Transfer public keys to Admin Workstation

Transfer public keys to Admin Workstation#

To configure the SecureDrop Servers, the Admin Workstation requires copies of the public keys associated with your SecureDrop. Now is a good time to copy these keys onto the Admin Workstation so they will be available when you install the servers at a later step.

Import Submission Public Key#

Earlier, you generated the Submission Key. The public half of this key needs to be imported to the correct location on the Admin Workstation.

Moving the Submission Public Key to sd-admin for a combined Workstation (one laptop install)#

If you have opted to create a combined Admin + Journalist Workstation, then you should hav generated the Submission Key on the same laptop. The Submission Public Key simply needs to be copied from dom0 to the sd-admin qube.

In the dom0 terminal, run the command:

securedrop-submission-key export --target admin

Importing the Submission Public Key to sd-admin from separate Journalist Workstation (two laptop install)#

If you have opted to create distinct Admin and Journalist Workstations, then your Submission Key needs to be copied from the Journalist Workstation onto the Admin Workstation and placed in the sd-admin qube.

Export Submission Public Key from a Journalist Workstation#

  1. Insert a USB flash drive into your Journalist Workstation. You may use an encrypted drive such as an Export Device, but it is not necessary for transferring the public key.

  2. Open the Qubes Devices Widget and find your newly inserted USB flash drive under USB Storage at the bottom of the list (indicated by the word new in blue).

  3. Attach your USB flash drive to a the vault qube.

  1. Open the file manager in the vault (Qubes Application menu ▸ vault ▸ Thunar File Manager).

  1. Select your USB flash drive in the file manager to mount it (and unlock it if it is an encrypted Export Device).

  1. Use the Qubes Devices menu to detach the USB flash drive. Then shut down the vault qube.

Import Submission Public Key onto the Admin Workstation#

  1. Insert the USB flash drive into the Admin Workstation.

  2. Open the Qubes Devices menu and find your newly inserted USB flash drive under USB Storage at the bottom of the list (indicated by the word new in blue).

  3. Attach your USB flash drive to sd-admin.

  1. Open the file manager in sd-admin (Qubes Application menu ▸ sd-admin`` ▸ Thunar File Manager).

  2. Select your USB flash drive in the file manager to mount it (and unlock it if it is an encrypted Export Device).

  1. Right click on the sd-public.sec file and drag and drop to copy to the Home directory.

  1. Open a terminal in sd-admin (Qubes Application menu ▸ sd-admin`` ▸ Xfce Terminal) and run the following command to move the Submission Public Key:

    mv ~/sd-public.sec ~/.config/securedrop-admin/.

Copy email alert public keys#

SecureDrop sends different email alerts which are encrypted to a PGP secret key associated with specific recipient email addresses, as outlined here.

Before proceeding, you will need to transfer the public keys for the email addresses which will receive the OSSEC and optional Daily Journalist Alerts to ~/.config/securedrop-admin in the sd-admin qube on the Admin Workstation.

Copy public keys using a USB flash drive#

You can request the public keys from keyservers using the known fingerprint or email address, but it’s best to copy the key from a trusted and verified source.

If you have your public keys available on another computer, you can follow the these steps to transfer your them to the Admin Workstation. The public keys are not sensitive, so you can use any standard FAT32 formatted USB flash drive that is readable by any operating system.

  1. Copy each public key onto the USB drive from your source computer.

  2. Insert the USB drive into your Admin Workstation.

  3. Open the Qubes Devices Widget and find your newly inserted USB flash drive under USB Storage at the bottom of the list (indicated by the word new in blue). Attach your USB flash drive to the sd-admin qube.

  4. Open the File Manager in sd-admin: (Qubes Application menu ▸ sd-admin ▸ File Manager), and mount the drive.

  5. Copy everything to the ~/.config/securedrop-manage/ directory. You can use the copy and paste functionality of the file manager. Use the location bar to easily get to the destination directory.

Import public keys from a keyserver#

Instead of manually transferring your email public keys, you can request them from keyservers using the known fingerprint. Looking a key up by email address or a shorter key ID format could cause you to obtain a wrong, malicious, or expired key. Instead, we recommend you type out your fingerprint in groups of four (just like GPG prints it) enclosed by double quotes. The reason we suggest this formatting for the fingerprint is simply because it’s easiest to type and verify correctly. In the code below simply replace <fingerprint> with your full, space-separated fingerprint:

Download your key and import it into the local keyring:

gpg --recv-key "<fingerprint>"

Note

It is important you type this out correctly. If you are not copy-pasting this command, we recommend you double-check you have entered it correctly before pressing enter.

Again, when passing the full public key fingerprint to the --recv-key command, GPG will implicitly verify that the fingerprint of the key received matches the argument passed.

Caution

If GPG warns you that the fingerprint of the key received does not match the one requested do not proceed with the installation. If this happens, please email us at securedrop@freedom.press.

Next we export the key to a local file.

gpg --export -a "<fingerprint>" > ossec.pub

Copy the key to a directory where it’s accessible by the SecureDrop installation:

cp ossec.pub ~/.config/securedrop-admin/

The fingerprint is a unique identifier for an encryption (public) key. The short and long key ids correspond to the last 8 and 16 hexadecimal digits of the fingerprint, respectively, and are thus a subset of the fingerprint. The full fingerprint must be the entire 40 hexadecimal digit GPG fingerprint for this same key, with all capital letters and no spaces. The following command will retrieve and format the fingerprint per our requirements:

gpg --with-colons --fingerprint "<fingerprint>" | grep "^fpr" | cut -d: -f10

Custom CA certificate#

The Postfix configuration enforces certificate verification, and requires both a valid certificate and STARTTLS support on the SMTP relay. By default the system CAs will be used for validating the relay certificate.

If you need to provide a custom CA to perform the validation, copy the cert file to ~/.config/securedrop-admin using the same procedure described above, and add a new variable to ~/.config/securedrop-admin/site-specific:

smtp_relay_cert_override_file: MyOrg.crt

where MyOrg.crt is the filename. The file will be copied to the server in /etc/ssl/certs_local and the system CAs will be ignored when validating the SMTP relay TLS certificate. Be sure to save ~/.config/securedrop-admin/site-specific when you are finished.