nyxnor / onioncomms

OnionComms is a repository of script to run an onion server and guides to configure client side applications to connect to any onion service that uses the same protocol, therefore, onion communications.

OnionComms

OnionComms is a repository of script to run an onion server and guides to configure client side applications to connect to any onion service that uses the same protocol, therefore, onion communications.

---

Table of contents

• OnionComms
  • Server
  • Client
  • Applications
    • Tor
    • Remote-Administration
    • File-Sharing
    • RSS
    • VOIP
    • XMPP
    • IRC
    • Misc

---

Server

Read the README inside the folder of the program you want to use, the scripts are non-interactive unless a password needs to be set. They were designed for Debian and derived systems.

Client

TORIFICATION.MD is a must read on how to do properly torifications of applications. In short:

• application proxy settings may fail and leak DNS requests and IP address (per application)
• enforce proxy with a wrapper may also fail if not using the libc and leak DNS requests and IP address (torsocks, orbot)
• transparent proxy has huge security problems, it does not protect agains protocol leaks but the IP address will never be revealed (Tails)
• isolating proxy is the best solution as no leaks occur but it requires two host (virtual or physical) (Whonix)

The client guides are intended for plain Debian users, therefore application proxy settings and enforcing a proxy with a wrapper is the only solution, which isn't great but it is what is available.

Transparent proxy is hard to configure system wide and isolating proxy requires advanced configuration of creating a network between two hosts, these methods already route everything through Tor, so you don't need to configure the client to have onion routing, as all the traffic already does. What may change are simple configurations such as enforcing TCP mode or "hardening" by removing some "bad features" that leaks protocol information.

Applications

Tor

Application	Client	Server
tor	yes	yes
torsocks	yes	no
Tor Browser	yes	no
Orbot	yes	no

Remote-Administration

Application	Client	Server
OpenSSH client	yes	no
OpenSSH server	no	yes
Remmina	yes	yes

TODO: Remmina guide is incomplete.

File-Sharing

Application	Client	Server
Magic-wormhole	yes	no
OnionShare	no	yes

RSS

Application	Client	Server
Newsboat	yes	no
QuiteRSS	yes	no

VOIP

Application	Client	Server
Mumble	yes	no
Mumble-server	no	yes

XMPP

Application	Client	Server
Prosody	no	yes
Ejabberd	no	yes
Pidgin	yes	no
Dino IM	yes	no

TODO: Every XMPP client guide is incomplete.

IRC

Application	Client	Server
Hexchat	yes	no
Irssi	yes	no

Misc

Application	Client	Server
apt	yes	no
wget	yes	no
cURL	yes	no
git	yes	no
gpg	yes	no
Ricochet-refresh	yes	yes
TEG	yes	no

TODO: TEG guide is incomplete.

onioncomms's Issues

prosody: improve configuration security

don't show server version, uptime etc, inspect the config file.
Also, try to move everything to the virtual host to not modify default file which can be overwrited via pkg-diverted.

security and privacy considerations of torification

This issue is not a issue of this repo, it is a general issue with torification.

I always read HowToTorify from TPO wiki but always made an excuse to continue comfortable with my plain debian setup using application proxy settings and torsocks app.

But after spending a lot of time thinking about it, it does not protect you at all if the application developers screw with proxy settings or don't use LD_PRELOAD.

Tails problem is that it was made to run on pen-drive and for amnesia. I am not a journalist under surveillance and amnesia is not for me, even though it can be useful sometimes, that is not a desktop computer.

Whonix was inevitable, host separation and not escaping non tor traffic is really important. Using on virtualbox was a pain in the ass and kvm also. Qubes+Whonix was inevitably inevitable. Qubes problem is hardware, I can't run that on 4GB ram 2010 non virtualization available computer, need a more expensive hardware with VT+x VT+d + be in the recommended list.

I made the guide wishing to help people and myself torify their applications for tor usage but false sense of protection is not protection, false sense of privacy is not privacy.

The server guides don't apply yet to whonix as the targets are hardcoded to 127.0.0.1 but that will be possible to change after https://github.com/nyxnor/onionjuggler supports Whonix and become a debian package. Other problem is installing server software on the workstation and hs on the gateway.

I rewrote TORIFICATION.md because no one took care of that for years, TPO documentation is on legacy, the wiki is uneditable (which was not previously).

implement options on the scripts

• install
• list
• remove

This will help make checks that avoid overwriting config.
I it was already installed and detected, stop, just continue if there was a --force flag to reinstall or something like it.

add more protocols

see https://landchad.net/

but it can only be done after #1 is closed