Install SecureDrop on the Servers#
Now that the Application and Monitor Servers are prepared, you are ready to install and configure the SecureDrop server on them. Like all future administrative tasks, this is performed from the sd-admin qube on the Admin Workstation you prepared earlier.
Test connectivity to Servers#
Having set up the firewall, you can plug the Application Server and the Monitor Server into the firewall. Your Admin Workstation should also be connected to the firewall.
If you are using a setup where there is a switch on the LAN port, plug the Application Server into the switch and plug the Monitor Server into the OPT1 port.
You should make sure you can connect from the Admin Workstation to both of the Servers before continuing with the installation.
Open a terminal in sd-admin (
▸ sd-admin`` ▸ Xfce Terminal) and verify that you can SSH into both Servers, authenticating with your server administrator username (e.g. sdadmin) and password:
$ ssh <username>@<App IP address> hostname
app
$ ssh <username>@<Monitor IP address> hostname
mon
Tip
If you cannot connect, check the network firewall logs for clues.
Set up SSH keys#
Ubuntu’s default SSH configuration authenticates users with their passphrases; however, public key authentication is more secure, and once it’s set up it is also easier to use. In this section, you will create a new SSH key for authenticating to both Servers. Since the Admin Workstation was set up with SSH Client Persistence, this key will be saved on the Admin Workstation and can be used in the future to authenticate to the Servers in order to perform administrative tasks.
First, generate the new SSH keypair:
ssh-keygen -t rsa -b 4096
You’ll be asked to “Enter file in which to save the key” Type Enter to use the default location.
Given that this key is stored on an Admin Workstation with full disk encryption, you do not need to add an additional passphrase to protect the key.
Once the key has finished generating, you need to copy the public key to both Servers. Use ssh-copy-id to copy the public key to each Server, authenticating with your passphrase:
ssh-copy-id <username>@<App IP address>
ssh-copy-id <username>@<Mon IP address>
Verify that you are able to authenticate to both Servers by running the below commands. You should not be prompted for a passphrase (unless you chose to passphrase-protect the key you just created).
$ ssh <username>@<App IP address> hostname
app
$ ssh <username>@<Monitor IP address> hostname
mon
If you have successfully connected to the Server via SSH, the terminal output will be name of the Server to which you have connected (‘app’ or ‘mon’) as shown above.
Prepare configuration files#
Make sure you have the following information and files ready before continuing:
the Application Server local IP address
the Monitor Server local IP address
the Submission Public Key
the Submission Key fingerprint
the email address that will receive alerts from OSSEC
the GPG public key and fingerprint for the email address that will receive the alerts
connection information for the SMTP relay that handles OSSEC Alerts (see the OSSEC Alerts Guide)
the username of a journalist who will be using SecureDrop (you can add more later)
the username of the system admin
If configuring Daily Journalist Alert emails (this is optional and can be configured later), you will also need:
the Journalist Alert Public Key
the Journalist Alert Public Key fingerprint
the email address that will receive the Daily Journalist Alerts
Earlier, you transferred your Submission Public Key, as well as the public keys for OSSEC Alerts and Daily Journalist Alerts (if applicable). If you need to determine the fingerprints for these public keys, you can do so by running the following command in a terminal in sd-admin ( ▸ sd-admin`` ▸ Xfce Terminal):
gpg --with-colons --show-keys <path/to/public_key_file> | grep "^fpr" | cut -d: -f10
Localization of the Source Interface and Admin Interface#
The Source Interface and Admin Interface are translated in the following languages:
During the installation you will be given the opportunity to choose from a list of supported languages to display using the codes shown in parentheses.
Note
With a Source Interface displayed in French (for example), Sources are likely to expect a Journalist fluent in French to be available to read their messages and submissions and follow up in that language.
Prepare SecureDrop Server configuration#
Open a terminal in sd-admin and run the following command, answering the prompts the the values that match your environment and SecureDrop installation:
securedrop-admin sdconfig
The script will automatically validate the answers you provided and display error messages if any problems are detected. The answers will be written to the file ~/.config/securedrop-admin/site-specific.
Optional: configuring fingerprint verification#
If you run your own mail server, you may wish to increase the security level used by Postfix for sending mail to fingerprint, rather than secure. Doing so will require an exact match for the fingerprint of TLS certificate on the SMTP relay. The advantage to fingerprint verification is additional security, but the disadvantage is potential maintenance cost if the fingerprint changes often. If you manage the mail server and handle the certificate rotation, you should update the SecureDrop configuration whenever the certificate changes, so that OSSEC alerts continue to send. Using fingerprint verification does not work well for popular mail relays such as smtp.gmail.com, as those fingerprints can change frequently, due to load balancing or other factors.
You can retrieve the fingerprint of your SMTP relay by running the command below (all on one line). Please note that you will need to replace smtp.gmail.com and 587 with the correct domain and port for your SMTP relay.
openssl s_client -connect smtp.gmail.com:587 -starttls smtp < /dev/null 2>/dev/null |
openssl x509 -fingerprint -noout -in /dev/stdin | cut -d'=' -f2
If you are using Tails, you will not be able to connect directly with openssl s_client due to the default firewall rules. To get around this, proxy the requests over Tor by adding torify at the beginning of the command. The output of the command above should look like the following:
6D:87:EE:CB:D0:37:2F:88:B8:29:06:FB:35:F4:65:00:7F:FD:84:29
Finally, add a new variable to ~/.config/securedrop-admin/site-specific as smtp_relay_fingerprint, like so:
smtp_relay_fingerprint: "6D:87:EE:CB:D0:37:2F:88:B8:29:06:FB:35:F4:65:00:7F:FD:84:29"
Specifying the fingerprint will configure Postfix to use it for verification on the next playbook run. (To disable fingerprint verification, simply delete the variable line you added, and rerun the playbooks.) Save ~/.config/securedrop-admin/site-specific and exit the editor.
Install SecureDrop Servers#
Now you are ready to install SecureDrop! This process will configure the Servers and install SecureDrop and all of its dependencies. In a terminal in sd-admin run the following command:
securedrop-admin install
You will be prompted to enter the sudo passphrase for the Application Server and Monitor Server (which must be the same).
The installation process will take some time. It will return you to the terminal prompt when complete.
If any errors occur while running the install, carefully inspect the error output. Considering saving any error messages for reference and troubleshooting.
Note
If you see an error running securedrop-admin install, and believe it may be an intermittent issue (for example, due to losing network connectivity to the servers), it is safe to run the securedrop-admin install command again. If you see the same issue consistently, then you will need to troubleshoot it.
If you see the error message “timeout (62s) waiting for privilege escalation prompt”, try deleting the Ansible control path directory on your Admin Workstation (rm -rf ~/.ansible/cp) to reset the connection to the servers, then re-run the securedrop-admin install.
If you encounter other errors, we encourage you to submit a bug report, or to contact us at securedrop@freedom.press (GPG encrypted).
If needed, make edits to the file located at ~/.config/securedrop-admin/site-specific as described above.
Note
The SecureDrop install process configures a custom Linux kernel hardened with the grsecurity patch set. Only binary images are hosted in the apt repo. For source packages, see the Source Offer.
Onion Service addresses#
Once the installation is complete, the Onion Service addresses for your Source and Admin Interfaces will be available in the following files under ~/.config/securedrop-admin:
app-sourcev3-thscontains the onion address of the Source Interface.app-journalist.auth_privatecontains the onion address and private key providing access to the Admin Interface.