Fixme.ch - User contributions [en]

31C3/laptop preparation

2014-11-01T16:06:58Z

Tengu: /* Firefox */

== Laptop preparation ==
Goal is easy: prevent unauthorized accesses to your laptop while still being able to access resources. Oh, and, ensure resources aren't faked or messed up by some rogue proxy.

It's mainly based on [https://events.ccc.de/congress/2014/wiki/Static:How_To_Survive CCC Survival Guide ]. It's a (very) good start to follow their advices, especially regarding physical protection ;).

=== Network ===
The proposed setup is based on two Onion Routers<ref>[https://en.wikipedia.org/wiki/Onion_routing Wikipedia: Onion Routing]</ref>: i2p<ref>[https://en.wikipedia.org/wiki/I2P Wikipedia: i2p]</ref> and Tor<ref>[https://en.wikipedia.org/wiki/Tor_%28anonymity_network%29 Wikipedia: Tor]</ref>. The first one is optional, but it's always cool having some new stuff in order to try them. Well, new… i2p is 11 years old now ;).

All is based on Debian Sid, but most of the packages are present on Arch, Ubuntu, Gentoo and so on.

==== Tor ====

===== Get package =====
First, install Tor. On Debian, we can use Torporject sources in order to get the latest official releases: 
<code><nowiki>deb http://deb.torproject.org/torproject.org <DISTRIBUTION> main</nowiki></code>

You can get the distribution code with this command: <code>lsb_release -c</code>.

You will also need the GPG key in order to be able to validate packages: 
<pre><nowiki>
gpg --keyserver keys.gnupg.net --recv 886DDD89
gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
</nowiki></pre>

Then, <code>sudo apt-get update && sudo apt-get install deb.torproject.org-keyring && sudo apt-get install tor</code>.

===== Configuration =====
Now we have the package and related daemon, we have to configure it a bit. As the main aim of this setup is to make all the traffic through Tor, here are the settings you'll need. You may empty the file and copy&paste this: 
<pre><nowiki>
# Create SOCKS port, and ensure we isolate streams
SocksPort 9050 IsolateDestAddr IsolateDestPort
SafeSocks 0
TestSocks 1
# This port will be used for "non-socks" connection. I.e. for
# stupid apps which just don't know what a SOCKS is
TransPort 9040
TransListenAddress 127.0.0.1
# Create a listener for DNS queries.
DNSPort 5400
DNSListenAddress 127.0.0.1
NumCPUs 1
VirtualAddrNetwork 10.192.0.0/10
AvoidDiskWrites 1
AutomapHostsOnResolve 1
</nowiki></pre>

Comments should be enough, but you might want to read some more documentation about [https://www.torproject.org/docs/tor-manual.html.en the tor configuration file].

Restart Tor with <code>sudo service tor restart</code>, and we're done :).

==== i2p ====
As said, this step is optional. But anyway, it's cool. And even easier in fact.

===== Get package =====
Add the following source to your Debian system: 
<code><nowiki>deb http://deb.i2p2.no/ unstable main</nowiki></code>

Import the following key for package signature: <code><nowiki>wget https://geti2p.net/_static/debian-repo.pub -O - | sudo apt-key add -</nowiki></code>

Install required packages: <code>sudo apt-get update && sudo apt-get install i2p i2p-keyring</code>

Edit the <code>/etc/default/i2p</code> file in order to enable the daemon. Start it with <code>sudo service i2p start</code>, and… well, that's all ;).

More information available [https://geti2p.net/en/download/debian#debian here].

==== IPTables ====
Now we hit the game: we might as well kill our connection capabilities, or make some great things. After all, that's IPTables<ref>[https://en.wikipedia.org/wiki/Iptables Wikipedia: iptables]</ref> ;)

There are multiple goals with the proposed configuration:
# lock out the intruders
# force outgoing traffic through Tor by default
# allow "smart" application to connect by them-selves to the SOCKS or Transproxy
# allow i2p to go out freely
# allow Tor to go out freely

More over, we want this policy to be enforced as soon as we get network. In order to do so, we will need an "iptables-restore" call, and a script/configuration to feed it.

The following content is to be put in /etc/network/iptables file (or something like that, you'll have to create the file anyway). We will explain bellow how it works.

<pre><nowiki>
*filter
:INPUT DROP [1:264]
:FORWARD ACCEPT [0:0]
:OUTPUT DROP [60:12415]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i vboxnet0 -j ACCEPT
-A INPUT -j LOG --log-prefix "INPUT DROP "

-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m owner --uid-owner debian-tor -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -m owner --uid-owner i2psvc -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -d 127.0.0.1/32 -p udp -m udp --dport 5400 -j ACCEPT
-A OUTPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 9050 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A OUTPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 9040 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A OUTPUT -d 127.0.0.1/32 -s 127.0.0.1/32 -p tcp -m tcp --dport 631 -j ACCEPT
-A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
-A OUTPUT -j LOG --log-prefix "OUTPUT DROP "
COMMIT

*nat
:INPUT DROP [524:86738]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [637739:421546290]
-A OUTPUT -m owner --uid-owner debian-tor -j RETURN
-A OUTPUT -m owner --uid-owner i2psvc -j RETURN
-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 5400
-A OUTPUT -p udp -m udp --dport 123 -j REDIRECT --to-ports 123
-A OUTPUT ! -o lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
-A OUTPUT -j LOG --log-prefix "OUTPUT nat DROP "
-A INPUT -j LOG --log-prefix "INPUT nat DROP "
COMMIT
</nowiki></pre>

So. How does it work? Pretty easy in the end: with iptables, we can filter packets by user ID, i.e. iptables knows "who" sends the packet it's filtering. As bot Tor and i2p daemon have dedicated users, we can tell iptables to let those two guys connections, while forcing the others through Tor. Or whatever you want, in fact.

The filter table (block starting with the *filter) will manage the IN and OUT, allowing only i2p and tor traffic out, while allowing related traffic in. It will force non-i2p/tor traffic to go through Tor TransPort we defined earlier, and it will also redirect DNS queries to Tor in order to avoid DNS poisoning.

The nat table (block starting with *nat) will do the redirects.

In order to enforce that, you'll need to edit your <code>/etc/network/interfaces</code> file and add the following line in your eth0/wlan0 definitions: <code><nowiki>post-up iptables-restore /etc/network/iptables</nowiki></code>.

==== Firefox ====
Firefox is smart. It can speak "SOCKS". Hence, we can make it speak both i2p and Tor. At the same time. But that's not all: we will also install a specific profile in order to ensure we don't leak too much data. For that, we will use the firefox profile proposed by JonDonym<ref>[https://anonymous-proxy-servers.net/ JonDonym ]</ref>.

It will avoid some bad behavior of Firefox, cover up our traces and avoid a too precise match with our browser. You might want to try the well-known [https://panopticlick.eff.org/ Panopticlick] proposed by the EFF in a "before/after" mode ;).

Also, we will use a very old standard: Proxy auto-config, also known as PAC file<ref>[https://en.wikipedia.org/wiki/Proxy_auto-config Wikipedia: Proxy auto-config]</ref>.

===== JonDonym =====
As said, we will install a special profile. In order to do so, simply follow the steps as described [https://anonymous-proxy-servers.net/en/help/firststeps.html here]. Beware, JonDo is another thing, and proposes some proxies we don't need for the current setup. Follow the steps for the "JonDoFox" installation.

Once this is done, start Firefox and check if you have the JonDonym profile — you will know pretty soon if you have it or not ;).

===== PAC =====
The PAC file is, in fact, a simple Javascript… err… script. It provides some nice features, allows you to tell Firefox (or any browser supporting this file type) how it should handle a request.

The script content looks like that: 
<pre><nowiki>
function FindProxyForURL(url, host) {
var lhost = host.toLowerCase();
host = lhost;
tor = 'SOCKS5 localhost:9050';
i2p_ssl = 'PROXY localhost:4445';
i2p_clear = 'PROXY localhost:4444';

if (shExpMatch(host, "*.onion")) {
alert("Tor hidden service");
return tor;
}

if (shExpMatch(url, "https")) {
if (shExpMatch(host, "*.i2p")) {
alert("i2p SSL");
return i2p_ssl;
}
} else {
if (shExpMatch(host, "*.i2p")) {
alert("i2p CLEAR");
return i2p_clear;
}
}
alert("No match at all for "+url);

return tor;
}
</nowiki></pre>

Such easiness. Such love. Such nice.

It:
# checks if the hostname maches ".onion"
## if it matches ".onion", it redirects to the Tor SOCKS port
# checks if we're using HTTPS
## if it matches ".i2p", redirect to the HTTPS i2p proxy
# If we're "in the clear" (HTTP) and match ".i2p", redirect to the HTTP i2p proxy
# if it matches nothing, it redirects to Tor anyway.

You might save this file in something like <code><nowiki>~/.mozilla/rules.pac</nowiki></code> and load it in Firefox using Preferences -> Advanced -> Network -> Settings and point to <code><nowiki>file:///home/<user>/.mozilla/rules.pac</nowiki></pre>.

You might want to check how it goes using the Browser Console (ctrl+shift+j or Developers -> Web Console).

=== Physical ===
Feel free to add stuff ;).

== References ==

<references />

31C3/laptop preparation

2014-11-01T15:40:48Z

Tengu: First draft, not finished.

== Laptop preparation ==
Goal is easy: prevent unauthorized accesses to your laptop while still being able to access resources. Oh, and, ensure resources aren't faked or messed up by some rogue proxy.

It's mainly based on [https://events.ccc.de/congress/2014/wiki/Static:How_To_Survive CCC Survival Guide ]. It's a (very) good start to follow their advices, especially regarding physical protection ;).

=== Network ===
The proposed setup is based on two Onion Routers<ref>[https://en.wikipedia.org/wiki/Onion_routing Wikipedia: Onion Routing]</ref>: i2p<ref>[https://en.wikipedia.org/wiki/I2P Wikipedia: i2p]</ref> and Tor<ref>[https://en.wikipedia.org/wiki/Tor_%28anonymity_network%29 Wikipedia: Tor]</ref>. The first one is optional, but it's always cool having some new stuff in order to try them. Well, new… i2p is 11 years old now ;).

All is based on Debian Sid, but most of the packages are present on Arch, Ubuntu, Gentoo and so on.

==== Tor ====

===== Get package =====
First, install Tor. On Debian, we can use Torporject sources in order to get the latest official releases: 
<code><nowiki>deb http://deb.torproject.org/torproject.org <DISTRIBUTION> main</nowiki></code>

You can get the distribution code with this command: <code>lsb_release -c</code>.

You will also need the GPG key in order to be able to validate packages: 
<pre><nowiki>
gpg --keyserver keys.gnupg.net --recv 886DDD89
gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
</nowiki></pre>

Then, <code>sudo apt-get update && sudo apt-get install deb.torproject.org-keyring && sudo apt-get install tor</code>.

===== Configuration =====
Now we have the package and related daemon, we have to configure it a bit. As the main aim of this setup is to make all the traffic through Tor, here are the settings you'll need. You may empty the file and copy&paste this: 
<pre><nowiki>
# Create SOCKS port, and ensure we isolate streams
SocksPort 9050 IsolateDestAddr IsolateDestPort
SafeSocks 0
TestSocks 1
# This port will be used for "non-socks" connection. I.e. for
# stupid apps which just don't know what a SOCKS is
TransPort 9040
TransListenAddress 127.0.0.1
# Create a listener for DNS queries.
DNSPort 5400
DNSListenAddress 127.0.0.1
NumCPUs 1
VirtualAddrNetwork 10.192.0.0/10
AvoidDiskWrites 1
AutomapHostsOnResolve 1
</nowiki></pre>

Comments should be enough, but you might want to read some more documentation about [https://www.torproject.org/docs/tor-manual.html.en the tor configuration file].

Restart Tor with <code>sudo service tor restart</code>, and we're done :).

==== i2p ====
As said, this step is optional. But anyway, it's cool. And even easier in fact.

===== Get package =====
Add the following source to your Debian system: 
<code><nowiki>deb http://deb.i2p2.no/ unstable main</nowiki></code>

Import the following key for package signature: <code><nowiki>wget https://geti2p.net/_static/debian-repo.pub -O - | sudo apt-key add -</nowiki></code>

Install required packages: <code>sudo apt-get update && sudo apt-get install i2p i2p-keyring</code>

Edit the <code>/etc/default/i2p</code> file in order to enable the daemon. Start it with <code>sudo service i2p start</code>, and… well, that's all ;).

More information available [https://geti2p.net/en/download/debian#debian here].

==== IPTables ====
Now we hit the game: we might as well kill our connection capabilities, or make some great things. After all, that's IPTables<ref>[https://en.wikipedia.org/wiki/Iptables Wikipedia: iptables]</ref> ;)

There are multiple goals with the proposed configuration:
# lock out the intruders
# force outgoing traffic through Tor by default
# allow "smart" application to connect by them-selves to the SOCKS or Transproxy
# allow i2p to go out freely
# allow Tor to go out freely

More over, we want this policy to be enforced as soon as we get network. In order to do so, we will need an "iptables-restore" call, and a script/configuration to feed it.

The following content is to be put in /etc/network/iptables file (or something like that, you'll have to create the file anyway). We will explain bellow how it works.

<pre><nowiki>
*filter
:INPUT DROP [1:264]
:FORWARD ACCEPT [0:0]
:OUTPUT DROP [60:12415]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i vboxnet0 -j ACCEPT
-A INPUT -j LOG --log-prefix "INPUT DROP "

-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m owner --uid-owner debian-tor -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -m owner --uid-owner i2psvc -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -d 127.0.0.1/32 -p udp -m udp --dport 5400 -j ACCEPT
-A OUTPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 9050 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A OUTPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 9040 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A OUTPUT -d 127.0.0.1/32 -s 127.0.0.1/32 -p tcp -m tcp --dport 631 -j ACCEPT
-A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
-A OUTPUT -j LOG --log-prefix "OUTPUT DROP "
COMMIT

*nat
:INPUT DROP [524:86738]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [637739:421546290]
-A OUTPUT -m owner --uid-owner debian-tor -j RETURN
-A OUTPUT -m owner --uid-owner i2psvc -j RETURN
-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 5400
-A OUTPUT -p udp -m udp --dport 123 -j REDIRECT --to-ports 123
-A OUTPUT ! -o lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
-A OUTPUT -j LOG --log-prefix "OUTPUT nat DROP "
-A INPUT -j LOG --log-prefix "INPUT nat DROP "
COMMIT
</nowiki></pre>

So. How does it work? Pretty easy in the end: with iptables, we can filter packets by user ID, i.e. iptables knows "who" sends the packet it's filtering. As bot Tor and i2p daemon have dedicated users, we can tell iptables to let those two guys connections, while forcing the others through Tor. Or whatever you want, in fact.

The filter table (block starting with the *filter) will manage the IN and OUT, allowing only i2p and tor traffic out, while allowing related traffic in. It will force non-i2p/tor traffic to go through Tor TransPort we defined earlier, and it will also redirect DNS queries to Tor in order to avoid DNS poisoning.

The nat table (block starting with *nat) will do the redirects.

In order to enforce that, you'll need to edit your <code>/etc/network/interfaces</code> file and add the following line in your eth0/wlan0 definitions: <code><nowiki>post-up iptables-restore /etc/network/iptables</nowiki></code>.

==== Firefox ====

===== PAC =====

=== Physical ===
Feel free to add stuff ;).

== References ==

<references />

Cryptoparty2

2013-10-08T08:10:57Z

Tengu: /* Possible talks/discussion */

[[Category:Workshops]]
[[Image:cryptoparty.jpg|400px]]
== Description ==
What is CryptoParty? Interested parties with computers, devices, and the desire to
learn to use the most basic crypto programs and the fundamental concepts of their operation!
* Date: FIXME
* Doodle: FIXME
* Event: FIXME
* http://weise7.org/tmp/cryptobook-v1.1.pdf
* http://www.cryptoparty.in/organize/howto

== Possible talks/discussion ==
* What should we do to resist ?
* Syncronize with [http://hackersatepfl.com/ HackEPFL] ?
* What about smartphone? How can we protect our privacy on Android (Tengu)

== See also ==
* [[Cryptoparty1]]

== Participants ==
* [[User:Rorist]]
* [[User:Prosouth]]
* [[User:Tengu]]
* You here

Cryptoparty2

2013-10-08T08:10:08Z

Tengu: /* Participants */

[[Category:Workshops]]
[[Image:cryptoparty.jpg|400px]]
== Description ==
What is CryptoParty? Interested parties with computers, devices, and the desire to
learn to use the most basic crypto programs and the fundamental concepts of their operation!
* Date: FIXME
* Doodle: FIXME
* Event: FIXME
* http://weise7.org/tmp/cryptobook-v1.1.pdf
* http://www.cryptoparty.in/organize/howto

== Possible talks/discussion ==
* What should we do to resist ?
* Syncronize with [http://hackersatepfl.com/ HackEPFL] ?

== See also ==
* [[Cryptoparty1]]

== Participants ==
* [[User:Rorist]]
* [[User:Prosouth]]
* [[User:Tengu]]
* You here

RaspberryPi1

2013-01-21T12:20:44Z

Tengu: /* Presentations */

[[Category:Workshops]]
== Description ==
* 26th February 2013 at 19h
* Share projects and ideas around the Raspberry PI mini-computer
* Short prentations (~10mn) about your projects
* Date: http://framadate.org/l48jvifcabcadjhy

== Presentations ==
* Rorist: Minecraft PI Edition with its simple network text protocol
* François: TBD (1-Wire temperature monitoring or XMBC with OpenElec)
* Tengu: Take pictures from a D90 using gphoto2 (for now, only theorical, nothing really usefull is done). Scripts are available here: https://gitorious.org/rpishooter but they are crappy. Even bad in fact ;).
* Tengu: manage some alarm with a Raspberry and a [http://www.yubico.com/ Yubikey] (pure theory)
* Sasha: Automated torrent seedbox with rtorrent and auto-irssi
* Fred: 1-Wire temperature monitoring with [http://owfs.org/ owfs] and Munin
* Mathias: Software Defined Radio on the Pi and other fun stuff like [http://www.icrobotics.co.uk/wiki/index.php/Turning_the_Raspberry_Pi_Into_an_FM_Transmitter FM transmitter] (if time permits). See also [[SDR]]
* Polto: Control your radio controlled car from your raspberry pi
* ''Your presentation here''

== Resources ==
* http://www.raspberrypi.org/
* http://elinux.org/RaspberryPiBoard
* http://www.posttenebraslab.ch/wiki/association/people/arekkusu/projects/gpio_fun
* http://pingbin.com/2012/12/30-cool-ideas-raspberry-pi-project/
* http://edurobot.ch/raspi/

== Participants ==
* [[User:Rorist]]
* [[User:Ol1v]]
* [[User:Freestorm]]

== See also ==
* [[CPU_Boards]]

RaspberryPi1

2013-01-06T21:30:49Z

Tengu: /* Presentations */

CoursAndroid1

2012-07-18T20:39:03Z

Tengu: /* SDK Setup */

[[Category:Workshops]]
[[Category:Android]]
= Description =
* First session of Android development class, focused on beginners.
* Date: FIXME
* Doodle: http://www.doodle.com/z54ecrdxr4kbdna7
* Event: http://fixme.ch/civicrm/event/info?id=45&reset=1

= Content =
* Installation and configuration of the SDK (a VM will be at disposal for others)
* Presentation of the tools
* First application

== SDK Setup ==
* Install Java/OpenJDK 1.6
* Download the SDK for your plateform http://developer.android.com/sdk/index.html
** Extract in /opt/android-sdk for example
** Correct the sdk permissions (tgz perms are crappy)
sudo chown -R <your-user>: /opt/android-sdk
chmod -R g-w /opt/android-sdk
** Add the tools to your path
export PATH="$PATH:/opt/android-sdk/tools:/opt/android-sdk/platform-tools"
* Run <tt>android</tt> from the cli to start the sdk manager
* Install API version 15, 10 and 4 (Android 4.0.3, 2.3.3 and 1.6) from the sdk manager
* Install Eclipse >= 3.6, (easier to start developping with eclipse then quit when your comfortable)
** [http://developer.android.com/sdk/installing/installing-adt.html Install the Android Development Tools for Eclipse]

= Project leader =
* [[User:Rorist]]

= Participants =
* [[User:Nemen]]

User:Tengu

2012-07-18T20:27:55Z

Tengu: Created page with "Life. Don't talk me about that!"

Life. Don't talk me about that!

CoursAndroid1

2012-07-18T20:24:18Z

Tengu: /* SDK Setup */

[[Category:Workshops]]
[[Category:Android]]
= Description =
* First session of Android development class, focused on beginners.
* Date: FIXME
* Doodle: http://www.doodle.com/z54ecrdxr4kbdna7
* Event: http://fixme.ch/civicrm/event/info?id=45&reset=1

= Content =
* Installation and configuration of the SDK (a VM will be at disposal for others)
* Presentation of the tools
* First application

== SDK Setup ==
* Install Java/OpenJDK 1.6
* Download the SDK for your plateform http://developer.android.com/sdk/index.html
** Extract in /opt/android-sdk for example
** Correct the sdk permissions
sudo find /opt/android-sdk -type d -exec chmod 0755 '{}' \;
sudo find /opt/android-sdk -type f -perm /u=rwx -exec chmod 0755 '{}' \;
** Add the tools to your path
export PATH="$PATH:/opt/android-sdk/tools:/opt/android-sdk/platform-tools"
* Run <tt>android</tt> from the cli to start the sdk manager as root
* Install API version 15, 10 and 4 (Android 4.0.3, 2.3.3 and 1.6) from the sdk manager
* Install Eclipse >= 3.6, (easier to start developping with eclipse then quit when your comfortable)
** [http://developer.android.com/sdk/installing/installing-adt.html Install the Android Development Tools for Eclipse]

= Project leader =
* [[User:Rorist]]

= Participants =
* [[User:Nemen]]