ra`s fnord » Linux http://ra.fnord.at blog Thu, 20 Sep 2012 12:06:12 +0000 http://wordpress.org/?v=abc en hourly 1 Easy and secure anonymous internet usage http://ra.fnord.at/2011/05/easy-and-secure-anonymous-internet-usage/ http://ra.fnord.at/2011/05/easy-and-secure-anonymous-internet-usage/#comments Sun, 29 May 2011 15:42:31 +0000 ra http://ra.fnord.at/?p=247 As of June 2012 all updates regarding the (fast) gateway will be posted on github.



Short version:

An easy and secure way for anonymous internet usage:

  1. Install and start Virtualbox (at least version 4).
  2. Download two VM images: Tor gateway and Tor workstation
  3. Import the images (in Virtualbox File->Import Appliance)

To start using the internet anonymously you just have to start both VMs Tor gateway VM and Tor workstation VM. As soon as they they finished booting, you can use the anonymous internet access through the Tor workstation. If you want to stop using the internet anonymously, just power down both VMs.

Long version:

The goal of this article is to provide a solution to use the internet anonymously in an easy and secure way. Anonymous as in no one but you must be able to tell that you are communication with a certain receiver (like browsing a website: No one must know that you are surfing that certain website). A way to use the internet anonymously is to use an internet connection that can not be tracked down to your person and a computer that has no information stored about you. Which means quite an effort every single time you want to use the internet anonymously. For an internet connection that can not be tracked down to your person, software like Tor has been developed to accomplish this also over a non-anonymous internet connection. Checking if the computer has no information stored about you, can not be handled by the Tor software and must be handled by the user! Currently there is one major problem if you want to use the internet anonymously: You really do have to understand the functioning of computer networks and the Tor software to a degree that is far away from being trivial – otherwise you might probably use the software in an insecure way. Let me give you some examples:

  1. Install the Tor client to your Operating System and configure your browser to use the local TOR client through SOCKS-proxy functionality of Tor (or use extensions like Torbutton for Firefox to do that for you). While this is quite easy to accomplish, it has a major security drawback: If you use your everyday browser it has a lot of information stored about you and your browsing history and behavior which it might leak. Even if you use some other browser, you must turn of all plugins like Java or Flash and disable Javascript (or use a proxy like Privoxy to do that for you) so they can not leak information like which sites you visited or in which network or city you are, … But this breaks lots of websites nowadays. While this approach might be easy it is usable for browsers only and far from being “secure”.
  2. If you use the tsocks/torify approach which allows non SOCKS aware applications (e.g telnet, ssh, ftp etc) to use SOCKS without any modification, you can use most applications. But they might still leak information about the local system themselves. Besides there is the risk of just forgetting to type the “torify” in front of the command that should be executed. Which is definitely not what one wants to happen. So this approach is neither “easy” nor “secure”.
  3. The VM approach I already wrote about in an article earlier, puts the software you are using on the internet into an virtual machine (VM) which reduces the risk to leak information about you and the information within the VM. The drawback is that you have to configure a redirection with a packet filter or firewall on your host system and that you have to set up and configure a VM to use as an anonymous workstation. So this approach is still far from being “easy”.

Which is why I want to discuss a new approach that is at least as secure as the last one above (#3) but additionally should be quite easy to use:

  1. Install and start Virtualbox (at least version 4).
  2. Download two VM images: Tor gateway and Tor workstation
  3. Import the images (in Virtualbox File->Import Appliance)

To start using the internet anonymously you just have to start both VMs Tor gateway VM and Tor workstation VM. As soon as they finished booting, you can use the anonymous internet access through the Tor workstation. If you want to stop using the internet anonymously, just power down both VMs. The task of routing traffic through the Tor network has been moved to the Tor gateway VM. So you do not have to modify your local system any more then installing Virtualbox and importing both VMs. You do have a preconfigured Tor workstation ready to use that boots within a minute and you can be sure to anonymously use the internet. The Tor gateway runs OpenWRT Linux using just about 8Mb of disk space and 32Mb of RAM. It boots in less then 3 seconds and transparently routes all traffic generated within the Tor gateway itself and every traffic coming on the virtual internal interface “tor” through the Tor network. You do not need to do anything but start when you want to use Tor and stop the VM when you finished. The Tor workstation runs Micro Core Linux using about 120Mb of disk space and 192Mb of RAM. It boots in less then a minute and has some browsers (Firefox, Chromium and Opera) and a terminal installed. It only stores information within a session. So if you shut it down and boot it again it does not have any information about the previous session. Of course you are not forced to use the Tor workstation. You can use any other VM (Linux, Windows, AmigaOS, just any TCP/IP capable Operating System). Just configure the network settings of the VM (in Virtualbox Settings->Network->Adapter attached to internal network “tor”). Please report, if you encounter any unwanted behavior or find any problems! Also do so if you have got any suggestions to improve the VMs or this approach as a whole. Side note: The content of the communication between you (Tor workstation VM) and any receiver (e.g. a website) is necessarily only encrypted within the Tor network. So if you open an unencrypted connection to any receiver the Tor exit node which in fact opens the connection to the receiver is able to see the content of the connection. So do not send any sensible information like passwords over unencrypted connections!

Information for developers

There is a git repository available for building the Tor gateway image from scratch. Feedback and patches are welcome.

Changelog

To use the fast gateway you need to change the internal network of workstation VM to “torfast”.

]]>
http://ra.fnord.at/2011/05/easy-and-secure-anonymous-internet-usage/feed/ 134
Routing unmodified Virtual Machines through the TOR network http://ra.fnord.at/2010/02/routing-unmodified-virtual-machines-through-the-tor-network/ http://ra.fnord.at/2010/02/routing-unmodified-virtual-machines-through-the-tor-network/#comments Wed, 03 Feb 2010 16:43:13 +0000 ra http://ra.fnord.at/?p=205 So far I had three different TOR setups:

  • A browser (Firefox) using a local HTTP proxy (Privoxy) which uses a local TOR client through SOCKS.
  • tsocks/torify to make non-SOCKS-aware-applications work through TOR.
  • A virtual machine (VM) where some applications are configured to use the local HTTP proxy and/or TOR client.

Each of these setups has different disadvantages and neither fits my requirements:

  • In the browser approach I had to turn off all plugins (Java, Flash, ..) and Javascript so they can not leak information about the local system. Unfortunately this breaks many websites nowadays.
  • The tsocks/torify approach works for most applications but they may leak information about the local system themselves. Anyway there is a small risk of just forgetting to type the “torify” in front of the command I want to execute which I really do not want to happen.
  • The VM approach is like putting the two previous approaches into a VM. So the risk of leaking local information is reduced to the VM. Anyway I have to make applications running within the VM explicitely use the TOR network. Besides I want to take care that no other traffic but TOR is going out of the VM which means I have to set up a packet filter on the host.

One solution might be to transparently route a VM through the TOR network so that a VM does not need to be modified in any way. It is quite simple and should work on all OS although I just tried it on a Linux host. As already said, the VM can run any OS!

The host must to redirect all TCP packets to a transparent SOCKS proxy which itself forwards the packets to a TOR client. UDP packets with destination port 53 are redirected to a small script which puts the payload into a TCP packet and forwards it to a TOR client. This is necessary because TOR itself can only handle TCP packets. The host must drop all other packets coming from the VM.

How this works under a Linux host:

  • Create an unprivileged user “torbob” that runs the VMs.
  • Choose a virtualization software. I decided to go for qemu/kvm since I am already familiar with it. Using Virtualbox or VMware should also work.
  • Install, configure and run a transparent SOCKS proxy. I use redsocks but there are also others around. Remember the port it is listening on (31337 in this case). Update: This is not necessary anymore, because Tor has an inbuilt SOCKS proxy since version 0.2.0.1-alpha. Just add “TransListenAddress 127.0.0.1″ and “TransPort 31337″ to your torrc.
  • Configure and run the tor-dns-proxy.py script from dsocks which does the UDP->TCP packet DNS conversion and remember the port it is listening on (1253 in this case). Update: This is not necessary anymore, because Tor has this inbuilt since version 0.2.0.1-alpha. Just add ” DNSListenAddress 127.0.0.1″ and “DNSPort 1253″ to your torrc. If you want to be able to resolve .onion domains, you also have to add “VirtualAddrNetwork 10.192.0.0/10″ to your torrc.
  • Redirect the packets from the VM to the local daemons:

iptables -A OUTPUT -t nat -p tcp -m owner –uid-owner torbob -j REDIRECT –to-ports 31337
iptables -A OUTPUT -t nat -p udp –dport 53 -m owner –uid-owner torbob -j REDIRECT –to-ports 1253

  • Make sure that packets to that daemons are accepted and all other packets from that user are dropped/logged:

iptables -A OUTPUT -d 127.0.0.1/32 -p tcp -m tcp –dport 31337 -m owner –uid-owner torbob -j ACCEPT
iptables -A OUTPUT -d 127.0.0.1/32 -p udp -m udp –dport 1253 -m owner –uid-owner torbob -j ACCEPT
iptables -A OUTPUT -m owner –uid-owner torbob -j LOG
iptables -A OUTPUT -m owner –uid-owner torbob -j DROP

  • If you want to share files through SMB between the host and the VM you have to add a few more rules *before* the rules above:

iptables -A OUTPUT -t nat -d 127.0.0.1/32 -p tcp -m tcp –dport 445 -m owner –uid-owner torbob -j RETURN
iptables -A OUTPUT -t nat -d 127.0.0.1/32 -p tcp -m tcp –dport 139 -m owner –uid-owner torbob -j RETURN
iptables -A OUTPUT -d 127.0.0.1/32 -p udp -m udp –dport 137 -m owner –uid-owner torbob -j ACCEPT
iptables -A OUTPUT -d 127.0.0.1/32 -p tcp -m tcp –dport 445 -m owner –uid-owner torbob -j ACCEPT
iptables -A OUTPUT -d 127.0.0.1/32 -p tcp -m tcp –dport 139 -m owner –uid-owner torbob -j ACCEPT

  • Thats it. Now starting a VM (or running any other program) as user “torbob” will either route its traffic through the TOR network (or drop the packets if they use an unsupported protocol).
]]>
http://ra.fnord.at/2010/02/routing-unmodified-virtual-machines-through-the-tor-network/feed/ 0
Instant messaging file transfers just do not work http://ra.fnord.at/2009/05/instant-messaging-file-transfers-just-do-not-work/ http://ra.fnord.at/2009/05/instant-messaging-file-transfers-just-do-not-work/#comments Sat, 30 May 2009 12:34:49 +0000 ra http://ra.fnord.at/?p=181 A few days ago I wanted to quickly send a file through my instant messaging client which neither worked through xmpp nor icq. It came to my mind that I keep having this problem for years now and having to send files through email sucks.

So I decided to write a small script which is executed from the context menu of konqueror or dolphin (kde file browsers). It compresses a file or directory, sets a password and uploads it to filefactory.com .

project site on kde-apps.org

]]>
http://ra.fnord.at/2009/05/instant-messaging-file-transfers-just-do-not-work/feed/ 2
Kmail auto add address to addressbook http://ra.fnord.at/2008/11/kmail-auto-add-address-to-addressbook/ http://ra.fnord.at/2008/11/kmail-auto-add-address-to-addressbook/#comments Fri, 21 Nov 2008 13:45:22 +0000 ra http://ra.fnord.at/?p=124 I just figured out how to automatically add addresses I wrote an email to to my addressbook in kmail. Christian Schaarschmidt wrote a small patch which adds a filter you can define for your outgoing mails. Unfortunately it’s not available in vanilla kmail (yet?). I added an updated ebuild+patch to my gentoo repository so one can easily use it.

I think got used to that feature with the previous mail client I used: thunderbird and I am wondering if the mail client I used before thunderbird (mutt) has a similar feature.

]]>
http://ra.fnord.at/2008/11/kmail-auto-add-address-to-addressbook/feed/ 0
Gentoo overlay http://ra.fnord.at/2008/10/gentoo-overlay/ http://ra.fnord.at/2008/10/gentoo-overlay/#comments Sun, 05 Oct 2008 19:55:31 +0000 ra http://ra.fnord.at/?p=110 I finally put my local ebuilds online. Browse my Gentoo overlay.

Update:
New URL: git://github.com/ra–/ra-gentoo-overlay.git
Browse online: http://github.com/ra–/ra-gentoo-overlay/tree/master

]]>
http://ra.fnord.at/2008/10/gentoo-overlay/feed/ 0
Google Earth http://ra.fnord.at/2008/09/google-earth/ http://ra.fnord.at/2008/09/google-earth/#comments Wed, 03 Sep 2008 19:09:48 +0000 ra http://ra.fnord.at/?p=107 I experienced Google Earth being really slow after updating it to version 4.3. Disabling atmosphere in the view menu made it work again.

]]>
http://ra.fnord.at/2008/09/google-earth/feed/ 0
NetworkManager applet for KDE http://ra.fnord.at/2008/04/networkmanager-applet-for-kde/ http://ra.fnord.at/2008/04/networkmanager-applet-for-kde/#comments Sat, 26 Apr 2008 09:59:52 +0000 ra http://ra.fnord.at/2008/04/networkmanager-applet-for-kde/ A few days ago I figured out that the NetworkManager applet for Gnome is also working in KDE. I use it because it has less bugs, compiles against the current svn of NetworkManager and works more reliable in general then the KNetworkManager. Someone should have told me before that this works. (:

]]>
http://ra.fnord.at/2008/04/networkmanager-applet-for-kde/feed/ 1
New driver in linux kernel for intel 3945 wlan chip http://ra.fnord.at/2008/04/new-driver-in-linux-kernel-for-intel-3945-wlan-chip/ http://ra.fnord.at/2008/04/new-driver-in-linux-kernel-for-intel-3945-wlan-chip/#comments Sat, 26 Apr 2008 09:29:26 +0000 ra http://ra.fnord.at/2008/04/new-driver-in-linux-kernel-for-intel-3945-wlan-chip/ I already tried the new driver for the intel 3945 wlan chip (iwl3945) a couple of times, but it always ran more unsatisfying than the old driver (ipw3945) – even though the old driver has many problems (needs a daemon running, sometimes problems when resuming from suspend/hibernate, ..).

The new version in the 2.6.25 linux kernel works quite well for me (the one in 2.6.24 did not), but the wlan led is not working. This patch makes it work (I removed the support for the 4965 chip since I don’t need it. If you need it: this is the source to the patch).

]]>
http://ra.fnord.at/2008/04/new-driver-in-linux-kernel-for-intel-3945-wlan-chip/feed/ 0
suspend/hibernate buttons in kde shutdown dialog http://ra.fnord.at/2007/10/suspendhibernate-buttons-in-kde-shutdown-dialog/ http://ra.fnord.at/2007/10/suspendhibernate-buttons-in-kde-shutdown-dialog/#comments Sat, 06 Oct 2007 15:05:59 +0000 ra http://ra.fnord.at/2007/10/suspendhibernate-buttons-in-kde-shutdown-dialog/ I took a patch which implements the suspend/hibernate buttons within the shutdown dialog in kde from the kubuntu guys and made it work on gentoo.

If you have no clue what this is all about here are two screenshots [1] [2] (actually these do not represent the patch exactly, but you should get the idea).

The kde split ebuild for ksmserver: ebuild (I will do the update to the kde-all-in-one ebuild on request).

To make use of the feature emerge with USE=”dbus hal”. If you don’t see any icons next to the suspend/hibernate buttons, make sure you use an icon set that provides the files “suspend.png” and “hibernate.png”.

]]>
http://ra.fnord.at/2007/10/suspendhibernate-buttons-in-kde-shutdown-dialog/feed/ 0
Kernel patches http://ra.fnord.at/2007/09/kernel-patches/ http://ra.fnord.at/2007/09/kernel-patches/#comments Sat, 29 Sep 2007 15:07:36 +0000 ra http://ra.fnord.at/2007/09/kernel-patches/ I updated some kernel patches:

]]>
http://ra.fnord.at/2007/09/kernel-patches/feed/ 0
konq-pdf (various PDF service menus for KDE) http://ra.fnord.at/2007/09/konq-pdf-various-pdf-service-menus-for-kde/ http://ra.fnord.at/2007/09/konq-pdf-various-pdf-service-menus-for-kde/#comments Fri, 28 Sep 2007 18:20:47 +0000 ra http://ra.fnord.at/2007/09/konq-pdf-various-pdf-service-menus-for-kde/ A few weeks ago I stumbled accross konq-pdf which offers various PDF related service (“right click”) menus for konqueror. These menus contain joining/adding files, changing pages per sheet, rotating, converting to other formats, extracting images, .. in a few words: it’s very handy if you don’t want to remember all the command line parameters for pdftk/pdfjam you just need once in a while. (:

There are just two things I found in the software:
The kde submenu text in pdfnup.desktop “X-KDE-Submenu=Paginate” is not
very clear. “X-KDE-Submenu=Pages per sheet” would be better imho.

A small bug in pdfjoin.desktop makes it always display the italian kde
submenu: “X-KDE-Submenu=Unisci o aggiungi” should be replaced by
“X-KDE-Submenu[it]=Unisci o aggiungi”.

I just wrote the author Giuseppe Benigno an email, so these “bugs” probably get fixed soon.

]]>
http://ra.fnord.at/2007/09/konq-pdf-various-pdf-service-menus-for-kde/feed/ 0
Linux Power Saving Projects http://ra.fnord.at/2007/09/linux-power-saving-projects/ http://ra.fnord.at/2007/09/linux-power-saving-projects/#comments Fri, 21 Sep 2007 11:46:51 +0000 ra https://sunkist.annessi.at/wordpress/2007/09/21/linux-power-saving-projects/ Even more linux power saving information from intel on LessWatts.org.

Source: http://kerneltrap.org/Linux/Power_Saving_Projects

]]>
http://ra.fnord.at/2007/09/linux-power-saving-projects/feed/ 0
uswsusp http://ra.fnord.at/2007/09/uswsusp/ http://ra.fnord.at/2007/09/uswsusp/#comments Tue, 18 Sep 2007 20:01:59 +0000 ra https://sunkist.annessi.at/wordpress/2007/09/18/uswsusp/ Ich habe eigentlich die letzten Jahre auf suspend2/tuxonice gesetzt, nun aber uswsusp ausprobiert, da hier mittlerweile auch compression und splash funktioniert, und bin begeistert: selbe Funktionalität und stabiler. (:

]]>
http://ra.fnord.at/2007/09/uswsusp/feed/ 0
Kernel “Trusted Path Execution” patch (tpe) http://ra.fnord.at/2007/09/kernel-trusted-path-execution-patch-tpe/ http://ra.fnord.at/2007/09/kernel-trusted-path-execution-patch-tpe/#comments Mon, 10 Sep 2007 17:33:29 +0000 ra https://sunkist.annessi.at/wordpress/2007/09/10/kernel-trusted-path-execution-patch-tpe/ I just finished a patch to the Linux kernel which implements “trusted path execution”.

You can specifiy a trusted directory and a group as “trusted” or “untrusted”.
If the group is untrusted all users belonging to this group will only be able to execute files from the trusted directory. If the group is trusted all users will only be able to execute files from the trusted directory but users belonging to the group (and root of course).

Get it here: linux-2.6.18-tpe_restriction (patch, 5 KB)

The patch is based on grsecurity – so credits go to Brad Spengler.

]]>
http://ra.fnord.at/2007/09/kernel-trusted-path-execution-patch-tpe/feed/ 0
Kernel Patches (proc & dmesg restriction) http://ra.fnord.at/2007/07/kernel-patches-proc-dmesg-restriction/ http://ra.fnord.at/2007/07/kernel-patches-proc-dmesg-restriction/#comments Tue, 31 Jul 2007 16:38:11 +0000 ra https://sunkist.annessi.at/wordpress/2007/07/31/kernel-patches-proc-dmesg-restriction/ I updated two kernel patches to the Linux kernel.

  • linux-2.6.18-proc_restrictions.patch (patch, 12 KB) which basically restricts non-root users from viewing all processes (plus an option for some additional /proc restrictions). It is possible to define a GID which is not affected by the restrictions.
  • linux-2.6.18-dmesg_restriction.patch (patch, 1 KB) which restricts non-root users from viewing kernel log buffer messages.

Both patches are based on grsecurity – so credits go to Brad Spengler.

]]>
http://ra.fnord.at/2007/07/kernel-patches-proc-dmesg-restriction/feed/ 0
Kostenfreie KUbuntu CDs http://ra.fnord.at/2007/07/kostenfreie-kubuntu-cds/ http://ra.fnord.at/2007/07/kostenfreie-kubuntu-cds/#comments Sun, 15 Jul 2007 12:15:48 +0000 ra https://sunkist.annessi.at/wordpress/2007/07/15/kostenfreie-kubuntu-cds/ Die Fachschaft Informatik auf der TU Wien verteilt kostenfrei KUbuntu “Feisty Fawn”-CDs.
Siehe http://www.fsinf.at/node/477

]]>
http://ra.fnord.at/2007/07/kostenfreie-kubuntu-cds/feed/ 0
Suspend2 Becomes TuxOnIce http://ra.fnord.at/2007/07/suspend2-becomes-tuxonice/ http://ra.fnord.at/2007/07/suspend2-becomes-tuxonice/#comments Wed, 04 Jul 2007 05:22:15 +0000 ra https://sunkist.annessi.at/wordpress/2007/07/04/suspend2-becomes-tuxonice/ The Suspend2 project has been renamed to TuxOnIce Nigel Cunningham announced on the lkml.

Source: http://kerneltrap.org/node/8476

]]>
http://ra.fnord.at/2007/07/suspend2-becomes-tuxonice/feed/ 0
Linux für Kinder http://ra.fnord.at/2007/06/linux-fr-kinder/ http://ra.fnord.at/2007/06/linux-fr-kinder/#comments Mon, 25 Jun 2007 07:19:41 +0000 ra https://sunkist.annessi.at/wordpress/2007/06/25/linux-fr-kinder/ Quelle: http://www.jux-net.info/juxlala/index.html
Download: http://www.jux-net.info/juxlala/isos/

Da wären Erfahrungsberichte sehr interessant. (:

]]>
http://ra.fnord.at/2007/06/linux-fr-kinder/feed/ 0
Understanding Power Consumption http://ra.fnord.at/2007/05/understanding-power-consumption/ http://ra.fnord.at/2007/05/understanding-power-consumption/#comments Wed, 16 May 2007 07:50:06 +0000 ra https://sunkist.annessi.at/wordpress/2007/05/16/understanding-power-consumption/ Intel released a utility “powertop” for detecting what Linux programs and kernel tunables are resulting in the most power consumption.

Source: http://kerneltrap.org/node/8207

]]>
http://ra.fnord.at/2007/05/understanding-power-consumption/feed/ 0
GNU/Linux on Dell notebooks/workstations http://ra.fnord.at/2007/04/gnulinux-on-dell-notebooksworkstations/ http://ra.fnord.at/2007/04/gnulinux-on-dell-notebooksworkstations/#comments Sun, 01 Apr 2007 22:29:00 +0000 ra https://sunkist.annessi.at/wordpress/2007/04/02/gnulinux-on-dell-notebooksworkstations/ Dell announced to support GNU/Linux on notebook and (consumer)workstations.
http://direct2dell.com/one2one/archive/2007/03/28/9655.aspx
http://www1.euro.dell.com/content/topics/global.aspx/ideastorm/ideasinaction

]]>
http://ra.fnord.at/2007/04/gnulinux-on-dell-notebooksworkstations/feed/ 0
Linux kernel patches http://ra.fnord.at/2006/09/linux-kernel-patches/ http://ra.fnord.at/2006/09/linux-kernel-patches/#comments Mon, 25 Sep 2006 20:14:02 +0000 ra https://sunkist.annessi.at/wordpress/2006/09/25/linux-kernel-patches/ I put two patches online i put together some weeks ago:
A patch to build the driver for the rt2500 wireless chipset within the linux kernel (statically or as a module): linux-2.6.17-rt2500-1.diff (diff, 1,155 KB)
A patch to build the kqemu module within the linux kernel (statically or as a module): kqemu-2.6.17.diff (diff, 19 KB)

As you can see, I do prefer a kernel without modules. (:

]]>
http://ra.fnord.at/2006/09/linux-kernel-patches/feed/ 0