Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC
Summary: Debian package option to set up an .onion address (Tor hidden service) for th...
Status: Patch doesn't apply
Alias: None
Product: Koha
Classification: Unclassified
Component: Packaging (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Mirko Tietgen
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-01-11 05:59 UTC by Mirko Tietgen
Modified: 2017-10-15 10:36 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Text to go in the release notes:
Version(s) released in:


Attachments
Working prototype screenshot (56.65 KB, image/png)
2016-01-11 05:59 UTC, Mirko Tietgen
Details
Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC (19.19 KB, patch)
2016-01-14 08:53 UTC, Mirko Tietgen
Details | Diff | Splinter Review
Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC (18.52 KB, patch)
2016-11-19 21:13 UTC, Mirko Tietgen
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Mirko Tietgen 2016-01-11 05:59:01 UTC
Created attachment 46471 [details]
Working prototype screenshot

Allow automatic setup of an .onion address pointing to the Koha OPAC. Automatic installation of Tor from the official repository if necessary. Easily upgradable to run a Tor relay or add other hidden services.
Comment 1 Mirko Tietgen 2016-01-14 08:53:41 UTC
Created attachment 46644 [details] [review]
Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC

Add --tor to koha-create: automatically set up a .onion URL for the OPAC.
Install Tor from official repository if required.

Test plan:

0) Requirements

- Apply patch
- Build Debian package
- Test server needs to be reachable from the internet
- Download Tor Browser to your local machine (not the server)
  https://www.torproject.org/download/download-easy.html.en
  (Running Tor Browser and Koha with Tor on the same machine does not seem to work)

1) First Koha instance using Tor, refuse Tor installation

- Test without the package 'tor' installed!
- koha-create --create-db --tor <instance1>
  You should be asked if you want to install Tor
- Refuse

Expected result:

- You are told to either accept to install Tor or not use the --tor option
- Installation process stops cleanly (no remaining user account etc.)

2) First Koha instance using Tor, accept Tor installation

- Test without the package 'tor' installed!
- koha-create --create-db --tor <instance1>
  You should be asked if you want to install Tor
- Accept
- Wait for the installation to finish
- Open your regular OPAC URL
  You should see the OPAC maintenance website
- Open (in Tor Browser) the .onion address displayed at the end of the installation
  You should see the OPAC maintenance website. It can take a minute until this works

Expected results:

- Tor repository is added to /etc/apt/sources.list.d/tor.list
- Package 'tor' (and keyring + dependencies) is installed
- Koha instance is created as usual
- Tor config is added to /etc/tor/torrc. It includes a block that looks like
  # begin instance koha-<instance1>
  HiddenServiceDir /var/lib/tor/koha/<instance1>/hidden_service
  HiddenServicePort 80 127.0.0.1:80
  # end instance koha-<instance1>
- .onion address from /var/lib/tor/koha/<instance1>/hidden_service/hostname
  is added as ServerAlias to /etc/apache2/sites-availabled/<instance1>.conf
- You can reach the OPAC from the regular address and via .onion (in Tor Browser)

3) Additional instances using Tor / Tor already installed

- koha-create --create-db --tor <instance2>
  You should not be asked if you want to install Tor again.
- Wait for the installation to finish
- Open your regular OPAC URL of <instance2>
  You should see the OPAC maintenance website
- Open Tor Browser at the .onion address displayed at the end of the second installation
  You should see the OPAC maintenance website
  It can take a minute until this works
- Copy the .onion address, you will need it in step 5 and 7!

Expected results:

- Second Tor config is added to /etc/tor/torrc
- You can reach the second OPAC from the regular address and via .onion (Tor Browser)

4) Remove an instance

- Remove your first instance with koha-remove <instance1>
  Removal process should work as expected
- Check /etc/tor/torrc
  The block for your first instance should be gone
- Check /var/lib/tor/koha/instance1/
  The hidden_service folder and key should still be there. This way you can re-use
  an .onion address after reinstallation.

5) Re-create an instance (old config)

- koha-create --create-db --tor <instance1> #use the same name as for step 2!
  You should be asked if you want to re-use the existing .onion address or delete it
- Choose to re-use the old config
- Wait for installation to finish
- Open the OPAC with the regular URL and the (old) .onion address (in Tor Browser)
  Both should work. It can take a minute for the .onion to show up
- Verify that the .onion is the same as the one from step 3

6) Remove the instance again

- Follow step 4

7) Re-create an instance (new config)

- koha-create --create-db --tor <instance1> #use the same name as for step 1!
  You should be asked if you want to re-use the existing key and .onion address or delete it
- Choose to delete the folder and get a new .onion
- Wait for installation to finish
- Open the OPAC with the regular URL and the (new) .onion address (in Tor Browser)
  Both should work. It can take a minute for the .onion to show up
- Verify that the .onion is not the same as in step 3 and 5

Possible bonus tests:

- Using an operating system that does not have a Tor package available in the official
  repository should be detected. Testing this would require such an OS for testing.
  Recent Debian and Ubuntu seems to be covered.
- A manual Tor installation before Koha is installed should be detected and work,
  a prompt will allow to either overwrite the old config or stop the installation
- If the Tor repository is already present in /etc/apt/sources.list*, it is not added again
Comment 2 Mirko Tietgen 2016-01-14 10:48:14 UTC
This patch is about automatic setup. Needs a follow-up to deal with OPACbaseURL in some way (links should go to .onion for people coming via .onion)
Comment 3 Liz Rea 2016-07-18 03:40:59 UTC
Hi Mirko,

It looks like this doesn't apply anymore. :(

Applying: Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC
Using index info to reconstruct a base tree...
M	debian/docs/koha-create.xml
M	debian/scripts/koha-create
M	debian/scripts/koha-remove
Falling back to patching base and 3-way merge...
Auto-merging debian/scripts/koha-remove
Auto-merging debian/scripts/koha-create
CONFLICT (content): Merge conflict in debian/scripts/koha-create
Auto-merging debian/docs/koha-create.xml
CONFLICT (content): Merge conflict in debian/docs/koha-create.xml

Liz
Comment 4 Mirko Tietgen 2016-11-19 21:13:07 UTC
Created attachment 57661 [details] [review]
Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC

Add --tor to koha-create: automatically set up a .onion URL for the OPAC.
Install Tor from official repository if required.

Test plan:

0) Requirements

- Apply patch
- Build Debian package
- Test server needs to be reachable from the internet
- Download Tor Browser to your local machine (not the server)
  https://www.torproject.org/download/download-easy.html.en
  (Running Tor Browser and Koha with Tor on the same machine does not seem to work)

1) First Koha instance using Tor, refuse Tor installation

- Test without the package 'tor' installed!
- koha-create --create-db --tor <instance1>
  You should be asked if you want to install Tor
- Refuse

Expected result:

- You are told to either accept to install Tor or not use the --tor option
- Installation process stops cleanly (no remaining user account etc.)

2) First Koha instance using Tor, accept Tor installation

- Test without the package 'tor' installed!
- koha-create --create-db --tor <instance1>
  You should be asked if you want to install Tor
- Accept
- Wait for the installation to finish
- Open your regular OPAC URL
  You should see the OPAC maintenance website
- Open (in Tor Browser) the .onion address displayed at the end of the installation
  You should see the OPAC maintenance website. It can take a minute until this works

Expected results:

- Tor repository is added to /etc/apt/sources.list.d/tor.list
- Package 'tor' (and keyring + dependencies) is installed
- Koha instance is created as usual
- Tor config is added to /etc/tor/torrc. It includes a block that looks like
  # begin instance koha-<instance1>
  HiddenServiceDir /var/lib/tor/koha/<instance1>/hidden_service
  HiddenServicePort 80 127.0.0.1:80
  # end instance koha-<instance1>
- .onion address from /var/lib/tor/koha/<instance1>/hidden_service/hostname
  is added as ServerAlias to /etc/apache2/sites-availabled/<instance1>.conf
- You can reach the OPAC from the regular address and via .onion (in Tor Browser)

3) Additional instances using Tor / Tor already installed

- koha-create --create-db --tor <instance2>
  You should not be asked if you want to install Tor again.
- Wait for the installation to finish
- Open your regular OPAC URL of <instance2>
  You should see the OPAC maintenance website
- Open Tor Browser at the .onion address displayed at the end of the second installation
  You should see the OPAC maintenance website
  It can take a minute until this works
- Copy the .onion address, you will need it in step 5 and 7!

Expected results:

- Second Tor config is added to /etc/tor/torrc
- You can reach the second OPAC from the regular address and via .onion (Tor Browser)

4) Remove an instance

- Remove your first instance with koha-remove <instance1>
  Removal process should work as expected
- Check /etc/tor/torrc
  The block for your first instance should be gone
- Check /var/lib/tor/koha/instance1/
  The hidden_service folder and key should still be there. This way you can re-use
  an .onion address after reinstallation.

5) Re-create an instance (old config)

- koha-create --create-db --tor <instance1> #use the same name as for step 2!
  You should be asked if you want to re-use the existing .onion address or delete it
- Choose to re-use the old config
- Wait for installation to finish
- Open the OPAC with the regular URL and the (old) .onion address (in Tor Browser)
  Both should work. It can take a minute for the .onion to show up
- Verify that the .onion is the same as the one from step 3

6) Remove the instance again

- Follow step 4

7) Re-create an instance (new config)

- koha-create --create-db --tor <instance1> #use the same name as for step 1!
  You should be asked if you want to re-use the existing key and .onion address or delete it
- Choose to delete the folder and get a new .onion
- Wait for installation to finish
- Open the OPAC with the regular URL and the (new) .onion address (in Tor Browser)
  Both should work. It can take a minute for the .onion to show up
- Verify that the .onion is not the same as in step 3 and 5

Possible bonus tests:

- Using an operating system that does not have a Tor package available in the official
  repository should be detected. Testing this would require such an OS for testing.
  Recent Debian and Ubuntu seems to be covered.
- A manual Tor installation before Koha is installed should be detected and work,
  a prompt will allow to either overwrite the old config or stop the installation
- If the Tor repository is already present in /etc/apt/sources.list*, it is not added again
Comment 5 Mirko Tietgen 2016-11-19 21:15:37 UTC
Rebased in honour of the ugly times we live in.
Comment 6 Katrin Fischer 2017-10-15 10:36:21 UTC
Can't promise to test this, but maybe an email to the mailing list might find an interested tester?

Smallish conflict:

Apply? [(y)es, (n)o, (i)nteractive] y
Applying: Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC
Using index info to reconstruct a base tree...
M	debian/docs/koha-create.xml
M	debian/scripts/koha-create
M	debian/scripts/koha-remove
Falling back to patching base and 3-way merge...
Auto-merging debian/scripts/koha-remove
Auto-merging debian/scripts/koha-create
CONFLICT (content): Merge conflict in debian/scripts/koha-create
Auto-merging debian/docs/koha-create.xml
Failed to merge in the changes.
Patch failed at 0001 Bug 15540 - Debian package option to set up an .onion address (Tor hidden service) for the OPAC
The copy of the patch that failed is found in:
   /home/vagrant/kohaclone/.git/rebase-apply/patch
When you have resolved this problem run "git bz apply --continue".
If you would prefer to skip this patch, instead run "git bz apply --skip".
To restore the original branch and stop patching run "git bz apply --abort".
Patch left in /tmp/Bug-15540---Debian-package-option-to-set-up-an-oni-d0f2n1.patch