TorVM as an alternative to Whonix

General Discussion
1

Hi,

@unman - you mentioned more than once in time that you use TorVM and not Whonix.

I am very interested in that system as I don’t like the lack of minimal Whonix templates and some of the customizations it comes with.

Could you please provide more detail about TorVM installation, configuration and usage as I can’t find any documentation about it?

As for the updates issue you mentioned, what is the current situation with that TorVM? Any other cons?

Also: why isn’t TorVM a part of Qubes any more?

2 Likes
(disposable) sys-tor: Tor in Qubes (plain & simple)
2

That is easy to answer:

Archived April 26th, 2020.

4 Likes
3

Thanks for answering this part.

1 Like
4

It’s because of that decision that I decided to maintain it separately.
It’s important to recognise that the TorVM is compatible with Qubes
firewalling, unlike Whonix. It’s lightweight, and serves one purpose

  • providing a Tor Proxy.
    It’s for users to decide if this serves their needs.

    I never presume to speak for the Qubes team.
    When I comment in the Forum I speak for myself.
3 Likes
5

@unman

Could you probably answer the other questions from the OP too?

1 Like
6

Of course.
Clone a debian minimal template - say template-tor
In the template, add the 3isec repository definition in
/etc/apt/sources.list.d/3isec.list:
“deb [signed-by=/usr/share/keyrings/unman-keyring.gpg] Index of /4.3 trixie main”

Get a copy of my signing key, and install it in
/usr/share/keyrings/unman-keyring.gpg

In the template, install the 3isec-tor package -
sudo apt install 3isec-tor

Create a qube using template-tor
Set preferences to provides_network True
qvm-service QUBES 3isec-tor on

Start the tor qube.
Any qubes with netvm set to the tor qube will access over Tor.

You can run nyx to monitor bandwidth and circuits, and control the tor
daemon.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

3 Likes
7

Should have mentioned updates:
I run cacher behind tor, and have done so for years. I update dom0
behind tor qube.
I rarely have user reports of problems. Fewer than I seem to read of
Whonix.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

2 Likes
8

Thanks.

I followed the steps but I am getting stuck:

root@D13-TOR:~ # cat /etc/apt/sources.list.d/3isec.list 
deb [signed-by=/usr/share/keyrings/unman-keyring.gpg] https://qubes.3isec.org/4.3 trixie main

root@D13-TOR:~ # gpg --import --import-options import-show --no-default-keyring --keyring /usr/share/keyrings/unman-keyring.gpg /home/user/QubesIncoming/ddd9180/4b1f400df25651b53c4141b38b3f30f9c8c0c2ef.asc
pub   rsa4096 2016-06-25 [SC]
      4B1F400DF25651B53C4141B38B3F30F9C8C0C2EF
uid                      unman (Qubes OS signing key) <unman@thirdeyesecurity.org>
sub   rsa4096 2016-06-27 [S] [expires: 2027-06-30]
sub   rsa4096 2016-06-25 [E]
 
gpg: Total number processed: 1
gpg:              unchanged: 1
 
root@D13-TOR:~ # apt install 3isec-tor
Error: Unable to locate package 3isec-tor

root@D13-TOR:~ # apt-get update
Hit:1 https://deb.debian.org/debian trixie InRelease                                                                          
Hit:2 https://deb.debian.org/debian-security trixie-security InRelease                                                        
Hit:3 https://deb.qubes-os.org/r4.3/vm trixie InRelease                                                                       
Get:4 https://qubes.3isec.org/4.3 trixie InRelease [2,250 B]
Err:4 https://qubes.3isec.org/4.3 trixie InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/keyrings/unman-keyring.gpg"  Caused by:     0: Reading "/usr/share/keyrings/unman-keyring.gpg": EOF     1: EOF
Reading package lists... Done
W: OpenPGP signature verification failed: https://qubes.3isec.org/4.3 trixie InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/keyrings/unman-keyring.gpg"  Caused by:     0: Reading "/usr/share/keyrings/unman-keyring.gpg": EOF     1: EOF
E: The repository 'https://qubes.3isec.org/4.3 trixie InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

What am I missing?

1 Like
9

Is it really the same as unman’s instructions?

gpg -o /usr/share/keyrings/unman-keyring.gpg --dearmor  unman.pub

It works for me.

1 Like
10

I am not very experienced in key handling, so I don’t know if I did it correctly. I downloaded the .asc file from the keyserver.

What is unman.pub and where do you get it?

1 Like
11

You can replace it with 4b1f400df25651b53c4141b38b3f30f9c8c0c2ef.asc

1 Like
12

Thanks!

Now I see that command is actually on the homepage. - No testing new things when tired. Copy that.

1 Like
13

When I curl https://ipinfo.io/ip it always returns my clearnet address.
Why is that?

1 Like
14

The Tor daemon is not running, likely because you have not enabled the
service.
In the tor qube, run systemctl status 3isec-tor, and
systemctl start 3isec-tor. This will help identify the issue.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

2 Likes
15

Thanks.

After enabling and starting it I can’t connect to any host - neither from the AppVM, nor from the TorVM gateway itself. I triple checked that the service is running. How to proceed?

BTW, isn’t it a problem that with non-running service it falls back to clearnet, thus effectively deanonymizing all client qubes? IMO, the correct behaviour should be to drop all instead. What do you think?

1 Like
16

TorVM is a lightweight ProxyVM, not a drop-in replacement for Whonix Gateway, and the same logic applies to core-tor in Liteqube. The correct behaviour is to never carry expectations from one stack to another with different maintainers and use cases.

1 Like
17

I am not discussing correct behaviour of user but of software.

1 Like
18

The correct behaviour is to use Tor when the service is running, otherwise do not use Tor when the service has stopped. The category error is treating everything outside of the service as dependent on your specific network topology, threat model, and use case(s), when the TorVM service already works based on its design constraints in isolation.

19

Considering the goal of TorVM is anonymity, I don’t see how it can be correct to allow clearnet connections at all - that’s simply contrary to the whole idea.

In any case, even with a running service I can’t connect to any host, as mentioned, so that is the main issue for the moment.

Does it work for you?

1 Like
20

I cannot provide detailed troubleshooting steps for TorVM, so wait for @unman to respond to your issues.