https://docs.cwtch.im/assets/js/ce314f92.14c0af3a.js

1"use strict";(self.webpackChunkuser_handbook=self.webpackChunkuser_handbook||[]).push([[6965],{2270:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>a,contentTitle:()=>c,default:()=>h,frontMatter:()=>r,metadata:()=>o,toc:()=>l});var i=t(5893),s=t(1151);const r={sidebar_position:1},c="Running Cwtch on Tails",o={id:"platforms/tails",title:"Running Cwtch on Tails",description:"New in Cwtch 1.12",source:"@site/docs/platforms/tails.md",sourceDirName:"platforms",slug:"/platforms/tails",permalink:"/docs/platforms/tails",draft:!1,unlisted:!1,editUrl:"https://git.openprivacy.ca/cwtch.im/docs.cwtch.im/src/branch/staging/docs/platforms/tails.md",tags:[],version:"current",sidebarPosition:1,frontMatter:{sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Platforms",permalink:"/docs/category/platforms"},next:{title:"Running Cwtch on Whonix",permalink:"/docs/platforms/whonix"}},a={},l=[{value:"Onion Grater Configuration",id:"onion-grater-configuration",level:2},{value:"Persistence",id:"persistence",level:2}];function d(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",hr:"hr",li:"li",p:"p",ul:"ul",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"running-cwtch-on-tails",children:"Running Cwtch on Tails"}),"\n",(0,i.jsxs)(n.admonition,{title:"New Feature",type:"warning",children:[(0,i.jsxs)(n.p,{children:["New in ",(0,i.jsx)(n.a,{href:"/blog/cwtch-nightly-1-12",children:"Cwtch 1.12"})]}),(0,i.jsx)(n.p,{children:"This functionality may be incomplete and/or dangerous if misused. Please help us to review, and test."})]}),"\n",(0,i.jsxs)(n.p,{children:["The following steps require that Tails has been launched with an ",(0,i.jsx)(n.a,{href:"https://tails.boum.org/doc/first_steps/welcome_screen/administration_password/",children:"Administration Password"}),"."]}),"\n",(0,i.jsxs)(n.p,{children:["Tails uses ",(0,i.jsx)(n.a,{href:"https://gitlab.tails.boum.org/tails/tails/-/blob/master/config/chroot_local-includes/usr/local/lib/onion-grater#L3",children:"Onion Grater"})," to guard access to the control port. We have packaged\nan oniongrater configuration ",(0,i.jsxs)(n.a,{href:"https://git.openprivacy.ca/cwtch.im/cwtch-ui/src/branch/trunk/linux/cwtch-tails.yml",children:[(0,i.jsx)(n.code,{children:"cwtch-tails.yml"})," "]})," and setup script (",(0,i.jsx)(n.code,{children:"install-tails.sh"}),") with Cwtch on Linux."]}),"\n",(0,i.jsx)(n.p,{children:"The tails-specific part of the script is reproduced below:"}),"\n",(0,i.jsx)(n.h1,{id:"tails-needs-to-be-have-been-setup-up-with-an-administration-account",children:"Tails needs to be have been setup up with an Administration account"}),"\n",(0,i.jsx)(n.h1,{id:""}),"\n",(0,i.jsx)(n.h1,{id:"make-auth-cookie-readable",children:"Make Auth Cookie Readable"}),"\n",(0,i.jsx)(n.p,{children:"sudo chmod o+r /var/run/tor/control.authcookie"}),"\n",(0,i.jsx)(n.h1,{id:"copy-onion-grater-config",children:"Copy Onion Grater Config"}),"\n",(0,i.jsx)(n.p,{children:"sudo cp cwtch.yml /etc/onion-grater.d/cwtch.yml"}),"\n",(0,i.jsx)(n.h1,{id:"restart-onion-grater-so-the-config-takes-effect",children:"Restart Onion Grater so the Config Takes effect"}),"\n",(0,i.jsx)(n.p,{children:"sudo systemctl restart onion-grater.service"}),"\n",(0,i.jsxs)(n.p,{children:["When launching, Cwtch on Tails should be passed the ",(0,i.jsx)(n.code,{children:"CWTCH_TAILS=true"})," environment variable to automatically configure Cwtch for running in a Tails-like environment:"]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.code,{children:"exec env CWTCH_TAILS=true LD_LIBRARY_PATH=~/.local/lib/cwtch/:~/.local/lib/cwtch/Tor ~/.local/lib/cwtch/cwtch"})}),"\n",(0,i.jsx)(n.admonition,{title:"Install Location",type:"info",children:(0,i.jsxs)(n.p,{children:["The above command, and the below onion grater configuration assume that Cwtch was installed in ",(0,i.jsx)(n.code,{children:"~/.local/lib/cwtch/cwtch"})," - if Cwtch was installed somewhere else (or if you are running directly from the download folder) then you will need to adjust the commands."]})}),"\n",(0,i.jsx)(n.h2,{id:"onion-grater-configuration",children:"Onion Grater Configuration"}),"\n",(0,i.jsxs)(n.p,{children:["The oniongrater configuration ",(0,i.jsxs)(n.a,{href:"https://git.openprivacy.ca/cwtch.im/cwtch-ui/src/branch/trunk/linux/cwtch-tails.yml",children:[(0,i.jsx)(n.code,{children:"cwtch-tails.yml"})," "]})," is reproduced below. As noted this configuration is can likely be restricted much\nfurther."]}),"\n",(0,i.jsx)(n.hr,{}),"\n",(0,i.jsx)(n.h1,{id:"todo-this-can-likely-be-restricted-even-further-especially-in-regards-to-the-add_onion-pattern",children:"TODO: This can likely be restricted even further, especially in regards to the ADD_ONION pattern"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["apparmor-profiles:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"'/home/amnesia/.local/lib/cwtch/cwtch'\nusers:"}),"\n",(0,i.jsxs)(n.li,{children:["'amnesia'\ncommands:\nAUTHCHALLENGE:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"'SAFECOOKIE .*'\nSETEVENTS:"}),"\n",(0,i.jsx)(n.li,{children:"'CIRC WARN ERR'"}),"\n",(0,i.jsx)(n.li,{children:"'CIRC ORCONN INFO NOTICE WARN ERR HS_DESC HS_DESC_CONTENT'\nGETINFO:"}),"\n",(0,i.jsx)(n.li,{children:"'.*'\nGETCONF:"}),"\n",(0,i.jsx)(n.li,{children:"'DisableNetwork'\nSETCONF:"}),"\n",(0,i.jsx)(n.li,{children:"'DisableNetwork.*'\nADD_ONION:"}),"\n",(0,i.jsx)(n.li,{children:"'.*'\nDEL_ONION:"}),"\n",(0,i.jsx)(n.li,{children:"'.+'\nHSFETCH:"}),"\n",(0,i.jsx)(n.li,{children:"'.+'\nevents:\nCIRC:\nsuppress: true\nORCONN:\nsuppress: true\nINFO:\nsuppress: true\nNOTICE:\nsuppress: true\nWARN:\nsuppress: true\nERR:\nsuppress: true\nHS_DESC:\nresponse:"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["pattern:     '650 HS_DESC CREATED (\\S+) (\\S+) (\\S+) \\S+ (.+)'\nreplacement: '650 HS_DESC CREATED "," "," "," redacted ","'"]}),"\n",(0,i.jsxs)(n.li,{children:["pattern:     '650 HS_DESC UPLOAD (\\S+) (\\S+) .*'\nreplacement: '650 HS_DESC UPLOAD "," "," redacted redacted'"]}),"\n",(0,i.jsxs)(n.li,{children:["pattern:     '650 HS_DESC UPLOADED (\\S+) (\\S+) .+'\nreplacement: '650 HS_DESC UPLOADED "," "," redacted'"]}),"\n",(0,i.jsxs)(n.li,{children:["pattern:     '650 HS_DESC REQUESTED (\\S+) NO_AUTH'\nreplacement: '650 HS_DESC REQUESTED "," NO_AUTH'"]}),"\n",(0,i.jsxs)(n.li,{children:["pattern:     '650 HS_DESC REQUESTED (\\S+) NO_AUTH \\S+ \\S+'\nreplacement: '650 HS_DESC REQUESTED "," NO_AUTH redacted redacted'"]}),"\n",(0,i.jsxs)(n.li,{children:["pattern:     '650 HS_DESC RECEIVED (\\S+) NO_AUTH \\S+ \\S+'\nreplacement: '650 HS_DESC RECEIVED "," NO_AUTH redacted redacted'"]}),"\n",(0,i.jsx)(n.li,{children:"pattern:     '.*'\nreplacement: ''\nHS_DESC_CONTENT:\nsuppress: true"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"persistence",children:"Persistence"}),"\n",(0,i.jsxs)(n.p,{children:["By default, Cwtch creates ",(0,i.jsx)(n.code,{children:"$HOME/.cwtch"})," and saves all encrypted profiles and settings files there. In order to save any profiles/conversations in Cwtch on Tails you will have to backup this folder to a non-volatile home."]}),"\n",(0,i.jsxs)(n.p,{children:["See the Tails documentation for setting up ",(0,i.jsx)(n.a,{href:"https://tails.boum.org/doc/persistent_storage/",children:"persistent storage"})]})]})}function h(e={}){const{wrapper:n}={...(0,s.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>o,a:()=>c});var i=t(7294);const s={},r=i.createContext(s);function c(e){const n=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:c(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]);