-
Notifications
You must be signed in to change notification settings - Fork 88
/
TorBOX_Gateway
1909 lines (1511 loc) · 65 KB
/
TorBOX_Gateway
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/bin/bash
# Needs to be bash because we use "trap ERR".
# Save as /home/user/TorBOX_source/TorBOX_Gateway
# Homepage: https://trac.torproject.org/projects/tor/wiki/doc/TorBOX
# Version: TorBOX 0.2.1
# Copyright: proper
#
# License: GPL v3 or any later
#
# Any changes you pull changes into this source will be also licensed
# under GPL v3 or any later. Additionally you grant proper the right to
# re-license your work under a different license. If that is not acceptable,
# you can either fork this source under GPL v3 or any later or contact proper.
# Contact proper, if you require this source code under different license.
script_help() {
echo "
############################################################################
# INFO #
# Script to automatically transform an Ubuntu Server into a TorBOX-Gateway #
# Alpha/Development version, please test and leave feedback! #
# Read https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/DISCLAIMER #
# #
# PREREQUISITES/ASSUMPTIONS #
# 1) You have installed Ubuntu Server 12.04 (x86 or amd64). #
# For later versions you will most likely only have to #
# change /etc/sources.list accordingly. #
# 2) There are two network cards attached to the gateway: #
# External: eth0 (with an already working connection to the Internet) #
# Internal: eth1 (solely used for communicating with TorBOX-Workstations) #
# 3) Username must be "user"! If your user name differ set the USERNAME #
# variable accordingly and search for "HARDCODED" #
# 4) You read and understood the script, especially look search through #
# all occurrences of the string "!!!VERIFY!!!" and make sure that #
# hardcoded gpg fingerprints are correct #
# #
# CHOOSE ONE OF THE FOLLOWING FLAGS #
# WARNING! Currently only -install is tested! #
# #
# -install #
# Currently the only tested/supported option. #
# In addition to performing a full installation this #
# will enable auto-login, passwordless poweroff and #
# slim down the image size. #
# Make a snapshot first so you do not have to reinstall if things break! #
# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ #
# Only suited for VMs! #
# In case you really want to run on bare metal: #
# comment out vm_configuration and slim_down #
# use config_network instant of staticvboxip #
# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ #
# #
# -update #
# Update existing TorBOX-Gateway using the latest script. #
# #
# -uninstall #
# undo -install #
# #
# -onevm #
# see https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/OneVM #
############################################################################
#+# OPTIONAL FEATURES
# Normal comments. Optional feature comments look like this:
#+# Optional feature comment, skip them you are not interested.
#+# For convenient navigation through the optional feature in the script,
#+# it is recommend to use your browsers search function. (
#+# e.g.: Firefox: CTRL + F, in nano: CTRL + W
#+# find #OptionalFeatureNr.X#, Highlight all, F3 to jump to the next one.)
#+# You need to uncomment all occurrences in the script to to enable a Feature.
#+# #OptionalFeatureNr.1# Isolate Dest Port / Isolate Dest Addr ^1^ (UNTESTED!)
#+# #OptionalFeatureNr.2# Hidden Services. ^6^
#+# #OptionalFeatureNr.3# Even more restrictive firewall rules. ^7^
#+# #OptionalFeatureNr.4# More Socks Ports. ^4^
#+# #OptionalFeatureNr.5# Best possible protection against Identity correlation through circuit sharing. ^5^
#+# #OptionalFeatureNr.6# Leak Testing. ^8^
#+# ^1^ Read: TorBOX / Optional Configurations / isolate streams by destination port and/or destination address
#+# for explanation.
#+# ^4^ Read: TorBOX / Application Warnings And Notes / Identity correlation through circuit sharing,
#+# for explanation.
#+# ^6^ Read: TorBOX / Optional Configurations / Hosting hidden services
#+# for explanation.
#+# ^7^ Read: TorBOX / Application Warnings And Notes / TorBOXs TorBOX-Workstation is firewalled
#+# for explanation.
#+# ^8^ Read: TorBOX / Leak Tests
#+# for explanation.
############################################################################
# NOTE FOR ADVANCED USERS
# This script is modular. Functionality with effects is inside functions. At
# the end of the script, you will find our command line switches. If you know
# what you are doing, you can comment out one or another module, you do not
# want. For example, you can use -install and comment out the slim_down function.
# (To save time, testing or if you dislike for any other reason.)
# The very first line of every script must be #!/bin/bash. Do not add empty lines above.
############################################################################
# NOTE FOR DEBUGGING
# If you start the script without command line options, it will do nothing
# important, only create a backup. You can also check for some syntax errors,
# such as unbalanced apostrophes etc. And if you want for testing purposes,
# simply to run only one module and not the whole script, that is also
# possible. Scroll down the the bottom of the script, one one the last things
# will be "INFO: No option chosen.". Make space there and add the name of the
# function, you want to test, for example leaktest_tg. Leave the "exit 0"
# and fi below intact.
#
# For extensive debugging use:
# sudo bash -x 2>/tmp/log TorBOX-Gateway
# This will set -x and redirect everything bash does to /tmp/log.
# nano /tmp/log
############################################################################
# NOTE FOR CONTRIBUTORS
# Follow our style unless there is a good reason not to (let us know on TorBOX/Dev).
# functions() need to have a unique name
# Be careful using echos with single/double quotes/apostrophes in comments!
# Only use || true with care to override the trap function.
# Search the script for TODO and help us fix them.
"
}
######################################################
# List of modified system files. Not all of them are backed up/restored by -uninstall
######################################################
# Modified files:
# /etc/apt/sources.list
# /etc/default/grub
# /etc/sysctl.conf
# /etc/network/interfaces
# /etc/tor/torrc
# /etc/resolv.conf - no backup
# /etc/init/failsafe.conf
# /etc/sudoers
# /home/$USERNAME/.bashrc
#
# New files:
# /etc/torboxfirewall.sh
# /usr/local/bin/torbox
# /usr/local/bin/leaktest
# /home/$USERNAME/.vidalia/
# /home/$USERNAME/.vidalia/vidalia.conf
############################################################################
# SCRIPT STARTS HERE
############################################################################
# Enable debugging.
set -x
######################################################
# Variables
######################################################
# Set the linux username.
# "export USERNAME=$(whoami)" will not work, since the
# script gets, in most cases, started as root.
USERNAME=user
# Ports used by Tor (and used in /etc/torrc and /etc/torboxfirewall.sh)
#
# The following applications will be separated, preventing identity
# correlation through circuit sharing.
# Transparent Proxy Ports for TorBOX-Workstation
TRANS_PORT_TW="9040"
# Transparent Proxy Ports for TorBOX-Gateway
TRANS_PORT_TG="9041"
DNS_PORT_TG="54"
# SOCKS Ports
# TODO: Can we use a loop?
SOCKS_PORT_TB="9100"
SOCKS_PORT_IRC="9101"
SOCKS_PORT_TORBIRDY="9102"
SOCKS_PORT_IM="9103"
SOCKS_PORT_APT_GET="9104"
SOCKS_PORT_GPG="9105"
SOCKS_PORT_SSH="9106"
SOCKS_PORT_GIT="9107"
SOCKS_PORT_HTPDATE="9108"
SOCKS_PORT_WGET="9109"
SOCKS_PORT_TORCHECK="9110"
SOCKS_PORT_BITCOIN="9111"
SOCKS_PORT_PRIVOXY="9112"
SOCKS_PORT_POLIPO="9113"
#+# #OptionalFeatureNr.4# More Socks Ports.
#+# You can add more here but,
#+# you will have to edit the TorBOX-Gateway script:
#+# - /etc/tor/torrc
#+# - And "sudo service tor reload" afterwards.
#+# - /etc/torboxfirewall.sh and
#+# - And issue "sudo /etc/torboxfirewall.sh" afterwards.
#+# you will also have to edit in TorBOX-Workstation script
#+# - the line "extensions.torbutton.banned_ports" (search TorBOX-Workstation script for that term)
#+# - You can NOT simply add it to about:config in TorBrowser, since users.js will overwrite it.
#+# - Issue sudo TorBOX-Workstation -uwt to apply afterwards.
#+# - the function "install_uwt_wrappers()"
#+# - Issue sudo TorBOX-Workstation -uwt to apply afterwards.
#SOCKS_PORT_ETC="9198"
#SOCKS_PORT_ETC2="9199"
#+# #OptionalFeatureNr.1# Isolate Dest Port / Isolate Dest Addr
#SOCKS_PORT_ISOLATE_DEST_PORT="9200"
#SOCKS_PORT_ISOLATE_DEST_ADDR="9201"
# External interface
EXT_IF="eth0"
# Internal interface
INT_IF="eth1"
# Internal "tunnel" interface, usually the same as the Internal interface unless using vpn tunnels between workstations and gateway
INT_TIF="eth1"
# Internal interface IP. If you will not use the 192.168.0.0 network you will have to
# edit /etc/network/interfaces manually.
# This IP is static, no dhcp server is managing it. (internal/isolated network)
INT_IP="192.168.0.1"
# We also set a Tor User ID automatically, search for TOR_UID
# this can not be done at the beginning of the script because tor is not running yet...
# Unattended (un)installation of packages.
# Thanks to http://snowulf.com/2008/12/04/truly-non-interactive-unattended-apt-get-install/
export DEBIAN_FRONTEND=noninteractive
######################################################
# Checking script environment
######################################################
# Exit if there is an error
set -e
cd /home/$USERNAME
root_check() {
echo "
######################################################
# Check if we are root
######################################################
"
if [ "$(id -u)" != "0" ]; then
echo "ERROR: This must be run as root (sudo)"
exit 1
else
echo "INFO: Script running as root."
fi
}
backup_sysfiles() {
echo "
######################################################
Backup system files
######################################################
"
cp -n /etc/localtime /etc/localtime.backup
cp -n /etc/apt/sources.list /etc/apt/sources.list.backup
cp -n /etc/default/grub /etc/default/grub.backup
cp -n /etc/sysctl.conf /etc/sysctl.conf.backup
cp -n /etc/network/interfaces /etc/network/interfaces.backup
cp -n /home/$USERNAME/.bashrc /home/$USERNAME/.bashrc.backup
cp -n /etc/init/tty1.conf /etc/init/tty1.conf.backup
cp -n /etc/init/failsafe.conf /etc/init/failsafe.conf.backup
# /etc/tor/torrc
# - /etc/tor/torrc.backup gets created by setup_torrc(),
# because torrc begins to exist, after installing Tor.
}
# Roll back configurations if the script fails.
roll_back() {
echo "
######################################################
ERROR: Script failed!
INFO: Rolling back configuration...
######################################################
"
echo "INFO: set +e..."
set +e
echo "INFO: stopping tor..."
service tor stop
echo "roll_back(): restoring backup files..."
cp /etc/localtime.backup /etc/localtime
cp /etc/apt/sources.list.backup /etc/apt/sources.list
cp /etc/sysctl.conf.backup /etc/sysctl.conf
cp /etc/network/interfaces.backup /etc/network/interfaces
cp /etc/init/tty1.conf.backup /etc/init/tty1.conf
cp /etc/tor/torrc.backup /etc/tor/torrc
cp /etc/init/failsafe.conf.backup /etc/init/failsafe.conf
cp /home/$USERNAME/.bashrc.backup /home/$USERNAME/.bashrc
echo "roll_back(): deleting /etc/torboxfirewall.sh..."
rm /etc/torboxfirewall.sh
echo "roll_back(): deleting /usr/local/bin/leaktest..."
rm -r /usr/local/bin/leaktest
echo "INFO: Done." >&2
exit 1
}
create_apt_config() {
echo "
######################################################
create_apt_config
######################################################
"
# Currently disabled. Creates empty apt.conf.
# To use it there are some issues which would need to
# be resolved. Probable you have to add the repositories
# (torproject and ubuntu) on the host and run apt-get update
# on the host first.
# NOTE: If you dislike this, simply clear the content
# of apt.conf here. An empty apt.conf will do
# nothing. Please do not remove it without
# discussion.
# TODO: Lets find a better place for apt.conf. No harm
# in keeping when in correct folder.
# Must contain something. May not be completely empty.
# To be completely empty we had to remove the --config-file
# in front of every apt-get line in this script.
echo '
# TorBOX
# IP of TorBOX-Workstation for building TorBOX inside TorBOX.
# Works through Virtual Boxs NAT adapter.
#Acquire::http { Proxy "http://192.168.0.2:3142"; };
' > /tmp/apt.conf
}
config_etc() {
trap "roll_back" ERR INT TERM
echo "
######################################################
set up /etc configs
######################################################
"
echo "INFO: Set local time zone to UTC to prevent anonymity set reduction."
cp /usr/share/zoneinfo/UTC /etc/localtime
# Workaround to fix the two minutes startup delay when dhcp client fails to write to /etc/resolv.conf
# http://www.codewhirl.com/2011/10/ubuntu-11-10-waiting-up-to-60-more-seconds-for-network-configuration/
ed -s /etc/init/failsafe.conf <<< $',s/sleep 20/sleep 5/g\nw'
ed -s /etc/init/failsafe.conf <<< $',s/sleep 40/sleep 2/g\nw'
ed -s /etc/init/failsafe.conf <<< $',s/60 more/2 more/g\nw'
ed -s /etc/init/failsafe.conf <<< $',s/sleep 59/sleep 2/g\nw'
}
create_fix_sources_list() {
# This function is required because preseed without network connection will mess up
# /etc/apt/sources.list.
echo "
# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
# newer versions of the distribution.
deb http://us.archive.ubuntu.com/ubuntu/ precise main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ precise main restricted
## Major bug fix updates produced after the final release of the
## distribution.
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates main restricted
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
deb http://us.archive.ubuntu.com/ubuntu/ precise universe
deb-src http://us.archive.ubuntu.com/ubuntu/ precise universe
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates universe
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates universe
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team, and may not be under a free licence. Please satisfy yourself as to
## your rights to use the software. Also, please note that software in
## multiverse WILL NOT receive any review or updates from the Ubuntu
## security team.
deb http://us.archive.ubuntu.com/ubuntu/ precise multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ precise multiverse
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates multiverse
## N.B. software from this repository may not have been tested as
## extensively as that contained in the main release, although it includes
## newer versions of some applications which may provide useful features.
## Also, please note that software in backports WILL NOT receive any review
## or updates from the Ubuntu security team.
deb http://us.archive.ubuntu.com/ubuntu/ precise-backports main restricted universe multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-backports main restricted universe multiverse
deb http://security.ubuntu.com/ubuntu precise-security main restricted
deb-src http://security.ubuntu.com/ubuntu precise-security main restricted
deb http://security.ubuntu.com/ubuntu precise-security universe
deb-src http://security.ubuntu.com/ubuntu precise-security universe
deb http://security.ubuntu.com/ubuntu precise-security multiverse
deb-src http://security.ubuntu.com/ubuntu precise-security multiverse
## Uncomment the following two lines to add software from Canonical's
## 'partner' repository.
## This software is not part of Ubuntu, but is offered by Canonical and the
## respective vendors as a service to Ubuntu users.
# deb http://archive.canonical.com/ubuntu precise partner
# deb-src http://archive.canonical.com/ubuntu precise partner
## Uncomment the following two lines to add software from Ubuntu's
## 'extras' repository.
## This software is not part of Ubuntu, but is offered by third-party
## developers who want to ship their latest software.
# deb http://extras.ubuntu.com/ubuntu precise main
# deb-src http://extras.ubuntu.com/ubuntu precise main
" > /etc/apt/sources.list
}
modify_sources_list() {
# Add the Torporject repository, only works for Debian and derivatives.
# "local release=" line may need to be changed if you do not use Ubuntu or Debian.
# "lsb_release -c" and/or "cat /etc/debian_version" will tell you what version you are using.
# Determine name of distribution.
local release="$(lsb_release -cs)"
# Modify sources.list.
echo "
# TorBOX
# https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/
# You can find a backup of the original sources.list under /etc/apt/sources.list.backup.
# The torproject.org stable repository.
deb http://deb.torproject.org/torproject.org $release main
# The torproject.org alpha repository.
# Uncomment this in case you require the Tor alpha,
# which includes obfsproxy (obfuscated bridges).
#deb http://deb.torproject.org/torproject.org experimental-$release main
# End of TorBOX changes to sources.list.
" >> /etc/apt/sources.list
}
apt_get() {
trap "roll_back" ERR INT TERM
echo "
######################################################
Remove problematic software, install Tor and other software.
######################################################
"
# Some apt_get() code is shared between TorBOX-Workstation and TorBOX-Gateway.
echo "Checking if the system is functional and continuing apt-get if the script failed before,"
echo "by running dpkg --configure -a. Can take a while."
dpkg --configure -a
# !!!VERIFY!!!
#
# https://www.torproject.org/docs/signing-keys.html.en
# http://idnxcnkne4qt76tg.onion/docs/signing-keys.html.en
#
# https://www.torproject.org/docs/debian.html.en#ubuntu
# http://idnxcnkne4qt76tg.onion/docs/debian.html.en#ubuntu
echo "INFO: Importing torproject.org signing key..."
rm -r gpgtmpdir/ || true
sudo -u $USERNAME mkdir gpgtmpdir
chmod 700 gpgtmpdir/
sudo -u $USERNAME gpg --homedir gpgtmpdir --fingerprint
sudo -u $USERNAME gpg --homedir gpgtmpdir --keyserver keys.gnupg.net --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89
sudo -u $USERNAME gpg --homedir gpgtmpdir --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add -
rm -r gpgtmpdir/
echo "INFO: Imported torproject.org signing key."
echo "Refresh apt-get to include the newly added torproject.org repository."
apt-get --config-file /tmp/apt.conf update
echo "Running apt-get dist-upgrade..."
apt-get --config-file /tmp/apt.conf --yes dist-upgrade
# Remove problematic software.
apt-get --config-file /tmp/apt.conf --yes remove --purge popularity-contest network-manager network-manager-gnome ntpdate resolvconf || true
# Make sure required software is installed and install tor.
apt-get --config-file /tmp/apt.conf --yes install bash deb.torproject.org-keyring dnsutils ed gnupg ifupdown iptables iputils-ping isc-dhcp-client kbd less lsb-release nano net-tools netbase rungetty sudo tor tor-arm torsocks wget
# TODO: console-utilities console-tools console-data something broken
# (proper) For what do we need it anyway?
# dialog removed. Not really needed?
# Additionally install obfsproxy. Disabled by default, because
# it requires Tor Alpha and is only available in the experimental branch.
# obfsproxy is already available as a deb package in the Tor repository.
# https://trac.torproject.org/projects/tor/ticket/6046
#apt-get --config-file /tmp/apt.conf --yes install obfsproxy
# Backup torrc.
cp -n /etc/tor/torrc /etc/tor/torrc.backup
# Get and set Tor UID, distro specific!
TOR_UID=`id -u debian-tor`
# TOR_UID Fallback.
if [[ "$TOR_UID" == "" ]]; then
echo "WARNING: TOR_UID could not be determined. Setting to 103. Should work for Ubuntu. Distro specific!"
TOR_UID=103
fi
# create arm wrapper script to start arm without entering a password
echo "\
#!/bin/bash
sudo -u debian-tor /usr/bin/arm
" > /usr/local/bin/arm
chmod +x /usr/local/bin/arm
echo '
#
# TorBOX help file.
# This file will get overwritten when updating TorBOX TorBOX-Gateway through the apt_get function.
#
echo "The following commands are available on TorBOX TorBOX-Gateway:"
echo "sudo dpkg-reconfigure keyboard-configuration (Change keyboard layout.)"
echo "arm - Anonymizing Relay Monitor (Vidalia alternative, Tor Controller as console application)"
echo "nslookup check.torproject.org - check if DNS resolution is functional"
echo "sudo service tor restart"
echo "reboot"
echo "poweroff"
echo "sudo apt-get update"
echo "sudo apt-get dist-upgrade"
echo " "
echo "Important files:"
echo "nano /etc/tor/torrc"
echo "nano /etc/resolv.conf"
echo "nano /etc/torboxfirewall.sh"
echo " "
echo "End of help."
' > /usr/local/bin/torbox
chmod +x /usr/local/bin/torbox
}
config_grub() {
echo "
######################################################
# config_grub
######################################################
"
echo "
GRUB_TERMINAL=console
" > /etc/default/grub
update-grub2
}
base_desktop() {
echo "
######################################################
# Installing base desktop
######################################################
"
apt-get --config-file /tmp/apt.conf --yes install --no-install-recommends xserver-xorg xinit tint2 xterm openbox vidalia
}
config_home() {
trap "roll_back" ERR INT TERM
echo "
######################################################
config_home
######################################################
"
# TorBOX help/welcome message
cp /home/$USERNAME/.bashrc.backup /home/$USERNAME/.bashrc
echo \
'echo "Welcome to TorBOX Tor-Gateway!"
echo "TorBOX is a non-offical, community project. We are NOT affiliated with torproject.org. The Tor developers are NOT responsible for TorBOX. See Disclaimer for more information."
echo "TorBOX is produced independently from the Tor® anonymity software and carries no guarantee from The Tor Project about quality, suitability or anything else."
echo "TorBOX is based on Tor."
echo "TorBOX is experimental software by means of concept and design. Do not rely on it for strong anonymity."
echo "Type: \"torbox\" <enter> for help."
' | sudo -u $USERNAME tee -a /home/$USERNAME/.bashrc
}
fix_network() {
echo "
######################################################
fix_network
######################################################
"
# This function is required because preseed install messes up
# /etc/network/interfaces. There is no preseed netcfg instance
# for setting the broadcast address, which would be required
# for Virtual Box.
echo "fix_network(): overwriting /etc/network/interfaces..."
echo '
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet dhcp
' > /etc/network/interfaces
echo "fix_network(): restarting network..."
/etc/init.d/networking restart
echo "fix_network(): restarted network."
}
set_sysctl() {
trap "roll_back" ERR INT TERM
echo "
######################################################
IPv6 off, Forwarding off, fs.file-max to 100000, vm.swappiness to 0
######################################################
#We need to disable IPv6 because Tor does not support IPv6 yet and may create leaks.
#You can verify the setting applied by: cat /proc/sys/net/ipv6/conf/all/disable_ipv6, which should return 1.
#Advanced users only: If you were unwilling or unable to disable IPv6 you would have to create an IPv6 firewall.
#The firewall supplied by TorBOX does only protect IPv4.
#Disable ipv4 Forwarding as per https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy
#You can verify the setting applied by: cat /proc/sys/net/ipv4/ip_forward, which should return 0
#Also settings vm.swappiness=0 which you can check with sysctl -p.
" >&2
echo "
# Appended by TorBOX to /etc/sysctcl.conf.
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv4.ip_forward = 0
fs.file-max=100000
vm.swappiness=0
# End of TorBOX appends to /etc/systcl.conf.
" >> /etc/sysctl.conf
sysctl -p
}
create_swap_file() {
echo "
######################################################
# create_swap_file
######################################################
"
# Source: http://www.cyberciti.biz/faq/linux-add-a-swap-file-howto/
# Creating 512 MB swap file.
echo "INFO: Creating /swapfile1... This may take a while..."
dd if=/dev/zero of=/swapfile1 bs=1024 count=524288
echo "INFO: Created /swapfile1."
# Format swapfile.
mkswap /swapfile1 --uuid 0615ba72-85b0-4183-8d54-300bb0d2e491
# Set permissions.
chown root:root /swapfile1
# Set permissions.
chmod 0600 /swapfile1
# Should be probable omitted. No need. Will be restarted so or so.
# swapon /swapfile1
}
config_uuids_fstab() {
# code shared between TorBOX_Workstation and TorBOX_Gateway script.
echo "
######################################################
# Configuring disk uuids and /etc/fstab
######################################################
"
# Change uuid of hdd created by operating system installer.
# WARNING: This assumes you used "Guided - use entire disk" partitioning (NOT LVM!)
tune2fs /dev/sda1 -U 26ada0c0-1165-4098-884d-aafd2220c2c6
# Deactivate swap partition. Will not be created when using preseed.
# Deactivating anyway just in case anyone manually installs the operating system.
swapoff /dev/sda5 || true
# Share the same uuid among all TorBOX users.
# Setting anyway just in case anyone manually installs the operating system
# and then applies the script.
mkswap /dev/sda5 -U 9159bf6e-e242-4510-b4c1-348db252feff || true
echo "
# /etc/fstab: static file system information.
#
# Use blkid to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
# <file system> <mount point> <type> <options> <dump> <pass>
proc /proc proc nodev,noexec,nosuid 0 0
# TorBOX /etc/fstab changes.
# HDD created by operating system installer.
# Disk UUID changed by TorBOX.
UUID=26ada0c0-1165-4098-884d-aafd2220c2c6 / ext4 noatime,errors=remount-ro 0 1
# Swap partition NOT created by TorBOX preseed installation method.
# Disk UUID changed by TorBOX.
# The swap partition has been removed in favor of a swap file.
# Advantage: with a swap file its easier to grow the virtual hdd
# and to add the new space to the filesystem.
# UUID=9159bf6e-e242-4510-b4c1-348db252feff none swap sw 0 0
# Swap file created by TorBOX.
# Disk UUID changed by TorBOX.
# UUID=0615ba72-85b0-4183-8d54-300bb0d2e491
/swapfile1 swap swap defaults 0 0
# End of TorBOX /etc/fstab changes.
" > /etc/fstab
update-grub2
grub-install /dev/sda
}
config_network() {
trap "roll_back" ERR INT TERM
echo "
######################################################
Set up /etc/network/interfaces.
######################################################
"
echo "config_network(): appending to /etc/network/interfaces..."
echo '
pre-up /etc/torboxfirewall.sh
auto '$INT_IF'
iface '$INT_IF' inet static
address '$INT_IP'
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255
# https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/
# You can find a backup of the original interfaces under /etc/network/interfaces.backup.
' >> /etc/network/interfaces
}
firewall_setup() {
trap "roll_back" ERR INT TERM
echo "
######################################################
Set up Firewall.
######################################################
"
echo \
'#!/bin/sh
# WARNING! Do not use single quotes/apostrophes in the firwall comments!!!
###########################
# /etc/torboxfirewall.sh
###########################
echo "OK: Latest firewall updates can always be found here:"
echo "OK: https://trac.torproject.org/projects/tor/wiki/doc/TorBOX"
echo "OK: Loading TorBOX firewall..."
###########################
# VARIABELS
###########################
# Destinations you don not want routed through Tor, only for TG!
NON_TOR_TG="192.168.1.0/24 192.168.0.0/24 127.0.0.0/8"
# Tor User ID
TOR_UID='$TOR_UID'
# Output TOR_UID for debugging purposes.
echo "OK: TOR_UID: $TOR_UID"
# DnsPort_TW
DNS_PORT_TW=53
# DnsPort_TG
DNS_PORT_TG='$DNS_PORT_TG'
# TransPort_TW
TRANS_PORT_TW='$TRANS_PORT_TW'
# TransPort_TG
TRANS_PORT_TG='$TRANS_PORT_TG'
# Socks Ports for per application circuits.
# TODO: Can we use a loop?
SOCKS_PORT_TB='$SOCKS_PORT_TB'
SOCKS_PORT_IRC='$SOCKS_PORT_IRC'
SOCKS_PORT_TORBIRDY='$SOCKS_PORT_TORBIRDY'
SOCKS_PORT_IM='$SOCKS_PORT_IM'
SOCKS_PORT_APT_GET='$SOCKS_PORT_APT_GET'
SOCKS_PORT_GPG='$SOCKS_PORT_GPG'
SOCKS_PORT_SSH='$SOCKS_PORT_SSH'
SOCKS_PORT_GIT='$SOCKS_PORT_GIT'
SOCKS_PORT_HTPDATE='$SOCKS_PORT_HTPDATE'
SOCKS_PORT_WGET='$SOCKS_PORT_WGET'
SOCKS_PORT_TORCHECK='$SOCKS_PORT_TORCHECK'
SOCKS_PORT_BITCOIN='$SOCKS_PORT_BITCOIN'
SOCKS_PORT_PRIVOXY='$SOCKS_PORT_PRIVOXY'
SOCKS_PORT_POLIPO='$SOCKS_PORT_POLIPO'
#+# Additional Socks Ports for per application circuits.
#+# OptionalFeatureNr.4#
#SOCKS_PORT_ETC='$SOCKS_PORT_ETC'
#+# OptionalFeatureNr.1# Isolate Dest Port / Isolate Dest Addr
#SOCKS_PORT_ISOLATE_DEST_PORT='$SOCKS_PORT_ISOLATE_DEST_PORT'
#SOCKS_PORT_ISOLATE_DEST_ADDR='$SOCKS_PORT_ISOLATE_DEST_ADDR'
# External interface
EXT_IF='$EXT_IF'
# Internal interface
INT_IF='$INT_IF'
# Internal tunnel interface
INT_TIF='$INT_TIF'
###########################
# IPv4 DEFAULTS
###########################
# Set secure defaults.
iptables -P INPUT DROP
# FORWARD rules does not actually do anything if forwarding is disabled. Better be safe just in case.
iptables -P FORWARD DROP
# Only the Tor process is allowed to establish outgoing connections.
iptables -P OUTPUT DROP
###########################
# IPv4 PREPARATIONS
###########################
# Flush old rules.
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
############################
# IPv4 DROP INVALID PACKAGES
############################
# DROP INVALID
iptables -A INPUT -m state --state INVALID -j DROP
# DROP INVALID SYN PACKETS
iptables -A INPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
# DROP PACKETS WITH INCOMING FRAGMENTS. THIS ATTACK ONCE RESULTED IN KERNEL PANICS
iptables -A INPUT -f -j DROP
# DROP INCOMING MALFORMED XMAS PACKETS
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
# DROP INCOMING MALFORMED NULL PACKETS
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
###########################
# IPv4 INPUT
###########################
# Traffic on the loopback interface is accepted.
iptables -A INPUT -i lo -j ACCEPT
# Established incoming connections are accepted.
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow incoming SSH connections on the external interface.
iptables -A INPUT -i $EXT_IF -p tcp --dport 22 -j ACCEPT
# OPTIONAL Allow incoming OpenVPN connections on the external interface.
#iptables -A INPUT -i $EXT_IF -p tcp --dport 1194 -j ACCEPT
# Allow TCP to TransPort and DNS traffic to DNSListenAddress.
#+# SEE #OptionalFeatureNr.5#
iptables -A INPUT -i $INT_TIF -p udp --dport 53 -j ACCEPT
#+# SEE #OptionalFeatureNr.5#
iptables -A INPUT -i $INT_IF -p tcp --dport $TRANS_PORT_TW -j ACCEPT
# Allow socksified applications.
# TODO: Lets use a loop where we list all SOCKS_PORT_XXX add them.
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_TB -j ACCEPT
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_IRC -j ACCEPT
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_TORBIRDY -j ACCEPT
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_IM -j ACCEPT
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_APT_GET -j ACCEPT
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_GPG -j ACCEPT
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_SSH -j ACCEPT
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_GIT -j ACCEPT
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_HTPDATE -j ACCEPT
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_WGET -j ACCEPT
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_TORCHECK -j ACCEPT
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_BITCOIN -j ACCEPT
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_PRIVOXY -j ACCEPT
iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_POLIPO -j ACCEPT
#+# #OptionalFeatureNr.4# More Socks Ports.
#iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_ETC -j ACCEPT
#OptionalFeatureNr.1# Isolate Dest Port / Isolate Dest Addr
#iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_ISOLATE_DEST_PORT -j ACCEPT
#iptables -A INPUT -i $INT_TIF -p tcp --dport $SOCKS_PORT_ISOLATE_DEST_ADDR -j ACCEPT
# Redirect DNS traffic to DNSPORT.
#+# SEE #OptionalFeatureNr.5#
iptables -t nat -A PREROUTING -i $INT_IF -p udp --dport 53 -j REDIRECT --to-ports $DNS_PORT_TW
# Redirect Browser/IRC/TorBirdy, etc. to SocksPort.
# TODO: Lets use a loop where we list all SOCKS_PORT_XXX add them.
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_TB -j REDIRECT --to-ports $SOCKS_PORT_TB
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_IRC -j REDIRECT --to-ports $SOCKS_PORT_IRC
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_TORBIRDY -j REDIRECT --to-ports $SOCKS_PORT_TORBIRDY
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_IM -j REDIRECT --to-ports $SOCKS_PORT_IM
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_APT_GET -j REDIRECT --to-ports $SOCKS_PORT_APT_GET
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_GPG -j REDIRECT --to-ports $SOCKS_PORT_GPG
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_SSH -j REDIRECT --to-ports $SOCKS_PORT_SSH
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_GIT -j REDIRECT --to-ports $SOCKS_PORT_GIT
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_HTPDATE -j REDIRECT --to-ports $SOCKS_PORT_HTPDATE
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_WGET -j REDIRECT --to-ports $SOCKS_PORT_WGET
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_TORCHECK -j REDIRECT --to-ports $SOCKS_PORT_TORCHECK
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_BITCOIN -j REDIRECT --to-ports $SOCKS_PORT_BITCOIN
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_PRIVOXY -j REDIRECT --to-ports $SOCKS_PORT_PRIVOXY
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_POLIPO -j REDIRECT --to-ports $SOCKS_PORT_POLIPO
#+# OptionalFeatureNr.4# More Socks Ports.
#+# Rules for additional SocksPorts.
#iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_ETC -j REDIRECT --to-ports $SOCKS_PORT_ETC
#OptionalFeatureNr.1# Isolate Dest Port / Isolate Dest Addr
#iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_ISOLATE_DEST_PORT -j REDIRECT --to-ports $SOCKS_PORT_ISOLATE_DEST_PORT
#iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport $SOCKS_PORT_ISOLATE_DEST_ADDR -j REDIRECT --to-ports $SOCKS_PORT_ISOLATE_DEST_ADDR
# Catch all remaining tcp and redirect to TransPort.
#+# SEE #OptionalFeatureNr.5#
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT_TW
#+# #OptionalFeatureNr.3# Even more restrictive firewall rules.
#+# Replace above rule with a more restrictive one, e.g.:
#iptables -t nat -A PREROUTING -i $INT_IF -p tcp --match multiport --dports 80,443 --syn -j REDIRECT --to-ports $TRANS_PORT_TW
# Reject anything not explicitly allowed above.
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
###########################
# IPv4 FORWARD