Securedrop Documentation Release 0.3.5
Total Page：16
File Type：pdf, Size：1020Kb
SecureDrop Documentation Release 0.3.5 SecureDrop Team and Contributors June 03, 2016 User Guides 1 Source Guide 3 1.1 Choose who to submit to.........................................3 1.2 Get the Tor Browser...........................................3 1.3 Making your First Submission......................................4 1.4 Continuing the Conversation.......................................9 2 Journalist Guide 15 2.1 Workflow................................................. 15 2.2 Create GPG key for the journalist.................................... 15 2.3 Connect to the Document Interface................................... 15 2.4 Move Documents to the Secure Viewing Station............................ 17 2.5 Decrypt and work on the Secure Viewing Station............................ 21 2.6 Interact With Sources.......................................... 23 2.7 Work with Documents.......................................... 26 2.8 Encrypt and move documents to Journalist Workstation........................ 26 2.9 Decrypt and prepare to publish...................................... 28 3 Administrator Guide 29 3.1 Adding Users............................................... 29 4 Overview 35 4.1 Technical Summary........................................... 35 4.2 Infrastructure............................................... 35 4.3 Operation................................................. 37 5 Terminology 39 5.1 App Server................................................ 39 5.2 Monitor Server.............................................. 39 5.3 Source Interface............................................. 39 5.4 Document Interface........................................... 39 5.5 Journalist Workstation.......................................... 39 5.6 Admin Workstation............................................ 40 5.7 Secure Viewing Station......................................... 40 5.8 Two-Factor Authenticator........................................ 40 5.9 Transfer Device............................................. 40 6 Passphrases 41 6.1 Admin.................................................. 41 6.2 Journalist................................................. 42 i 7 Hardware 43 7.1 Required Hardware............................................ 43 7.2 Optional Hardware............................................ 44 7.3 Specific Hardware Recommendations.................................. 45 8 Before you begin 49 9 Create Tails USBs 51 9.1 Install Tails................................................ 51 9.2 Enable Persistent Storage........................................ 52 10 Set up the Secure Viewing Station 53 11 Set up the Data Transfer Device 55 12 Generate the SecureDrop Application GPG Key 61 12.1 Correct the system time......................................... 61 12.2 Create the key.............................................. 61 13 Set up the Admin Workstation 67 13.1 Start Tails with Persistence Enabled................................... 67 13.2 Download the SecureDrop repository.................................. 67 13.3 Create the Admin Passphrase Database................................. 68 14 Set up the Network Firewall 69 14.1 Before you begin............................................. 69 14.2 Initial Configuration........................................... 71 14.3 SecureDrop Configuration........................................ 74 14.4 Keeping pfSense up to date....................................... 85 15 Set up the Servers 89 15.1 Install Ubuntu.............................................. 89 15.2 Test Connectivity............................................. 94 15.3 Set up SSH keys............................................. 94 15.4 Minor Admin Tasks........................................... 94 16 Install SecureDrop 97 16.1 Install Ansible.............................................. 97 16.2 Configure the Installation........................................ 97 16.3 Run the Ansible playbook........................................ 99 17 Configure the Admin Workstation Post-Install 101 17.1 Auto-connect to the Authenticated Tor Hidden Services........................ 101 17.2 Set up two-factor authentication for the Admin............................. 102 18 Create an admin account on the Document Interface 103 19 Test the Installation 105 19.1 Test connectivity............................................. 105 19.2 Sanity-check the install.......................................... 105 19.3 Test the web interfaces.......................................... 106 20 Onboard Journalists 107 20.1 Determine access protocol for the Secure Viewing Station....................... 107 20.2 Create a Journalist Tails USB...................................... 107 20.3 Set up automatic access to the Document Interface........................... 108 ii 20.4 Add an account on the Document Interface............................... 108 21 SecureDrop Deployment Best Practices 109 21.1 Landing Page............................................... 109 21.2 Minimum requirements for the SecureDrop environment........................ 112 21.3 Suggested................................................. 113 21.4 Whole Site Changes........................................... 113 22 Google Authenticator 115 22.1 iOS.................................................... 115 22.2 Android.................................................. 115 23 Useful Logs 117 23.1 Both servers............................................... 117 23.2 App Server................................................ 117 23.3 Monitor Server.............................................. 117 24 OSSEC Guide 119 24.1 Setting up OSSEC alerts......................................... 119 24.2 Troubleshooting............................................. 122 24.3 Analyzing the Alerts........................................... 125 25 Tails Guide 127 25.1 Installing Tails on USB sticks...................................... 127 25.2 Configure Tails for use with SecureDrop................................ 128 26 Setting up a printer with Tails 131 27 SecureDrop On-Site Training Schedule 141 27.1 Day 1: Preparation and Install...................................... 141 27.2 Day 2: Journalist and Admin Training.................................. 142 28 Using YubiKey with the Document Interface 145 28.1 Download the YubiKey personalization tool............................... 145 28.2 Set up OATH-HOTP........................................... 145 28.3 Set up a user with the OATH-HOTP secret key............................. 146 29 Backup and Restore SecureDrop 149 29.1 Minimizing disk space.......................................... 149 29.2 Backing Up................................................ 150 29.3 Restoring................................................. 151 30 Upgrade to 0.3.x 153 30.1 Upgrade from 0.2.1 to 0.3.x....................................... 153 30.2 Upgrade from 0.3pre to 0.3.x...................................... 154 31 Upgrade from 0.3.x to 0.3.5 159 31.1 Important Changes............................................ 159 31.2 Prerequisites............................................... 160 31.3 Upgrade Procedure............................................ 160 32 Upgrade from 0.3.5 to 0.3.6 163 32.1 Important Changes............................................ 163 32.2 Prerequisites............................................... 163 32.3 Upgrade Procedure............................................ 164 iii 33 Upgrade from 0.3.6 to 0.3.7 165 33.1 Upgrade Procedure............................................ 165 34 Upgrade Tails from 1.x to 2.x 167 34.1 Upgrade each Tails device........................................ 167 34.2 Finishing up............................................... 176 34.3 Troubleshooting............................................. 177 35 Getting Started 181 35.1 Prerequisites............................................... 181 35.2 Clone the repository........................................... 182 35.3 Virtual Environments........................................... 182 35.4 Tips & Tricks............................................... 185 36 Generating AppArmor profiles for Tor and Apache 187 37 SecureDrop apt repository 189 38 Documentation Guidelines 191 38.1 Integration with Read the Docs..................................... 191 38.2 Style Guide................................................ 192 39 Serverspec Tests 193 39.1 Install directions (Ubuntu)........................................ 193 39.2 Running the tests............................................. 193 39.3 Updating the tests............................................ 193 39.4 Spectest layout.............................................. 194 40 Threat Model 195 40.1 Assumptions............................................... 195 40.2 Attack Scenarios............................................. 197 iv SecureDrop Documentation, Release 0.3.5 SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from and communicate with anonymous sources. User Guides 1 SecureDrop Documentation, Release 0.3.5 2 User Guides CHAPTER 1 Source Guide 1.1 Choose who to submit to There are currently over 20 organizations running SecureDrop. Each instance is totally independent, and submissions to that instance are only available to journalists associated with that organization. All organizations have a landing page that provides their own organization-specific recommendations for using Se- cureDrop. We encourage you to consider an organization’s landing