# Moolticute on Tails

jms1 2019-08-30

last update 2019-09-02

**THIS DOCUMENT IS IN PROGRESS**, don't trust it, especially if you can't see the fnords

At the moment, this is the notes I'm keeping as I figure this out, Once I have it working and have tested the procedure from scratch I'll clean this document up and "release" it.

# Background

explain mooltipass, link to website

explain moolticute, link to github

* tried their "AppBundle" thing, it started but couldn't connect to a background daemon

* read about the "AppBundle" concept ... it's interesting, but it's an x86_64 ELF executable, so it won't work on other architectures. that really needs to be made clear, plus it might be useful to make an x86 bundle as well. (haven't looked at how to build from source yet)

* try the AppBundle thing again after figuring out a script to fix the udev and firewall issues

explain tails, link to its website

# Procedure

## Install the software

### APT source file

Create `/live/persistence/TailsData_unlocked/sources.list.d/moolticute-tor.list`

```
deb tor+http://ppa.launchpad.net/mooltipass/moolticute/ubuntu xenial main
```

### Make sure `/etc/apt/sources.list.d` gets persistent files

Add to `/live/persistence/TailsData_unlocked/persistence.conf`

```
/etc/apt/sources.list.d     source=sources.list.d,link
```

### Symlink the file

```
cd /etc/apt/sources.list.d
sudo ln -s /live/persistence/TailsData_unlocked/sources.list.d/moolticute-tor.list .
```

### Update repo

```
sudo apt update
```

This will fail, because...

```
W: GPG error: tor+http://ppa.launchpad.net/mooltipass/moolticute/ubuntu xenial InRelease:
  The following signatures couldn't be verified because the public key is not available:
  NO_PUBKEY D30397520E0A5FDD
E: The repository 'tor+http://ppa.launchpad.net/mooltipass/moolticute/ubuntu xenial
  InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by
  default.
```

Found [this page](https://www.ghacks.net/2011/03/31/adding-missing-ppa-keys-to-an-apt-keyring/) which pointed me to the `apt-add` command. (I've been a RedHat guy since RedHat 4.2 ... not RedHat *Enterprise* 4.2, but the original RedHat 4.2.)

The "`apt-add adv --recv-key`" command on that page didn't work, my guess is that `apt-add` was trying to connect to the keyserver directly instead of using Tor. I figured `gpg` was an important enough security tool that Tails would have it configured to use Tor, and that the key would have made its way to the normal public keyservers, so I tried retrieving the key that way.

```
gpg --recv-key D30397520E0A5FDD
```

Then I exported the key and fed it into "`apt-key add`", like so:

```
gpg -a --export D30397520E0A5FDD | sudo apt-key add
```

After this, I ran the command to update the repo again. This time it worked.

```
sudo apt update
```

### Install the package

```
sudo apt install moolticute
```

## Problems

### udev rules

update `/lib/udev/rules.d/69-mooltipass.rules`

- add `, GROUP="plugdev"` to all four `SUBSYSTEM==` lines
- if device is plugged in, remove and plug back in
- if `moolticuted` is running, kill and restart it

if you run `moolticuted` from the command line, its output will show you that it is in fact able to talk to the device

this file is installed by the `.deb` file, so it will need to be updated evry time tails starts up. persisting the file won't help, the one from the `.deb` file would just overwrite it.

### firewall rules

tails configures the firewall not to trust localhost-to-localhost, so the front-end can't connect to the back-end's TCP socket.

wrote a shell script to add a rule allowing this, it's in the  `~amnesia/Persistence/` directory on (either lexar 16gb "tails installer" or blue 32gb easystore with the opensolaris keychain, i forget which), it needs to run as root

need to figure out if there's a way to persistently run a script as root whenever tails boots, after persistent software is installed. either that, or just write a script which fixes the udev file and the firewall, and tell people that they need to run it with `sudo` before connecting the mooltipass.