Настройка соеденения tails->tor->proxy
Приветствую. Долго искал инфу по настройки соединения описанного в названии темы. В основном что-то толковое на англоязычных ресурсах. Решил объединить свои усилия в одну тему и послушать критику и дельные советы от специалистов. Наша цель получить неизменный IP в конце цепочки тор-нодов. Конечно на официальном форуме такую связку не одобряют, но на практике она иногда необходима, причем последний ip-шник не должен принадлежать к «списку» нодов tor`a так как их некоторые сайты распознают и создают всякие траблы при использовании. Вот как у меня получилось.
Нам необходимы права root, для этого открываем терминал суперпользователя или в обычном используем префикс sudo. Не забываем добавить пароль root`a при загрузке tails. Далее:
# Proxy DNS requests — no leak for DNS data
# proxy_dns
Как я понимаю DNS у нас используется tor-вский, поправьте меня если я не прав.
И добавляем в конец списка прокси, адрес нужного нам прокси-сервера:
[ProxyList]
# add proxy here .
# meanwile
# defaults set to «tor»
socks4 127.0.0.1 9050
<наш прокси сервер>
Using a VPN/Proxy in Tails
While it isn’t recommended to use a VPN inside the Tails environment (nor would it even work properly without significant modification), using a proxy for specific purposes is completely fine. Your PIA account includes a free Netherlands proxy (proxy-nl.privateinternetaccess.com) that you can generate a userid/pass for and use inside Tails.
Proxy > Tor
If your threat model does not care if PIA knows which first-hop Tor node you connect to and you’re merely trying to hide your Tor activity from your ISP, then a Proxy > Tor connection is ideal. You may also achieve this by using a private Tor bridge (requestable online at https://bridges.torproject.org/ ) but there is zero guarantee that the bridge being used won’t also be known to your ISP and it will still be clear to your ISP that the traffic is Tor related.
To make this type of connection, supply the proxy information in the «Network connection» settings at the Tails startup screen.
Tor > Proxy (Using a program’s internal proxy settings)
Note: these instructions must be repeated each time you restart Tails
If your threat model does not care if your local ISP knows you’re using Tor and you wish to hide your Tor activity from the target website or service (i.e. a site that blocks or restricts Tor users), then a Tor > Proxy connection is ideal. Keep in mind that this would be making a connection between your PIA account details (and any payment methods used for it) and your activity on the target service site. Do not use this if you’re trying to be anonymous unless you are confident that your purchase of PIA credentials was equally anonymous and understand the risks involved.
To make this type of connection, first you’ll need to obtain SOCKS credentials from your PIA account page. Log in to your PIA account and on the account page ( https://www.privateinternetaccess.com/pages/client-sign-in ), in the «PPTP/L2TP/SOCKS Username and Password» section there should be a username and password to use for proxy login. If not, click the button to generate one.
You will be provided with the host proxy-nl.privateinternetaccess.com and port 1080. Then, in the program you wish to route over SOCKS, change the proxy settings of the program to PIA’s SOCKS host and credentials. Typically this data is already entered as 127.0.0.1 port 9050 to route the traffic over Tor.
Instead of running the program standalone, run it with the proxychains command. First we need to install proxychains.
Now we run the program (in this example, hexchat)
This forces the connection first over Tor (127.0.0.1:9150) and then uses the program’s own connection functionality to connect to the SOCKS proxy.
If the program you want to run does not have proxy settings available, this method will not work.
Tor > Proxy (Forcing all traffic over proxychains; ideal for web browsers that don’t have internal proxy settings)
Note: these instructions must be repeated each time you restart Tails
Как в Tails весь установленный софт пустить через Tor?
Весь установленный поверх софт нужно настраивать самому на подключение через SOCKS5 Proxy, которую предоставляет Tor (127.0.0.1:9150). Пока Вы этого не сделаете, у софта не будет выхода в Интернет.
Подключения по SSH по умолчанию будут торифицироваться.
Можете сделать это через Nautilus, он уже торифицирован и умеет SFTP через «Connect to Server».
Скорее всего, ничего не выйдет.
Skype блокирует подключения с Tor-exit нод:
https://trac.torproject.org/projects/tor/wiki/org/.
К тому же, Skype сам по себе, как продукт, в плане приватности небезопасен: а) никто не знает, что он делает (closed-source) и какие фингерпринты собирает; б) Skype кооперируется с NSA: www.theguardian.com/world/2013/jul/11/microsoft-ns.
- Telegram Desktop умеет подключаться через SOCKS5: i.imgur.com/pZCvzqR.png
- Telegram Web будет работать из браузера. Встроенный в Tails браузер торифицирует подключения по умолчанию. Правда, он выключает некоторые скрипты. Нужно проверять, работает ли Telegram Web. Ещё, браузер в Tails не хранит кук/хранилищ, поэтому каждый вход в Telegram Web означает повторную авторизацию через код.
Вообще, будьте осторожны:
Tails не предназначен для использования в качестве постоянной ОС на диске. Это дистрибутив, оптимизированный затирать все данные о своём присутствии после каждой сессии.
https://tails.boum.org/support/faq/index.en.html#i.
Тем не менее, настройки ПО (даже своего) можно сохранять на persistent volume.
Всё установленное поверх ПО будет устанавливаться с пакетов при каждом запуске Tails заново, с каждой сессией. Хранение конфигов на persistent volume позволит сохранять настройки.
Connecting to Tor automatically
First, Tails synchronizes the clock of the computer automatically, because a correct time is needed to be able to connect to the Tor network.
Tails learns the current time by connecting to the captive portal detection service of Fedora, which is used by most Linux distributions. This connection does not go through the Tor network and is an exception to our policy of only making Internet connections through the Tor network.
You can learn more about our security assessment of this time synchronization in our design documentation about non-Tor traffic.
If you choose instead to hide that you are connecting to Tor, you might have to fix the computer clock manually.
Then, Tails tries different ways of connecting to Tor until it succeeds:
Tails tries to connect to Tor directly using public relays, without using a bridge.
Tails tries to connect to Tor using one of the default bridges, already included in Tails, if connecting using public relays fails.
If public relays and default bridges don't work, Tails asks you to configure a custom bridge, if connecting using the default bridges fails.
- Detect if you have to sign in to the local network using a captive portal (#5785)
Hiding to your local network that you are connecting to Tor
When you choose this option, Tails will only connect to Tor after you configure a Tor bridge. Bridges are secret Tor relays that hide that you are connecting to Tor.
It is impossible to hide to the websites that you visit that you are using Tor, because the list of exit nodes of the Tor network is public.
You will have to know the address of a custom bridge.
To request a custom bridge, you can either:
For example, you can send the email from your phone and type the bridge in Tails.
Sending the email reveals to Gmail or Riseup that you are trying to connect to Tor but not to someone who monitors your Internet connection.
Even someone who knows your bridge cannot know what you are doing online from Tails.
To save the last Tor bridge that connected to Tor successfully, turn on the Tor Bridge feature of the Persistent Storage.
In the future, we will make it easier to use a custom bridge by:
- Allowing you to scan the QR code returned by bridges@torproject.org (#18219)
- Allowing you to request a bridge from Tails by solving a CAPTCHA (#15331)
Viewing the status of Tor
Вы подключены к Tor.
Вы не подключены к Tor.