Blog Archive

DeepDotArchive

Guide: Anonymity and Privacy for Advanced Linux Users

22 minute read

Posted by: DeepDotWeb

June 15, 2015

All Credits go to beac0n, thanks for contacting us and contributing the guide you created!

As people requested – here is a link to download this guide as a PDF.

Intro

The goal is to bring together enough information in one document for a beginner to get started. Visiting countless sites, and combing the internet for information can make it obvious your desire to obtain anonymity, and lead to errors, due to conflicting information. Every effort has been made to make this document accurate. This guide is image heavy so it may take some time to load via Tor.

Some general sources/Big Thanks

For more general guides checkout:
EFF Surveillance Self-Defense project
Riseup.net Security Guide
Security in a box
TAILS Documentation – for those looking for a solid starting place TAILS OS is a great choice.

Thanks!
securityinabox.org
Deepdotweb.com
EFF and EPIC
riseup.net

For educational purposes.
Not legal advice or call to action.

Table of Contents

1 Intro
2 Some general sources/Big Thanks
3 Technical Information

Technical Information

Strong Passwords

It’s difficult to remember many passwords. First off it’s good to select a strong password manager. Keepassx is cross-platform, and has good security features, like encryption by password and using a keyfile. It also allows you to generate strong passwords, so if you’re not worried about memorization it’s good practice to let Keepassx generate secure random passwords.

It’s best not to use services that store your passwords in the cloud. If you need you can back up your encrypted password database, on a secure server, in an encrypted directory, and store your keyfile in a separate location.

Passwords for encryption and critical access should be prioritized. Even a long randomized password may not be a secure enough method. EFF recommends you try the diceware method, or basically randomly chain a number of words selected from a word list based on dice roles. Full details are available here.

Although it’s an annoyance, passwords are the ever present key to what matters most to you.

Internet Connectivity

No service provider should be presumed to completely protect your privacy. Even if your VPN/Proxy or other ISP promises no logs, or identifiable information, time and time again information has been collected and used against those seeking anonymity. Open-Source technologies where you are able to examine source, yet trust is still ultimately placed in the hands of developers, are better than trusting a Government of other entity with your security.

Consider reading the Terms of Service any time you sign up for a service or install something.

Also remember that the times you use technology can be used to build a profile of your location for identification. Consider changing up your times of connectivity. On forums, chat and other services, it may be worthwhile to disable the notification that outwardly displays when you are on line or select invisible mode when applicable.

Firewall

UFW (Uncomplicated Firewall) is a great general firewall for linuux

sudo apt-get install ufw
sudo ufw enable
sudo ufw default deny incoming

as some malware may utilize outgoing traffic, like encrypted udp, it may be worthwhile to limit outgoing ports

sudo ufw default deny outgoing

it may be better to specifically allow/deny the specific ports of concern.

sudo ufw allow port/tcp
sudo ufw allow port/udp

Then when you’re done check the status

sudo ufw status</textarea></div>

you can see I’ve blocked some specific ports in this example

For more advanced configuration visit.

Changing MAC Address

A MAC Address is a hardware specific identifier for you network interface. In some cases it may be useful to change your mac address to avoid detection.

Arch Linux Guide:

sudo apt-get install macchanger for a gui sudo apt-get install macchange-gtk</textarea></div>

With macchanger-gtk

heck your current mac addresses for future reference

macchanger eth0 macchanger wlan0</textarea></div>

for a random macaddress

sudo ifconfig wlan0 down</textarea></div>

sudo macchanger -r wlan0</textarea></div>

This will change the mac address to a random value

macchanger -e wlan0</textarea></div>

will change the mac address but keep it as the same vendor. This can be useful if you’re spoofing your address but you don’t want it obviously coming from a device not on the network.

sudo macchanger -A wlan0</textarea></div>

This will change the devices MAC to a random MAC of any kind, regardless of the original device.

sudo macchanger —mac=XX:XX:XX:XX:XX:XX interface</textarea></div>

Will change to a specific mac address of your choice

You may want to write a script to start automatically on network manager start, and network manager shut down.

sudo nano /etc/init/macchanger.conf</textarea></div>

description "change mac addresses" start on starting network-manager pre-start script /usr/bin/macchanger -A wlan0 /usr/bin/macchanger -A eth0 /usr/bin/macchanger -A wmaster0 /usr/bin/macchanger -A pan0 #/usr/bin/logger wlan0 `/usr/bin/macchanger -s wlan0` #/usr/bin/logger eth0 `/usr/bin/macchanger -s eth0` end script </textarea></div>

you can switch out -A for -r or whatever other configuration you might want.

sudo nano /etc/network/if-post-down.d/random-mac</textarea></div>

#!/bin/sh MACCHANGER=/usr/bin/macchanger [ "$IFACE" != "lo" ] || exit 0 # Bring down interface (for wireless cards that are up to scan for networks), change MAC address to a random vendor address, bring up the interface /sbin/ifconfig "$IFACE" down macchanger -A "$IFACE" </textarea></div>

sudo chmod +x /etc/network/if-post-down.d/random-mac
sudo service network-manager restart

Intrustion Detection

The basic premise is monitoring the system for unusual activity. First is to keep an eye on the logs, and the next step is to consider an IDS like snort. There’s a learning curve, but here are some useful tools, that with some research can increase security especially if you allow others to access the system.

logwatch
1. help.ubuntu.com

snort
1. snort.org
2. http://manual.snort.org/

Open Source SECurity
1. www.ossec.net
2. http://www.ossec.net/?page_id=160

You may want to get yourself acquainted with some of the common security tools available. Here’s a good list, definitely nmap, tcpdump, netcat and wireshark are useful.

Disk Encryption

On first install of a linux operating system you should be prompted to create an encrypted LVM partition, and encrypt your home folder. This is a good start. For further security there is veracrypt.

Veracrypt is a fork of Truecrypt that is better at patching vulnerabilities. I see a lot of tutorials touting Truecrypt, and it’s in most package managers. However, you should download Veracrypt.

Download: veracrypt.codeplex.com/releases/view/56…

Here’s a good beginners tutorial for Veracrypt

How to create a hidden encrypted volume with Veracrypt

Select Create Volume

Select Create an Encrypted File Container

Select Hidden Veracrypt volume

Choose volume location and select never save history:

Select your encryption algorithm, AES is fine, but you may chose more secure
Select Hash Algorithm, SHA-512 is sufficient

Select Use Key files and click the key files box… optional:

Generate save the new key.

Click add files and add the key<br/>
Click Generate Random Keyfile box if you want another key<br/>
You may also use existing keys:</p>

Click format to create the volume that will be visible:</p>

Now it’s recommended to load this volume with contents that appear sensitive</p>

You will follow the same steps, remember this is the hidden volume consider it’s security most important.</p>

When complete you will see this warning, read it carefully.</p>

Browsers

Tor Browser

Download at: torproject.org

All Tor network addresses will be followed with .onion, not .com. It is far more secure browsing .onion services.

In depth explanation of Tor by its head developer Arma.

Once you’ve download tor browser, expand the zipped file. Then

cd tordirectory ./start-tor-browser.desktop</textarea></div>

Forbidding javascript and other elements can make web browsing less convenient, but by allowing more elements you open yourself to potential vulnerabilities. It’s best to find the best possible security setting you can withstand while the web browsing experience is still functional.

Configuring Security Settings

Privacy and security settings can be easily configured. Click on the Onion in the top left.

Select “Privacy and Security Settings” Adjust the slider to your desired level of security.

Noscript basics

Depending on your security level selected in Tor, Noscript may not provide any advantage. That main advantage of Noscript is it’s easier to tailor allowing on specific sites, or for specific elements on the fly. Click the S in the Top Left next to the Tor Onion symbol and select forbid scripts globally. You should see a red line across the S. If you allow specific sites, you should check that the red line is there for those you do not allow. Allowing only specific sites may create a fingerprint of your activity. There are some advanced settings under options worth taking a look at.

Tor bridge

in some cases if Tor is blocked or you wish to conceal the use of Tor a bridge can be configured. This makes it more difficult for an ISP to detect Tor. Bridges can help avoid censorship, and if your ISP Blocks Tor Traffic it is much more difficult to detect the nature of the traffic unless deep packet inspection is employed. It’s one of those things that since it’s there, might as well set it up as a per-cautionary measure and see if your connection is still, reliable and fast enough for your standards.

Click Open Settings on the Pop-up Connection Box </a>
Click configure
Select Yes to ISP Censors or Blocks
obfs3 is fine, see below for information on other options.
Most likely just skip use a local proxy
Click connect </ul>
Optionally if Tor is already started you can:
- click the onoin icon in the top left of the browser and select
- Open Network Settings
- check My ISP Blocks Connections and hit OK.
- Use obfs 3 which is recommended, see next section on other types.