| Summary: | Debian package option to set up an .onion address (Tor hidden service) for the OPAC | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Mirko Tietgen <mirko> |
| Component: | Packaging | Assignee: | Mirko Tietgen <mirko> |
| Status: | RESOLVED WISHLIST | QA Contact: | Testopia <testopia> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | dcook, gmcharlt, liz, robin |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: |
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8897 http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 |
||
| Change sponsored?: | --- | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
Working prototype screenshot
Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC |
||
Created attachment 46644 [details] [review] Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC Add --tor to koha-create: automatically set up a .onion URL for the OPAC. Install Tor from official repository if required. Test plan: 0) Requirements - Apply patch - Build Debian package - Test server needs to be reachable from the internet - Download Tor Browser to your local machine (not the server) https://www.torproject.org/download/download-easy.html.en (Running Tor Browser and Koha with Tor on the same machine does not seem to work) 1) First Koha instance using Tor, refuse Tor installation - Test without the package 'tor' installed! - koha-create --create-db --tor <instance1> You should be asked if you want to install Tor - Refuse Expected result: - You are told to either accept to install Tor or not use the --tor option - Installation process stops cleanly (no remaining user account etc.) 2) First Koha instance using Tor, accept Tor installation - Test without the package 'tor' installed! - koha-create --create-db --tor <instance1> You should be asked if you want to install Tor - Accept - Wait for the installation to finish - Open your regular OPAC URL You should see the OPAC maintenance website - Open (in Tor Browser) the .onion address displayed at the end of the installation You should see the OPAC maintenance website. It can take a minute until this works Expected results: - Tor repository is added to /etc/apt/sources.list.d/tor.list - Package 'tor' (and keyring + dependencies) is installed - Koha instance is created as usual - Tor config is added to /etc/tor/torrc. It includes a block that looks like # begin instance koha-<instance1> HiddenServiceDir /var/lib/tor/koha/<instance1>/hidden_service HiddenServicePort 80 127.0.0.1:80 # end instance koha-<instance1> - .onion address from /var/lib/tor/koha/<instance1>/hidden_service/hostname is added as ServerAlias to /etc/apache2/sites-availabled/<instance1>.conf - You can reach the OPAC from the regular address and via .onion (in Tor Browser) 3) Additional instances using Tor / Tor already installed - koha-create --create-db --tor <instance2> You should not be asked if you want to install Tor again. - Wait for the installation to finish - Open your regular OPAC URL of <instance2> You should see the OPAC maintenance website - Open Tor Browser at the .onion address displayed at the end of the second installation You should see the OPAC maintenance website It can take a minute until this works - Copy the .onion address, you will need it in step 5 and 7! Expected results: - Second Tor config is added to /etc/tor/torrc - You can reach the second OPAC from the regular address and via .onion (Tor Browser) 4) Remove an instance - Remove your first instance with koha-remove <instance1> Removal process should work as expected - Check /etc/tor/torrc The block for your first instance should be gone - Check /var/lib/tor/koha/instance1/ The hidden_service folder and key should still be there. This way you can re-use an .onion address after reinstallation. 5) Re-create an instance (old config) - koha-create --create-db --tor <instance1> #use the same name as for step 2! You should be asked if you want to re-use the existing .onion address or delete it - Choose to re-use the old config - Wait for installation to finish - Open the OPAC with the regular URL and the (old) .onion address (in Tor Browser) Both should work. It can take a minute for the .onion to show up - Verify that the .onion is the same as the one from step 3 6) Remove the instance again - Follow step 4 7) Re-create an instance (new config) - koha-create --create-db --tor <instance1> #use the same name as for step 1! You should be asked if you want to re-use the existing key and .onion address or delete it - Choose to delete the folder and get a new .onion - Wait for installation to finish - Open the OPAC with the regular URL and the (new) .onion address (in Tor Browser) Both should work. It can take a minute for the .onion to show up - Verify that the .onion is not the same as in step 3 and 5 Possible bonus tests: - Using an operating system that does not have a Tor package available in the official repository should be detected. Testing this would require such an OS for testing. Recent Debian and Ubuntu seems to be covered. - A manual Tor installation before Koha is installed should be detected and work, a prompt will allow to either overwrite the old config or stop the installation - If the Tor repository is already present in /etc/apt/sources.list*, it is not added again This patch is about automatic setup. Needs a follow-up to deal with OPACbaseURL in some way (links should go to .onion for people coming via .onion) Hi Mirko, It looks like this doesn't apply anymore. :( Applying: Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC Using index info to reconstruct a base tree... M debian/docs/koha-create.xml M debian/scripts/koha-create M debian/scripts/koha-remove Falling back to patching base and 3-way merge... Auto-merging debian/scripts/koha-remove Auto-merging debian/scripts/koha-create CONFLICT (content): Merge conflict in debian/scripts/koha-create Auto-merging debian/docs/koha-create.xml CONFLICT (content): Merge conflict in debian/docs/koha-create.xml Liz Created attachment 57661 [details] [review] Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC Add --tor to koha-create: automatically set up a .onion URL for the OPAC. Install Tor from official repository if required. Test plan: 0) Requirements - Apply patch - Build Debian package - Test server needs to be reachable from the internet - Download Tor Browser to your local machine (not the server) https://www.torproject.org/download/download-easy.html.en (Running Tor Browser and Koha with Tor on the same machine does not seem to work) 1) First Koha instance using Tor, refuse Tor installation - Test without the package 'tor' installed! - koha-create --create-db --tor <instance1> You should be asked if you want to install Tor - Refuse Expected result: - You are told to either accept to install Tor or not use the --tor option - Installation process stops cleanly (no remaining user account etc.) 2) First Koha instance using Tor, accept Tor installation - Test without the package 'tor' installed! - koha-create --create-db --tor <instance1> You should be asked if you want to install Tor - Accept - Wait for the installation to finish - Open your regular OPAC URL You should see the OPAC maintenance website - Open (in Tor Browser) the .onion address displayed at the end of the installation You should see the OPAC maintenance website. It can take a minute until this works Expected results: - Tor repository is added to /etc/apt/sources.list.d/tor.list - Package 'tor' (and keyring + dependencies) is installed - Koha instance is created as usual - Tor config is added to /etc/tor/torrc. It includes a block that looks like # begin instance koha-<instance1> HiddenServiceDir /var/lib/tor/koha/<instance1>/hidden_service HiddenServicePort 80 127.0.0.1:80 # end instance koha-<instance1> - .onion address from /var/lib/tor/koha/<instance1>/hidden_service/hostname is added as ServerAlias to /etc/apache2/sites-availabled/<instance1>.conf - You can reach the OPAC from the regular address and via .onion (in Tor Browser) 3) Additional instances using Tor / Tor already installed - koha-create --create-db --tor <instance2> You should not be asked if you want to install Tor again. - Wait for the installation to finish - Open your regular OPAC URL of <instance2> You should see the OPAC maintenance website - Open Tor Browser at the .onion address displayed at the end of the second installation You should see the OPAC maintenance website It can take a minute until this works - Copy the .onion address, you will need it in step 5 and 7! Expected results: - Second Tor config is added to /etc/tor/torrc - You can reach the second OPAC from the regular address and via .onion (Tor Browser) 4) Remove an instance - Remove your first instance with koha-remove <instance1> Removal process should work as expected - Check /etc/tor/torrc The block for your first instance should be gone - Check /var/lib/tor/koha/instance1/ The hidden_service folder and key should still be there. This way you can re-use an .onion address after reinstallation. 5) Re-create an instance (old config) - koha-create --create-db --tor <instance1> #use the same name as for step 2! You should be asked if you want to re-use the existing .onion address or delete it - Choose to re-use the old config - Wait for installation to finish - Open the OPAC with the regular URL and the (old) .onion address (in Tor Browser) Both should work. It can take a minute for the .onion to show up - Verify that the .onion is the same as the one from step 3 6) Remove the instance again - Follow step 4 7) Re-create an instance (new config) - koha-create --create-db --tor <instance1> #use the same name as for step 1! You should be asked if you want to re-use the existing key and .onion address or delete it - Choose to delete the folder and get a new .onion - Wait for installation to finish - Open the OPAC with the regular URL and the (new) .onion address (in Tor Browser) Both should work. It can take a minute for the .onion to show up - Verify that the .onion is not the same as in step 3 and 5 Possible bonus tests: - Using an operating system that does not have a Tor package available in the official repository should be detected. Testing this would require such an OS for testing. Recent Debian and Ubuntu seems to be covered. - A manual Tor installation before Koha is installed should be detected and work, a prompt will allow to either overwrite the old config or stop the installation - If the Tor repository is already present in /etc/apt/sources.list*, it is not added again Rebased in honour of the ugly times we live in. Can't promise to test this, but maybe an email to the mailing list might find an interested tester? Smallish conflict: Apply? [(y)es, (n)o, (i)nteractive] y Applying: Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC Using index info to reconstruct a base tree... M debian/docs/koha-create.xml M debian/scripts/koha-create M debian/scripts/koha-remove Falling back to patching base and 3-way merge... Auto-merging debian/scripts/koha-remove Auto-merging debian/scripts/koha-create CONFLICT (content): Merge conflict in debian/scripts/koha-create Auto-merging debian/docs/koha-create.xml Failed to merge in the changes. Patch failed at 0001 Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC The copy of the patch that failed is found in: /home/vagrant/kohaclone/.git/rebase-apply/patch When you have resolved this problem run "git bz apply --continue". If you would prefer to skip this patch, instead run "git bz apply --skip". To restore the original branch and stop patching run "git bz apply --abort". Patch left in /tmp/Bug-15540---Debian-package-option-to-set-up-an-oni-d0f2n1.patch Mirko disappeared from Koha a long time ago, so I don't think he's going to revisit these patches. It's a really interesting idea, but realistically I don't think that it would ever be used in production. |
Created attachment 46471 [details] Working prototype screenshot Allow automatic setup of an .onion address pointing to the Koha OPAC. Automatic installation of Tor from the official repository if necessary. Easily upgradable to run a Tor relay or add other hidden services.