# Keybase on Tails John Simpson `` 2019-08-10 Last updated: 2019-08-12 **NOTE: I'm not 100% sure that everything in this document is correct.** Please be careful, make sure you understand what's going on with each step before you do it. Also, you should make VERY sure that your Persistent Volume is set up and working correctly before signing into Keybase, *especially* if you're creating a new Keybase user for this. Remember that Keybase usernames cannot be re-used. If you create a ### Notes In the command line examples below, lines starting with "`$`" are meant to be executed as the `amnesia` user, and lines starting with "`#`" are meant to be executed as `root`. # Procedure ## Enable Persistence ### Set up Persistent Volume The following options need to be "ON" after creating the persistent volume: * **Personal Data** - this creates a "`~/Persistent/`" directory whose contents are persistent across reboots. * **Additional Software** - this sets up a mechanism to have `.deb` files automatically install when Tails boots. * **Dotfiles** - this sets up a mechanism to have any files you may need, automatically symlinke into the `amnesia` user's home directory. Typically this would be used for "dot files", such as "`.bashrc`". We will be using it to configure `curl` to use the SOCKS5 proxy built into TOR. Obviously, other options can be enabled if you need them. (I normally enable all of them.) ### Reboot with Persistent Volume After *creating* the persistent volume, you need to reboot Tails and unlock the volume in order to use it. The Tails greeter should have a section in the middle which allows you to unlock the persistent volume. **Enter the persistent volume's password** and click the "Unlock" button on the right. It will verify the password and then say "Your persistent storage is unlocked". You will also need to **set an administration password**, in order to have permission to make some of the changes below. Click the "+" button at the bottom left of the greeter, click "Administration Password", enter a password twice, and click "Add" at the top right of the password entry window. Click the "Start Tails" button at the top right of the greeter window. ## Set up the system Now that persistence is active, we can start thinking of Tails as a "system" which can be configured in a "permanent" manner, although because only certain parts of the system are persistent across reboots, the configuration process is somewhat different than you may be used to. The biggest difference is that, instead of directly configuring the system the way you want it, you need to configure the Persistence software to set the system up the way you want it. ### Become root Many of the following commands need to be run as root. Rather than typing `sudo` in front of every single command, it's easier to just walk through this part of process as root. ``` amnesia@amnesia:~$ sudo -i ... root@amnesia:~# ``` You will be prompted for a password, enter the "Administration Password" you created while booting Tails. When this is done, your shell prompt will change to "`root@amnesia:~#`". In the examples below, commands shown with "`#`" at the beginning are meant to be executed as root. ### Persistent `/etc/apt/sources.list.d/` files The Tails "Configure persistent volume" app doesn't offer the list of APT repositories as an option, so we need to add it by hand. **NOTE:** Be VERY careful with the `persistence.conf` file. If you make a typo, you can break the entire Persistence feature of Tails. (This is why we're making a backup copy of the file before we change anything.) ``` # cd /live/persistence/TailsData_unlocked # mkdir -m 0755 sources.list.d # cp persistence.conf persistence.conf.bak # echo '/etc/apt/sources.list.d source=sources.list.d,link' >> persistence.conf ``` When Tails boots, any *files* in the `/live/persistence/TailsData_unlocked/sources.list.d/` directory will be symlinked into the `/etc/apt/sources.list.d/` directory. Doing it this way allows us to *add to* the list of repositories that the `apt` utilities use. ### Configure Keybase deb repo ``` # cd /live/persistence/TailsData_unlocked/sources.list.d # echo 'deb tor+http://prerelease.keybase.io/deb stable main' > keybase-tor.list # chmod 0644 keybase-tor.list # cd /etc/apt/sources.list.d # ln -s /live/persistence/TailsData_unlocked/sources.list.d/keybase-tor.list . ``` This creates a *slightly modified* copy of what's in the `keybase.list` file. The difference is that this one uses "`tor+http://`" in the URL, rather than just `http://`. It then manually creates the same symlink that the Persistence software will create when Tails boots, so that the repo is available without having to reboot. ``` # apt update ``` This reads and caches the repo index files from all APT sources, including the one we just created. ### Persistent `/etc/default/` files The Keybase `.deb` package normally an APT source list file, which allows the `apt` utilities to upgrade the Keybase software without your having to manually download a new `.deb` file. However, the source list file that it installs doesn't work under Tails, because the URL starts with "`http://`" rather than "`tor+http://`". If the file `/etc/default/keybase` exists when the `.deb` package is installed, the package will *not* create the APT source list file. However, Tails installs the package before the user has a chance to create this file, *and* if the user doesn't enter an Administration password in the Tails greeter, they won't have permission to create the file. So we're going to make the Persistence software create the file for us. ``` # cd /live/persistence/TailsData_unlocked # mkdir -p etc/default # touch etc/default/keybase # chmod -R go=u-w etc # echo '/etc/default source=etc/default,link' >> persistence.conf # cd /etc/default # ln -s /live/persistence/TailsData_unlocked/etc/default/keybase . ``` ### Install Keybase At this point we should be able to install the Keybase package. ``` # apt install keybase ``` Remember that the package is being downloaded through the Tor network, so it's going to take a bit longer than you may be used to. In my case, with a 100Mbit fiber connection at the house, downloading it directly took about twelve seconds, while downloading it over the Tor network took about three minutes. *Be patient.* When the installation is complete, a window will "slide down" from the top of the screen, asking if you want to install Keybase every time Tails boots. Obviously you should say yes. ### Set up persistent Keybase directories The Keybase stores files in three different directories, whose contents need to be kept across reboots. We're going to make these directories persistent. First create the three directories: ``` # cd /live/persistence/TailsData_unlocked # mkdir -p keybase/{cache,config,localshare} # chown -R amnesia:amnesia keybase ``` Then edit the `persistence.conf` file, and add the following lines to the end of the file: ``` /home/amnesia/.cache/keybase source=keybase/cache /home/amnesia/.config/keybase source=keybase/config /home/amnesia/.local/share/keybase source=keybase/localshare ``` ### Reboot At this point, we should reboot the system and make sure Tails starts up the way we expect it to. ``` # reboot ``` ## Using the client When booting Tails, when you get to the Tails greeter, be sure to unlock your Persistent Volume, and (for now) set an Administration Password. When the desktop appears, watch the messages in the boxes which "slide down" from the top of the screen. They will normally report the following: * Installing your additional software from persstent storage * Synchronizing the system's clock * Tor is ready * Additional software installed successfully ### Post-setup checklist If you've just finished setting things up and is this is the first time you've rebooted Tails, you should check the following items to be sure that Tails is configuring things correctly: * **`ls -l /etc/apt/sources.list.d/`** * `keybase-tor.list` should exist as a symlink pointing to `/lib/live/mount/persistence/TailsData_unlocked/sources.list.d/keybase-tor.list` * `keybase.list` should *not* exist * **`ls -l /etc/default/`** * `keybase` should exist as a symlink pointing to `/lib/live/mount/persistence/TailsData_unlocked/etc/default/keybase` * **`mount | grep keybase`** * You should see three lines, starting with "`/dev/maper/TailsData_unlocked on`", mounted on each of these directories: * `/home/amnesia/.cache/keybase` * `/home/amnesia/.config/keybase` * `/home/amnesia/.local/share/keybase` * **`apt show keybase`** * Should show information about the installed Keybase client. * This information should contain the following lines: * `Package: keybase` * `Version:` with something newer than `4.3.0-20190812143918.f8de90a10f` * `APT-Sources: tor+http://prrelease.keybase.io/deb stable/main amd64 Packages` * The "Applications -> Internet" menu should have an entry for the Keybase app. ### Temporary fix **At the time I'm writing this**, the current version of the client is `4.3.0-20190812143918+f8de90a10f`. There is a bug in the `.deb` file where one of the files is installed with the wrong permissions. This needs to be fixed before the GUI will be able to run. ``` $ sudo chmod 04755 /opt/keybase/chrome-sandbox ``` I've been told that an update should be out tomorrow some time. Once it is, and I have verified that this problem no longer exists, I will remove this section of the document. Also, at that point, an Administation Password should not be necessary (although you may need it in order to upgrade the Keybase package, I haven't tried this yet.) **UPDATE:** This problem is fixed in the current version, `4.3.1-20190813132700.6f497ec371`. ### Configure "tor mode" By default, the Keybase client expects to be able to connect directly to the Keybase servers. Tails configures the system so that all traffic *not* going through Tor is blocked, so this won't work. To fix this, we need to configure the Keybase client to send all of its network traffic through Tor. ``` $ keybase config set tor.mode leaky ▶︎ INFO Stating keybase.service. ``` Note that the three persistent directories *must* be active in order for this setting to be remembered, which is why we've waited until now to do this. * [Documentation about Tor mode](https://keybase.io/docs/command_line/tor) ### Start Keybase The moment we've all been waiting for... ``` $ run_keybase ``` Assuming all goes well, this will take a few seconds to start things up, and then you'll see the "Crypto Squirrel" message. Then, a few seconds later, the Keybase GUI should pop up, and a Keybase widget should appear in the menu bar at the top of the screen.