https://docs.cwtch.im/assets/js/83128a56.95469a98.js

1"use strict";(self.webpackChunkuser_handbook=self.webpackChunkuser_handbook||[]).push([[545],{6147:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>l,contentTitle:()=>h,default:()=>d,frontMatter:()=>r,metadata:()=>c,toc:()=>s});var i=o(5893),t=o(1151);const r={sidebar_position:1},h="Running Cwtch on Whonix",c={id:"platforms/whonix",title:"Running Cwtch on Whonix",description:"New in Cwtch 1.13",source:"@site/docs/platforms/whonix.md",sourceDirName:"platforms",slug:"/platforms/whonix",permalink:"/docs/platforms/whonix",draft:!1,unlisted:!1,editUrl:"https://git.openprivacy.ca/cwtch.im/docs.cwtch.im/src/branch/staging/docs/platforms/whonix.md",tags:[],version:"current",sidebarPosition:1,frontMatter:{sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Running Cwtch on Tails",permalink:"/docs/platforms/tails"}},l={},s=[{value:"Configure the Whonix-Gateway",id:"configure-the-whonix-gateway",level:2},{value:"Onion Grater",id:"onion-grater",level:3},{value:"Configure the Whonix-Workstation",id:"configure-the-whonix-workstation",level:2},{value:"Linux Firewall",id:"linux-firewall",level:3},{value:"Running Cwtch",id:"running-cwtch",level:3},{value:"Remove configuration from the Whonix-Gateway",id:"remove-configuration-from-the-whonix-gateway",level:2},{value:"Remove configuration from the Whonix-Workstation",id:"remove-configuration-from-the-whonix-workstation",level:2}];function a(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",ul:"ul",...(0,t.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"running-cwtch-on-whonix",children:"Running Cwtch on Whonix"}),"\n",(0,i.jsxs)(n.admonition,{title:"New Feature",type:"warning",children:[(0,i.jsxs)(n.p,{children:["New in ",(0,i.jsx)(n.a,{href:"/blog/cwtch-1-13",children:"Cwtch 1.13"})]}),(0,i.jsx)(n.p,{children:"This functionality may be incomplete and/or dangerous if misused. Please help us to review, and test."})]}),"\n",(0,i.jsx)(n.h2,{id:"configure-the-whonix-gateway",children:"Configure the Whonix-Gateway"}),"\n",(0,i.jsx)(n.p,{children:"The following steps should be done in the Whonix-Gateway."}),"\n",(0,i.jsx)(n.h3,{id:"onion-grater",children:"Onion Grater"}),"\n",(0,i.jsxs)(n.p,{children:["Whonix uses ",(0,i.jsx)(n.a,{href:"https://www.whonix.org/wiki/Onion-grater",children:"Onion Grater"})," to guard access to the control port. We have packaged an onion-grater configuration ",(0,i.jsxs)(n.a,{href:"https://git.openprivacy.ca/cwtch.im/cwtch-ui/src/branch/trunk/linux/cwtch-whonix.yml",children:[(0,i.jsx)(n.code,{children:"cwtch-whonix.yml"})," "]})," which is present in the root directory of the tarball."]}),"\n",(0,i.jsxs)(n.p,{children:["This file needs to be placed in ",(0,i.jsx)(n.code,{children:"/usr/share/doc/onion-grater-merger/examples/40_cwtch.yml"}),"."]}),"\n",(0,i.jsxs)(n.p,{children:["Whonix has also packaged the profile ",(0,i.jsxs)(n.a,{href:"https://github.com/Whonix/onion-grater/blob/master/usr/share/doc/onion-grater-merger/examples/40_cwtch.yml",children:[(0,i.jsx)(n.code,{children:"40_cwtch.yml"}),"_"]}),", therefore you can use either one."]}),"\n",(0,i.jsx)(n.p,{children:"Enable the Cwtch onion-grater profile:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-shell",children:"sudo onion-grater-add 40_cwtch\n"})}),"\n",(0,i.jsx)(n.h2,{id:"configure-the-whonix-workstation",children:"Configure the Whonix-Workstation"}),"\n",(0,i.jsx)(n.p,{children:"The following steps should be done in the Whonix-Workstation."}),"\n",(0,i.jsx)(n.h3,{id:"linux-firewall",children:"Linux Firewall"}),"\n",(0,i.jsxs)(n.p,{children:["The Whonix-Workstation Firewall needs to have the possible Cwtch binding port open. Follow the ",(0,i.jsx)(n.a,{href:"https://www.whonix.org/wiki/Whonix-Workstation_Firewall#Open_an_Incoming_Port",children:"upstream firewall guide"}),"."]}),"\n",(0,i.jsxs)(n.p,{children:["Use the following configuration in the file ",(0,i.jsx)(n.code,{children:"/usr/local/etc/whonix_firewall.d/50_user.conf"}),":"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-shell",children:'EXTERNAL_OPEN_PORTS+=" $(seq 15000 15378) "\n'})}),"\n",(0,i.jsx)(n.h3,{id:"running-cwtch",children:"Running Cwtch"}),"\n",(0,i.jsx)(n.p,{children:"When launching, Cwtch on Whonix, some environment variables must be set:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"CWTCH_TAILS=true"})," - automatically configure Cwtch for running in a Whonix-like environment."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"CWTCH_RESTRICT_PORTS=true"})," - forces connectivity to bind to a subset of ports ",(0,i.jsx)(n.code,{children:"15000-15378"}),", easier to manage on the firewall configuration."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"CWTCH_BIND_EXTERNAL_WHONIX=true"})," - forces connectivity to bind to external interfaces (only supported/recommended on for Whonix-based setups where the machine (Workstation) which is running Cwtch is firewalled, where the only source of network is through the Gateway."]}),"\n"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-shell",children:"cd ~/.local/lib/cwtch\nenv LD_LIBRARY_PATH=~/.local/lib/cwtch/:~/.local/lib/cwtch/Tor CWTCH_TAILS=true CWTCH_RESTRICT_PORTS=true CWTCH_BIND_EXTERNAL_WHONIX=true ~/.local/lib/cwtch/cwtch\n"})}),"\n",(0,i.jsx)(n.admonition,{title:"Install Location",type:"info",children:(0,i.jsxs)(n.p,{children:["The above command, and the below onion grater configuration assume that Cwtch was installed in ",(0,i.jsx)(n.code,{children:"~/.local/lib/cwtch/cwtch"})," - if Cwtch was installed somewhere else (or if you are running directly from the download folder) then you will need to adjust the commands."]})}),"\n",(0,i.jsx)(n.h1,{id:"removing-cwtch-from-whonix",children:"Removing Cwtch from Whonix"}),"\n",(0,i.jsx)(n.h2,{id:"remove-configuration-from-the-whonix-gateway",children:"Remove c

1onfiguration from the Whonix-Gateway"}),"\n",(0,i.jsx)(n.p,{children:"The following steps should be done in the Whonix-Gateway."}),"\n",(0,i.jsx)(n.p,{children:"Disable the Cwtch onion-grater profile:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-shell",children:"sudo onion-grater-remove cwtch-whonix\n"})}),"\n",(0,i.jsx)(n.h2,{id:"remove-configuration-from-the-whonix-workstation",children:"Remove configuration from the Whonix-Workstation"}),"\n",(0,i.jsx)(n.p,{children:"The following steps should be done in the Whonix-Workstation."}),"\n",(0,i.jsxs)(n.p,{children:["Delete the Cwtch application directory ",(0,i.jsx)(n.code,{children:"$HOME/.local/lib/cwtch"})," and Cwtch data directory ",(0,i.jsx)(n.code,{children:"$HOME/.cwtch"}),"."]}),"\n",(0,i.jsx)(n.p,{children:"The firewall ports should also be closed manually by removing the configuration added above and reloading the firewall."})]})}function d(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(a,{...e})}):a(e)}},1151:(e,n,o)=>{o.d(n,{Z:()=>c,a:()=>h});var i=o(7294);const t={},r=i.createContext(t);function h(e){const n=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:h(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]);