TorBOX_Workstation

#!/bin/bash
# Needs to be bash because we use "trap ERR".
# Save as /home/user/TorBOX_source/TorBOX_Workstation
# Homepage: https://trac.torproject.org/projects/tor/wiki/doc/TorBOX

# Version: TorBOX 0.2.1

# Copyright: proper
#
# License: GPL v3 or any later
#
# Any changes you pull changes into this source will be also licensed
# under GPL v3 or any later. Additionally you grant proper the right to
# re-license your work under a different license. If that is not acceptable,
# you can either fork this source under GPL v3 or any later or contact proper.
# Contact proper, if you require this source code under different license.

script_help() {
echo \
"
############################################################################
#       INFO                                                               #
# Automatically transform a fresh minimal Ubuntu Server 12.04 into a       #
# "TorBOX-Workstation"                                                     #
#                                                                          #
# Development version, please test and leave feedback!                     #
# Read https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/DISCLAIMER #
#                                                                          #
#       WARNING!                                                           #
# Only run on an unmodified Ubuntu installation inside a Virtual Machine.  #
# WARNING! Currently only -install is tested!                              # 
#                                                                          #
#       ASSUMPTIONS                                                        #
# 1) You use Ubuntu                                                        #
# 2) The main username is "user"                                           #
# (search for HARDCODED! and check the variable "USERNAME")                #
# 3) You are using following network settings:                             #
# Your primary (and only) network interface is eth0                        #
# TorBOX-Workstation IP: 192.168.0.2                                       #
# TorBOX-Gateway IP: 192.168.0.1                                           #
# 4) TorBOX-Workstation's build environment has a working internet         #
# connection to ubuntu mirrors                                             #
# 5) you read and understood the script and verified all hardcoded gpg     #
# fingerprints tagged with !!!VERIFY!!!                                    #
#                                                                          #
#       CHOOSE ONE OF THE FOLLOWING FLAGS                                  #
# Available options:                                                       #
# -install                                                                 #
#                                                                          #
# -update                                                                  #
# WARNING! This will overwrite all your Browser settings                   #
#                                                                          #
# -xchat                                                                   #
# Use this, if you want to unlink your previous activities on IRC with     #
# XChat. The XChat configuration folder with your old identity gets        #
# deleted and you can create a new pseudonym.                              #
# WARNING This terminates XChat and deletes your old settings!             #
#                                                                          #
# -hiddenserver                                                            #
# Installs and configures lighttp. Hidden service has also to be activated #
# on TorBOX-Gateway, see TorBOX-Gateway script for more information.       #
# You need to put your website into /var/www.                              #
#                                                                          #
# -uwt                                                                     #
# Installs the latest uwt wrapper script and the latest uwt wrappers and   #
# updates extensions.torbutton.banned_ports.                               #
# https://trac.torproject.org/projects/tor/wiki/doc/torsocks               #
#                                                                          #
# -update-torbrowser                                                       #
# Note: you can run this without root.                                     #
# Updates only Tor Browser.                                                #
# If you are a TorBOX user, you should only run this if you recently       #
# issues -update. Otherwise, if you just want to install/update            #
# TorBrowser, do not use -update.                                          #
#                                                                          #
# -uninstall                                                               #
# undo *most* of the changes made by the script                            #
# WARNING! Make a backup of all files and settings you want to keep        #        
# This will probably delete important things, you have been warned.        #
############################################################################
# NOTE FOR ADVANCED USERS
# NOTE FOR DEBUGGING
# NOTE FOR CONTRIBUTORS
# Same comments as under
# https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/Dev/TGScript
# apply.
# Search for TODO in the script and help us fix them.
"
}
######################################################
# List of modified system files. Not all of them are backed up/restored by -uninstall
######################################################
# Modified:
# /etc/apt/sources.list
# /etc/localtime
# /etc/fonts/conf.d/10-sub-pixel-rgb.conf
# /etc/init/tty6.conf
# /etc/sudoers
# /etc/resolv.conf
# /etc/network/interfaces
# /etc/fstab
# - /etc/fstab.old Does not get restored. Would break boot, since uuids changed.
# /var/lib/dbus/machine-id
# - /etc/fstab.old Does not get restored. Would break boot, since uuids changed.
# .gnupg/gpg.conf
# ./tor-browser_en-US/Data/profile/user.js
#
# New:
# .config/openbox/menu.xml
# /etc/torboxfirewall.sh
# /usr/share/leaktest/
# /usr/local/bin/leaktest
# /usr/local/bin/torcheck

############################################################################
# SCRIPT STARTS HERE
############################################################################

# TODO [0.3]
# Items marked with SPLITOFF are subject to be moved in their own files.
# Open for discussion.

######################################################
# Variables
######################################################
# Set the linux username.
# "export USERNAME=$(whoami)" will not work, since the
# script gets, in most cases, started as root.
USERNAME="user"

# change to home dir so relative paths work correctly
cd /home/$USERNAME

# Unattended (un)installation of packages.
# Thanks to http://snowulf.com/2008/12/04/truly-non-interactive-unattended-apt-get-install/
export DEBIAN_FRONTEND=noninteractive



error_handler() {
echo "
##################################################
# TorBOX_Workstation script: ERROR detected.     #
# Do not worry. Provable nothing serious.        #
# The error_handler is still a toothless tiger.  #
# In long term a trap function will be           #
# implemented. This simply helps devs to add the #
# necessary overriding. After that is done, this #
# text will be changed and the script will       #
# really stop.                                   #
##################################################
"
}

trap "error_handler" ERR INT TERM



root_check() {
######################################################
# Checking script environment
######################################################
# Check if we are root
  if [ "$(id -u)" != "0" ]; then
       echo "ERROR: This must be run as root (sudo)!"
       exit 1
  else
       echo "INFO: Script running as root."
  fi
}



set_dbusmachineid() {
echo "
######################################################
# Set generic UUIDs
######################################################
"
echo "b08dfa6083e7567a1921a715000001fb" > /var/lib/dbus/machine-id
}



create_fix_sources_list() {
# This function is required because preseed without network connection will mess up
# /etc/apt/sources.list.

echo "
# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
# newer versions of the distribution.
deb http://us.archive.ubuntu.com/ubuntu/ precise main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ precise main restricted

## Major bug fix updates produced after the final release of the
## distribution.
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates main restricted

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
deb http://us.archive.ubuntu.com/ubuntu/ precise universe
deb-src http://us.archive.ubuntu.com/ubuntu/ precise universe
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates universe
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates universe

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu 
## team, and may not be under a free licence. Please satisfy yourself as to 
## your rights to use the software. Also, please note that software in 
## multiverse WILL NOT receive any review or updates from the Ubuntu
## security team.
deb http://us.archive.ubuntu.com/ubuntu/ precise multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ precise multiverse
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates multiverse

## N.B. software from this repository may not have been tested as
## extensively as that contained in the main release, although it includes
## newer versions of some applications which may provide useful features.
## Also, please note that software in backports WILL NOT receive any review
## or updates from the Ubuntu security team.
deb http://us.archive.ubuntu.com/ubuntu/ precise-backports main restricted universe multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-backports main restricted universe multiverse

deb http://security.ubuntu.com/ubuntu precise-security main restricted
deb-src http://security.ubuntu.com/ubuntu precise-security main restricted
deb http://security.ubuntu.com/ubuntu precise-security universe
deb-src http://security.ubuntu.com/ubuntu precise-security universe
deb http://security.ubuntu.com/ubuntu precise-security multiverse
deb-src http://security.ubuntu.com/ubuntu precise-security multiverse

## Uncomment the following two lines to add software from Canonical's
## 'partner' repository.
## This software is not part of Ubuntu, but is offered by Canonical and the
## respective vendors as a service to Ubuntu users.
# deb http://archive.canonical.com/ubuntu precise partner
# deb-src http://archive.canonical.com/ubuntu precise partner

## Uncomment the following two lines to add software from Ubuntu's
## 'extras' repository.
## This software is not part of Ubuntu, but is offered by third-party
## developers who want to ship their latest software.
# deb http://extras.ubuntu.com/ubuntu precise main
# deb-src http://extras.ubuntu.com/ubuntu precise main
" > /etc/apt/sources.list
}



apt_get() {
echo "
######################################################
# Updating system, removing problematic software
######################################################
"

echo "INFO: Updating system..."
apt-get update && apt-get --yes dist-upgrade

echo "INFO: Removing problematic software..."
apt-get --yes remove --purge ntpdate popularity-contest resolvconf


# build-essential is required to patch torsocks.
echo "INFO: Installing required software..."
apt-get --yes install --no-install-recommends nano wget gnupg ed torsocks mingetty build-essential dbus
}



config_grub() {
echo "
######################################################
# config_grub
######################################################
"
echo "
GRUB_TERMINAL=console
" > /etc/default/grub

update-grub2
}



base_desktop() {
echo "
######################################################
# Installing base desktop
######################################################
"

apt-get --yes install --no-install-recommends xserver-xorg xinit openbox obmenu pcmanfm evince \
libasound2 file-roller xchat gpicview gnome-mplayer tint2 unrar-free alsa alsa-utils \
mplayer leafpad gnome-terminal zenity

# no longer needed: rxvt-unicode

# We should install the following at some later point...
# - Thunderbird with TorBirdy, once no longer experimental.
# - Pidgin, once torproject.org solved the remaining issues.
# - Pidgin OTR
# - Pidgin TorChat https://github.com/prof7bit/TorChat
}



config_audio() {
echo "
######################################################
# Set up audio
######################################################
"

usermod -a -G audio $USERNAME
amixer set Master 70 unmute
amixer set PCM 70 unmute
}



torsocks_patch() {
# TODO: Do we really need to keep the source folder?
# If yes, we would have to move it tor /home/$USERNAME/.torsocks-1.2.
# But what if the script gets executed again? Than we would have to delete
# the .torsocks-1.2 folder before. That may have unexpected side effects,
# if someone was really working on the source and everything where gone.
#
# If someone wants to issue sudo make uninstall, source can be downloaded
# again.
#
# If there are no objections, lets remove this todo.

# Will break if torsocks gets updated.
# Run as root, since T-W script also runs as root.

echo "
########################
# Get torsocks source
########################
"

# Get into temp folder.
cd /tmp

# Download torsocks source code.
echo "INFO: Trying to download torsocks source code..."
sudo -u $USERNAME apt-get source torsocks

# Get into torsocks source code folder.
cd /tmp/torsocks-1.2

# Check if we could cd into the torsocks source code folder.
# cd will return 0 if it was possible to get into that directory.
if  [ "$?" != "0" ]; then
   # Inform about failure.
   echo "ERROR: Could not cd into torsocks-1.2 folder. torsocks got probable updated and torsocks_patch() is no longer necessary."
   # Restore working folder.
   cd /home/$USERNAME
   # Exit this function.
   return
fi

echo "INFO: Successfully joint the torsocks source code folder."

echo "
########################
# ./configure torsocks
########################
"

sudo -u $USERNAME ./configure

echo "
########################
# create torsocks patch
########################
"

# SPLITOFF /home/user/TorBOX_source/torsocks_patch
# Source: https://bugs.gentoo.org/show_bug.cgi?id=395953#c7
sudo -u $USERNAME echo '--- torsocks-1.2.orig//src/torsocks.c	2011-10-25 17:49:50.000000000 -0400
+++ torsocks-1.2/src/torsocks.c	2012-02-21 11:09:20.000000000 -0500
@@ -124,9 +124,9 @@
 #define LOAD_ERROR(s,l) { \
     const char *error; \
     error = dlerror(); \
-    show_msg(l, "The symbol %s() was not found in any shared " \
-                     "library. The error reported was: %s!\n", s, \
-                     (error)?error:"not found"); \
+    if (error) \
+        show_msg(l, "The symbol %s() was not found in any shared " \
+            "library. The error reported was: %s!\n", s, error); \
     dlerror(); \
     }
     pthread_mutex_lock(&torsocks_init_mutex);
' > /tmp/torsocks-1.2/torsocks_patch

# Tee does not like the \n and converts them to new lines which breaks the patch.
# | sudo -u $USERNAME tee 

# Correcting owner.
chown $USERNAME torsocks_patch

echo "
########################
# patching torsocks
########################
"

sudo -u $USERNAME patch -p1 < torsocks_patch

echo "
########################
# make torsocks
########################
"

sudo -u user make

echo "
########################
# make install torsocks
########################
"

# Install as root.
make install

# Leave that folder.
cd /home/$USERNAME

# Temporary files will be delted by the slim_down function. 
}



install_uwt() {
echo "
######################################################
# Installing uwt...
######################################################
"

# Using this until the feature to add ip/port through command line
# reaches upstream torsocks, if ever. Source:
# https://trac.torproject.org/projects/tor/wiki/doc/torsocks
# If you make changes to uwt, please also add them "upstream"
# (link above).

# UPDATE 9

# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/usr/local/bin/uwt
echo '
#! /bin/sh
# ***************************************************************************
# *                                                                         *
# *   Copyright (C) 2008-2011 Robert Hogan <robert@roberthogan.net>         *
# *                                                                         *
# *   This program is free software; you can redistribute it and/or modify  *
# *   it under the terms of the GNU General Public License as published by  *
# *   the Free Software Foundation; either version 2 of the License, or     *
# *   (at your option) any later version.                                   *
# *                                                                         *
# *   This program is distributed in the hope that it will be useful,       *
# *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
# *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
# *   GNU General Public License for more details.                          *
# *                                                                         *
# *   You should have received a copy of the GNU General Public License     *
# *   along with this program; if not, write to the                         *
# *   Free Software Foundation, Inc.,                                       *
#*   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
# ***************************************************************************
# *                                                                         *
# *   This is a modified version of a source file from the Tor project.     *
# *   Original copyright notice from tsocks source file follows:            *
# ***************************************************************************

# Wrapper script for use of the tsocks(8) transparent socksification library
# See the tsocks(1) and torify(1) manpages.

# Copyright (c) 2004, 2006 Peter Palfrader
# Modified by Jacob Appelbaum <jacob@appelbaum.net> April 16th 2006
# Modified by Marcus Griep <marcus@griep.us> June 16 2009
# May be distributed under the same terms as Tor itself

# Note:
# -v (verbose) and the UWT_VERBOSE environment variable set to 1
# will break many graphical applications, which use applications,
# which will call applications, which we wrapped to use uwt.

# You can also type in shell:
# 	export UWT_VERBOSE="1"
# to enable verbose output.
# Note: When running applications as root, you also have to set and
#       export that variable as root.

# Define and ensure we have tsocks
# XXX: what if we do not have which?
TORSOCKS="`which torsocks`"
PROG=
VERBOSE=

usage () {
	echo "Usage: $0 [-h] [-v] [ <command> [<options>...]"
}

set_id () {
	echo "ERROR: $1 is set${2}id. usewithtor will not work on a set${2}id executable." >&2
	exit 1
}

# Check for any argument list
if [ "$#" = 0 ]; then
	usage >&2
	exit 1
fi

while [ "$1" ]; do
	case "$1" in
		-h|--h*)
			usage
			exit 0
			;;
		-v|--v*)
			VERBOSE=YesPlease
			shift
			;;
		*)
			break;
	esac
done

if [ -u `which "$1"` ]; then
	set_id $1 u
elif [ -g `which "$1"` ]; then
	set_id $1 g
fi

if [ -x "$TORSOCKS" ]; then
	PROG=torsocks
else
	echo "$0: Unable to find torsocks in PATH." >&2
	echo "    Perhaps you have not installed it?" >&2
	exit 1
fi

if [ "$VERBOSE" ]; then
	echo "We are armed with the following torsocks: $TORSOCKS"
	echo "We are attempting to use $PROG for all tor action."
fi

if [ "$PROG" = "torsocks" ]; then
	# Define our torsocks config file.
        # In ~ to avoid permission conflicts with root.
        # TODO: find a more elegant solutoin and revert back to sh script.
	TORSOCKS_CONF_FILE=~
        TORSOCKS_CONF_FILE="$TORSOCKS_CONF_FILE/.torsocks_temp"
	export TORSOCKS_CONF_FILE

	#echo "TORSOCKS_CONF_FILE: $TORSOCKS_CONF_FILE"

	echo "
		# Temporary torsocks configuration file created by uwt.
		# Safe to delete.
		local = 127.0.0.0/255.128.0.0
		local = 127.128.0.0/255.192.0.0
		local = 169.254.0.0/255.255.0.0
		local = 172.16.0.0/255.240.0.0
		local = 192.168.0.0/255.255.0.0
		server = $ip
		server_type = 5
		server_port = $port
	" > $TORSOCKS_CONF_FILE

	# Check that we have got a torsocks config file
	if [ -r "$TORSOCKS_CONF_FILE" ]; then
		# echo "1 UWT_VERBOSE: $UWT_VERBOSE"

		if [ -z $UWT_VERBOSE ]; then
			# echo "UWT_VERBOSE: did not exist."
			UWT_VERBOSE=0
		else
			if [ $UWT_VERBOSE -eq "1" ]; then
				VERBOSE=YesPlease
			fi
		fi
		# echo "2 UWT_VERBOSE: $UWT_VERBOSE"
		if [ $VERBOSE ]; then
			echo "uwt"
			echo "ip: $ip port: $port"
		fi

                UWT_LOCALHOST="0"

                case "$*" in
                   *127.0.0.1*)
                      UWT_LOCALHOST="1"
                   ;;
                   *localhost*)
                      UWT_LOCALHOST="1"
                   ;;
                   *)
                      # do nothing
                      sleep 0
                   ;;
                esac

                if [ "$UWT_LOCALHOST" = "1" ]; then
                   if [ $VERBOSE ]; then
                      echo "UWT_LOCALHOST: $UWT_LOCALHOST NOT using torsocks."
  		      echo "exec torsocks \"$@\""
                   fi
                   exec "$@"
                else
                   if [ $VERBOSE ]; then
                      echo "UWT_LOCALHOST: $UWT_LOCALHOST USING torsocks."
  		      echo "exec torsocks \"$@\""
                   fi
                   exec torsocks "$@"
                fi
	else
		# Since identity corelation through circuit sharing is at risk,
		# we should no longer let torsocks default to 9050.
		echo "$0: Missing torsocks configuration file \"$TORSOCKS_CONF_FILE\."
		exit 1
	fi
fi

# We should have hit an exec. If we get here, we did not exec
echo "$0: failed to exec $PROG $@" >&2
exit 1
# End of uwt script.
' > /usr/local/bin/uwt

}



install_uwt_wrappers() {
######################################################
# Installing uwt wrappers
######################################################

# SPLITOFF? /home/user/TorBOX_source/TorBOX_Workstation/usr/local/bin/apt-get etc.

# SOCKS_PORT_TB="9100"
# - gui application with socks proxy settings
# - no wrapper required

# SOCKS_PORT_IRC="9101"
# - gui application with socks proxy settings
# - no wrapper required

# SOCKS_PORT_TORBIRDY="9102"
# - gui application with socks proxy settings
# - no wrapper required
# - not yet installed

# SOCKS_PORT_IM="9103"
# - gui application with socks proxy settings
# - no wrapper required

# SOCKS_PORT_APT_GET="9104"
echo '
#!/bin/bash
ip=192.168.0.1 port=9104 uwt /usr/bin/apt-get $*
' > /usr/local/bin/apt-get

# SOCKS_PORT_GPG="9105"
echo '
#!/bin/bash
ip=192.168.0.1 port=9105 uwt /usr/bin/gpg $*
' > /usr/local/bin/gpg

# SOCKS_PORT_SSH="9106"
echo '
#!/bin/bash
ip=192.168.0.1 port=9106 uwt /usr/bin/ssh $*
' > /usr/local/bin/ssh

# SOCKS_PORT_GIT="9107"
echo '
#!/bin/bash
ip=192.168.0.1 port=9107 uwt /usr/bin/git $*
' > /usr/local/bin/git

# SOCKS_PORT_HTPDATE="9108"
echo '
#!/bin/bash
ip=192.168.0.1 port=9108 uwt /usr/bin/htpdate $*
' > /usr/local/bin/htpdate

## SOCKS_PORT_WGET="9109"
#echo '
##!/bin/bash
#ip=192.168.0.1 port=9109 uwt /usr/bin/wget $*
#' > /usr/local/bin/wget

# SOCKS_PORT_TORCHECK="9110"
# - pointing uwt directly to this port
# - no wrapper required

# SOCKS_PORT_BITCOIN="9111"
# - gui application with socks proxy settings
# - not installed
# - no wrapper required

# SOCKS_PORT_PRIVOXY="9112"
# - not installed
# - no wrapper required

# SOCKS_PORT_POLIPO="9113"
# - not installed
# - no wrapper required

# More wrappers...

# should be safe
chmod +x /usr/local/bin/*

}



config_etc() {
echo "
######################################################
# /etc configs
######################################################
"

# in case we forgot to set the time during installation
cp /usr/share/zoneinfo/UTC /etc/localtime

# enable sub pixel rendering
cp -n /etc/fonts/conf.avail/10-sub-pixel-rgb.conf /etc/fonts/conf.d/

# Auto-login on tty6
cp -n /etc/init/tty6.conf /etc/init/tty6.conf.backup
# HARDCODED!
ed -s /etc/init/tty6.conf <<< $',s/exec \/sbin\/getty -8 38400 tty6/exec \/sbin\/mingetty --autologin user --noclear tty6/g\nw'

# Allow user to reboot and poweroff without having to supply a password.
# Privilege escalation through backup file should not be possible because owned by root.
# REVIEW: Is this OK? Race condition, syntax error detection do not apply here and we set correct permission just to make sure.
cp -n /etc/sudoers /etc/sudoers.backup
chmod 0440 /etc/sudoers.backup
chown root /etc/sudoers.backup

echo "
$USERNAME $HOSTNAME=NOPASSWD: /sbin/shutdown -h now,/sbin/reboot,/sbin/poweroff
" >> /etc/sudoers

chmod 0440 /etc/sudoers
}


config_home() {
echo "
######################################################
# General ~/ configs
######################################################
"

# Create a backup of filed modified by config_home().
sudo -u $USERNAME cp -n .bashrc .bashrc.backup
sudo -u $USERNAME cp -n .gtkrc-2.0 .gtkrc-2.0.backup
sudo -u $USERNAME cp -n .profile .profile.backup
sudo -u $USERNAME cp -n .gnupg/gpg.conf .gnupg/gpg.conf.backup

# Modify .bashrc to allow reboot and poweroff without sudo.
echo '
alias reboot="sudo reboot"
alias poweroff="sudo poweroff"
' | sudo -u $USERNAME tee -a .bashrc

# Set up icons for gtk2 (and theme, but I have not found a better theme yet that works both for gtk2 and 3)
# (Humanity gets installed with evince)
echo 'gtk-icon-theme-name="Humanity"' | sudo -u $USERNAME tee .gtkrc-2.0

# TODO
# Gtk3 - you probably need gnome-themes-standard
# Uncommented till we decide on a theme that works across gtk2 and gtk3 apps.
#sudo -u $USERNAME mkdir -p .config/gtk-3.0
#echo "
#[Settings]
#gtk-theme-name=Adwaita
#gtk-icon-theme-name=nuoveXT2
#"| sudo -u $USERNAME tee .config/gtk-3.0/settings.ini

# auto-start X, we do not need a display manager
echo '
# if logging into tty6 (which will autologin), run startx
if [ -z "$DISPLAY" ] && [ $(tty) = /dev/tty6 ] ; then
    startx ;
fi
' | sudo -u $USERNAME tee -a .profile

# Fixing black on black for gnome-terminal.
# Not working: gconftool-2 --set "/apps/gnome-terminal/profiles/Default/use_theme_colors" --type bool false
# Thanks to: http://ubuntuforums.org/showthread.php?t=1513791
sudo -u $USERNAME gconftool-2 --type string --set /apps/gnome-terminal/profiles/Default/foreground_color "#FFFFFFFFFFFF"

# Run gpg at least once to create the GPG default files
# gpg.conf, pubring.gpg and trustdb.gpg.
# The --fingerprint option will do nothing and has been
# added to let GPG terminate itself after creating the
# configuration files. GPG run with no options would
# result in GPG running interactively.
sudo -u $USERNAME gpg --fingerprint --homedir /home/"$USERNAME"/.gnupg
# Stop GPG from adding the version information.
# Some further suggestions added from Debian.
# http://keyring.debian.org/creating-key.html
# TODO: needs review
sudo -u $USERNAME echo "
# TorBOX /home/user/.gnupg/gpg.conf changes.
# suggestions from TorBirdy extensions.enigmail.agentAdditionalParam
##################################################################
no-emit-version
no-comments
throw-keyids
display-charset utf-8
#no proxy because of uwt wrapper
#keyserver-options http-proxy=http://127.0.0.1:8118
keyserver hkp://2eghzlv2wwcq7u7y.onion
##################################################################

personal-digest-preferences SHA512
cert-digest-algo SHA512
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
# End of TorBOX /home/user/.gnupg/gpg.conf changes.
" >> /home/"$USERNAME"/.gnupg/gpg.conf
}



config_openbox() {
echo "
######################################################
# OPENBOX+TINT2
######################################################
"

# prepare dirs
sudo -u $USERNAME mkdir -p .config/openbox
sudo -u $USERNAME mkdir .config/tint2

# copy default files to home. Tint2 example file is Ubuntu specific 
sudo -u $USERNAME cp /usr/share/doc/tint2/examples/icon_and_text_1.tint2rc /home/$USERNAME/.config/tint2/tint2rc
sudo -u $USERNAME cp /etc/xdg/openbox/rc.xml .config/openbox/

# Autostart for GUI applications
echo "
tint2 &
torcheck &
exec openbox-session
" | sudo -u $USERNAME tee .xinitrc

# Fix ugly corners in tint2rc
sudo -u $USERNAME ed -s .config/tint2/tint2rc <<< $',s/rounded = 7/rounded = 0/g\nw'

# maximize TorBrowser windows
( echo '/<applications>/a'; echo '<application class="Tor*" role="browser"> <maximized>yes</maximized> </application>'; echo '.'; echo 'wq') | sudo -u $USERNAME ed -s .config/openbox/rc.xml 

# Win+Space shows Openbox menu.
( echo '/<keyboard>/a'; echo '<keybind key="W-space"><action name="ShowMenu"><menu>root-menu</menu></action></keybind>'; echo '.'; echo 'wq') | sudo -u $USERNAME ed -s .config/openbox/rc.xml 

# Configure the openbox right click menu.
# Note: echo may not insert a newline at the beginning,
#  otherwise Openbox will complain about a phrasing error.
# How to create/modify this file:
#  Actually very easy. Simply use obmenu from the Openbox
#  right click menu. Make changes and paste here. There is
#  no need to manually edit it.

# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/home/user/.config/openbox/menu.xml

echo '<?xml version="1.0" encoding="utf-8"?>
<openbox_menu xmlns="http://openbox.org/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://openbox.org/                 file:///usr/share/openbox/menu.xsd">
	<menu id="root-menu" label="Openbox 3">
		<item label="Terminal">
			<action name="Execute">
				<execute>
                                        x-terminal-emulator
                                </execute>
			</action>
		</item>
		<item label="TorBrowser">
			<action name="Execute">
				<execute>
# HARDCODED!
                                        /home/user/tor-browser_en-US/start-tor-browser 
                                </execute>
			</action>
		</item>
		<menu id="root-menu-25943" label="TorBOX">
			<item label="Check your IP (takes few seconds)">
				<action name="Execute">
					<execute>torcheck</execute>
				</action>
			</item>
			<item label="Tor Browser Update Check (takes few seconds)">
				<action name="Execute">
					<execute>torcheck</execute>
				</action>
			</item>
		</menu>
		<item label="File Manager">
			<action name="Execute">
				<execute>
                                        pcmanfm
                                </execute>
			</action>
		</item>
		<menu id="root-menu-1" label="Applications">
			<item label="Archive Manager">
				<action name="Execute">
					<execute>
                                                file-roller
                                        </execute>
				</action>
			</item>
			<item label="IRC Client">
				<action name="Execute">
					<execute>
                                                xchat
                                        </execute>
				</action>
			</item>
			<item label="Media Player">
				<action name="Execute">
					<execute>
                                                gnome-mplayer
                                        </execute>
				</action>
			</item>
			<item label="PDF Viewer">
				<action name="Execute">
					<execute>
                                                evince
                                        </execute>
				</action>
			</item>
			<item label="Text Editor">
				<action name="Execute">
					<execute>
                                                leafpad
                                        </execute>
				</action>
			</item>
		</menu>
		<separator/>
		<menu id="client-list-menu"/>
		<separator/>
		<item label="obmenu">
			<action name="Execute">
				<execute>
                                        obmenu
                                </execute>
			</action>
		</item>
		<item label="Reconfigure">
			<action name="Reconfigure"/>
		</item>
		<item label="Restart">
			<action name="Restart"/>
		</item>
		<separator/>
		<item label="Exit">
			<action name="Exit"/>
		</item>
		<item label="Shut down">
			<action name="Execute">
				<execute>
                                        sudo /sbin/poweroff
                                </execute>
			</action>
		</item>
	</menu>
</openbox_menu>
' | sudo -u $USERNAME tee .config/openbox/menu.xml
}



config_pcmanfm() {
echo "
######################################################
# PCMANFM
######################################################
"

sudo -u $USERNAME mkdir -p .config/libfm/

# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/home/user/.config/libfm/libfm.conf
echo '
[config]
single_click=0
use_trash=0
confirm_del=1
show_internal_volumes=0
terminal=x-terminal-emulator -e %s
archiver=file-roller
thumbnail_local=1
thumbnail_max=2048

[ui]
big_icon_size=48
small_icon_size=24
pane_icon_size=24
thumbnail_size=128
show_thumbnail=1
' | sudo -u $USERNAME tee .config/libfm/libfm.conf
}



create_gui_autostarts() {
echo "
######################################################
# create_gui_autostarts
######################################################
"

# ~/.config/autostart is a freedesktop.org standard and should work cross desktop.

# Discussion (can be deleted):
# - determine clean/standard autostart method for gui applications
#    tw is graphical so .xinit should do it, for headless: torbox welcome script should prompt the user to run it. We shouldn't run the script each time a user logs in on a tty console.
#      (proper) .xinitrc does not work cross desktop environment. Should we not use upstart scripts for any autostarts anyway?
#         xinitrc is DE agnostic (it actually is the place to start DEs...) Upstart may or may not work but it's most certainly not correct place to autostart GUI applications.
#           KDE does not listen to it: http://www.jon.demon.co.uk/kde_xinitrc/ Not sure about others...
#           Created: http://askubuntu.com/questions/155448/how-to-autostart-gui-application-cross-desktop
#           Lets wait for the outcome. If there is no other outcome, live with the glitch and inform about it.
#      (proper) .config/autostart looks like a great solution.

# Create ~/.config/autostart if it does not exist.
sudo -u $USERNAME mkdir -p /home/$USERNAME/.config/autostart

# Create torcheck autostart.

# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/home/user/.config/autostart/torcheck.desktop
echo '
[Desktop Entry]
Type=Application
Exec=torcheck
' | sudo -u $USERNAME tee /home/$USERNAME/.config/autostart/torcheck.desktop
}



create_tb_user_js() {
echo "
######################################################
# create_tb_user_js
######################################################
"

# Editing /home/$USERNAME/tor-browser_en-US/Data/profile/users.js
# http://kb.mozillazine.org/User.js_file
# Configuring Torbutton to use SOCKSPort 9100 on 192.168.0.1 (TorBOX-Gateway);
# expanding extensions.torbutton.banned_ports with TorBOX specific ports;
# and set homepage to TorBOX/Readme.
# http://kb.mozillazine.org/User.js_file

# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/home/user/tor-browser_en-US/Data/profile/user.js

echo '
# Begin of User.js.
# If you edit this file while Firefox is running, your changes will be
# overwritten, when you close Firefox.

# How to create the User.js network settings:
# 1. Make a backup of prefs.js.
# 1. Start Tor Browser with the patched start script.
# 2. Apply TorBOX proxy settings with the Tor Button settings dialog..
# 3. Make a diff from the old and the new pref.js.
# 4. Copy the relevant changes to User.js.

# network settings
user_pref("network.proxy.socks", "192.168.0.1");
user_pref("network.proxy.socks_port", 9100);
user_pref("extensions.torbutton.use_privoxy", false);
user_pref("extensions.torbutton.settings_method", "custom");
user_pref("extensions.torbutton.socks_host", "192.168.0.1");
user_pref("extensions.torbutton.socks_port", 9100);
user_pref("extensions.torbutton.custom.socks_host", "192.168.0.1");
user_pref("extensions.torbutton.custom.socks_port", 9100);

# misc settings
user_pref("extensions.torbutton.prompt_torbrowser", false);
user_pref("general.autoScroll", true);

# homepage
user_pref("browser.startup.homepage", "https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/Readme");

# banned ports
# https://www.torproject.org/torbutton/en/design/ and search for extensions.torbutton.banned_ports
# http://idnxcnkne4qt76tg.onion/torbutton/en/design/
user_pref("extensions.torbutton.banned_ports", "8118,8123,9050,9051,9100,9101,9102,9103,9104,9105,9106,9107,9108,9109,9110,9111,9112,9113");

# End of User.js.
' | sudo -u $USERNAME tee ./tor-browser_en-US/Data/profile/user.js
}



# Please keep in mind, we allow -update-torbrowser to run without root. If you ever make some changes,
# to config_torbrowser(), which require root, please disallow running the script without root.
# SPLITOFF the whole torbrowser functions can be moved into their own files.
#          /home/user/TorBOX_source/TorBOX_Workstation/usr/local/bin/torbrowser-update 
config_torbrowser() {
echo "
######################################################
# TORBROWSER
######################################################
"

# Install TBB and patch it. This part may break when the file name or RecommendedTBBVersions format changes!

# Get into correct directory is required for relative paths.
cd /home/$USERNAME

# Delete old tbbdownload folder.
rm -r tbbdownload/

# Create new tbbdownload folder.
sudo -u $USERNAME mkdir tbbdownload

# Get into the tbbdownload folder.
cd tbbdownload

# Importing GPG keys...
echo "INFO: Importing GPG keys to the temporary directory gpgtmpdir..."
echo "INFO: The GPG keys will not be permanently added to your keyring."
sudo -u $USERNAME mkdir gpgtmpdir
chmod 700 gpgtmpdir/

echo "INFO: Getting the GPG keys... Verify the fingerprints. Do not trust the wiki..."

# !!!VERIFY!!!
#
# https://www.torproject.org/docs/signing-keys.html.en
# http://idnxcnkne4qt76tg.onion/docs/signing-keys.html.en

# !!!VERIFY!!!
echo "INFO: Getting Erinn Clarks GPG key..."
sudo -u $USERNAME gpg --homedir gpgtmpdir --keyserver keys.gnupg.net --recv 8738A680B84B3031A630F2DB416F061063FEE659

# !!!VERIFY!!!
echo "INFO: Getting Sebastian Hahns GPG key..."
sudo -u $USERNAME gpg --homedir gpgtmpdir --keyserver keys.gnupg.net --recv 261C5FBE77285F88FB0C343266C8C2D7C5AA446D

# !!!VERIFY!!!
echo "INFO: Verifying Erinn Clarks GPG key..."
sudo -u $USERNAME gpg --homedir gpgtmpdir --fingerprint 8738A680B84B3031A630F2DB416F061063FEE659

if [ $? == 0 ];
then
	echo "INFO: Successfully verified Erinn Clarks GPG key."
	# FYI: Script will continue outside the if.
else
	echo "ERROR: Could not verify Erinn Clarks GPG key."
	echo "INFO: Tor Browser Download failed. Try again later using:"
	echo "     TorBOX-Workstation -update-torbrowser"
	# Exit this function.
	return
fi

# !!!VERIFY!!!
echo "INFO: Verifying Sebastian Hahns GPG key..."
sudo -u $USERNAME gpg --homedir gpgtmpdir --fingerprint 261C5FBE77285F88FB0C343266C8C2D7C5AA446D

if [ $? == 0 ];
then
	echo "INFO: Successfully verified Sebastian Hahns GPG key."
	# FYI: Script will continue outside the if.
else
	echo "ERROR: Could not verify Sebastian Hahns GPG key."
	echo "INFO: Tor Browser Download failed. Try again later using:"
	echo "     TorBOX-Workstation -update-torbrowser"
	# Exit this function.
	return
fi

# Find out latest version.
sudo -u $USERNAME wget --output-document RecommendedTBBVersions https://check.torproject.org/RecommendedTBBVersions

# Phrasing the last version information.
TBBVERSION=`grep Linux-i686 RecommendedTBBVersions |egrep -v 'alpha|x86_64'|awk '{sub(/^"/,"")}1'|awk '{sub(/-Linux-i686",/,"")}1'|tail -1`

# Download the latest Tor Browser Bundle and its gpg signature.
# sudo -u $USERNAME wget http://idnxcnkne4qt76tg.onion/dist/torbrowser/linux/tor-browser-gnu-linux-i686-$TBBVERSION-dev-en-US.tar.gz{,.asc}
sudo -u $USERNAME wget https://www.torproject.org/dist/torbrowser/linux/tor-browser-gnu-linux-i686-$TBBVERSION-dev-en-US.tar.gz{,.asc}

# Verify GPG signature.
# Not using the users GPG keyring also ensures, that the key can be only
# singed by the GPG keys we added. Signatures from random people from the
# users keyring will be ignored.
sudo -u $USERNAME gpg --homedir gpgtmpdir --verify tor-browser*.asc

# If the exit code ? of GPG return 0, GPG verification was successful.
if [ $? == 0 ];
then
	echo "INFO: Signature valid."
	# FYI: Script will continue outside the if.
else
	echo "ERROR: Signature could NOT be verified. GPG exit code: $?"
	echo "INFO: Deleting tor-browser-gnu-linux-*.tar.gz*..."
	rm tor-browser-gnu-linux-*.tar.gz*

	echo "Regular file tor-browser-gnu-linux-*.tar.gz missing."
	cd /home/$USERNAME
	echo "Deleting tbbdownload..."
	sudo -u $USERNAME rm -r tbbdownload
	# Tell about failure.
	touch TorBrowser_installation_FAILED
	echo "Update Failed" >&2
	# Exit this function.
	echo "INFO: Tor Browser Download failed. Try again later using:"
	echo "     TorBOX-Workstation -update-torbrowser"
	return
fi

if [ -f tor-browser-gnu-linux-*.tar.gz ];
then
	echo "INFO: Regular file tor-browser-gnu-linux-*.tar.gz exists."
	# Unpack.
	sudo -u $USERNAME tar -xzvf tor-browser-gnu-linux-*.tar.gz
else
	echo "FATAL ERROR: Regular file tor-browser-gnu-linux-*.tar.gz exists. Please report this bug!"
fi

# Fix the start script.
sudo -u $USERNAME ed -s tor-browser_en-US/start-tor-browser <<< $',s/.\/App\/vidalia --datadir Data\/Vidalia\//.\/App\/Firefox\/firefox --profile Data\/profile/g\nw'

# Remove stuff we do do need.
sudo -u $USERNAME rm ./tor-browser_en-US/App/{tor,vidalia}
sudo -u $USERNAME rm -r ./tor-browser_en-US/Data/{Tor,Vidalia}
sudo -u $USERNAME rm -r ./tor-browser_en-US/Docs/{Tor,Vidalia,Qt,README-TorBrowserBundle}
sudo -u $USERNAME rm -r ./tor-browser_en-US/Lib/*

# Call the function create_tb_user_js().
create_tb_user_js

echo "INFO: cd /home/$USERNAME..."
cd /home/$USERNAME
echo "INFO: Moving old folder tor-browser_en-US..."
sudo -u $USERNAME mv tor-browser_en-US tor-browser_en-US.old."`date '+%F-%H:%M:%S'`"
echo "INFO: Moving temporary folder tbbdownload/tor-browser_en-US to /home/$USERNAME/tor-browser_en-US"
mv tbbdownload/tor-browser_en-US tor-browser_en-US
echo "INFO: Deleting temporary folder tbbdownload..."
sudo -u $USERNAME rm -r tbbdownload
echo "INFO: Finished installing TBB. Can be found in /home/$USERNAME/tor-browser_en-US."
}



# Since we can start the script with -xchat, it might be a desirable goal to support,
# running config_xchat() without root. That may not be possible, since we disable
# most XChat plugins.
config_xchat() {
echo "
######################################################
# XCHAT
######################################################
"

# Does not have a trap function yet.
# -xchat should not revert uninstall whole TorBOX-Workstation.

# XChat settings from https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/XChat with the exception,
# of the SOCKS settings. XChat gets its own SocksPort on TorBOX-Gateway, to prevent Identity correlation through
# circuit sharing.

# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/home/user/.xchat2/xchat.conf
# xchat.conf
sudo -u $USERNAME mkdir .xchat2

echo "
# By default, XChat based IRC software, when started-up, or run for first time,
# it starts to use local network, to connect to the internet. To prevent that,
# and to force it, to use Tor proxy (a Socks5 server):
#
# /set net_proxy_host 192.168.0.1
# /set net_proxy_port 9101
# /set net_proxy_type 3
# /set net_proxy_use 0
net_proxy_host = 192.168.0.1
net_proxy_port = 9101
# Technical note: 3 = socks5
net_proxy_type = 3
# Technical note: Do not worry. 0 is not equal to "off". 0 stands for "All".
#                 Check yourself https://toxin.jottit.com/xchat_set_variables
net_proxy_use = 0

# XChat should not use the same circuit/exit server as other Tor applications.
# Otherwise activity in different applications could be correlated to the same
# pseudonym. There is a way to prevent that.
# It is called stream isolation. We use IsolateSOCKSAuth, 
# see https://www.torproject.org/docs/tor-manual-dev.html.en
# The password is actually not required, but it does not hurt either.
# Will probable not hurt on Tor 0.2.2 and below.
# Works with Tor 0.2.3 and above.
#
# /set net_proxy_auth 1
# /set net_proxy_pass = XChat
# /set net_proxy_user = XChat
#
net_proxy_auth = 1
net_proxy_pass = XChat
net_proxy_user = XChat

# Get rid of protocol leaks:
# a DCC session can reveal IP address, etc. identd flag can reveal your
# username which you use to login in your OS(Windows/Linux/Unix/MacOS) profile.
# To prevent those:
#
# /set dcc_auto_chat 0
# /set dcc_auto_resume OFF
# /set dcc_auto_send 0
# /set irc_hide_version ON
# /set identd OFF <-- NOT working on all XChat-based IRC software.
# But still highly suggested to include & use it.
# Probable not needed on UNIX, source: http://xchat.org/faq/#q21 
dcc_auto_chat = 0
dcc_auto_resume = 0
dcc_auto_send = 0
irc_hide_version = 1
identd = 0

# If you use your own comment instead of default values, then these data are
# posted on each channel when you do these events: JOIN, PART, QUIT, AWAY.
# So they can reveal who you actually are, when you are using same XChat
# software for multiple different nicknames.
#
# Delete everything under Settings -> Preferences -> Default Messages:
# -> Quit: <Deleted everything!>
# -> Leave channel: <Deleted everything!>
# -> Away: <Deleted everything!>
away_reason = 
irc_part_reason = 
irc_quit_reason = 

# By default, XChat based IRC software uses your platform OS(Operating System)s
# login user name as your nickname, user name, real name.  To prevent leaking
# that, and, to use your own choice of nickname, realname, username:
#
# ***Pseudonymous vs. anonymous IRC use.***
# Actually IRC is pseudonymous. Your nickname might also reveal something about
# your origin, interests, etc. You can make IRC more anonymous by choosing a more
# meaningless nickname. Use the following defaults if you want to be more anonymous.
# If user, user_ and user___ are already taken, add more _ or start using user1,
# user2, user3, etc. Or if the irc network auto assigns your a nickname, i.e.
# guest532, stick with that nickname.
#
# Of course, you are free to continue using IRC in a pseudonymous manner.
# In that case, instant of user, choose your nickname.
#
# /set irc_real_name user
# /set irc_user_name user
# /set irc_nick1 user
# /set irc_nick2 user_
# /set irc_nick3 user__
irc_real_name = user
irc_user_name = user
irc_nick1 = user
irc_nick2 = user_
irc_nick3 = user__

# Use a more common nick completion suffix:
# When you write the first few characters of a nickname followed by tab,
# it will, by XChat default, complete the nickname and ", " behind the
# nickname. The behavior is XChat specific. The " :" is more more common
# for more common clients such as mIRC.
#
# XChat -> Settings -> Preferences -> input box -> completion_suffix set to :
#
completion_suffix = :

# Not starting the server windows at the beginning so you can check and set
# settings before connecting to any IRC networks.
gui_slist_skip = 1
" | sudo -u $USERNAME tee .xchat2/xchat.conf

# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/home/user/.xchat2/ignore.conf
# Disable DCC and CTCP replies.
echo '
# Issue/Use do this, to block the CTCP, DCC commands and
# inquiries sent toward your IRC client software:
#
# /ignore *!*@* CTCP DCC
# /ignore * CTCP DCC
mask = *
type = 136
mask = *!*@*
type = 136
' | sudo -u $USERNAME tee .xchat2/ignore.conf

# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/home/user/.xchat2/ctcpreply.conf
# Remove all ctcpreplies.
echo "
# new and empty
# no CTCP replies
#
# Same as:
# Go to Settings -> Advanced -> CTCP Replies, delete everything and safe. Check again if everything is empty.
" | sudo -u $USERNAME tee .xchat2/ctcpreply.conf

# Remove all IRC servers but the TLS version of Tors official #Tor on OFTC.
# On port 9999, since that is not banned by so many Tor exit nodes.
# http://www.oftc.net/oftc/
# The OFTC TLS certificate is included in the package ca-certificates.
# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/home/user/.xchat2/servlist_.conf
echo '
N=OFTC
E=IRC (Latin/Unicode Hybrid)
F=23
D=0
S=irc.oftc.net/9999
' | sudo -u $USERNAME tee .xchat2/servlist_.conf

# The following two commands require root.

# 1) Prepare directory for the disabled plugins.
mkdir -p /usr/lib/xchat/plugins.disabled/

# Disable unnecessary plugins (keep perl for sasl).
#   mv /usr/lib/xchat/plugins/{python.*,tcl.*} /usr/lib/xchat/plugins.disabled/

# 2) Move all plugins to plugins.disabled.
mv /usr/lib/xchat/plugins/* /usr/lib/xchat/plugins.disabled/ || true
}



optional_hiddenserver() {
echo "
######################################################
# Optional hidden webserver, using lighttpd as an example
######################################################
"

echo "INFO: Installing lighttpd..."
sudo apt-get install lighttpd

echo "INFO: Backing up web server configuration files..."
cp -nr /etc/lighttpd/ /etc/lighttpd.backup/

echo "INFO: Configuring web server..."
# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/etc/lighttpd/lighttpd.conf
echo "\
server.port                = 12345
" >> /etc/lighttpd/lighttpd.conf

echo "INFO: Restarting web server..."
service lighttpd restart
}



set_sysctl() {
echo "
######################################################
# set_sysctl
######################################################
"

# no trap function yet

# Let the kernel only swap if it is absolutely necessary.
# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/etc/sysctl.conf
echo "
# Appended by TorBOX to /etc/sysctcl.conf
vm.swappiness=0
# End of TorBOX appends to /etc/systcl.conf
" >> /etc/sysctl.conf

sysctl -p
}



create_swap_file() {
echo "
######################################################
# create_swap_file
######################################################
"
# Source: http://www.cyberciti.biz/faq/linux-add-a-swap-file-howto/

# Creating 512 MB swap file.
echo "INFO: Creating /swapfile1... This may take a while..."
dd if=/dev/zero of=/swapfile1 bs=1024 count=524288
echo "INFO: Created /swapfile1."

# Format swapfile.
mkswap /swapfile1 --uuid 0615ba72-85b0-4183-8d54-300bb0d2e491

# Set permissions.
chown root:root /swapfile1

# Set permissions.
chmod 0600 /swapfile1

# Should be probable omitted. No need. Will be restarted so or so.
# swapon /swapfile1
}



config_uuids_fstab() {
# code shared between TorBOX_Workstation and TorBOX_Gateway script.

echo "
######################################################
# Configuring disk uuids and /etc/fstab
######################################################
"
# Change uuid of hdd created by operating system installer.
# WARNING: This assumes you used "Guided - use entire disk" partitioning (NOT LVM!)
tune2fs /dev/sda1 -U 26ada0c0-1165-4098-884d-aafd2220c2c6

# Deactivate swap partition. Will not be created when using preseed.
# Deactivating anyway just in case anyone manually installs the operating system.
swapoff /dev/sda5 || true

# Share the same uuid among all TorBOX users.
# Setting anyway just in case anyone manually installs the operating system
# and then applies the script.
mkswap /dev/sda5 -U 9159bf6e-e242-4510-b4c1-348db252feff || true

echo "
# /etc/fstab: static file system information.
#
# Use blkid to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).

# <file system> <mount point>   <type>  <options>       <dump>  <pass>
proc            /proc           proc    nodev,noexec,nosuid 0       0

# TorBOX /etc/fstab changes.

# HDD created by operating system installer.
# Disk UUID changed by TorBOX.
UUID=26ada0c0-1165-4098-884d-aafd2220c2c6 /               ext4    noatime,errors=remount-ro 0       1

# Swap partition NOT created by TorBOX preseed installation method.
# Disk UUID changed by TorBOX.
# The swap partition has been removed in favor of a swap file.
# Advantage: with a swap file its easier to grow the virtual hdd
# and to add the new space to the filesystem.
# UUID=9159bf6e-e242-4510-b4c1-348db252feff none            swap    sw              0       0

# Swap file created by TorBOX.
# Disk UUID changed by TorBOX.
# UUID=0615ba72-85b0-4183-8d54-300bb0d2e491
/swapfile1 swap swap defaults 0 0

# End of TorBOX /etc/fstab changes.
" > /etc/fstab

update-grub2
grub-install /dev/sda
}



config_network() {
echo "
######################################################
# Configuring eth0 which is going to be attached to TorBOX-Gateway
######################################################
"

#ifdown -a

# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/etc/resolv.conf
echo "nameserver 192.168.0.1" > /etc/resolv.conf

# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/etc/network/interfaces
echo '
# This file gets overwritten when issuing TorBOX-Workstation -update.

# for more information, see interfaces(5)
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
# increment last octet on additional workstations
address 192.168.0.2
       netmask 255.255.255.0
       network 192.168.0.0
       broadcast 192.168.0.255
       gateway 192.168.0.1
       # SPLITOFF torboxfirewall.sh to /home/user/TorBOX_source/TorBOX_Workstation/usr/local/bin/twfirewall
       pre-up /etc/torboxfirewall.sh
' > /etc/network/interfaces

#ifup -a
}



firewall_setup() {
# TorBOX-Workstation script does not have a trap function yet.
# trap "roll_back" ERR INT TERM
echo "
######################################################
Set up Firewall.
######################################################
"

# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/usr/local/bin/twfirewall
echo \
'#!/bin/sh

# This file gets overwritten when issuing TorBOX-Workstation -update.

# This firewall is disabled by default.
# Comment out the following exit 0 to enable it.
exit 0

# WARNING! Do not use single quotes/apostrophes in the firwall comments!!!

# NOTE: If you make changes to this firewall, think about, if it would
#       make sense, to add the changes to TorBOX-Gateway script as well.
#       Some things, like drop invalid packages, should be shared.

# DESIGN NOTES:
# - This firewall script provides only damage limitation.
#   - Some additional security.
#   - For example, if Tor on TorBOX-Gateway were compromised through a
#     zero day exploit, it were harder to attack TorBOX-Workstation, which might
#     contain confidential data.
#   - In future, there will be an optional feature, to chain more than one
#     Gateway, you can have a separate Gateway for SSH, proxy or VPN which all
#     will be independent from each other.
#   - When using multiple TorBOX-Workstations, this offers some protection from
#     attacks from compromised TorBOX-Workstations, see
#     TorBOX / Security and Hardening for details.
# - This firewall script might also enhance the connectivity of certain
#   custom installed applications, because it rejects traffic, which is
#   not supported by Tor so or so, such as UDP and ICMP. For example, ping
#   will fail instantly (reject), instant of waiting for a timeout (drop).
# - This firewall is less important than the TorBOX-Gateway firewall.
# - Staying anonymous, is by TorBOX design, not dependent on TorBOX-Workstations
#   firewall. You could drop this firewall at all and were still anonymous.
#   This was always and will always be that way for all TorBOX versions.
# - TorBOX-Gateways firewall is responsible for routing all traffic over Tor.

# - Should allow unlimited TCP/UDP/IPv6 traffic on the virtual external interface (OnionCat / OpenVPN).

# source for some rules:
# http://www.cyberciti.biz/faq/ip6tables-ipv6-firewall-for-linux/

###########################
# /etc/torboxfirewall.sh
###########################

echo "OK: Latest firewall updates can always be found here:"
echo "OK: https://trac.torproject.org/projects/tor/wiki/doc/TorBOX"
echo "OK: Loading TorBOX firewall..."

###########################
# VARIABELS
###########################

# Not in use/defined yet.
# INT_IF could be the internal network.
# EXT_IF could be an additional virtual network adapter,
#        such as OnionCat or OpenVPN.

# External interface
EXT_IF='$EXT_IF'
# Internal interface
INT_IF='$INT_IF'

###########################
# IPv4 DEFAULTS
###########################

# Set secure defaults.
iptables -P INPUT DROP

# FORWARD rules does not actually do anything if forwarding is disabled. Better be safe just in case.
iptables -P FORWARD DROP

# Will be lifted below.
iptables -P OUTPUT DROP

###########################
# IPv4 PREPARATIONS
###########################

# Flush old rules.
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X

############################
# IPv4 DROP INVALID PACKAGES
############################

# DROP INVALID
iptables -A INPUT -m state --state INVALID -j DROP

# DROP INVALID SYN PACKETS
iptables -A INPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

# DROP PACKETS WITH INCOMING FRAGMENTS. THIS ATTACK ONCE RESULTED IN KERNEL PANICS
iptables -A INPUT -f -j DROP

# DROP INCOMING MALFORMED XMAS PACKETS
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# DROP INCOMING MALFORMED NULL PACKETS
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

###########################
# IPv4 INPUT
###########################

# Traffic on the loopback interface is accepted.
iptables -A INPUT -i lo -j ACCEPT

# Established incoming connections are accepted.
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

#+# OptionalFeatureNr.2#
#+# Uncomment the following line, if you want to use a Hidden Service
#+# on port 12345.
#iptables -A INPUT -p tcp --dport 12345 -j ACCEPT

# Reject anything not explicitly allowed above.
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable

###########################
# IPv4 FORWARD
###########################

iptables -A FORWARD -j DROP

###########################
# IPv4 OUTPUT
###########################

# Allow unlimited traffic on localhost.
iptables -A OUTPUT -o lo -j ACCEPT

# Allow TorBOX-Workstation to query TorBOX-Gateway for DNS.
iptables -A OUTPUT -p udp --dport 53 --dst 192.168.0.1 -j ACCEPT

# Not sure about the next one. UDP is not supported by Tor, why not
# block any outgoing UDP. Might have unwanted side effects when tunneling
# UDP over Tor.
# https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/OptionalConfigurations/TunnelingUDPoverTor
#
# All other non-TCP protocol traffic gets rejected.
# iptables knows 7 different protocols and all.
# (tcp, udp, udplite, icmp, esp, ah, sctp or all)
#
# The following rule (1) does for some unknown reason, not make rule (2) redundant.
# (1) iptables -A OUTPUT -p udp -j REJECT --reject-with icmp-port-unreachable -> (3)
# (2) iptables -A OUTPUT -p icmp -j REJECT --reject-with icmp-port-unreachable -> (4)
#
# (3) ping torproject.org
#     4 packets transmitted, 0 received, 100% packet loss, time 3000ms
#
# (4) ping torproject.org
#     From 192.168.0.2 icmp_seq=1 Destination Port Unreachable
#     0 packets transmitted, 0 received, +100 errors
#
# The next rule ensures, that only tcp can leave and archives the desired result from (4).
iptables -A OUTPUT ! -p tcp -j REJECT --reject-with icmp-port-unreachable

# Allow full outgoing connection but no incoming stuff.
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Logging in case, needed for debugging.
#iptables -A OUTPUT -j LOG

# Reject all other outgoing traffic.
iptables -A OUTPUT -j REJECT --reject-with icmp-port-unreachable

###########################
# IPv6
###########################

# Policy DROP for all traffic as fallback.
ip6tables -P INPUT DROP
ip6tables -P OUTPUT DROP
ip6tables -P FORWARD DROP

# Flush old rules.
ip6tables -F
ip6tables -X
ip6tables -t mangle -F
ip6tables -t mangle -X
 
# Allow unlimited access on loopback.
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT

# Logging in case, needed for debugging.
#ip6tables -A INPUT -j LOG

# Drop/reject all other traffic.
ip6tables -A INPUT -j DROP
ip6tables -A OUTPUT -j REJECT --reject-with icmp6-port-unreachable
ip6tables -A FORWARD -j DROP

###########################
# End
###########################

echo "OK: The firewall should show any messages besides output beginning with prefix OK:..."
echo "OK: TorBOX firewall loaded."
' > /etc/torboxfirewall.sh

chmod +x /etc/torboxfirewall.sh
}


# SPLITOFF all the files must go into their own files.
# /home/user/TorBOX_source/TorBOX_Workstation/usr/local/bin/leaktest
# /home/user/TorBOX_source/TorBOX_Workstation/usr/share/leaktest/simple_ping.py
# etc.
leaktest_tw() {
#trap "roll_back" ERR INT TERM

# leaktest_tg() does nothing dangerous.
# It creates only /usr/share/leaktest/ and /usr/local/bin/leaktest
# The neccessary software for leak testing will be only installed,
# if you run /usr/local/bin/leaktest.

echo "
######################################################
# Creating leaktests
######################################################
"

# Create the leaktest folder.
mkdir -p /usr/share/leaktest/

echo "
########################
#Creating simple_ping.py
########################
"

echo '
#! /usr/bin/env python

# This file gets overwritten when issuing TorBOX-Workstation -update.

# Since it will be useful to know something about the script,
# for the later tests, the terms are defined here:
# (A discussion of Python language structure is beyond
# the scope of this document)

# [1] http://en.wikipedia.org/wiki/Ipv4
# [2] http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol
# [3] http://en.wikipedia.org/wiki/IP_routing
# [4] http://en.wikipedia.org/wiki/Ping
# [5] http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#List_of_permitted_control_messages_.28incomplete_list.29
# [6] http://www.secdev.org/projects/scapy/doc/usage.html#send-and-receive-packets-sr
# [7] http://www.secdev.org/projects/scapy/doc/usage.html#stacking-layers

import sys
from scapy.all import *

# define the target gateway & data payload
target = "192.168.0.1"
data = "testing"

# define packets
# These define two variables, that are set to the object types IP
# and ICMP respectively. These objects in Scapy define the protocol
# type for IP (default IPv4) [1] and ICMP [2] respectively.
# And will send packets on the wire of these types when used. 
ip = IP()
icmp = ICMP()

# define packet parameters
ip.dst = target

# IP packets are used for routing [3] between networks on the Internet.
# So, we assign the destination (dst) in the IP portion of the
# packet we are going to assemble and send out.
icmp.type = 8
icmp.code = 0

# Defines the type of ICMP message to send out. The ..8 type.. is
# a type defined as ..echo request.., e.g. a simple ping [4].
# See a list here of  various types of ICMP [5] messages here.

# The sr1() [6] command will ..send and receive network traffic,
# returning the 1st packet received...
# The notation of ..ip/icmp/data.. is the notation for encapsulation
# of various instances of networking protocols [7].
# Read it right to left: ..data encapsulated inside an ICMP message
# and encapsulated inside an IP datagram...
test_ping = sr1(ip/icmp/data)

if isinstance(test_ping, types.NoneType):
        print "No response"
else:
# Prints a short report on the packet received (if any). 
        test_ping.summary()
' > /usr/share/leaktest/simple_ping.py

echo "
#################################
#Creating exhaustive_ip_send.py
#################################
"

echo '
#! /usr/bin/env python

# This file gets overwritten when issuing TorBOX-Workstation -update.

import sys
from scapy.all import *

#define the target gateway & data payload
target = "google.com"
data = "testing"

#define packet
ip = IP()

#define packet parameters
ip.dst = target

#loop through all IP packet types
for ip_type in range(0,255):
        ip.proto = ip_type
        send(ip/data)
' > /usr/share/leaktest/exhaustive_ip_send.py

echo "
#################################
#Creating tcp_test.py
#################################
"

echo '
#! /usr/bin/env python

# This file gets overwritten when issuing TorBOX-Workstation -update.

import sys
from scapy.all import *

#define the target gateway & data payload
target = "google.com"
data = "testing"

#define packets
ip = IP()
tcp = TCP()

#define packet parameters
ip.dst = target

#loop through all TCP ports
for tcp_port in range(0,65535):
        tcp.dport = tcp_port
        send(ip/tcp/data)
' > /usr/share/leaktest/tcp_test.py

echo "
#################################
#Creating udp_test.py
#################################
"

echo '
#! /usr/bin/env python

# This file gets overwritten when issuing TorBOX-Workstation -update.

import sys
from scapy.all import *

#define the target gateway & data payload
target = "google.com"
data = "testing"

#define packets
ip = IP()
udp = UDP()

#define packet parameters
ip.dst = target

#loop through all TCP ports
for udp_port in range(0,65535):
        udp.dport = udp_port
        send(ip/udp/data)
' > /usr/share/leaktest/udp_test.py

echo "
#################################
# Creating leaktest script...
#################################
"

echo '
#!/bin/bash

# This file gets overwritten when issuing TorBOX-Workstation -update.

# Exit if there is an error
set -e

# Check if we are root
  if [ "$(id -u)" != "0" ]; then
     echo "leaktest: This script must be run as root (sudo)"
     exit 1
  fi

echo "leaktest: Installing python-scapy, if it is not installed yet."
# Install scapy to the TorBOX-Workstation for Leak Testing.
apt-get --yes install python-scapy

echo "leaktest: Starting leak test, hit ctrl+c to abort..."
echo "leaktest: Make sure leaktest is already running on TorBOX-Gateway."

echo "leaktest: python /usr/share/leaktest/exhaustive_ip_send.py..."
python /usr/share/leaktest/exhaustive_ip_send.py
echo "leaktest: python /usr/share/leaktest/tcp_test.py..."
python /usr/share/leaktest/tcp_test.py
echo "leaktest: python /usr/share/leaktest/udp_test.py..."
python /usr/share/leaktest/udp_test.py

echo "leaktest: You may uninstall python-scapy manually using:"
echo "          sudo apt-get remove python-scapy"
echo "leaktest: Leaktest finished."
echo "leaktest: See TorBOX/LeakTestsOld on instructions how to interpret the results."
' > /usr/local/bin/leaktest

chmod +x /usr/local/bin/leaktest
}


# SPLITOFF /home/user/TorBOX_source/TorBOX_Shared/usr/local/bin/torcheck
create_torcheck_script() {
echo "
######################################################
Creating torcheck script.
######################################################
"

echo '
#!/bin/bash

#echo "
# Temporarily moved to https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/Dev/torcheck
# You can get it form there.
# 
# Until we figured out https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/Dev#torcheckscriptdiscussion
#"
#' > /usr/local/bin/torcheck

chmod +x /usr/local/bin/torcheck
}



modify_crontab() {
# TODO: Please review. If it is ok, delete this one.

# Adds torcheck script. Also note the following link when
# you are about to add graphical applications to cron.
# http://promberger.info/linux/2009/01/02/running-x-apps-like-zenity-from-crontab-solving-cannot-open-display-problem/
 
# Add crontab.
# cron.daily will run as root, but the script will be executed as user.
# Otherwise wget would run as root.
# SPLITOFF /home/user/TorBOX_source/TorBOX_Workstation/etc/cron.daily/torcheck
echo "
#!/bin/bash
# torcheck script by TorBOX
sudo -u $USERNAME /usr/local/bin/torcheck &
#end of crontab
" > /etc/cron.daily/torcheck

# Make crontab script executable.
chmod +x /etc/cron.daily/torcheck
}



create_rc_local() {
trap "roll_back" ERR INT TERM
echo "
######################################################
Fixing, recreating /etc/rc.local
######################################################
"

# /etc/rc.local was (ab)used by TorBOX-Image -tX-copyinto
# to run TorBOX_$VM script once. That is because TorBOX_$VM
# scripts get executed inside the VM. We restore /etc/rc.local
# here. A new TorBOX-Image -tX-copyinto would overwrite it
# again.

# Using "" because the $USERNAME should be converted to "user"
# by the TorBOX_Gateway script.
echo "#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.

# TorBOX changes to /etc/rc.local.

# TorBOX WARNING: 
# Better make a backup of this script if you want to make changes.

echo \"rc.local: Start...\"
set -x
setterm -blank 0 -powerdown 0
sudo -u $USERNAME setterm -blank 0 -powerdown 0
echo \"rc.local: End.\"

# End of TorBOX changes to /etc/rc.local.

exit 0
" > /etc/rc.local
}



# SPLITOFF, perhaps to /home/user/TorBOX_source/TorBOX_Shared/slim_down
slim_down() {
echo "
######################################################
Slim down the system.
######################################################
"
# Remove unnecessary packages to slim down the system.
# This list contains only packages, which waste space and are not required.
# Unsafe or problematic packages are being removed with apt_get().
apt-get --yes remove --purge xserver-xorg-video-all xserver-xorg-video-ati xserver-xorg-video-fbdev \
xserver-xorg-video-geode xserver-xorg-video-intel xserver-xorg-video-mach64 xserver-xorg-video-mga \
xserver-xorg-video-neomagic xserver-xorg-video-nouveau xserver-xorg-video-openchrome \
xserver-xorg-video-qxl xserver-xorg-video-r128  xserver-xorg-video-radeon xserver-xorg-video-s3 \
xserver-xorg-video-savage xserver-xorg-video-siliconmotion xserver-xorg-video-sis xserver-xorg-video-sisusb \
xserver-xorg-video-tdfx xserver-xorg-video-trident xserver-xorg-video-vmware fuse command-not-found* \
geoip-database sound-theme-freedesktop fuse-utils aptitude pciutils hdparm lshw ftp parted telnet \
mlocate ufw ppp pppconfig pppoeconf bind9-host dosfstools strace mtr-tiny

echo "Cleaning up..."

# Not sure about those:
# apt-get --yes remove --purge manpages man-db perl bash-completion 

# Remove openssh-server.
apt-get --yes remove --purge openssh-server || true

# Kill dhclient3 to prevent rewrite of /var/lib/dhcp/*.
killall dhclient3 || true
# There are .leases.
rm /var/lib/dhcp/*.leases || true
# And there are .lease.
rm /var/lib/dhcp/*.lease || true
# We are best of deleting the whole folder.
rm -r /var/lib/dhcp/* || true

# Better save than sorry.
# rm /etc/resolv.conf || true
echo "nameserver 192.168.0.1" > /etc/resolv.conf

# Cleanup.
apt-get --yes autoremove --purge || true
apt-get --yes clean || true

# Killing rsyslog so we can remove logs.
stop rsyslog || true

# Delete logs and other stuff.
rm -r /tmp/* || true
rm /var/log/installer/* || true
rm -r /var/cache/apt/* || true
rm -r /var/lib/apt/lists/* || true
rm -r /var/log/installer || true
rm /var/lib/dpkg/*-old || true
rm /var/cache/debconf/*-old || true
# Erase rotated logs (usually wont appear unless you left your VM running for several days).
rm /var/log/*.[0-9] || true
rm /var/log/*.[0-9].gz || true

# Truncate all log files, keeping user group and perms.
find /var/log -type f -exec cp /dev/null {} \;

# TODO
# Which are safe?
# rm /usr/share/icons/nuoveXT2/icon-theme.cache
# cd /usr/share/locale &&  ls | grep -v en | xargs rm -r && cd /home/$USERNAME
# rm -r /usr/share/doc/* #(are we even allowed to do that, see licenses?)

# Take care of development leaks and make resulting ova image smaller.
# Since VBox export works below the FS level it will keep deleted files (and the ova will stay large). 
# This also ensure that possible leaks we deleted before are really deleted.
echo "Wiping free space. This can take a while."
dd if=/dev/zero of=./zerofile bs=1024 || true

# Flush the zero-file to disk before removing it.
sync

# Delete the zero-file.
rm ./zerofile || true

# Flush again after rm.
sync

# Delete bash history.
rm /home/$USERNAME/.bash_history
history -c
}


# SPLITOFF the whole Tor Browser related scripts should be moved into their own file
#          /home/user/TorBOX_source/TorBOX_Workstation/usr/local/bin/torbrowser-update 
# Please keep in mind, we allow -update-torbrowser to run without root. If you ever make some changes,
# to ask_tb_update(), which require root, please disallow running the script without root.
ask_tb_update() {
#################################
# prompt user about TBB update.
#################################
cd /home/$USERNAME
rm -r tbbdownload/
sudo -u $USERNAME mkdir tbbdownload
cd tbbdownload

echo "
#################################
# Getting latest version number
#################################
"

sudo -u $USERNAME wget --output-document RecommendedTBBVersions https://check.torproject.org/RecommendedTBBVersions
TBBVERSION=`grep Linux-i686 RecommendedTBBVersions |egrep -v 'alpha|x86_64'|awk '{sub(/^"/,"")}1'|awk '{sub(/-Linux-i686",/,"")}1'|tail -1`

echo "
#################################
# Getting currently installed version number
#################################
"

# Will fail if the file does not exist. Will not break the script.
# TODO:
# - (proper) Lets hardcode the path to /home/$USERNAME/tor-browser_en-US/Docs/changelog ?
# - (proper) Needs to be changed/fixed in torcheck as well, since torcheck is currently broken.
#   (torcheck is in /usr/local/bin/torcheck and .. relative paths do not work there.)
TBBINSTALLEDVERSION=`head -1 ../tor-browser_en-US/Docs/changelog|awk -F '[()]' '{print $2}'`

current="$TBBINSTALLEDVERSION"
check=""

if [ "$current" != "$check" ];
then
	echo "INFO: Successfully detected Tor Browser version."
else
	echo "INFO: Could not determine the currently installed Tor Browser version."
	echo "INFO: This could be either because none is installed or because the version format changed."
	TBBINSTALLEDVERSION="UNKNOWN"
fi

echo "Please close TorBrowswer if you want to upgrade!"
echo "TBB version $TBBINSTALLEDVERSION is currently installed. Do you want to replace it with $TBBVERSION?"
echo 'If your currently installed version is higher you are likely victim of a downgrade attack, SAY NO NOW!'
echo "If your currently installed version is lower you should upgrade, if it matches say no now."
echo "WARNING: YOUR BROWSER WILL BE KILLED."
echo "WARNING: YOUR WHOLE BROWSER PROFILE INCLUDING BOOKMARKS AND PASSWORDS WILL GET REPLACED!"
echo "INFO: The old browser and settings are automatically backed up" 
echo "INFO: It's a good idea to delete old TBB backups once in a while if you are running low with disk space."
echo -n "Do you want to upgrade? [y/N]"

read answer

if test "$answer" != "Y" -a "$answer" != "y";
then 
	cd /home/$USERNAME
	echo "INFO: Deleting temporary folder tbbdownload."
	sudo -u $USERNAME rm -r tbbdownload
	# Exit this function.
	return
fi

echo "
#################################
# Killing TorBrowser if it is still running.
#################################
"

killall firefox

echo "
#################################
# Starting TBB download and installation
#################################
"

config_torbrowser
}



uninstall_tw() {
cd /home/$USERNAME
cp /etc/init/tty6.conf.backup /etc/init/tty6.conf
cp /etc/network/interfaces.backup /etc/network/interfaces
cp /etc/sudoers.backup /etc/sudoers
chmod 0440 /etc/sudoers

rm -r /etc/lighttpd/
mv /etc/lighttpd.backup/ /etc/lighttpd/

sudo -u $USERNAME cp .bashrc.backup .bashrc 
sudo -u $USERNAME cp .gtkrc-2.0.backup .gtkrc-2.0 
sudo -u $USERNAME cp .profile.backup .profile
sudo -u $USERNAME cp .gnupg/gpg.conf.backup .gnupg/gpg.conf

rm -r .xchat2/
rm -r .config/openbox/
rm -r tor-browser_en-US/
rm .config/libfm/libfm.conf
rm -r leaktest/
rm /usr/local/bin/leaktest
rm /usr/local/bin/torcheck
rm -r tbbdownload/
rm /usr/local/bin/{apt-get,gpg,ssh,torsocks,uwt,git,htpdate,usewithtor,wget}
echo "You need to fix /etc/resolv.conf manually!"
}



######################################################
# install TorBOX-Workstation
######################################################
if [[ "$1" = "-install" ]]; then
root_check                 # Depends on nothing.

set_sysctl                 # Depends on root_check, being run only once.
create_swap_file           # Depends on root_check, not being run again when in use.
config_uuids_fstab         # Depends on root_check, not being run again after adding new hdds.
config_etc                 # Depends on root_check. Provides UTC timezone.
create_fix_sources_list    # Depends on root_check, not being run after the user modified sources.list.

# http://lifeonubuntu.com/how-to-prevent-server-daemons-from-starting-during-apt-get-install/
# Prevents Tor from connecting the the public Tor network while building
# (for bridge users). Should also take care of chroot mount getting locked
echo "#!/bin/sh
exit 101" > /usr/sbin/policy-rc.d
chmod 755 /usr/sbin/policy-rc.d

apt_get                    # Depends on root_check, create_fix_sources_list, working internet connection, UTC.
config_grub                # Depends on root_check, being run only once.
set_dbusmachineid          # Depends on root_check, apt_get

torsocks_patch             # Depends on root_check, working internet connection.

base_desktop               # Depends on root_check, working internet connection.
config_audio               # Depends on base_desktop.
config_home                # Depends on being run only once.
config_openbox             # Depends on apt_get
create_gui_autostarts      # Depends on nothing.
config_pcmanfm             # Depends on apt_get
config_torbrowser          # Depends on working internet connection, calls create_tb_user_js

install_uwt                # Depends on root_check.
install_uwt_wrappers       # Depends on root_check. Breaks internet connection!

leaktest_tw                # Depends on nothing.
config_xchat               # Depends on nothing.
#+# #OptionalFeatureNr.2#
#optional_hiddenserver     # Depends on root_check.

# Disabled because taken care by debootstrap
# TODO: what about other installation methods?
#        (proper) Should we not rather  drop other installation methods for simplicity
#                 and improved maintainability?
#create_torcheck_script    # Depends on root_check.

modify_crontab             # Depends on nothing.

firewall_setup             # Depends on root_check.
config_network             # Depends on root_check. Breaks internet connection!

# make daemons start again
rm -f /usr/sbin/policy-rc.d

create_rc_local            # Depends on root_check, not being run again /etc/rc.local got modified by the user.
slim_down                  # Depends on root_check, being last function.

echo '
Script completed, this indicates neither success nor failure.
E.g.: Check that TBB downloaded successfully ("ls ~" will tell you)

Do not forget to change VBox Adapter 1 to Internal Network, Name:"torbox"
' >&2
exit 0
fi



################################################################ 
# update TorBOX-Workstation                                       #
################################################################ 
if [[ "$1" = "-update" ]]; then
root_check
## If this does not work or is not thorough enough, first -uninstall, then -install again
apt_get                    # Depends on root_check, working internet connection, UTC.
base_desktop               # Depends on root_check, working internet connection.
create_gui_autostarts      # Depends on nothing.
install_uwt                # Depends on root_check.
install_uwt_wrappers       # Depends on root_check. Breaks internet connection!
create_tb_user_js          # TODO: remove if it works: What is defunct?
leaktest_tw                # Depends on nothing.
#create_torcheck_script    # Depends on root_check.
modify_crontab             # Depends on nothing.
ask_tb_update              # calls config_torbrowser which calls create_tb_user_js
exit 0
fi



################################################################ 
# xchat                                                        #
################################################################ 
if [[ "$1" = "-xchat" ]]; then
echo "INFO: Resetting your IRC XChat identity..."
killall xchat
rm -r .xchat2
config_xchat
echo "INFO: Done."
echo "INFO: Be sure to change your circuit before you reconnect to IRC!"

exit 0
fi



################################################################ 
# update-torbrowser                                            #
################################################################ 
if [[ "$1" = "-update-torbrowser" ]]; then
ask_tb_update # calls config_torbrowser which calls create_tb_user_js
exit 0
fi



################################################################ 
# -hiddenserver                                                #
################################################################ 
if [[ "$1" = "-hiddenserver" ]]; then
root_check
optional_hiddenserver
exit 0
fi



################################################################ 
# -uwt                                                         #
################################################################ 
if [[ "$1" = "-uwt" ]]; then
root_check
install_uwt
install_uwt_wrappers
create_tb_user_js
exit 0
fi



################################################################ 
# uninstall TorBOX-Workstation                                    #
################################################################ 
if [[ "$1" = "-uninstall" ]]; then
root_check
uninstall_tw
exit 0
fi



################################################################ 
# help                                                         #
################################################################ 
if [[ "$1" = "-help" ]]; then
script_help
exit 0
fi



################################################################ 
# no option chosen                                             # 
################################################################ 
if [[ "$1" = "" ]]; then 
echo "
INFO: No option chosen.

Please run TorBOX-Workstation -help to find out more.
"

exit 0
fi
###################################################################################################################

# TODO: Add this.
#
# Touching the default browser.startup.homepage is not a good idea, since TorButton sets the
# "up to date" or "not up to date" homepage.
#
#  we don't need that anymore, with torcheck implemented we can keep the readme as the homepage
#   (proper) When TorButton is updated and version format is changed, torcheck in tbb will still
#            continue to work.
#             in that case zenity should prompt the user to visit check.tpo. Not that the code below doesn't help in that case either.
#               (proper) When visiting check.torproject.org manually, Tor Browser will not notify about updates. Afaik this only happens
#                        on startup and the default homepage has not been touched and still is check.tpo.
#                        That code would help in that case. If Tor Button gets updated, everyone gets the Tor Button update and if the
#                        version format changes at the same time, Tor Buttons update notification will continue to work.
#               (proper) Now that torcheck uses TransPort instant of SocksPort (see torcheck script comments), leaving check.tpo in
#                        Tor Browser would also demonstrate, that stream isolation is functional.
#                           The Tor Button update check used to be broken and report false positives when being run behind a transparent proxy and probably socks port, we should test that again. If it's still broken that's a very good reason to keep the default home page changed.
#                               (proper) Test: I used my archived old tor-browser-gnu-linux-i686-2.2.35-12-dev-en-US.tar.gz,
#                                        used the fixed startup script and my revised user.js. Result: Update check works when using SocksPort 192.168.0.1 9100.
#                               (proper) The problem with the code below is also, it opens Tor Browser and the readme only once after boot.
#                                        But we should show the readme/news each time the users starts Tor Browser. We could let the script run permanently,
#                                        safe the Tor Browser pid in memory and each time there is a new pid open the readme.

#!/bin/bash
#if [ "$(pgrep firefox)" = "" ]; then
#   echo "Starting TorBrowser"
#   ~/tor-browser_en-US/start-tor-browser &
#else
#   echo "TBB is already running"
#fi
#
#while [ "$(xlsclients | grep firefox)" = "" ]
#do
#   sleep 3
#done
#
#echo "Opening TorBOX Readme"
#~/tor-browser_en-US/App/Firefox/firefox --profile Data/profile -new-tab https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/Readme