[v.0.5.0] Information about the next version - juggled Onions

[radio24]

Behind the scene, we (mainly nyxor, zotil and myself) have been working on different parts to publish a new main version (v.0.5.0) of TorBox (hopefully) at the end of the year. In this post, I will share what components we are working on, what has to be done to meet the deadline, and how you, as a contributor, can help us.

Juggled Onions
The goal of TorBox is not only to give people an anonymizing router on a Raspberry Pi, but we also have the vision to provide a tool that helps bypass barriers such as censorship. However, censorship is not only affecting content receivers but also content deliverers. Our idea is to give out an easy to use micro-server, which allows publishing even if the publisher is behind firewalls, network address translators or lives in a censoring country. Simultaneously, this should not jeopardize the publisher's security and anonymity if correctly used. For that reason, Tor is providing Onion Services, and we started to integrate the Onion Service support into the next TorBox release.

The base for this integration founded nyxor with creating the tool Onionservices. So far, we have implemented the possibility to share a folder on an Onion domain (see below), but Zotil has been providing us with a TorBox File Sharing (TFS) tool which allows us to download and/or upload files as well as a TorBox Chat Secure (TCS). These two tools will also be implemented into TorBox v.0.5.0.

With the above sub-menu, the user can easily create an Onion Service, and (not) publicly share a folder (with a static website):

Other new/improved features

• The coming TorBox version will be based on Debian version 11 (bullseye). We will start to test it out in the following days.
• The "first use" routine will be more user-friendly and provide more options (see here).
• Besides the Bridge support, we will give an option to overcome tightly configured firewalls.
• Some improvements in handling networks (especially the handling with cable connections) will be implemented based on the feedbacks of our users, and the TWM has undergone some nice improvements.
• The displayed tor logs will be decluttered, and TorBox Automatic Counter Actions (TACA) will have some new tricks up its sleeve.
• ...maybe some more

How can you help?
With testing and feedbacks. Tell us what is working good and what is not working. You can also contribute with code - if you see errors (even spelling errors), change them directly in the code and hand in a pull request. Also tell us, which network services you would like to see running on an Onion domain.

How can I install TorBox v.0.5.0 ALPHA?
Our installation script in the v.0.5.0 branch is now updated to support the installation of TorBox v.0.5.0 ALPHA?

1. Download the latest version of the Raspberry Pi OS Lite (about 463 MB)
2. Transfer the downloaded Raspberry Pi OS Lite image on an SD Card, for example, with Balena Etcher. TorBox needs at least a 8 GB SD Card.
3. Log into your newly set up system (pi/rapberry) and, if needed, configure it with “sudo raspi-config”. You need a stable Internet connection for the installation.
4. Download and run the script (to see more options, use -h). USE IT ONLY ON A FRESH INSTALLED SYSTEM - IT WILL CHANGE YOUR SYSTEM AND DELETE CONFIGURATIONS, FILES ETC.:

cd
wget https://raw.githubusercontent.com/radio24/TorBox/v.0.5.0/install/run_install.sh
chmod a+x run_install.sh  
./run_install.sh --select-branch v.0.5.0

5. Restart the system; after 2-3 minutes, when the green LED stops to flicker, connect your client to the new WiFi “TorBox042” (password: CHANGE-IT).
6. Login to the TorBox by using a SSH client (192.168.42.1 on a WiFi client or 192.168.43.1 on a cable client) or a web browser (https://192.168.42.1:9000 on a WiFi client or https://192.168.43.1:9000 on a cable client; for a connection via cable, see here; username: torbox / password: CHANGE-IT).

What are we doing next?

• Handle the open pull requests.
• Update the installation script for the new Raspberry Pi OS (based on Debian version 11 (bullseye)).
• Implementation of the TFS.
  Implementation of the TCS. --> moved to 0.5.1
• Change the update-submenu so that it fits the other submenus.
• ...and more

[nyxnor]

don't forget auth client option, which adds clients to the ClientOnionAuthDir /var/lib/tor/onion_auth used for ssh over tor or any other authentication via the daemon, not the browser.

[radio24]

I'm not sure if I have enough time to integrate it to TorBox v.0.5.0. If not, it will be integrated for v.0.5.1.

[nyxnor]

getopt addition is great.

If possible to add to run_install.sh the option --select-github-user or something like it for anyone to build from their fork.

Also, instead of:

TorBox/install/run_install.sh

Line 163 in b4add58

[ ! -z $2 ] && TORBOXMENU_BRANCHNAME="$2"

TorBox/install/run_install.sh

Line 175 in b4add58

[ -z $TORBOXMENU_BRANCHNAME ] && TORBOXMENU_BRANCHNAME="master"

SELECT_BRANCH="--select-branch"
[ ! -z $2 ] && TORBOXMENU_BRANCHNAME="$2"
[ -z $TORBOXMENU_BRANCHNAME ] && TORBOXMENU_BRANCHNAME="master"

use

SELECT_BRANCH="--select-branch"
TORBOXMENU_BRANCHNAME="${2:-master}"

${VAR:-STRING} ## If VAR is empty or unset, use STRING as its value.

Read the shell bible

[radio24]

Thanks, I will add a --select-fork option right away.

Regarding your second suggestion: if --select-branch is not set, $2 cannot be evaluated.
For example, if you start the program with ./run-install.sh it will straight away go to -- ) shift; break ;; This means that the [ -z $TORBOXMENU_BRANCHNAME ] && TORBOXMENU_BRANCHNAME="master" has to be done after the while loop.

[nyxnor]

tested ACK.

Played with getopt, no option, one option, multiple options, working great.

I would propose instead of

# NEW v.0.5.0: We have to do that after catching the command line option
# TorBox Repository
[ -z $TORBOXMENU_FORKNAME ] && TORBOXMENU_FORKNAME="radio24"
[ -z $TORBOXMENU_BRANCHNAME ] && TORBOXMENU_BRANCHNAME="master"
TORBOXURL="https://github.com/$TORBOXMENU_FORKNAME/TorBox/archive/refs/heads/$TORBOXMENU_BRANCHNAME.zip"

use

TORBOXURL="https://github.com/${TORBOXMENU_FORKNAME:=radio24}/TorBox/archive/refs/heads/${TORBOXMENU_BRANCHNAME:=master}.zip"

Now I am using := to assign the value to the variable, else it would be a one time assignment and not permanent. The :- would work because those variables do not appear after that line on the rest of the script.

What the SELECT_BRANCH and SELECT_FORK is used for? I presume is for the future.

I also suggest using scurl instead of wget according to https://www.whonix.org/wiki/Secure_Downloads when cloning the $TORBOXURL.
It would become

curl --tlsv1.3 --proto =https --location --remote-name ${TORBOXURL}

I was playing with getopt, added short options, put option arguments between <arg>.

# NEW v.0.5.0: New options: [-h|--help] [--select-branch branch_name]
# Catching command line options
OPTIONS=$(getopt -o h,t,f:,b:,s --long help,select-tor,select-fork:,select-branch:,step_by_step -n 'run-install' -- "$@")
if [ $? != 0 ] ; then echo "Syntax error!"; echo ""; OPTIONS="-h" ; fi
eval set -- "$OPTIONS"

SELECT_TOR=
SELECT_BRANCH=
TORBOXMENU_BRANCHNAME=
STEP_BY_STEP=
while true; do
  case "$1" in
    -h | --help )
      echo "Copyright (C) 2021 Patrick Truffer, nyxnor (Contributor)"
      echo "Syntax: run_install.sh [-h|--help] [--select-tor] [--select-branch <branch_name>] [--step_by_step]"
      echo "Options:"
      echo " -h, --help           Shows this help screen ;-)"
      echo " -t, --select-tor     Select a specific tor version (default: newest stable version)"
      echo " -f, --select-fork <fork_owner_name>"
      echo "                      Select a specific fork from a GitHub username"
      echo " -b, --select-branch <branch_name>"
      echo "                      Select a specific TorBox branch (default: master)"
      echo " -s, --step_by_step   Executes the installation step by step"
      echo ""
      echo "For more information visit https://www.torbox.ch/ or https://github.com/radio24/TorBox"
      exit 0
    ;;
    -t | --select-tor ) SELECT_TOR="--select-tor"; shift ;;
    -f | --select-fork ) TORBOXMENU_FORKNAME="${2}"; shift 2;;
    -b | --select-branch ) TORBOXMENU_BRANCHNAME="${2}"; shift 2;;
    -s | --step_by_step ) STEP_BY_STEP="--step_by_step"; shift ;;
    -- ) shift; break ;;
    * ) break ;;
  esac
done

# NEW v.0.5.0: We have to do that after catching the command line option
# TorBox Repository
TORBOXURL="https://github.com/${TORBOXMENU_FORKNAME:=radio24}/TorBox/archive/refs/heads/${TORBOXMENU_BRANCHNAME:=master}.zip"

echo "
TORBOXMENU_FORKNAME=${TORBOXMENU_FORKNAME}
TORBOXMENU_BRANCHNAME=${TORBOXMENU_BRANCHNAME}
TORBOXURL=${TORBOXURL}
"

[radio24]

Thanks for testing and your suggestions! Next, I'm testing the Debian installation script with Debian 11 Bullseye and Debian 12 Bookworm.

Regarding the oneliner code, I know it is shorter, and it looks geekier. However, I like to have the code readable. I'm sure, next time when I look at the code, I will say, what the heck did I here. :-D

What the SELECT_BRANCH and SELECT_FORK is used for? I presume is for the future.

Yes, at the moment, because I also have to update the update script. If I don't need it, I will cut them out.

Regarding scurl: I put it on the to-do list for v.0.5.1. I will look into it, but if I understand it right from the Whonix website, this is not a program package. It seems to be Whonix specific. Outside Whonix it seems to be replaced by curl --tlsv1.3 --proto =https --location --remote-name. Unfortunately, I had some problems with curl in the past. This is why I switched to wget in the first place.

[nyxnor]

Regarding the oneliner code, I know it is shorter, and it looks geekier. However, I like to have the code readable. I'm sure, next time when I look at the code, I will say, what the heck did I here. :-D

It will be readable as soon as you start using it constantly :)

Which problems with curl? Github has tlvsv1.3 but keybase.io only has 1.2, which then would fail. So --tlsv1.2 accepts 1.2 and higher.

[radio24]

Which problems with curl? Github has tlvsv1.3 but keybase.io only has 1.2, which then would fail. So --tlsv1.2 accepts 1.2 and higher.

I'm not sure anymore. It was at the beginning of the project on GitHub. If I remember it right, sometimes downloading from GitHub broke. I didn't have any problems with wget so far. As I said, I will take a look into it, but I cannot lose too much time with it. I'm not working in IT and starting with next week my job offers me again some other nice challenges. ;-) So, my timing for the release date at the end of the year is very tight.

[radio24]

I looked into the curl --tlsv1.3 --proto =https --location --remote-name ${TORBOXURL} suggestion, which is based on a Whonix page.

Whonix claims that wget is buggy and references a post on the wget mailing list archive from July 2012. This is not the first time Whonix has pointed out an old bug, assuming that the affected software has not been developed further all these years. If I chose the used software based on past bug reports, I would probably keep changing indefinitely because bugs are normal but are usually fixed over time in active projects. In TorBox, wget runs without problems and is not used anywhere where it would jeopardize the secure use of the TorBox. At the moment, I see no reason to change the working configuration. As I wrote before, I'm short on available time.

[radio24]

We are working on the implementation of TFS.

[radio24]

Sharing subdirectories is supported, you can have multiple subdirectories inside your TFS file path, but you can download one file at time.

On the TorBox side the shared directory looks like this:

Should I see the subdirectory "test" under "Download" in TFS?

Creating directories for uploading is not supported, because we also thought in the UX and privacy. Creating directories mean to have an authentication layer and identifying who is uploading. Without it, your TFS could become a mess, specially if you're running public.

This makes sense. Years ago, when I was running a public FTP, I always had problems: people created very looong sub-directories with special characters to try to hack the system or hide their uploaded content.

We did our best to have a product without javascript and user friendly and we are open to add more features as people need. Of course there are more things that can be better and we will make it better with the time.

I fully agree with that. Also, feedback will help us know what is essential for the users and concentrate on these points.

[zotil]

On the TorBox side the shared directory looks like this:

Should I see the subdirectory "test" under "Download" in TFS?

Yes, but you need to restart the instance of TFS to re-scan the directory.

[nyxnor]

would nginx reload work?

[zotil]

would nginx reload work?

For re-scan directory? No, TFS does the scan, so is needed to restart TFS, nginx can keep running. Maybe we can add a --scan option to the tfs command in the next versions.

[zotil]

--scan added in the #131