Bugzilla – Attachment 46644 Details for
Bug 15540
Debian package option to set up an .onion address (Tor hidden service) for the OPAC
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC
Bug-15540---Debian-package-option-to-set-up-an-oni.patch (text/plain), 19.19 KB, created by
Mirko Tietgen
on 2016-01-14 08:53:41 UTC
(
hide
)
Description:
Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC
Filename:
MIME Type:
Creator:
Mirko Tietgen
Created:
2016-01-14 08:53:41 UTC
Size:
19.19 KB
patch
obsolete
>From 5845d5351fb8234dfeb8d2666950c6c32a9701b3 Mon Sep 17 00:00:00 2001 >From: Mirko Tietgen <mirko@abunchofthings.net> >Date: Sat, 9 Jan 2016 22:55:16 +0100 >Subject: [PATCH] Bug 15540 - Debian package option to set up an .onion address > (Tor hidden service) for the OPAC > >Add --tor to koha-create: automatically set up a .onion URL for the OPAC. >Install Tor from official repository if required. > >Test plan: > >0) Requirements > >- Apply patch >- Build Debian package >- Test server needs to be reachable from the internet >- Download Tor Browser to your local machine (not the server) > https://www.torproject.org/download/download-easy.html.en > (Running Tor Browser and Koha with Tor on the same machine does not seem to work) > >1) First Koha instance using Tor, refuse Tor installation > >- Test without the package 'tor' installed! >- koha-create --create-db --tor <instance1> > You should be asked if you want to install Tor >- Refuse > >Expected result: > >- You are told to either accept to install Tor or not use the --tor option >- Installation process stops cleanly (no remaining user account etc.) > >2) First Koha instance using Tor, accept Tor installation > >- Test without the package 'tor' installed! >- koha-create --create-db --tor <instance1> > You should be asked if you want to install Tor >- Accept >- Wait for the installation to finish >- Open your regular OPAC URL > You should see the OPAC maintenance website >- Open (in Tor Browser) the .onion address displayed at the end of the installation > You should see the OPAC maintenance website. It can take a minute until this works > >Expected results: > >- Tor repository is added to /etc/apt/sources.list.d/tor.list >- Package 'tor' (and keyring + dependencies) is installed >- Koha instance is created as usual >- Tor config is added to /etc/tor/torrc. It includes a block that looks like > # begin instance koha-<instance1> > HiddenServiceDir /var/lib/tor/koha/<instance1>/hidden_service > HiddenServicePort 80 127.0.0.1:80 > # end instance koha-<instance1> >- .onion address from /var/lib/tor/koha/<instance1>/hidden_service/hostname > is added as ServerAlias to /etc/apache2/sites-availabled/<instance1>.conf >- You can reach the OPAC from the regular address and via .onion (in Tor Browser) > >3) Additional instances using Tor / Tor already installed > >- koha-create --create-db --tor <instance2> > You should not be asked if you want to install Tor again. >- Wait for the installation to finish >- Open your regular OPAC URL of <instance2> > You should see the OPAC maintenance website >- Open Tor Browser at the .onion address displayed at the end of the second installation > You should see the OPAC maintenance website > It can take a minute until this works >- Copy the .onion address, you will need it in step 5 and 7! > >Expected results: > >- Second Tor config is added to /etc/tor/torrc >- You can reach the second OPAC from the regular address and via .onion (Tor Browser) > >4) Remove an instance > >- Remove your first instance with koha-remove <instance1> > Removal process should work as expected >- Check /etc/tor/torrc > The block for your first instance should be gone >- Check /var/lib/tor/koha/instance1/ > The hidden_service folder and key should still be there. This way you can re-use > an .onion address after reinstallation. > >5) Re-create an instance (old config) > >- koha-create --create-db --tor <instance1> #use the same name as for step 2! > You should be asked if you want to re-use the existing .onion address or delete it >- Choose to re-use the old config >- Wait for installation to finish >- Open the OPAC with the regular URL and the (old) .onion address (in Tor Browser) > Both should work. It can take a minute for the .onion to show up >- Verify that the .onion is the same as the one from step 3 > >6) Remove the instance again > >- Follow step 4 > >7) Re-create an instance (new config) > >- koha-create --create-db --tor <instance1> #use the same name as for step 1! > You should be asked if you want to re-use the existing key and .onion address or delete it >- Choose to delete the folder and get a new .onion >- Wait for installation to finish >- Open the OPAC with the regular URL and the (new) .onion address (in Tor Browser) > Both should work. It can take a minute for the .onion to show up >- Verify that the .onion is not the same as in step 3 and 5 > >Possible bonus tests: > >- Using an operating system that does not have a Tor package available in the official > repository should be detected. Testing this would require such an OS for testing. > Recent Debian and Ubuntu seems to be covered. >- A manual Tor installation before Koha is installed should be detected and work, > a prompt will allow to either overwrite the old config or stop the installation >- If the Tor repository is already present in /etc/apt/sources.list*, it is not added again >--- > C4/Auth_cas_servers.yaml.orig | 12 --- > debian/docs/koha-create.xml | 8 ++ > debian/scripts/koha-create | 176 ++++++++++++++++++++++++++++++- > debian/scripts/koha-remove | 5 + > debian/templates/apache-site-tor.conf.in | 21 ++++ > debian/templates/apache-site.conf.in | 1 + > debian/templates/torrc.in | 31 ++++++ > 7 files changed, 240 insertions(+), 14 deletions(-) > delete mode 100644 C4/Auth_cas_servers.yaml.orig > create mode 100644 debian/templates/apache-site-tor.conf.in > create mode 100644 debian/templates/torrc.in > >diff --git a/C4/Auth_cas_servers.yaml.orig b/C4/Auth_cas_servers.yaml.orig >deleted file mode 100644 >index 8ad171e..0000000 >--- a/C4/Auth_cas_servers.yaml.orig >+++ /dev/null >@@ -1,12 +0,0 @@ >-# This file is used for authenticating against multiple CAS servers >-# If the file Auth_cas_servers.yaml exists, then the casServerUrl syspref will be ignored >- >-# If you have to authenticate against only one CAS server, which is usually the case, >-# don't use this file, but the casServerUrl syspref instead >- >-default: ServerName >---- >- ServerName: "https://example.com/cas" >- OtherServerName: "https://example.org/cas" >- ThirdServerName: "https://example.edu/cas" >- >diff --git a/debian/docs/koha-create.xml b/debian/docs/koha-create.xml >index 92785ac..4dc3b68 100644 >--- a/debian/docs/koha-create.xml >+++ b/debian/docs/koha-create.xml >@@ -40,6 +40,7 @@ > <arg><option>--enable-sru</option></arg> > <arg><option>--sru-port</option> port</arg> > <arg><option>--upload-path</option> directory</arg> >+ <arg><option>--tor</option></arg> > <arg><option>--help</option>|<option>-h</option></arg> > > <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg> >@@ -177,6 +178,13 @@ > </varlistentry> > > <varlistentry> >+ <term><option>--tor</option></term> >+ <listitem> >+ <para>Enable a Tor hidden service (.onion address) for the created instance.</para> >+ </listitem> >+ </varlistentry> >+ >+ <varlistentry> > <term><option>--help</option>,<option>-h</option></term> > <listitem> > <para>Print usage information.</para> >diff --git a/debian/scripts/koha-create b/debian/scripts/koha-create >index a36f7e3..6c15c14 100755 >--- a/debian/scripts/koha-create >+++ b/debian/scripts/koha-create >@@ -71,6 +71,7 @@ Options: > conjunction with --defaultsql and --populate-db. > --upload-path dir Set a user defined upload_path. It defaults to > /var/lib/koha/<instance>/uploads >+ --tor Automatically set up a Tor hidden service for the OPAC > --help,-h Show this help. > > Note: the instance name cannot be longer that 11 chars. >@@ -311,6 +312,158 @@ enable_sru_server() > fi > } > >+tor_check_install() >+{ >+ # Check if Tor is installed >+ >+ # Check if Tor is installed, otherwise do it now >+ # Repeat for every instance. Do at the beginning so we can stop the installation if necessary. >+ if [ $(dpkg-query -W -f='${Status}' tor 2>/dev/null | grep -c "ok installed") -eq 0 ]; then >+ debrelease="$(lsb_release -c | sed 's|.*\W\(.*\)|\1|')" >+ # Check if Tor repository for this version of GNU/Linux exists >+ if [ $(curl -sI "http://deb.torproject.org/torproject.org/dists/$debrelease/" | grep -c "200 OK") -eq 0 ]; then >+ die "Cannot find a Tor release for $debrelease in the official repository. Please install the 'tor' package manually to use the option --tor" >+ else >+ # Prompt before adding the official Tor repo and installing Tor >+ read -r -p "Tor is not installed. Do you want Koha to automatically set up the Tor repository and install Tor? [y/N] " response >+ if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]] >+ then >+ TORINSTALLATION="yes" >+ else >+ die "You need to install Tor to use the --tor option. Either accept or run koha-create without the --tor option." >+ fi >+ fi >+ else >+ if [ -e "/etc/tor/torrc-koha" ]; then >+ TORINSTALLATION="previous" >+ else >+ TORINSTALLATION="manual" >+ # Prompt to overwrite previous Tor config, otherwise stop installation >+ read -r -p "Tor seems to be installed manually. Previous configuration file /etc/tor/torrc will be deleted! Continue? [y/N] " response >+ if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]] >+ then >+ rm -f /etc/tor/torrc >+ else >+ die "Please move your old configuration file /etc/tor/torrc and run koha-create again." >+ fi >+ fi >+ fi >+ >+ # Is a key already present in the folder? >+ if [ $(tor_check_instance $name) -eq 1 ]; then >+ # Prompt to re-use previous key >+ toroldonion="$(tor_get_onion $name)" >+ read -r -p "There is a previous .onion key in the hidden service folder for instance $name. Do you want to overwrite it? Choose no to re-use the address $toroldonion. [y/N] " response >+ if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]; then >+ rm -Rf /var/lib/tor/koha/$name/ >+ toruseoldconfig="no" >+ else >+ toruseoldconfig="yes" >+ fi >+ >+ fi >+} >+ >+tor_check_instance() >+{ >+ # Check if previous Tor hidden service folder exists and promt for re-use or deletion >+ # Takes a Koha instance name as an argument >+ if [ -e "/var/lib/tor/koha/$1/hidden_service/private_key" ]; then >+ echo "1"; >+ else >+ echo "0" >+ fi >+} >+ >+tor_install() >+{ >+ # Install Tor from the official repository. >+ # Only done once⦠I guess. >+ >+ echo "Installing Torâ¦" >+ debrelease="$(lsb_release -c | sed 's|.*\W\(.*\)|\1|')" >+ # Check if Tor repository is already in /etc/apt/sources.list.* >+ if [ $(grep -rl "^deb http://deb.torproject.org/torproject.org" "/etc/apt/sources.list" "/etc/apt/sources.list.d/") != "" ]; then >+ echo "deb http://deb.torproject.org/torproject.org $debrelease main" | tee -a /etc/apt/sources.list.d/tor.list >+ gpg --keyserver keys.gnupg.net --recv 886DDD89 >+ gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add - >+ apt-get update >+ fi >+ apt-get install -y tor deb.torproject.org-keyring >+ service tor stop >+ # next: tor_config >+} >+ >+tor_config() >+{ >+ # Create Koha-specific Tor config, make backup of last config. >+ # Called for every new instance >+ >+ # Check if /etc/tor/torrc-koha exists, if not create it now >+ if [ ! -e "/etc/tor/torrc-koha" ]; then >+ generate_config_file torrc.in \ >+ "/etc/tor/torrc-koha" >+ rm -f /etc/tor/torrc # just in case >+ ln -s /etc/tor/torrc-koha /etc/tor/torrc >+ chown -R debian-tor:debian-tor /etc/tor/ >+ fi >+ tor_instance >+} >+ >+tor_instance() # FIXME there needs to be tor_remove in koha-remove to undo all this >+{ >+ # Add config to Tor configuration file >+ # Repeat for every instance. >+ # FIXME should go to koha-tor or koha-functions? >+ >+ torconfig=`cat <<EOF >+ >+# begin instance koha-$name >+HiddenServiceDir /var/lib/tor/koha/$name/hidden_service/ >+HiddenServicePort 80 127.0.0.1:80 >+# end instance koha-$name >+ >+EOF` >+ echo "$torconfig" >> /etc/tor/torrc-koha >+ # Create instance-specific Tor folder. >+ # We put this in /var/lib/tor/koha/ to keep it out of Koha backups and safe from koha-remove. >+ # FIXME Would it be better to have it in the backups? >+ # >+ # Re-use old .onion if desired >+ if [ "$toruseoldconfig" != "yes" ]; then >+ mkdir -p /var/lib/tor/koha/$name >+ fi >+ chown -R debian-tor:debian-tor /var/lib/tor/koha/ >+ # Start Tor with new settings >+ service tor restart # needs to be done after apache for this instance is started, or hostname won't be created >+ # Get .onion address # FIXME does this work instantly or should we wait a few seconds? >+ onion="$(tor_get_onion $name)" >+ torinfo=`cat <<EOF >+Your .onion address is $onion. >+If you already have another .onion address that you would like to re-use, >+stop the tor service, copy the key to /var/lib/tor/koha/$name/hidden_service/private_key, >+change the ServerAlias in /etc/apache2/sites/sites-available/$name.conf to your >+old .onion address, restart Apache and restart Tor. >+EOF` # FIXME Should this be done at the first check so we don't do all the installation? >+ echo "$torinfo" >+ # Write ServerAlias $onion to apache config and restart apache >+ sed -i "s/__OPACTORHIDDENSERVICE__/$onion/g" "/etc/apache2/sites-available/$name.conf" >+ sed -i "s:^\s*#\(.*\)#onion$: \1:" "/etc/apache2/sites-available/$name.conf" >+ service apache2 reload >+} >+ >+tor_get_onion() >+{ >+ # Get .onion address of an instance >+ # Repeat on demand. >+ # FIXME should go to koha-tor or koha-functions? >+ >+ # This is useful for 'public' 'hidden' Koha OPACS. For security reasons, other >+ # hidden services a library might run SHOULD NOT BE in /var/lib/tor/koha/ >+ local myonion="$(cat /var/lib/tor/koha/$1/hidden_service/hostname)" >+ echo $myonion >+} >+ > # Set defaults and read config file, if it exists. > DOMAIN="" > OPACPORT="80" >@@ -354,6 +507,10 @@ END_BIBLIOS_RETRIEVAL_INFO="" > START_AUTHORITIES_RETRIEVAL_INFO="" > END_AUTHORITIES_RETRIEVAL_INFO="" > >+# Tor settings >+ENABLE_TOR_HIDDEN_SERVICE="no" >+TOR_INSTALLATION="no" >+ > if [ -e /etc/koha/koha-sites.conf ] > then > . /etc/koha/koha-sites.conf >@@ -361,7 +518,7 @@ fi > > [ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" ) > >-TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:, \ >+TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,tor, \ > -n "$0" -- "$@"` > > # Note the quotes around `$TEMP': they are essential! >@@ -419,6 +576,8 @@ while true ; do > SRU_SERVER_PORT="$2" ; shift 2 ;; > --upload-path) > CLO_UPLOAD_PATH="$2" ; shift 2 ;; >+ --tor) >+ ENABLE_TOR_HIDDEN_SERVICE="yes" ; shift ;; > -h|--help) > usage ; exit 0 ;; > --) >@@ -508,6 +667,12 @@ then > die "This script must be run with root privileges." > fi > >+# If --tor is used, but package 'tor' not installed, prompt for installation >+# If refused, we can stop cleanly here >+if [ "$ENABLE_TOR_HIDDEN_SERVICE" = "yes" ]; then >+ enable_tor_hidden_service >+fi >+ > # Check everything is ok with Apache, die otherwise > check_apache_config > >@@ -710,12 +875,19 @@ then > fi > fi > >- > if [ "$op" = request ] > then > koha-disable "$name" > fi > >+if [ "$op" = create ] && [ "$TORINSTALLATION" = "yes" ]; then >+ tor_install >+fi >+ >+if [ "$op" = create ] && [ "$ENABLE_TOR_HIDDEN_SERVICE" = "yes" ]; then >+ tor_config >+fi >+ > echo <<eoh > > Email for this instance is disabled. When you're ready to enable it, use: >diff --git a/debian/scripts/koha-remove b/debian/scripts/koha-remove >index 528db75..f789493 100755 >--- a/debian/scripts/koha-remove >+++ b/debian/scripts/koha-remove >@@ -105,6 +105,11 @@ eof > getent passwd "$name-koha" > /dev/null && deluser --quiet "$name-koha" > # in case the site has already been disabled, we don't want to break the loop now. > a2dissite "$name" > /dev/null 2>&1 || a2dissite "${name}.conf" > /dev/null 2>&1 || /bin/true >+ # Remove Tor hidden service info from torrrc if present and restart Tor >+ if [ $(grep -c "# Start instance koha-$name" "/etc/tor/torrc") -eq 1 ]; then >+ sed -i '/# begin instance koha-$name/, +4 d' "/etc/tor/torrc" >+ service tor restart >+ fi > done > > service apache2 restart >diff --git a/debian/templates/apache-site-tor.conf.in b/debian/templates/apache-site-tor.conf.in >new file mode 100644 >index 0000000..7593728 >--- /dev/null >+++ b/debian/templates/apache-site-tor.conf.in >@@ -0,0 +1,21 @@ >+# Koha instance __KOHASITE__ Apache config for Tor hidden service. >+ >+# OPAC >+<VirtualHost 127.0.0.1:8080> >+ <IfVersion >= 2.4> >+ Define instance "__KOHASITE__" >+ </IfVersion> >+ Include /etc/koha/apache-shared.conf >+# Include /etc/koha/apache-shared-disable.conf >+# Include /etc/koha/apache-shared-opac-plack.conf >+ Include /etc/koha/apache-shared-opac.conf >+ >+ SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" >+# SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" >+# SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" >+ AssignUserID __UNIXUSER__ __UNIXGROUP__ >+ >+ ErrorLog /var/log/koha/__KOHASITE__/opac-error.log >+# TransferLog /var/log/koha/__KOHASITE__/opac-access.log >+# RewriteLog /var/log/koha/__KOHASITE__/opac-rewrite.log >+</VirtualHost> >diff --git a/debian/templates/apache-site.conf.in b/debian/templates/apache-site.conf.in >index 3f7ad52..c8d0e52 100644 >--- a/debian/templates/apache-site.conf.in >+++ b/debian/templates/apache-site.conf.in >@@ -11,6 +11,7 @@ > Include /etc/koha/apache-shared-opac.conf > > ServerName __OPACSERVER__ >+# ServerAlias __OPACTORHIDDENSERVICE__ #onion > SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" > SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" > SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" >diff --git a/debian/templates/torrc.in b/debian/templates/torrc.in >new file mode 100644 >index 0000000..2fdc0ca >--- /dev/null >+++ b/debian/templates/torrc.in >@@ -0,0 +1,31 @@ >+# Tor minimal config for Koha bundle >+# For a list of options check the default file at /etc/tor/torrc-old >+ >+ >+# General section. >+ >+SocksPort 0 >+SocksPolicy reject * >+DataDirectory /var/lib/tor >+ >+ >+# Relay section >+# You should read the Tor manual before you set up a Tor relay! >+ >+#ORPort 9001 # use a port that is not used by anything else >+#Address # ip or domain, or tor will guess >+#Nickname Koha ILS Tor Server # public name of the Tor server, use whatever you like >+#RelayBandwidthRate 100 KB # Throttle traffic to 100KB/s (800Kbps) >+#RelayBandwidthBurst 200 KB # But allow bursts up to 200KB/s (1600Kbps) >+#ExitPolicy reject *:* # no exits allowed >+ >+ >+# General hidden service section >+# If you want to a run Tor hidden service other than the Koha OPAC, put it here. >+# DO NOT USE the /var/lib/tor/koha FOLDER FOR CUSTOM HIDDEN SERVICES! >+ >+ >+ >+# !!! DO NOT EDIT ANYTHING BELOW THIS LINE !!! >+ >+# Koha hidden service section. This is generated automatically. Do not touch! >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 15540
:
46471
|
46644
|
57661