# Using the OnlyKey app under Tails John Simpson `` 2019-07-13 Last updated: 2019-08-10 ## Notes In the command line examples below, lines starting with "`$`" are meant to be executed as the `amnesia` user, and lines starting with "`#`" are meant to be executed as `root`. ## Persistence The following options need to be "ON" after creating the persistent volume: * **Personal Data** - this creates a "`~/Persistent/`" directory whose contents are persistent across reboots. * **Additional Software** - this sets up a mechanism to have `.deb` files automatically install when Tails boots. * **Dotfiles** - this sets up a mechanism to have any files you may need, automatically symlinke into the `amnesia` user's home directory. Typically this would be used for "dot files", such as "`.bashrc`". We will be using it to configure `curl` to use the SOCKS5 proxy built into TOR. Obviously, other options can be enabled if you need them. (I normally enable all of them.) ### Creating a Persistent Volume * Applications menu * Tails * Configure persistent volume This will set up a partition using the empty space on the USB stick from which Tails was booted. Note that the USB stick should have enough free space to do this - I'm using a 16 GB stick to write/test these directions and the persistent volume only has 7.1 GB available. ### Checking an existing Persistent Volume If you've already set up a Persistent Storage Volume, you should check again to be sure that these options are enabled. Run the same app listed above, it will bypass the creation process and go directly to the list of options. ## Boot Tails Wne you boot Tails, you should select the following options in the Tails Greeter: * **The Persistent Storage Volume needs to be unlocked.** Enter the passphrase you used when creating the encrypted volume. * **You must create an Administration Password.** This will allow you to use `sudo` in order to run commands as root. * Click the "+" under "Additional Settings" at the bottom of the greeter window. * Select "Administration Password". * Enter a password. Note that this password is not permanent, it will only "exist" until Tails shuts down. ## Set up the `.curlrc` file Tails does not allow processes other than `tor` to access the network. This means that any process needing network access, has to be configured to use `tor` as a proxy. Tails configures most of its built-in applications, such as Thunderbird, Pidgin, and Tor Browser, to use `tor` as a proxy, however it does not confgure `curl`. So in order to use `curl`, we need to configure it. First create a persistent `~/.curlrc` file. We only need to do this once. From now on, the persistence framework will create this symlink for us, when Tails boots with the persistent volume unlocked. ``` $ touch /live/persistence/TorData_unlocked/dotfiles/.curlrc $ ln -s /live/persistence/TorData_unlocked/dotfiles/.curlrc ~ ``` Then add the configuration option which tells `curl` how to use the `tor` proxy. ``` $ echo 'socks5-hostname = "localhost:9050"' > ~/.curlrc ``` ## Download the OnlyKey `.deb` file Use the Tor browser to visit [`https://docs.crp.to/app.html`](https://docs.crp.to/app.html), and download the Linux Desktop App. The directions below will assume that you have saved the file in the "Tor Browser" directory within the `amnesia` user's home directory, which should be the default location that the browser offers you. I'm not including a direct URL for the file here, because there may be a newer version of the app by the time you read this. ## Create a local apt repository We *could* just install the file directly using "`sudo dpkg -i OnlyKey*.deb`". However, in order for the persistence software to install it automatically, you have to install the package using an `apt` command, and in order to do that, the package has to exist within an APT repo. So we're going to create an `~/Persistent/apt-repo/` directory, which will be the APT repo. This is where you will store any `.deb` files you want to install, which don't come from the default repos installed as part of Tails. Create the directory. ``` $ mkdir ~/Persistent/apt-repo ``` Within that directory, create a script which builds the index files which allow the `apt` programs to use the directory as a repo. ``` $ cd ~/Persistent/apt-repo $ cat > go < Packages apt-ftparchive release . > Release chmod -R go=u-w . EOF $ chmod 0755 go ``` Copy the OnlyKey `.deb` file into the repo. If you saved the downloaded `.deb` file somewhere else, you will need to adjust the `cp` command below accordingly. ``` $ cd ~/Persistent/apt-repo $ cp ~/Tor\ Browser/OnlyKey*.deb . ``` Run the script to build the index files. ``` $ ./go ``` Note that if you add, update, or remove `.deb` files in the future, you should run the `./go` script again after doing so. ### Make Tails use the new repo The next step is to configure Tails to use this directory as an APT repo, even after rebooting. Some of these commands need to be run as root. Rather than typing `sudo` in front of every single command, it's easier to just walk through this part of process as root. ``` $ sudo -i ``` You will be prompted for a password, enter the "Administration Password" you created while booting Tails. When this is done, your shell prompt will change to "`root@amnesia:~#`". We're going to create a persistent `sources.list.d` directory, and then configure the persistence program to symlink the directory's contents into the `/etc/apt/sources.list.d/` directory when Tails boots. ``` # cd /live/persistence/TailsData_unlocked # mkdir sources.list.d ``` ``` # echo '/etc/apt/sources.list.d source=sources.list.d,link' >> persistence.conf ``` Within this directory, we're going to create an APT source list file which points to the `~/Persistent/apt-repo/` directory we created above. ``` # echo 'deb [trusted=yes] file:/live/persistence/TailsData_unlocked/Persistent/apt-repo ./' > sources.list.d/local.list # chown -R amnesia:amnesia sources.list.d ``` Next, we will manually create the same symlink that the persistence software will create when Tails reboots. ``` # ln -s /live/persistence/TailsData_unlocked/sources.list.d/local.list /etc/apt/sources.list.d/ ``` The new source should now be visible to the `apt` programs. Update the `apt` software's caches with the contents of the new repo. (Note that if the machine is online, it will also update its cached information about the normal Tails and Debian repos as well.) ``` # apt-get update ``` At this point, we can install the OnlyKey app. ``` # apt-get install onlykey ``` When the package finishes installing, a window will slide down from the top of the screen, asking if you want to install the `onlykey` package every time Tails boots. Obviously you're going to want to choose "Install Every Time". # Linux `udev` rules Before you physically insert the OnlyKey device, you need to install a `udev` rules file. These files tell the system what do when a particular hardware device is inserted or removed from the machine. In this case, we need to set some permissions so that the `amnesia` user is able to interact with the OnlyKey hardware. Download the `49-onlykey.rules` file. ``` cd curl -LOv https://raw.githubusercontent.com/trustcrypto/trustcrypto.github.io/master/49-onlykey.rules ``` If the URL in the `curl` command doesn't work: * Make sure that the `~/.curlrc` file or symlink exists, and contains the `socks5-hostname` line shown above. * Visit [`https://docs.crp.to/linux.html`](https://docs.crp.to/linux.html) to make sure the URL for the `49-onlykey.rules` file hasn't changed. Create a persistent `udev-rules.d` directory, and move the downloaded file into it. ``` sudo -i mkdir /live/persistence/TailsData_unlocked/udev-rules.d cd /live/persistence/TailsData_unlocked/udev-rules.d mv ~amnesia/49-onlykey.rules . chown -R 0:0 . chmod -R go=u-w . ``` Configure the persistence software to symlink the files from our new directory, into the system's `/etc/udev/rules.d/` directory when the system starts up. ``` cd /live/persistence/TailsData_unlocked echo '/etc/udev/rules.d source=udev-rules.d,link' >> persistence.conf ``` Create the same symlink that the persistence software will create. ``` ln -s /live/persistence/TailsData_unlocked/udev-rules.d/* /etc/udev/rules.d/ ``` If your OnlyKey device is currently plugged in, you will need to unplug it and plug it back in, in order for the new rules to take effect. # Test it At this point, you should be able to shut down the system, and then reboot Tails again. As long as you unlock the Persistent Storage Volume, the OnlyKey app should automatically install itself. Once the OnlyKey app is finished installing, the Applications menu will have a new sub-menu called "Other", and the OnlyKey app will be listed there. # References [How to Create a Local APT repository](https://askubuntu.com/questions/170348/how-to-create-a-local-apt-repository)