From f3b8a2673635bb758f331bc0ea55c77e7c50ffd3 Mon Sep 17 00:00:00 2001 From: Mirko Tietgen Date: Sat, 9 Jan 2016 22:55:16 +0100 Subject: [PATCH] Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC Add --tor to koha-create: automatically set up a .onion URL for the OPAC. Install Tor from official repository if required. Test plan: 0) Requirements - Apply patch - Build Debian package - Test server needs to be reachable from the internet - Download Tor Browser to your local machine (not the server) https://www.torproject.org/download/download-easy.html.en (Running Tor Browser and Koha with Tor on the same machine does not seem to work) 1) First Koha instance using Tor, refuse Tor installation - Test without the package 'tor' installed! - koha-create --create-db --tor You should be asked if you want to install Tor - Refuse Expected result: - You are told to either accept to install Tor or not use the --tor option - Installation process stops cleanly (no remaining user account etc.) 2) First Koha instance using Tor, accept Tor installation - Test without the package 'tor' installed! - koha-create --create-db --tor You should be asked if you want to install Tor - Accept - Wait for the installation to finish - Open your regular OPAC URL You should see the OPAC maintenance website - Open (in Tor Browser) the .onion address displayed at the end of the installation You should see the OPAC maintenance website. It can take a minute until this works Expected results: - Tor repository is added to /etc/apt/sources.list.d/tor.list - Package 'tor' (and keyring + dependencies) is installed - Koha instance is created as usual - Tor config is added to /etc/tor/torrc. It includes a block that looks like # begin instance koha- HiddenServiceDir /var/lib/tor/koha//hidden_service HiddenServicePort 80 127.0.0.1:80 # end instance koha- - .onion address from /var/lib/tor/koha//hidden_service/hostname is added as ServerAlias to /etc/apache2/sites-availabled/.conf - You can reach the OPAC from the regular address and via .onion (in Tor Browser) 3) Additional instances using Tor / Tor already installed - koha-create --create-db --tor You should not be asked if you want to install Tor again. - Wait for the installation to finish - Open your regular OPAC URL of You should see the OPAC maintenance website - Open Tor Browser at the .onion address displayed at the end of the second installation You should see the OPAC maintenance website It can take a minute until this works - Copy the .onion address, you will need it in step 5 and 7! Expected results: - Second Tor config is added to /etc/tor/torrc - You can reach the second OPAC from the regular address and via .onion (Tor Browser) 4) Remove an instance - Remove your first instance with koha-remove Removal process should work as expected - Check /etc/tor/torrc The block for your first instance should be gone - Check /var/lib/tor/koha/instance1/ The hidden_service folder and key should still be there. This way you can re-use an .onion address after reinstallation. 5) Re-create an instance (old config) - koha-create --create-db --tor #use the same name as for step 2! You should be asked if you want to re-use the existing .onion address or delete it - Choose to re-use the old config - Wait for installation to finish - Open the OPAC with the regular URL and the (old) .onion address (in Tor Browser) Both should work. It can take a minute for the .onion to show up - Verify that the .onion is the same as the one from step 3 6) Remove the instance again - Follow step 4 7) Re-create an instance (new config) - koha-create --create-db --tor #use the same name as for step 1! You should be asked if you want to re-use the existing key and .onion address or delete it - Choose to delete the folder and get a new .onion - Wait for installation to finish - Open the OPAC with the regular URL and the (new) .onion address (in Tor Browser) Both should work. It can take a minute for the .onion to show up - Verify that the .onion is not the same as in step 3 and 5 Possible bonus tests: - Using an operating system that does not have a Tor package available in the official repository should be detected. Testing this would require such an OS for testing. Recent Debian and Ubuntu seems to be covered. - A manual Tor installation before Koha is installed should be detected and work, a prompt will allow to either overwrite the old config or stop the installation - If the Tor repository is already present in /etc/apt/sources.list*, it is not added again --- debian/docs/koha-create.xml | 8 ++ debian/scripts/koha-create | 175 ++++++++++++++++++++++++++++++- debian/scripts/koha-remove | 5 + debian/templates/apache-site-tor.conf.in | 21 ++++ debian/templates/apache-site.conf.in | 1 + debian/templates/torrc.in | 31 ++++++ 6 files changed, 239 insertions(+), 2 deletions(-) create mode 100644 debian/templates/apache-site-tor.conf.in create mode 100644 debian/templates/torrc.in diff --git a/debian/docs/koha-create.xml b/debian/docs/koha-create.xml index aad649a..4b56d2f 100644 --- a/debian/docs/koha-create.xml +++ b/debian/docs/koha-create.xml @@ -41,6 +41,7 @@ port directory + | instancename @@ -192,6 +193,13 @@ + + + Enable a Tor hidden service (.onion address) for the created instance. + + + + , Print usage information. diff --git a/debian/scripts/koha-create b/debian/scripts/koha-create index 2636675..f4fe710 100755 --- a/debian/scripts/koha-create +++ b/debian/scripts/koha-create @@ -72,6 +72,7 @@ Options: --upload-path dir Set a user defined upload_path. It defaults to /var/lib/koha//uploads --letsencrypt Set up a https-only site with letsencrypt certificates + --tor Automatically set up a Tor hidden service for the OPAC --help,-h Show this help. Note: the instance name cannot be longer that 11 chars. @@ -377,6 +378,157 @@ letsencrypt_instance() echo -e "opacdomain=\"$opacdomain\"\nintradomain=\"$intradomain\"" > /var/lib/koha/$name/letsencrypt.enabled # restart apache with working certs service apache2 restart + +tor_check_install() +{ + # Check if Tor is installed + + # Check if Tor is installed, otherwise do it now + # Repeat for every instance. Do at the beginning so we can stop the installation if necessary. + if [ $(dpkg-query -W -f='${Status}' tor 2>/dev/null | grep -c "ok installed") -eq 0 ]; then + debrelease="$(lsb_release -c | sed 's|.*\W\(.*\)|\1|')" + # Check if Tor repository for this version of GNU/Linux exists + if [ $(curl -sI "http://deb.torproject.org/torproject.org/dists/$debrelease/" | grep -c "200 OK") -eq 0 ]; then + die "Cannot find a Tor release for $debrelease in the official repository. Please install the 'tor' package manually to use the option --tor" + else + # Prompt before adding the official Tor repo and installing Tor + read -r -p "Tor is not installed. Do you want Koha to automatically set up the Tor repository and install Tor? [y/N] " response + if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]] + then + TORINSTALLATION="yes" + else + die "You need to install Tor to use the --tor option. Either accept or run koha-create without the --tor option." + fi + fi + else + if [ -e "/etc/tor/torrc-koha" ]; then + TORINSTALLATION="previous" + else + TORINSTALLATION="manual" + # Prompt to overwrite previous Tor config, otherwise stop installation + read -r -p "Tor seems to be installed manually. Previous configuration file /etc/tor/torrc will be deleted! Continue? [y/N] " response + if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]] + then + rm -f /etc/tor/torrc + else + die "Please move your old configuration file /etc/tor/torrc and run koha-create again." + fi + fi + fi + + # Is a key already present in the folder? + if [ $(tor_check_instance $name) -eq 1 ]; then + # Prompt to re-use previous key + toroldonion="$(tor_get_onion $name)" + read -r -p "There is a previous .onion key in the hidden service folder for instance $name. Do you want to overwrite it? Choose no to re-use the address $toroldonion. [y/N] " response + if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]; then + rm -Rf /var/lib/tor/koha/$name/ + toruseoldconfig="no" + else + toruseoldconfig="yes" + fi + + fi +} + +tor_check_instance() +{ + # Check if previous Tor hidden service folder exists and promt for re-use or deletion + # Takes a Koha instance name as an argument + if [ -e "/var/lib/tor/koha/$1/hidden_service/private_key" ]; then + echo "1"; + else + echo "0" + fi +} + +tor_install() +{ + # Install Tor from the official repository. + # Only done once… I guess. + + echo "Installing Tor…" + debrelease="$(lsb_release -c | sed 's|.*\W\(.*\)|\1|')" + # Check if Tor repository is already in /etc/apt/sources.list.* + if [ $(grep -rl "^deb http://deb.torproject.org/torproject.org" "/etc/apt/sources.list" "/etc/apt/sources.list.d/") != "" ]; then + echo "deb http://deb.torproject.org/torproject.org $debrelease main" | tee -a /etc/apt/sources.list.d/tor.list + gpg --keyserver keys.gnupg.net --recv 886DDD89 + gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add - + apt-get update + fi + apt-get install -y tor deb.torproject.org-keyring + service tor stop + # next: tor_config +} + +tor_config() +{ + # Create Koha-specific Tor config, make backup of last config. + # Called for every new instance + + # Check if /etc/tor/torrc-koha exists, if not create it now + if [ ! -e "/etc/tor/torrc-koha" ]; then + generate_config_file torrc.in \ + "/etc/tor/torrc-koha" + rm -f /etc/tor/torrc # just in case + ln -s /etc/tor/torrc-koha /etc/tor/torrc + chown -R debian-tor:debian-tor /etc/tor/ + fi + tor_instance +} + +tor_instance() # FIXME there needs to be tor_remove in koha-remove to undo all this +{ + # Add config to Tor configuration file + # Repeat for every instance. + # FIXME should go to koha-tor or koha-functions? + + torconfig=`cat <> /etc/tor/torrc-koha + # Create instance-specific Tor folder. + # We put this in /var/lib/tor/koha/ to keep it out of Koha backups and safe from koha-remove. + # FIXME Would it be better to have it in the backups? + # + # Re-use old .onion if desired + if [ "$toruseoldconfig" != "yes" ]; then + mkdir -p /var/lib/tor/koha/$name + fi + chown -R debian-tor:debian-tor /var/lib/tor/koha/ + # Start Tor with new settings + service tor restart # needs to be done after apache for this instance is started, or hostname won't be created + # Get .onion address # FIXME does this work instantly or should we wait a few seconds? + onion="$(tor_get_onion $name)" + torinfo=`cat <