]> pere.pagekite.me Git - homepage.git/blob - blog/Always_download_Debian_packages_using_Tor___the_simple_recipe.html
07442095aa632172e3336918e3a2119d634dd81c
[homepage.git] / blog / Always_download_Debian_packages_using_Tor___the_simple_recipe.html
1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
4 <head>
5 <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
6 <title>Petter Reinholdtsen: Always download Debian packages using Tor - the simple recipe</title>
7 <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
8 <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
9
10
11 </head>
12 <body>
13 <div class="title">
14 <h1>
15 <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
16
17 </h1>
18
19 </div>
20
21
22 <div class="entry">
23 <div class="title">Always download Debian packages using Tor - the simple recipe</div>
24 <div class="date">15th January 2016</div>
25 <div class="body"><p>During his DebConf15 keynote, Jacob Appelbaum
26 <a href="https://summit.debconf.org/debconf15/meeting/331/what-is-to-be-done/">observed
27 that those listening on the Internet lines would have good reason to
28 believe a computer have a given security hole</a> if it download a
29 security fix from a Debian mirror. This is a good reason to always
30 use encrypted connections to the Debian mirror, to make sure those
31 listening do not know which IP address to attack. In August, Richard
32 Hartmann observed that encryption was not enough, when it was possible
33 to interfere download size to security patches or the fact that
34 download took place shortly after a security fix was released, and
35 <a href="http://richardhartmann.de/blog/posts/2015/08/24-Tor-enabled_Debian_mirror/">proposed
36 to always use Tor to download packages from the Debian mirror</a>. He
37 was not the first to propose this, as the
38 <tt><a href="https://tracker.debian.org/pkg/apt-transport-tor">apt-transport-tor</a></tt>
39 package by Tim Retout already existed to make it easy to convince apt
40 to use <a href="https://www.torproject.org/">Tor</a>, but I was not
41 aware of that package when I read the blog post from Richard.</p>
42
43 <p>Richard discussed the idea with Peter Palfrader, one of the Debian
44 sysadmins, and he set up a Tor hidden service on one of the central
45 Debian mirrors using the address vwakviie2ienjx6t.onion, thus making
46 it possible to download packages directly between two tor nodes,
47 making sure the network traffic always were encrypted.</p>
48
49 <p>Here is a short recipe for enabling this on your machine, by
50 installing <tt>apt-transport-tor</tt> and replacing http and https
51 urls with tor+http and tor+https, and using the hidden service instead
52 of the official Debian mirror site. I recommend installing
53 <tt>etckeeper</tt> before you start to have a history of the changes
54 done in /etc/.</p>
55
56 <blockquote><pre>
57 apt install apt-transport-tor
58 sed -i 's% http://ftp.debian.org/% tor+http://vwakviie2ienjx6t.onion/%' /etc/apt/sources.list
59 sed -i 's% http% tor+http%' /etc/apt/sources.list
60 </pre></blockquote>
61
62 <p>If you have more sources listed in /etc/apt/sources.list.d/, run
63 the sed commands for these too. The sed command is assuming your are
64 using the ftp.debian.org Debian mirror. Adjust the command (or just
65 edit the file manually) to match your mirror.</p>
66
67 <p>This work in Debian Jessie and later. Note that tools like
68 <tt>apt-file</tt> only recently started using the apt transport
69 system, and do not work with these tor+http URLs. For
70 <tt>apt-file</tt> you need the version currently in experimental,
71 which need a recent apt version currently only in unstable. So if you
72 need a working <tt>apt-file</tt>, this is not for you.</p>
73
74 <p>Another advantage from this change is that your machine will start
75 using Tor regularly and at fairly random intervals (every time you
76 update the package lists or upgrade or install a new package), thus
77 masking other Tor traffic done from the same machine. Using Tor will
78 become normal for the machine in question.</p>
79
80 <p>On <a href="https://wiki.debian.org/FreedomBox">Freedombox</a>, APT
81 is set up by default to use <tt>apt-transport-tor</tt> when Tor is
82 enabled. It would be great if it was the default on any Debian
83 system.</p>
84 </div>
85
86 <div class="tags">Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.</div>
87
88
89 </div>
90
91
92
93
94 <div id="sidebar">
95
96
97
98 <h2>Archive</h2>
99 <ul>
100
101 <li>2016
102 <ul>
103
104 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/01/">January (3)</a></li>
105
106 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/02/">February (2)</a></li>
107
108 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/03/">March (3)</a></li>
109
110 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/04/">April (8)</a></li>
111
112 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/05/">May (8)</a></li>
113
114 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/06/">June (2)</a></li>
115
116 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/07/">July (2)</a></li>
117
118 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/08/">August (5)</a></li>
119
120 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/09/">September (2)</a></li>
121
122 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/10/">October (3)</a></li>
123
124 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/11/">November (8)</a></li>
125
126 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/12/">December (4)</a></li>
127
128 </ul></li>
129
130 <li>2015
131 <ul>
132
133 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/01/">January (7)</a></li>
134
135 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/02/">February (6)</a></li>
136
137 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/03/">March (1)</a></li>
138
139 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/04/">April (4)</a></li>
140
141 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/05/">May (3)</a></li>
142
143 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/06/">June (4)</a></li>
144
145 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/07/">July (6)</a></li>
146
147 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/08/">August (2)</a></li>
148
149 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/09/">September (2)</a></li>
150
151 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/10/">October (9)</a></li>
152
153 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/11/">November (6)</a></li>
154
155 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/12/">December (3)</a></li>
156
157 </ul></li>
158
159 <li>2014
160 <ul>
161
162 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/01/">January (2)</a></li>
163
164 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/02/">February (3)</a></li>
165
166 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/03/">March (8)</a></li>
167
168 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/04/">April (7)</a></li>
169
170 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/05/">May (1)</a></li>
171
172 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/06/">June (2)</a></li>
173
174 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/07/">July (2)</a></li>
175
176 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/08/">August (2)</a></li>
177
178 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/09/">September (5)</a></li>
179
180 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/10/">October (6)</a></li>
181
182 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/11/">November (3)</a></li>
183
184 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/12/">December (5)</a></li>
185
186 </ul></li>
187
188 <li>2013
189 <ul>
190
191 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/01/">January (11)</a></li>
192
193 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/02/">February (9)</a></li>
194
195 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/03/">March (9)</a></li>
196
197 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/04/">April (6)</a></li>
198
199 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/05/">May (9)</a></li>
200
201 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/06/">June (10)</a></li>
202
203 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/07/">July (7)</a></li>
204
205 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/08/">August (3)</a></li>
206
207 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/09/">September (5)</a></li>
208
209 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/10/">October (7)</a></li>
210
211 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/11/">November (9)</a></li>
212
213 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/12/">December (3)</a></li>
214
215 </ul></li>
216
217 <li>2012
218 <ul>
219
220 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
221
222 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
223
224 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
225
226 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
227
228 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
229
230 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
231
232 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/07/">July (17)</a></li>
233
234 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/08/">August (6)</a></li>
235
236 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/09/">September (9)</a></li>
237
238 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/10/">October (17)</a></li>
239
240 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/11/">November (10)</a></li>
241
242 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/12/">December (7)</a></li>
243
244 </ul></li>
245
246 <li>2011
247 <ul>
248
249 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
250
251 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
252
253 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
254
255 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
256
257 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
258
259 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
260
261 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
262
263 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
264
265 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
266
267 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
268
269 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
270
271 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
272
273 </ul></li>
274
275 <li>2010
276 <ul>
277
278 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
279
280 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
281
282 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
283
284 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
285
286 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
287
288 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
289
290 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
291
292 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
293
294 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
295
296 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
297
298 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
299
300 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
301
302 </ul></li>
303
304 <li>2009
305 <ul>
306
307 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
308
309 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
310
311 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
312
313 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
314
315 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
316
317 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
318
319 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
320
321 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
322
323 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
324
325 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
326
327 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
328
329 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
330
331 </ul></li>
332
333 <li>2008
334 <ul>
335
336 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
337
338 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
339
340 </ul></li>
341
342 </ul>
343
344
345
346 <h2>Tags</h2>
347 <ul>
348
349 <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
350
351 <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
352
353 <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
354
355 <li><a href="http://people.skolelinux.org/pere/blog/tags/bankid">bankid (4)</a></li>
356
357 <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (9)</a></li>
358
359 <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (16)</a></li>
360
361 <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
362
363 <li><a href="http://people.skolelinux.org/pere/blog/tags/chrpath">chrpath (2)</a></li>
364
365 <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (143)</a></li>
366
367 <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (158)</a></li>
368
369 <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (10)</a></li>
370
371 <li><a href="http://people.skolelinux.org/pere/blog/tags/dld">dld (16)</a></li>
372
373 <li><a href="http://people.skolelinux.org/pere/blog/tags/docbook">docbook (23)</a></li>
374
375 <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
376
377 <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (335)</a></li>
378
379 <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (23)</a></li>
380
381 <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (12)</a></li>
382
383 <li><a href="http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (29)</a></li>
384
385 <li><a href="http://people.skolelinux.org/pere/blog/tags/freedombox">freedombox (9)</a></li>
386
387 <li><a href="http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (18)</a></li>
388
389 <li><a href="http://people.skolelinux.org/pere/blog/tags/h264">h264 (20)</a></li>
390
391 <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (42)</a></li>
392
393 <li><a href="http://people.skolelinux.org/pere/blog/tags/isenkram">isenkram (14)</a></li>
394
395 <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (19)</a></li>
396
397 <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (9)</a></li>
398
399 <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (8)</a></li>
400
401 <li><a href="http://people.skolelinux.org/pere/blog/tags/lsdvd">lsdvd (2)</a></li>
402
403 <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
404
405 <li><a href="http://people.skolelinux.org/pere/blog/tags/mesh network">mesh network (8)</a></li>
406
407 <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (39)</a></li>
408
409 <li><a href="http://people.skolelinux.org/pere/blog/tags/nice free software">nice free software (9)</a></li>
410
411 <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (285)</a></li>
412
413 <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (182)</a></li>
414
415 <li><a href="http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (26)</a></li>
416
417 <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
418
419 <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (62)</a></li>
420
421 <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (96)</a></li>
422
423 <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (1)</a></li>
424
425 <li><a href="http://people.skolelinux.org/pere/blog/tags/reactos">reactos (1)</a></li>
426
427 <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
428
429 <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (3)</a></li>
430
431 <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (10)</a></li>
432
433 <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
434
435 <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (5)</a></li>
436
437 <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
438
439 <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (52)</a></li>
440
441 <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
442
443 <li><a href="http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (5)</a></li>
444
445 <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (49)</a></li>
446
447 <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (5)</a></li>
448
449 <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (10)</a></li>
450
451 <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (44)</a></li>
452
453 <li><a href="http://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin (2)</a></li>
454
455 <li><a href="http://people.skolelinux.org/pere/blog/tags/usenix">usenix (2)</a></li>
456
457 <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (8)</a></li>
458
459 <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (59)</a></li>
460
461 <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (4)</a></li>
462
463 <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (38)</a></li>
464
465 </ul>
466
467
468 </div>
469 <p style="text-align: right">
470 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.6</a>
471 </p>
472
473 </body>
474 </html>