/101.png rename to opsec/whentorisblocked/101.png diff --git a/opsec/anonymity/102.png b/opsec/whentorisblocked/102.png similarity index 100% rename from opsec/anonymity/102.png rename to opsec/whentorisblocked/102.png diff --git a/opsec/anonymity/103.png b/opsec/whentorisblocked/103.png similarity index 100% rename from opsec/anonymity/103.png rename to opsec/whentorisblocked/103.png diff --git a/opsec/anonymity/104.png b/opsec/whentorisblocked/104.png similarity index 100% rename from opsec/anonymity/104.png rename to opsec/whentorisblocked/104.png diff --git a/opsec/anonymity/105.png b/opsec/whentorisblocked/105.png similarity index 100% rename from opsec/anonymity/105.png rename to opsec/whentorisblocked/105.png diff --git a/opsec/anonymity/106.png b/opsec/whentorisblocked/106.png similarity index 100% rename from opsec/anonymity/106.png rename to opsec/whentorisblocked/106.png diff --git a/opsec/anonymity/11.png b/opsec/whentorisblocked/11.png similarity index 100% rename from opsec/anonymity/11.png rename to opsec/whentorisblocked/11.png diff --git a/opsec/anonymity/12.png b/opsec/whentorisblocked/12.png similarity index 100% rename from opsec/anonymity/12.png rename to opsec/whentorisblocked/12.png diff --git a/opsec/anonymity/13.png b/opsec/whentorisblocked/13.png similarity index 100% rename from opsec/anonymity/13.png rename to opsec/whentorisblocked/13.png diff --git a/opsec/anonymity/14.png b/opsec/whentorisblocked/14.png similarity index 100% rename from opsec/anonymity/14.png rename to opsec/whentorisblocked/14.png diff --git a/opsec/anonymity/15.png b/opsec/whentorisblocked/15.png similarity index 100% rename from opsec/anonymity/15.png rename to opsec/whentorisblocked/15.png diff --git a/opsec/anonymity/2.png b/opsec/whentorisblocked/2.png similarity index 100% rename from opsec/anonymity/2.png rename to opsec/whentorisblocked/2.png diff --git a/opsec/anonymity/20.png b/opsec/whentorisblocked/20.png similarity index 100% rename from opsec/anonymity/20.png rename to opsec/whentorisblocked/20.png diff --git a/opsec/anonymity/200.png b/opsec/whentorisblocked/200.png similarity index 100% rename from opsec/anonymity/200.png rename to opsec/whentorisblocked/200.png diff --git a/opsec/anonymity/3.png b/opsec/whentorisblocked/3.png similarity index 100% rename from opsec/anonymity/3.png rename to opsec/whentorisblocked/3.png diff --git a/opsec/anonymity/30.png b/opsec/whentorisblocked/30.png similarity index 100% rename from opsec/anonymity/30.png rename to opsec/whentorisblocked/30.png diff --git a/opsec/whentorisblocked/300.png b/opsec/whentorisblocked/300.png new file mode 100644 index 0000000..63e6d59 Binary files /dev/null and b/opsec/whentorisblocked/300.png differ diff --git a/opsec/anonymity/4.png b/opsec/whentorisblocked/4.png similarity index 100% rename from opsec/anonymity/4.png rename to opsec/whentorisblocked/4.png diff --git a/opsec/anonymity/40.png b/opsec/whentorisblocked/40.png similarity index 100% rename from opsec/anonymity/40.png rename to opsec/whentorisblocked/40.png diff --git a/opsec/anonymity/46.png b/opsec/whentorisblocked/46.png similarity index 100% rename from opsec/anonymity/46.png rename to opsec/whentorisblocked/46.png diff --git a/opsec/anonymity/47.png b/opsec/whentorisblocked/47.png similarity index 100% rename from opsec/anonymity/47.png rename to opsec/whentorisblocked/47.png diff --git a/opsec/anonymity/48.png b/opsec/whentorisblocked/48.png similarity index 100% rename from opsec/anonymity/48.png rename to opsec/whentorisblocked/48.png diff --git a/opsec/anonymity/49.png b/opsec/whentorisblocked/49.png similarity index 100% rename from opsec/anonymity/49.png rename to opsec/whentorisblocked/49.png diff --git a/opsec/anonymity/5.png b/opsec/whentorisblocked/5.png similarity index 100% rename from opsec/anonymity/5.png rename to opsec/whentorisblocked/5.png diff --git a/opsec/anonymity/50.png b/opsec/whentorisblocked/50.png similarity index 100% rename from opsec/anonymity/50.png rename to opsec/whentorisblocked/50.png diff --git a/opsec/anonymity/51.png b/opsec/whentorisblocked/51.png similarity index 100% rename from opsec/anonymity/51.png rename to opsec/whentorisblocked/51.png diff --git a/opsec/anonymity/52.png b/opsec/whentorisblocked/52.png similarity index 100% rename from opsec/anonymity/52.png rename to opsec/whentorisblocked/52.png diff --git a/opsec/anonymity/53.png b/opsec/whentorisblocked/53.png similarity index 100% rename from opsec/anonymity/53.png rename to opsec/whentorisblocked/53.png diff --git a/opsec/anonymity/54.png b/opsec/whentorisblocked/54.png similarity index 100% rename from opsec/anonymity/54.png rename to opsec/whentorisblocked/54.png diff --git a/opsec/anonymity/55.png b/opsec/whentorisblocked/55.png similarity index 100% rename from opsec/anonymity/55.png rename to opsec/whentorisblocked/55.png diff --git a/opsec/anonymity/56.png b/opsec/whentorisblocked/56.png similarity index 100% rename from opsec/anonymity/56.png rename to opsec/whentorisblocked/56.png diff --git a/opsec/anonymity/57.png b/opsec/whentorisblocked/57.png similarity index 100% rename from opsec/anonymity/57.png rename to opsec/whentorisblocked/57.png diff --git a/opsec/anonymity/58.png b/opsec/whentorisblocked/58.png similarity index 100% rename from opsec/anonymity/58.png rename to opsec/whentorisblocked/58.png diff --git a/opsec/anonymity/59.png b/opsec/whentorisblocked/59.png similarity index 100% rename from opsec/anonymity/59.png rename to opsec/whentorisblocked/59.png diff --git a/opsec/anonymity/6.png b/opsec/whentorisblocked/6.png similarity index 100% rename from opsec/anonymity/6.png rename to opsec/whentorisblocked/6.png diff --git a/opsec/anonymity/60.png b/opsec/whentorisblocked/60.png similarity index 100% rename from opsec/anonymity/60.png rename to opsec/whentorisblocked/60.png diff --git a/opsec/anonymity/61.png b/opsec/whentorisblocked/61.png similarity index 100% rename from opsec/anonymity/61.png rename to opsec/whentorisblocked/61.png diff --git a/opsec/anonymity/62.png b/opsec/whentorisblocked/62.png similarity index 100% rename from opsec/anonymity/62.png rename to opsec/whentorisblocked/62.png diff --git a/opsec/anonymity/63.png b/opsec/whentorisblocked/63.png similarity index 100% rename from opsec/anonymity/63.png rename to opsec/whentorisblocked/63.png diff --git a/opsec/anonymity/64.png b/opsec/whentorisblocked/64.png similarity index 100% rename from opsec/anonymity/64.png rename to opsec/whentorisblocked/64.png diff --git a/opsec/anonymity/65.png b/opsec/whentorisblocked/65.png similarity index 100% rename from opsec/anonymity/65.png rename to opsec/whentorisblocked/65.png diff --git a/opsec/anonymity/66.png b/opsec/whentorisblocked/66.png similarity index 100% rename from opsec/anonymity/66.png rename to opsec/whentorisblocked/66.png diff --git a/opsec/anonymity/67.png b/opsec/whentorisblocked/67.png similarity index 100% rename from opsec/anonymity/67.png rename to opsec/whentorisblocked/67.png diff --git a/opsec/anonymity/68.png b/opsec/whentorisblocked/68.png similarity index 100% rename from opsec/anonymity/68.png rename to opsec/whentorisblocked/68.png diff --git a/opsec/anonymity/69.png b/opsec/whentorisblocked/69.png similarity index 100% rename from opsec/anonymity/69.png rename to opsec/whentorisblocked/69.png diff --git a/opsec/anonymity/7.png b/opsec/whentorisblocked/7.png similarity index 100% rename from opsec/anonymity/7.png rename to opsec/whentorisblocked/7.png diff --git a/opsec/anonymity/70.png b/opsec/whentorisblocked/70.png similarity index 100% rename from opsec/anonymity/70.png rename to opsec/whentorisblocked/70.png diff --git a/opsec/anonymity/71.png b/opsec/whentorisblocked/71.png similarity index 100% rename from opsec/anonymity/71.png rename to opsec/whentorisblocked/71.png diff --git a/opsec/anonymity/72.png b/opsec/whentorisblocked/72.png similarity index 100% rename from opsec/anonymity/72.png rename to opsec/whentorisblocked/72.png diff --git a/opsec/anonymity/73.png b/opsec/whentorisblocked/73.png similarity index 100% rename from opsec/anonymity/73.png rename to opsec/whentorisblocked/73.png diff --git a/opsec/anonymity/8.png b/opsec/whentorisblocked/8.png similarity index 100% rename from opsec/anonymity/8.png rename to opsec/whentorisblocked/8.png diff --git a/opsec/anonymity/9.png b/opsec/whentorisblocked/9.png similarity index 100% rename from opsec/anonymity/9.png rename to opsec/whentorisblocked/9.png diff --git a/opsec/whentorisblocked/index.html b/opsec/whentorisblocked/index.html new file mode 100644 index 0000000..851f5c4 --- /dev/null +++ b/opsec/whentorisblocked/index.html @@ -0,0 +1,561 @@ + + + + + + + + + + + How to Anonymously access websites that block Tor + + + + + + + + + + + + + + + + + + + +
    +
    +
    + + The Nihilism Blog +
    +
    + +
    + +
    +
    + + + +
    +
    +
    +
    + Previous Page

    nothing@nowhere - 2023-10-12

    +

    How to Anonymously access websites that block Tor

    +

    In this tutorial we're going to cover how we can circumvent a website's attempts at blocking Tor traffic, by using a VPN. As we discussed previously, this is relating to the serverside context required to know if we should combine the use of Tor with the use of a VPN.

    + + + +

    Here we are using a VPN to hide from the website owner that we are connecting via Tor. Effectively giving off the impression that we are only connecting via a VPN, while in reality Tor is protecting our Anonymity on the IP level. Now we also need to preserve our Anonymity when we are renting and using the VPN, that's why we have to use MullvadVPN as they don't care who's using their service (they allow both Tor connections and Monero payments). We are also blending in their large userbase. (which would not be the case if we were using a VPS with openvpn on it, in which we would be the only one to use it).

    + +

    DISCLAIMER: Be aware that when doing a (you -> Tor -> VPN -> website) setup, you are getting rid of the stream isolation that is there by default in Whonix, making every application in that Whonix VM go through one circuit, rather than through many circuits. Over time this can lead to traffic use correlation if you start to use this VM for every other Anonymous use.

    + +

    So keep in mind that a website blocking Tor traffic is the only scenario in which you need a (you -> Tor -> VPN -> website) setup. the rest of your anonymous activities are to remain in a regular Whonix VM (you -> Tor -> website) setup !

    +
    +
    +
    +
    + + +
    +
    +
    +
    +

    Setting up the VM second Whonix Workstation VM

    +

    Now the first thing to do here is that we copy the existing the second workstation which will be used as the vpn over tor setup later on so let's copy the .xml and .qcow2 after shutting down the existing workstation:

    +

    Be careful that you need 100Gb for the Whonix Gateway, 100Gb for the Whonix Workstation, and another 100Gb for the Whonix Workstation with the VPN setup we want to make. So you need a total of 300Gb disk space at least!

    +
    
+[ nowhere ] [ /dev/pts/0 ] [/mnt/veracrypt1]
+→ ls
+lost+found     WHONIX_BINARY_LICENSE_AGREEMENT  Whonix-Gateway.qcow2  Whonix-Workstation.qcow2
+refreshvms.sh  WHONIX_DISCLAIMER                Whonix-Gateway.xml    Whonix-Workstation.xml
+script.sh      Whonix-external.xml              Whonix-internal.xml
+
+[ nowhere ] [ /dev/pts/0 ] [/mnt/veracrypt1]
+→ cp Whonix-Workstation.qcow2 Whonix-Workstation-vpn.qcow2
+
+ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ cp Whonix-Workstation.xml Whonix-Workstation-vpn.xml
+
+[ nowhere ] [ /dev/pts/0 ] [/mnt/veracrypt1]
+→ cp Whonix-Workstation.xml Whonix-Workstation-vpn.xml
+
+
    +

    Then edit the new xml file to match the new VM name:

    +
    
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ vim Whonix-Workstation-vpn.xml
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ cat Whonix-Workstation-vpn.xml | grep Workstation2
+  <name>Whonix-Workstation-vpn</name>
+      <source file='/mnt//mnt/veracrypt1/Whonix-Workstation-vpn.qcow2'/>
+	
+
    +

    Then we include it in the script.sh script:

    +
    
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ cat script.sh
+
+#!/bin/bash
+
+if [ $(virsh -c qemu:///system list --all | grep Whonix | wc -l) -ne 0 ];
+then
+
+	# if the VMs are imported, remove them:
+
+	virsh -c qemu:///system destroy Whonix-Gateway
+	virsh -c qemu:///system destroy Whonix-Workstation
+	virsh -c qemu:///system destroy Whonix-Workstation-vpn
+	virsh -c qemu:///system undefine Whonix-Gateway
+	virsh -c qemu:///system undefine Whonix-Workstation
+	virsh -c qemu:///system undefine Whonix-Workstation-vpn
+	virsh -c qemu:///system net-destroy Whonix-External
+	virsh -c qemu:///system net-destroy Whonix-Internal
+	virsh -c qemu:///system net-undefine Whonix-External
+	virsh -c qemu:///system net-undefine Whonix-Internal
+else
+
+
+	# if the VMs are not imported, import them:
+
+	virsh -c qemu:///system net-define /mnt/veracrypt1/Whonix-external.xml
+	virsh -c qemu:///system net-define /mnt/veracrypt1/Whonix-internal.xml
+	virsh -c qemu:///system net-autostart Whonix-External
+	virsh -c qemu:///system net-start Whonix-External
+	virsh -c qemu:///system net-autostart Whonix-Internal
+	virsh -c qemu:///system net-start Whonix-Internal
+	virsh -c qemu:///system define /mnt/veracrypt1/Whonix-Gateway.xml
+	virsh -c qemu:///system define /mnt/veracrypt1/Whonix-Workstation.xml
+	virsh -c qemu:///system define /mnt/veracrypt1/Whonix-Workstation-vpn.xml
+	# then exit because we dont want to run the rest of wipe.sh
+	exit $? 
+fi
+
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ ./script.sh
+
+Network Whonix-External defined from Whonix-external.xml
+
+Network Whonix-Internal defined from Whonix-internal.xml
+
+Network Whonix-External marked as autostarted
+
+Network Whonix-External started
+
+Network Whonix-Internal marked as autostarted
+
+Network Whonix-Internal started
+
+Domain 'Whonix-Gateway' defined from Whonix-Gateway.xml
+
+Domain 'Whonix-Workstation-vpn' defined from Whonix-Workstation-vpn.xml
+
+Domain 'Whonix-Workstation' defined from Whonix-Workstation.xml
+
+
    +

    Then edit the new workstation VM to have the 10.152.152.12 ip by default (since the other one has the 10.152.152.11 ip):

    + + +

    Now that our VM templates are done, let's put them on our veracrypt harddrive:

    +
    
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ ./script.sh
+[sudo] password for nothing:
+Domain 'Whonix-Gateway' destroyed
+
+Domain 'Whonix-Workstation' destroyed
+
+Domain 'Whonix-Workstation-vpn' destroyed
+
+Domain 'Whonix-Gateway' has been undefined
+
+Domain 'Whonix-Workstation' has been undefined
+
+Domain 'Whonix-Workstation-vpn' has been undefined
+
+Network Whonix-External destroyed
+
+Network Whonix-Internal destroyed
+
+Network Whonix-External has been undefined
+
+Network Whonix-Internal has been undefined
+
+[+] VMs removed, re-install them ? (ctrl+c to exit)
+^C
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ ls
+script.sh                             Whonix-Gateway.qcow2       Whonix-Workstation.qcow2
+WHONIX_BINARY_LICENSE_AGREEMENT           Whonix-Gateway.xml                     Whonix-Workstation.xml
+WHONIX_BINARY_LICENSE_AGREEMENT_accepted  Whonix-internal.xml                 Whonix-Xfce-17.2.3.7.qcow2.libvirt.xz
+WHONIX_DISCLAIMER                         Whonix-Workstation-vpn.qcow2
+Whonix-external.xml      Whonix-Workstation-vpn.xml
+	
+
    + + +

    Once mounted, let's copy them here and launch them:

    +
    
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ cd /mnt/veracrypt1
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ cp /mnt//mnt/veracrypt1/* .
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ ls -lash
+total 21G
+4.0K drwxr-xr-x 2 nothing nothing 4.0K Oct  8 13:35 .
+4.0K drwxr-xr-x 3 root    root    4.0K Oct  8 13:34 ..
+4.0K -rwxr-xr-x 1 nothing nothing 1.2K Oct  8 13:35 script.sh
+ 40K -rw-r--r-- 1 nothing nothing  39K Oct  8 13:35 WHONIX_BINARY_LICENSE_AGREEMENT
+   0 -rw-r--r-- 1 nothing nothing    0 Oct  8 13:35 WHONIX_BINARY_LICENSE_AGREEMENT_accepted
+8.0K -rw-r--r-- 1 nothing nothing 4.1K Oct  8 13:35 WHONIX_DISCLAIMER
+4.0K -rw-r--r-- 1 nothing nothing  172 Oct  8 13:35 Whonix-external.xml
+5.2G -rw-r--r-- 1 nothing nothing 101G Oct  8 13:35 Whonix-Gateway.qcow2
+4.0K -rw-r--r-- 1 nothing nothing 2.4K Oct  8 13:35 Whonix-Gateway.xml
+4.0K -rw-r--r-- 1 nothing nothing   97 Oct  8 13:35 Whonix-internal.xml
+6.9G -rw-r--r-- 1 nothing nothing 101G Oct  8 13:35 Whonix-Workstation-vpn.qcow2
+4.0K -rw-r--r-- 1 nothing nothing 2.3K Oct  8 13:35 Whonix-Workstation-vpn.xml
+7.0G -rw-r--r-- 1 nothing nothing 101G Oct  8 13:35 Whonix-Workstation.qcow2
+4.0K -rw-r--r-- 1 nothing nothing 2.3K Oct  8 13:35 Whonix-Workstation.xml
+1.3G -rw-r--r-- 1 nothing nothing 1.3G Oct  8 13:35 Whonix-Xfce-17.2.3.7.qcow2.libvirt.xz
+
+
    +

    Now that's done, you need to edit each XML to make sure it has the correct path in it:

    +
    
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ vim Whonix-Gateway.xml
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ vim Whonix-Workstation-vpn.xml
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ vim Whonix-Workstation.xml
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ cat Whonix-Gateway.xml| grep source
+      <source file='/mnt/veracrypt1/Whonix-Gateway.qcow2'/>
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ cat Whonix-Workstation-vpn.xml | grep source
+      <source file='/mnt/veracrypt1/whonix/Whonix-Workstation-vpn.qcow2'/>
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ cat Whonix-Workstation.xml | grep source
+      <source file='/mnt/veracrypt1/whonix/Whonix-Workstation.qcow2'/>
+	
+
    +

    Then you can use the VMs using the script.sh script:

    +
    
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ ./script.sh
+[sudo] password for nothing:
+error: failed to get domain 'Whonix-Gateway'
+
+error: failed to get domain 'Whonix-Workstation'
+
+error: failed to get domain 'Whonix-Workstation-vpn'
+
+error: failed to get domain 'Whonix-Gateway'
+
+error: failed to get domain 'Whonix-Workstation'
+
+error: failed to get domain 'Whonix-Workstation-vpn'
+
+error: failed to get network 'Whonix-External'
+error: Network not found: no network with matching name 'Whonix-External'
+
+error: failed to get network 'Whonix-Internal'
+error: Network not found: no network with matching name 'Whonix-Internal'
+
+error: failed to get network 'Whonix-External'
+error: Network not found: no network with matching name 'Whonix-External'
+
+error: failed to get network 'Whonix-Internal'
+error: Network not found: no network with matching name 'Whonix-Internal'
+
+[+] VMs removed, re-install them ? (ctrl+c to exit)
+
+
+Network Whonix-External defined from Whonix-external.xml
+
+Network Whonix-Internal defined from Whonix-internal.xml
+
+Network Whonix-External marked as autostarted
+
+Network Whonix-External started
+
+Network Whonix-Internal marked as autostarted
+
+Network Whonix-Internal started
+
+Domain 'Whonix-Gateway' defined from Whonix-Gateway.xml
+
+Domain 'Whonix-Workstation-vpn' defined from Whonix-Workstation-vpn.xml
+
+Domain 'Whonix-Workstation' defined from Whonix-Workstation.xml
+	
+
    +

    Now with this if you are forced to give away the password for that harddrive, you can give them this decoy partition, and they'll find the whonix VMs you've copied there.

    +

    So now dismount the veracrypt partition, to do that you need to first remove the VMs with the script, and then you need to EXIT the folder, otherwise it'll complain and tell you that the target drive is busy and can't be unmounted:

    +
    
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ ./script.sh
+error: Failed to destroy domain 'Whonix-Gateway'
+error: Requested operation is not valid: domain is not running
+
+error: Failed to destroy domain 'Whonix-Workstation'
+error: Requested operation is not valid: domain is not running
+
+error: Failed to destroy domain 'Whonix-Workstation-vpn'
+error: Requested operation is not valid: domain is not running
+
+Domain 'Whonix-Gateway' has been undefined
+
+Domain 'Whonix-Workstation' has been undefined
+
+Domain 'Whonix-Workstation-vpn' has been undefined
+
+Network Whonix-External destroyed
+
+Network Whonix-Internal destroyed
+
+Network Whonix-External has been undefined
+
+Network Whonix-Internal has been undefined
+
+[+] VMs removed, re-install them ? (ctrl+c to exit)
+^C
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ cd ..
+
+[ nowhere ] [ /dev/pts/23 ] [/media]
+→
+
    + +

    Now that's done for the decoy partition, we do the same for the hidden partition:

    + + +
    
+[ nowhere ] [ /dev/pts/23 ] [/media]
+→ cd veracrypt1
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ cp /mnt//mnt/veracrypt1/* .
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ ls
+script.sh                             Whonix-Gateway.qcow2       Whonix-Workstation.qcow2
+WHONIX_BINARY_LICENSE_AGREEMENT           Whonix-Gateway.xml                     Whonix-Workstation.xml
+WHONIX_BINARY_LICENSE_AGREEMENT_accepted  Whonix-internal.xml                 Whonix-Xfce-17.2.3.7.qcow2.libvirt.xz
+WHONIX_DISCLAIMER                         Whonix-Workstation-vpn.qcow2
+Whonix-external.xml      Whonix-Workstation-vpn.xml
+	
+
    +

    Then edit the paths again:

    +
    
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ vim Whonix-Gateway.xml
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ vim Whonix-Workstation-vpn.xml
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ vim Whonix-Workstation.xml
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ cat Whonix-Gateway.xml| grep source
+      <source file='/mnt/veracrypt1/Whonix-Gateway.qcow2'/>
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ cat Whonix-Workstation-vpn.xml | grep source
+      <source file='/mnt/veracrypt1/whonix/Whonix-Workstation-vpn.qcow2'/>
+
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ cat Whonix-Workstation.xml | grep source
+      <source file='/mnt/veracrypt1/whonix/Whonix-Workstation.qcow2'/>
+	
+
    +

    Then start the VMs:

    +
    
+[ nowhere ] [ /dev/pts/23 ] [/mnt/veracrypt1]
+→ ./script.sh
+[sudo] password for nothing:
+error: failed to get domain 'Whonix-Gateway'
+
+error: failed to get domain 'Whonix-Workstation'
+
+error: failed to get domain 'Whonix-Workstation-vpn'
+
+error: failed to get domain 'Whonix-Gateway'
+
+error: failed to get domain 'Whonix-Workstation'
+
+error: failed to get domain 'Whonix-Workstation-vpn'
+
+error: failed to get network 'Whonix-External'
+error: Network not found: no network with matching name 'Whonix-External'
+
+error: failed to get network 'Whonix-Internal'
+error: Network not found: no network with matching name 'Whonix-Internal'
+
+error: failed to get network 'Whonix-External'
+error: Network not found: no network with matching name 'Whonix-External'
+
+error: failed to get network 'Whonix-Internal'
+error: Network not found: no network with matching name 'Whonix-Internal'
+
+[+] VMs removed, re-install them ? (ctrl+c to exit)
+
+Network Whonix-External defined from Whonix-external.xml
+
+Network Whonix-Internal defined from Whonix-internal.xml
+
+Network Whonix-External marked as autostarted
+
+Network Whonix-External started
+
+Network Whonix-Internal marked as autostarted
+
+Network Whonix-Internal started
+
+Domain 'Whonix-Gateway' defined from Whonix-Gateway.xml
+
+Domain 'Whonix-Workstation-vpn' defined from Whonix-Workstation-vpn.xml
+
+Domain 'Whonix-Workstation' defined from Whonix-Workstation.xml
+	
+
    +

    You need to keep in mind that currently we have not given out any information about ourselves, other than we've used Tor. We won't stop there, and in order to use a VPN anonymously, you need to acquire it through Tor, buy it with Monero, and force the VPN Connection itself through Tor. Cherry on top is that we're going to use a well-used VPN service, so we won't be the only user with that public VPN ip. But what matters is that we do not give any information about us to the VPN provider. If the VPN provider forces you to provide anything personal (if the vpn provider blocks tor connections, or forces you to buy it with something else than monero), then it would not truly be a non-KYC VPN provider, and thus it's against your privacy. That's the only way you can find out which ones are all just marketing.

    + +

    Now that's done we can go find a vpn provider for the workstation2, let's try out the very praised mullvad vpn provider here, Firstly because it's a non-KYC VPN provider (meaning you can acquire it and use it through Tor, and pay with Monero), also due to the fact that we won't be the only ones using that service, it means we won't need to change the VPN server when we want to have another identity online. On top of that, mullvad gives us the ability to connect to a random server of theirs, via openvpn via TCP on port 443, which is definitely neat because it mimicks web HTTPS traffic, and isn't blockable by tor exit node hosters (which is definitely a trend, most of them block ports that are suceptible to abuse, 443 https being the least likely of them):

    + + +

    now to not loose your accesses , make sure to save credentials in a local keepass database on the VM.

    + + + +

    Now let's add time to our account, and of course we will pay with the only cryptocurrency that's used:

    + + +

    To get some monero you can buy it on localmonero.co, and make sure it arrives on your monero wallet inside the whonix VM, never trust centralised exchanges with your assets, always keep them locally.

    + +

    Once it finishes installing, create your monero wallet:

    + +

    Then say no to mining and use an onion-based monero daemon, like the one i'm hosting, you can find a full list of other ones here:

    + +

    Wait for it to finish synchronizing, then get some monero from a vendor on localmonero.co (by giving them a wallet address you'd have created:

    + + +

    Once you've paid, download the .ovpn file to connect via vpn:

    + +

    Then unzip and let's now make sure the vpn goes through tor:

    + + +

    To do that we need to make sure the VPN goes through the local SOCKS port 9050, and to mention the entry node which is the gateway 10.152.152.10:

    + +

    before we launch it keep in mind this:

    + +

    Then launch the VPN and you can then see that you no longer have a tor exit node IP:

    + + +

    Now check your ip from Firefox, not the tor browser:

    + +

    You can also check if there are any DNS leaks:

    + +

    here we see the test revealed a dns ip leak, but upon checking (in shodan.io) we see that it's a tor exit IP address:

    + +

    We can also check if there are any WebRTC leaks:

    + +

    and there we see that there are no webRTC leaks either, so it's all good.

    +

    To make sure the vpn is started automatically we can make it a systemd service:

    +
    
+root@workstation:~# cat /etc/systemd/system/vpn.service
+[Unit]
+Description=VPN
+After=network-online.target
+Wants=network-online.target
+
+[Install]
+WantedBy=multi-user.target
+
+[Service]
+Type=simple
+WorkingDirectory=/home/user/Desktop/mullvad_config_linux_nl_ams/
+ExecStart=/usr/sbin/openvpn /home/user/Desktop/mullvad_config_linux_nl_ams/mullvad_nl_ams.conf
+ExecStop=kill -9 $(pidof openvpn)
+Restart=always
+
+root@workstation:~# systemctl daemon-reload ; systemctl enable --now vpn.service ; systemctl restart vpn.service
+
+
    + +

    Now thanks to that, you can still browse websites anonymously in case if they block tor exit nodes. However as stated above, make sure that you leave the rest of your Anonymous use in the regular Whonix VM, as there is no stream isolation in the Whonix-Workstation-VPN VM.

    +
    +
    +
    +
    + + +
    +
    +
    +
    +

    Nihilism

    +

    + Until there is Nothing left.



    Creative Commons Zero: No Rights Reserved
    + +

    +
    + +
    +

    My Links

    +

    + + RSS Feed
    SimpleX Chat
    + +

    +
    + +
    +

    About nihilist

    +

    Donate XMR: 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8


    Contact: nihilist@contact.nowhere.moe (PGP)

    +
    + +
    + +
    +
    + + + + + + +