mirror of
https://github.com/Start9Labs/documentation.git
synced 2026-03-30 12:11:57 +00:00
rework ca trusting flow (#547)
* rework ca trusting flow * abstract firefox guides for ca and tor * remove uneeded package.lock * fix references, update submodule * clean up
This commit is contained in:
Matt Hill
64
site/source/misc-guides/ca-ff.rst
Normal file
64
site/source/misc-guides/ca-ff.rst
Normal file
@@ -0,0 +1,64 @@
|
||||
.. _ca-ff:
|
||||
|
||||
===========================================
|
||||
Configuring Firefox to Respect Your Root CA
|
||||
===========================================
|
||||
|
||||
.. tabs::
|
||||
|
||||
.. group-tab:: Mac/Windows
|
||||
|
||||
#. Open Firefox and enter ``about:config`` in the URL bar. Accept any warnings that appear
|
||||
|
||||
#. Search for ``security.enterprise_roots.enable``, set it to ``true``.
|
||||
|
||||
.. figure:: /_static/images/ssl/browser/enterprise_roots_enabled_true.png
|
||||
:width: 80%
|
||||
:alt: Firefox security settings
|
||||
|
||||
#. Restart Firefox
|
||||
|
||||
.. group-tab:: Debian/Ubuntu
|
||||
|
||||
This guide applies to Firefox, Firefox ESR, Librewolf, and Thunderbird. Mozilla apps need to be configured to use the certificate store of your device. To find out why Mozilla does this differently, you can read their `blog post <https://blog.mozilla.org/security/2019/02/14/why-does-mozilla-maintain-our-own-root-certificate-store/>`_ on the topic (TLDR: for security purposes).
|
||||
|
||||
#. Select the hamburger menu -> ``Settings``. Search for ``security devices`` and select ``Security Devices...``
|
||||
|
||||
.. figure:: /_static/images/ssl/linux/cert-trust-linux-firefox-p11kit-1.png
|
||||
:width: 60%
|
||||
:alt: Mozilla application p11kit trust #1
|
||||
|
||||
#. When the Device Manager dialog window opens, select ``Load``
|
||||
|
||||
.. figure:: /_static/images/ssl/linux/cert-trust-linux-firefox-p11kit-2.png
|
||||
:width: 60%
|
||||
:alt: Mozilla application p11kit trust #2
|
||||
|
||||
#. Give the Module Name a title such as "System CA Trust Module". For the Module filename, paste in ``/usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so`` and hit ``OK``
|
||||
|
||||
.. figure:: /_static/images/ssl/linux/cert-trust-linux-firefox-p11kit-3.png
|
||||
:width: 60%
|
||||
:alt: Mozilla application p11kit trust #3
|
||||
|
||||
.. tip:: The path to p11-kit-trust.so will be slightly different if your processor's architecture is not x86_64.
|
||||
|
||||
#. Verify that the new module shows up on the left hand side and select ``OK`` at the bottom right:
|
||||
|
||||
.. figure:: /_static/images/ssl/linux/cert-trust-linux-firefox-p11kit-4.png
|
||||
:width: 60%
|
||||
:alt: Mozilla application p11kit trust #4
|
||||
|
||||
#. Restart Firefox
|
||||
|
||||
.. group-tab:: Arch/Garuda/CentOS/Fedora
|
||||
|
||||
No special steps are needed for Arch/Garuda/CentOS/Fedora.
|
||||
|
||||
.. group-tab:: Android
|
||||
|
||||
.. warning:: You must use `Firefox Beta <https://blog.mozilla.org/security/2019/02/14/why-does-mozilla-maintain-our-own-root-certificate-store/>`_ on Android. The regular Firefox app will not work.
|
||||
|
||||
#. Tap ``Kebab Menu > Settings > About Firefox`` and tap the Firefox icon 5 times to enable "developer mode"
|
||||
|
||||
#. Go back to ``Kebab Menu > Settings > Secret Settings`` (at the bottom), and tap ``Use third party CA certificates``
|
||||
|
||||
@@ -8,6 +8,8 @@ Guides that do not fit into the categories of "devices" or "services."
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
|
||||
ca-ff
|
||||
tor-ff
|
||||
attach-drive
|
||||
transfer-data
|
||||
upgrade-pi
|
||||
|
||||
180
site/source/misc-guides/tor-ff.rst
Normal file
180
site/source/misc-guides/tor-ff.rst
Normal file
@@ -0,0 +1,180 @@
|
||||
.. _tor-ff:
|
||||
|
||||
===========================
|
||||
Configuring Firefox for Tor
|
||||
===========================
|
||||
|
||||
.. tabs::
|
||||
|
||||
.. group-tab:: Mac
|
||||
|
||||
#. Open Firefox and enter ``about:config`` in the URL bar. Accept any warnings that appear
|
||||
|
||||
#. Search for ``dom.securecontext.allowlist_onions`` and set the value to ``true``:
|
||||
|
||||
.. figure:: /_static/images/tor/firefox_allowlist.png
|
||||
:width: 60%
|
||||
:alt: Firefox whitelist onions screenshot
|
||||
|
||||
#. Go to the right-hand hamburger menu and select ``Settings``:
|
||||
|
||||
.. figure:: /_static/images/tor/os_ff_settings.png
|
||||
:width: 30%
|
||||
:alt: Firefox options screenshot
|
||||
|
||||
#. Search for the term ``proxy`` in the search bar in the upper right and select ``Settings...``:
|
||||
|
||||
.. figure:: /_static/images/tor/firefox_search.png
|
||||
:width: 60%
|
||||
:alt: Firefox search screenshot
|
||||
|
||||
#. Check the option labeled ``Use System Proxy Settings`` *and* the box labeled ``Proxy DNS when using SOCKS v5``:
|
||||
|
||||
.. figure:: /_static/images/tor/firefox_proxy.png
|
||||
:width: 60%
|
||||
:alt: Firefox proxy settings screenshot
|
||||
|
||||
#. Click ``OK`` and restart Firefox
|
||||
|
||||
#. Test that Firefox can resolve `.onion` URLs by visiting Start9's Tor website: http://privacy34kn4ez3y3nijweec6w4g54i3g54sdv7r5mr6soma3w4begyd.onion.
|
||||
|
||||
.. group-tab:: Windows
|
||||
|
||||
#. Download the ``Proxy Auto Config`` file to inform Firefox how to resolve `.onion` URLs. Click `here <https://start9.com/assets/proxy.pac>`_ to get the one offered by Start9. Save it somewhere you will not delete it, and remember where you save it. For example:
|
||||
|
||||
.. code-block::
|
||||
|
||||
C:\Program Files\Tor Browser\proxy.pac
|
||||
|
||||
#. Open Firefox and enter ``about:config`` in the URL bar. Accept any warnings that appear
|
||||
|
||||
#. Search for ``dom.securecontext.allowlist_onions`` and set the value to ``true``:
|
||||
|
||||
.. figure:: /_static/images/tor/firefox_allowlist.png
|
||||
:width: 60%
|
||||
:alt: Firefox whitelist onions screenshot
|
||||
|
||||
#. Go to the right-hand hamburger menu and select ``Settings``:
|
||||
|
||||
.. figure:: /_static/images/tor/os_ff_settings.png
|
||||
:width: 30%
|
||||
:alt: Firefox options screenshot
|
||||
|
||||
#. Search for the term ``proxy`` in the search bar in the upper right and select ``Settings...``:
|
||||
|
||||
.. figure:: /_static/images/tor/firefox_search.png
|
||||
:width: 60%
|
||||
:alt: Firefox search screenshot
|
||||
|
||||
#. Select ``Automatic proxy configuration URL`` and paste in the path to your PAC file from earlier, prefixed with ``file://``. For example:
|
||||
|
||||
.. code-block::
|
||||
|
||||
file://C:/Program Files/Tor Browser/proxy.pac
|
||||
|
||||
#. Check the box labeled ``Proxy DNS when using SOCKS v5``:
|
||||
|
||||
.. figure:: /_static/images/tor/firefox_proxy.png
|
||||
:width: 60%
|
||||
:alt: Firefox proxy settings screenshot
|
||||
|
||||
#. Click ``OK`` and restart Firefox
|
||||
|
||||
#. Test that Firefox can resolve `.onion` URLs by visiting Start9's Tor website: http://privacy34kn4ez3y3nijweec6w4g54i3g54sdv7r5mr6soma3w4begyd.onion.
|
||||
|
||||
.. group-tab:: Linux
|
||||
|
||||
#. Download the `Proxy Auto Config` file to inform Firefox how to resolve `.onion` URLs. You can get Start9's standard file from a terminal, by using:
|
||||
|
||||
.. code-block::
|
||||
|
||||
sudo wget -P ~/ https://start9.com/assets/proxy.pac
|
||||
|
||||
#. Open Firefox and enter ``about:config`` in the URL bar. Accept any warnings that appear
|
||||
|
||||
#. Search for ``dom.securecontext.allowlist_onions`` and set the value to ``true``:
|
||||
|
||||
.. figure:: /_static/images/tor/firefox_allowlist.png
|
||||
:width: 60%
|
||||
:alt: Firefox whitelist onions screenshot
|
||||
|
||||
#. Determine the full path of `proxy.pac`, which we will use in step 9, by executing the following command in the terminal, and copying its output to your clipboard:
|
||||
|
||||
.. code-block::
|
||||
|
||||
echo file://$HOME/proxy.pac
|
||||
|
||||
#. Go to the right-hand hamburger menu and select ``Settings``:
|
||||
|
||||
.. figure:: /_static/images/tor/os_ff_settings.png
|
||||
:width: 30%
|
||||
:alt: Firefox options screenshot
|
||||
|
||||
#. Search for the term ``proxy`` in the search bar in the upper right and select ``Settings...``:
|
||||
|
||||
.. figure:: /_static/images/tor/firefox_search.png
|
||||
:width: 60%
|
||||
:alt: Firefox search screenshot
|
||||
|
||||
#. Select ``Automatic proxy configuration URL`` and paste the output from the command you performed in step 6. Be aware, the triple ``///`` is intentional, and your path *will* be different from the one below - namely, YOUR_LINUX_USERNAME will be your actual linux username:
|
||||
|
||||
.. code-block::
|
||||
|
||||
file:///home/YOUR_LINUX_USERNAME/proxy.pac
|
||||
|
||||
.. figure:: /_static/images/tor/firefox_proxy_linux.png
|
||||
:width: 60%
|
||||
:alt: Firefox proxy settings screenshot
|
||||
|
||||
#. Check the box labeled ``Proxy DNS when using SOCKS v5`` in the image above
|
||||
|
||||
#. Click ``OK`` and restart Firefox
|
||||
|
||||
#. Test that Firefox can resolve `.onion` URLs by visiting Start9's Tor website: http://privacy34kn4ez3y3nijweec6w4g54i3g54sdv7r5mr6soma3w4begyd.onion.
|
||||
|
||||
.. group-tab:: Android
|
||||
|
||||
#. Download the `Proxy Auto Config` file to inform Firefox how to resolve `.onion` URLs. We have one hosted `here <https://start9.com/assets/proxy.pac>`_
|
||||
|
||||
#. Open Firefox and enter ``about:config`` in the URL bar. Accept any warnings that appear
|
||||
|
||||
#. Search for ``dom.securecontext.allowlist_onions`` and set the value to ``true``:
|
||||
|
||||
.. figure:: /_static/images/tor/firefox_allowlist.png
|
||||
:width: 60%
|
||||
:alt: Firefox whitelist onions screenshot
|
||||
|
||||
#. Search for ``network.proxy.autoconfig_url``, and set the value to ``file:///storage/emulated/0/Download/proxy.pac``. This is the default location of a the proxy.pac file downloaded in step 2, although your path may vary:
|
||||
|
||||
.. figure:: /_static/images/tor/autoconfig_url.png
|
||||
:width: 30%
|
||||
:alt: Firefox autoconfig url setting screenshot
|
||||
|
||||
#. Search for ``network.proxy.type`` into the search bar, and set the value to ``2``:
|
||||
|
||||
.. figure:: /_static/images/tor/network_proxy_type.png
|
||||
:width: 30%
|
||||
:alt: Firefox network proxy type setting screenshot
|
||||
|
||||
#. Search for ``network.proxy.socks_remote_dns``, and set the value to ``true``:
|
||||
|
||||
.. figure:: /_static/images/tor/socks_remote_dns.png
|
||||
:width: 30%
|
||||
:alt: Firefox socks remote dns setting screenshot
|
||||
|
||||
#. Search for ``dom.securecontext.allowlist_onions`` and set the value to ``true``:
|
||||
|
||||
.. figure:: /_static/images/tor/firefox_allowlist_mobile.png
|
||||
:width: 30%
|
||||
:alt: Firefox whitelist onions screenshot
|
||||
|
||||
#. Search for ``network.http.referer.hideOnionsSource`` and set the value to ``true``
|
||||
|
||||
#. (**GrapheneOS users only**): Head to ``Settings -> Apps -> Firefox Beta -> Permissions -> Photos and videos -> Configure Storage Scopes -> ADD FILE``, then navigate to where you placed the proxy.pac file:
|
||||
|
||||
.. figure:: /_static/images/tor/storage-scopes-proxy.jpg
|
||||
:width: 15%
|
||||
|
||||
#. Restart Firefox
|
||||
|
||||
#. Test that Firefox can resolve `.onion` URLs by visiting Start9's Tor website: http://privacy34kn4ez3y3nijweec6w4g54i3g54sdv7r5mr6soma3w4begyd.onion.
|
||||
Reference in New Issue
Block a user