Installing Newer Tor Versions

From Kicksecure
Revision as of 12:38, 9 December 2021 by Nurmagoz (talk | contribs)
Jump to navigation Jump to search

Introduction

Info Testers only.

It is possible to install newer Tor versions from either:

  • Tor Project APT repositories; or
  • Tor Project source code.

Note that a later Tor version will not always be installed from The Tor Project APT repository -- in the recent past, the Debian buster repositories for packages.debian.org and deb.torproject.org had identical Tor versions. In general, as the Debian stable release ages, the likelihood of receiving a newer Tor version from deb.torproject.org increases.

The Tor Project APT Repository

Info If the latest Tor version from deb.torproject.org has not been fully tested by Kicksecure developers at a specific point in time, then problems can emerge such as broken connectivity. [1] [2] Testers should always maintain a separate, working version of Kicksecure (kicksecure) so future connectivity problems can be averted.

If you wish to proceed despite the risk, two steps are required:

  • The deb.torproject.org repository must be enabled.
  • The anon-shared-build-apt-sources-tpoarchive.org iconarchive.today icon package must be installed, since it enables The Tor Project's APT signing key and installs the apt source torproject.list [3]

1. In Kicksecure (kicksecure-17), update the package lists.

Click = Copy Copied to clipboard! sudo apt update

2. Install anon-shared-build-apt-sources-tpo.

Click = Copy Copied to clipboard! sudo apt install anon-shared-build-apt-sources-tpo

3. Optional: select an alternative Tor Project distribution for the Tor package.

Open file /etc/apt/sources.list.d/torproject.list in an editor with root rights.

Kicksecure

See Open File with Root RightsOnion network Logo for detailed instructions on why to use sudoedit for better security and how to use it.

Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.

Click = Copy Copied to clipboard! sudoedit /etc/apt/sources.list.d/torproject.list

Kicksecure for Qubes

NOTES:

Click = Copy Copied to clipboard! sudoedit /etc/apt/sources.list.d/torproject.list

  • After applying this change, shutdown the Template.
  • All App Qubes based on the Template need to be restarted if they were already running.
  • This is a general procedure required for Qubes and unspecific to Kicksecure for Qubes.

Others and Alternatives

  • This is just an example. Other tools could achieve the same goal.
  • If this example does not work for you or if you are not using Kicksecure, please refer to this link.

Click = Copy Copied to clipboard! sudoedit /etc/apt/sources.list.d/torproject.list

Comment out deb tor+https://deb.torproject.org/torproject.orgarchive.org iconarchive.today icon bookworm main by adding a hash (#) in front of it. Comment in a different distributionarchive.org iconarchive.today icon by removing the hash in front of it or by adding a newer deb URI line.

Save the file.

4. Refresh the package lists. [4]

Click = Copy Copied to clipboard! sudo apt update

5. Install the (potentially) newer version of the tor package.

This step also installs the deb.torproject.org-keyring package which keeps the Tor Project repository apt key up-to-date.

Click = Copy Copied to clipboard! sudo apt install tor deb.torproject.org-keyring

Onionize Tor Project APT Repository

Only follow these instructions if Newer Tor versions from The Tor Project Repository was configured. Note that The Tor Project deb apt signing key must be added first (see the prior link), or error messages will appear when completing these steps.

Kicksecure

This procedure works in both Kicksecure and Kicksecure-Qubes.

Run the following commands in Kicksecure.

1. Create a torproject.list file using an editor.

Open file /etc/apt/sources.list.d/torproject.list in an editor with root rights.

Kicksecure

See Open File with Root RightsOnion network Logo for detailed instructions on why to use sudoedit for better security and how to use it.

Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.

Click = Copy Copied to clipboard! sudoedit /etc/apt/sources.list.d/torproject.list

Kicksecure for Qubes

NOTES:

Click = Copy Copied to clipboard! sudoedit /etc/apt/sources.list.d/torproject.list

  • After applying this change, shutdown the Template.
  • All App Qubes based on the Template need to be restarted if they were already running.
  • This is a general procedure required for Qubes and unspecific to Kicksecure for Qubes.

Others and Alternatives

  • This is just an example. Other tools could achieve the same goal.
  • If this example does not work for you or if you are not using Kicksecure, please refer to this link.

Click = Copy Copied to clipboard! sudoedit /etc/apt/sources.list.d/torproject.list

2. Cut and paste the following text and comment out (#) the corresponding http repository.

Click = Copy Copied to clipboard! #Tor Project Mirror #deb http://deb.torproject.org/torproject.org bookworm main deb tor+http://http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/torproject.org bookworm main

Save and exit.

Qubes Debian Templates

Info In Qubes R4.0 and above, Templates do not have network connections by default. This means any attempt to download the apt key in kicksecure-17 will fail. [5]

As a workaround, the Tor apt singing key can be fetched from a (networked) kicksecure App Qube, then copied over to kicksecure-17 in a text file.

1. Download and verify the Tor Project deb apt signing key.

Perform the following procedure either in kicksecure or even better in a Kicksecure Disposable. [6]

Note:

  • Examine the following key's fingerprint. Compare the fingerprint displayed in the terminal with the one listed at this link: Tor Project: Signing Keysarchive.org iconarchive.today icon (.oniononion icon).
  • Instead of downloading with scurl-download from https it is even safer to download using curl-download from Tor Project onion, assuming the user independently verified the onion really belongs to The Tor Project.
    • Click = Copy Copied to clipboard! curl-download http://apow7mjfryruh65chtdydfmqfpj5btws7nbocgtaovhvezgccyjazpqd.onion/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc

  • Digital signatures are a tool enhancing download security. They are commonly used across the internet and nothing special to worry about.
  • Optional, not required: Digital signatures are optional and not mandatory for using Kicksecure, but an extra security measure for advanced users. If you've never used them before, it might be overwhelming to look into them at this stage. Just ignore them for now.
  • Learn more: Curious? If you are interested in becoming more familiar with advanced computer security concepts, you can learn more about digital signatures here digital software signatures.

Securely download the signing key.

Click = Copy Copied to clipboard! scurl-download https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc

Display the key's fingerprint.

Click = Copy Copied to clipboard! gpg --keyid-format long --import --import-options show-only --with-fingerprint A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc

Verify the fingerprint. It should show.

Note: Key fingerprints provided on the Kicksecure website are for convenience only. The Kicksecure project does not have the authorization or the resources to function as a certificate authority, and therefore cannot verify the identity or authenticity of key fingerprints. The ultimate responsibility for verifying the authenticity of the key fingerprint and correctness of the verification instructions rests with the user.

Key fingerprint = A3C4 F0F9 79CA A22C DBA8 F512 EE8C BC9E 886D DD89

The most important check is confirming the key fingerprint exactly matches the output above. [7]

warning Warning:

Do not continue if the fingerprint does not match! This risks using infected or erroneous files! The whole point of verification is to confirm file integrity.

Add the signing key.

Click = Copy Copied to clipboard! gpg --import A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc

2. Copy the Tor signing key to kicksecure-17.

In kicksecure, copy the A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc text file over to kicksecure-17.

Click = Copy Copied to clipboard! qvm-copy A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc kicksecure-17

If the following error appears, it can be safely ignored (hit "OK" when prompted). 

 qfile-agent: Fatal error: stat kicksecure-17-version (error type: No such file or directory)

3. Move the Tor signing key to the Template's home folder. [8]

Note: if using a Disposable the file path will be different.

Click = Copy Copied to clipboard! mv ~/QubesIncoming/kicksecure/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc ~/

4. Verify the Tor signing key again. [9]

The same verification command from step 1 can be used.

5. Add the Tor signing key to the list of trusted keys.

In kicksecure-17, run.

Click = Copy Copied to clipboard! sudo apt-key-install A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc

Onionize the Sources File

1. To onionize Tor Project updates, first create a torproject.list file using an editor.

Open file /etc/apt/sources.list.d/torproject.list in an editor with root rights.

Kicksecure

See Open File with Root RightsOnion network Logo for detailed instructions on why to use sudoedit for better security and how to use it.

Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.

Click = Copy Copied to clipboard! sudoedit /etc/apt/sources.list.d/torproject.list

Kicksecure for Qubes

NOTES:

Click = Copy Copied to clipboard! sudoedit /etc/apt/sources.list.d/torproject.list

  • After applying this change, shutdown the Template.
  • All App Qubes based on the Template need to be restarted if they were already running.
  • This is a general procedure required for Qubes and unspecific to Kicksecure for Qubes.

Others and Alternatives

  • This is just an example. Other tools could achieve the same goal.
  • If this example does not work for you or if you are not using Kicksecure, please refer to this link.

Click = Copy Copied to clipboard! sudoedit /etc/apt/sources.list.d/torproject.list

2. Next, cut and paste the following text and comment out (#) the corresponding http repository.

Click = Copy Copied to clipboard! #Tor Project Mirror #deb http://deb.torproject.org/torproject.org bookworm main deb tor+http://http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/torproject.org bookworm main

Save and exit.

Install Tor from Source Code

All steps should be performed inside Kicksecure (kicksecure).

1. Add the Debian bookworm source repository.

Click = Copy Copied to clipboard! echo "deb-src tor+https://deb.debian.org/debian bookworm main" | sudo tee /etc/apt/sources.list.d/debian-source.list

2. Update the package lists.

Click = Copy Copied to clipboard! sudo apt update

3. Install build dependencies for Tor.

Click = Copy Copied to clipboard! sudo apt build-dep tor

4. Fetch the signing key. [10]

Whonix first time users warning Warning:

The following command using gpg with --recv-keys is not recommended for security reasons and is often non-functional. [11] This is not a Kicksecure-specific issue. The OpenPGP public key should be downloaded from the web instead; see also Secure Downloads. This procedure is currently undocumented and can be resolved as per the Self Support First Policy. Documentation contributions will be happily considered.

Click = Copy Copied to clipboard! gpg --keyserver keys.openpgp.org --recv-keys 7A02B3521DC75C542BA015456AFEE6D49E92B601

If the attempt fails, utilize the v3 onion service instead.

Click = Copy Copied to clipboard! gpg --keyserver zkaan2xfbuxia2wpf7ofnkbz6r5zdbbvxbunvp5g2iebopbfc4iqmbad.onion --recv-keys 7A02B3521DC75C542BA015456AFEE6D49E92B601

5. Download the Tor source code archive.

Note: Replace Tor version 0.4.6.5 with the actual Tor version to be downloaded. (Template:Tor upstream version)

Click = Copy Copied to clipboard! scurl-download https://dist.torproject.org/tor-0.4.6.5.tar.gz

6. Download and verify the Tor source code OpenPGP signature.

Click = Copy Copied to clipboard! scurl-download https://dist.torproject.org/tor-0.4.6.5.tar.gz.asc

Click = Copy Copied to clipboard! gpg --verify tor-0.4.6.5.tar.gz.asc

The output should look similar to the following.

gpg: assuming signed data in 'tor-0.4.6.5.tar.gz'

gpg: Signature made Mon 09 Dec 2019 06:21:51 PM UTC gpg: using RSA key 7A02B3521DC75C542BA015456AFEE6D49E92B601 gpg: Good signature from "Nick Mathewson <nickm@alum.mit.edu>" [unknown] gpg: aka "Nick Mathewson <nickm@wangafu.net>" [unknown] gpg: aka "Nick Mathewson <nickm@freehaven.net>" [unknown] gpg: aka "Nick Mathewson <nickm@torproject.org>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 2133 BC60 0AB1 33E1 D826 D173 FE43 009C 4607 B1FB

Subkey fingerprint: 7A02 B352 1DC7 5C54 2BA0 1545 6AFE E6D4 9E92 B601

7. Extract the Tor source code archive.

Click = Copy Copied to clipboard! tar xvzf tor-0.4.6.5.tar.gz

8. Navigate to the Tor source code folder.

Click = Copy Copied to clipboard! cd tor-0.4.6.5/

9. Run configure and build the binary package.

Click = Copy Copied to clipboard! ./configure

Click = Copy Copied to clipboard! make

The build should now be finished.

10. Check the version of the built binary.

Click = Copy Copied to clipboard! ./src/app/tor --version

The output should show.

Tor version 0.4.6.5.

11. Template:Q project name only: copy the newly built binary to Kicksecure TemplateVM (whonix-gw-17).

Click = Copy Copied to clipboard! qvm-copy ./src/app/tor

12. Stop Tor.

Click = Copy Copied to clipboard! sudo systemctl stop tor

13. Copy the newly build Tor binary to the system.

Click = Copy Copied to clipboard! sudo cp ./src/app/tor /usr/sbin/tor

Copy the binary again. [12]

Click = Copy Copied to clipboard! sudo cp ./src/app/tor /usr/bin/tor

14. Restart Tor.

Click = Copy Copied to clipboard! sudo systemctl start tor

The process of installing Tor from source code is now complete.

Footnotes

  1. ↑ One example in the recent past was a Tor release that contained AppArmor changes which were incompatible with one of Kicksecure (kicksecure-17)'s configuration files (anon-gw-anonymizer-configarchive.org iconarchive.today icon's /etc/apparmor.d/local/system_tor.anondistarchive.org iconarchive.today icon) causing Tor's systemd unit to fail.
  2. ↑ Also, at the time of writing Tor v4.2.5 is non-functional in Kicksecure.
  3. ↑ Alternatively, The Tor Project's native instructions for Debianarchive.org iconarchive.today icon can be used, but the manual steps are more difficult and involved. The verification of The Tor Project APT signing key is also harder. Since you already trust Kicksecure, the logical choice is to trust another Kicksecure package to install the right signing key.
  4. ↑ So the newly installed /etc/apt/sources.list.d/torproject.list takes effect.
  5. ↑ https://github.com/QubesOS/qubes-issues/issues/1854archive.org iconarchive.today icon
  6. ↑ This can also be performed in a non-Kicksecure VM. However, then scurl-download and onion access will be unavailable unless the user sets that up, which is out of scope for this documentation.
  7. ↑ Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.
  8. ↑ This step is optional, but provides better usability. Advanced users can skip this step and adjust the file path.
  9. ↑ That is because the Template is more trusted than kicksecure and perhaps safer from malware. If using a Disposable, the added security might be negligible.
  10. ↑
  11. ↑ https://forums.whonix.org/t/gpg-recv-keys-fails-no-longer-use-keyservers-for-anything/5607archive.org iconarchive.today icon
  12. ↑ apt-file list tor shows both locations /usr/bin/tor and /usr/sbin/tor.
Notification image
Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=Tor_Versioning&oldid=53632"