Downstream for 3isec-tor

[acdep]

3isec-tor is great. It would be nice to have examples for 3isec-tor downstream vms. I am particularly interested in below two topics.

1. How to install tor browser in a downstream vm and use the tor service in sys-tor.
2. How to route connections through socks ports defined in 3isec-tor. Let’s say I am running wget, curl, apt-cacher-ng in downstream vm. How to route connections through socks port 9050 in sys-tor?
3. Does setting CookieAuthentication 1 means downstream vms should have access to the cookie file in sys-tor?

[unman]

1. How to install tor browser in a downstream vm and use the tor service in sys-tor.

You can run tor browser without using Tor - this is, I think, what
Whonix does. Configure it to use upstream proxy on first start.
You can no longer run Tor over Tor.
Or use Mullvad Browser, developed with the Tor project.

2. How to route connections through socks ports defined in 3isec-tor. Let’s say I am running wget, curl, apt-cacher-ng in downstream vm. How to route connections through socks port 9050 in sys-tor?

By default, any TCP traffic is routed to the TransPort on 9040 -
configured “IsolateClientAddress”.
If you want to use the Socks Port on 9050 - “IsolateClientAddress
IsolateSocksAuth”, just follow usual guidance on using an upstream
proxy:

export http_proxy=http://IP_ADDRESS:9050
export https_proxy=http://IP_ADDRESS:9050
wget https://www.qubes-os.org

You can put the export lines in ~/.bashrc in the qube.

3. Does setting CookieAuthentication 1 means downstream vms should have access to the cookie file in sys-tor?

That option is used to authenticate controllers to the tor instance, so
that only authorized controllers can connect. In this case the
ControlPort is bound to the local interface, so not accessible from
downstream qubes.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

[acdep]

Thanks for the response.

@unman

Or use Mullvad Browser, developed with the Tor project.

I don’t think we can browser onion address using mullvad browser. I tried and it does not work as is. Probably needs more tweaking.

@unman

just follow usual guidance on using an upstream
proxy

I don’t think we can use http(s)_proxy to use socks port. I think we need to use applications like torsocks or socat from tcp to socks in order to forward connections to socks port. I am not sure so that’s why I posted the question to see if anyone has done the setup already.

@unman

You can run tor browser without using Tor - this is, I think, what
Whonix does.

I checked whonix repository and its not easy to understand. I think there might be a much simpler solution than what is done for whonix.

@unman

In this case the
ControlPort is bound to the local interface, so not accessible from
downstream qubes

I noticed statements in whonix wiki about transferring cookie auth file from gateway vm to workstation vm. I am not sure under what circumstances the cookie auth file is required in workstation vm. Hence posted the question to the community.

[unman]

I don’t think we can browser onion address using mullvad browser. I tried and it does not work as is. Probably needs more tweaking.

You just need to make the same change required in Firefox:
about:config → toggle network.dns.blockDotOnion to false

You also need to turn OFF DNS over HTTPS, and probably set
/etc/resolv.conf to use 9.9.9.9 or anything - doesnt matter, it will
get shot through Tor

I don’t think we can use http(s)_proxy to use socks port. I think we need to use applications like torsocks or socat from tcp to socks in order to forward connections to socks port. I am not sure so that’s why I posted the question to see if anyone has done the setup already.

Right - perils of copy/paste .

@unman

You can run tor browser without using Tor - this is, I think, what
Whonix does.

I checked whonix repository and its not easy to understand. I think there might be a much simpler solution than what is done for whonix.

Use Mullvad Browser which is designed for this purpose in
collaboration with TorProject .

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.