Migrate Admin Workstation from Tails

Migrate Admin Workstation from Tails#

These steps will create a new Admin Workstation from your existing Tails Admin Workstation USB flash drive.

Typically you will perform these steps on a laptop where you have freshly installed Qubes OS and the SecureDrop packages to create a new standalone Admin Workstation.

Alternatively, you may perform these steps on an existing Journalist Workstation laptop to turn it into a combined Admin + Journalist Workstation.

Install Admin Workstation#

Open a dom0 terminal (Qubes Application menu ▸ System Tools ▸ Other ▸ Xfce Terminal) and configure infinite scrollback for your terminal via Edit ▸ Preferences ▸ General ▸ Unlimited scrollback. This helps to ensure that you will be able to review any error output printed to the terminal during the installation.

When ready run the following command in the dom0 terminal:

securedrop-manage apply --target admin

This command will take approximately 30-60 minutes and 4GB of bandwidth, as it sets up multiple qubes and installs supporting packages. When the command finishes, reboot the machine to complete the installation and set up.

Import from Tails Admin Workstation#

  1. Locate a Tails Admin Workstation USB flash drive.

  2. Connect the USB flash drive to a USB port on the Qubes computer, then use the Devices Widget in the upper right panel to attach it to the vault qube. There will be 3 listings for the USB flash drive in the widget: one for the base drive, one for the Tails partition (labeled Tails), and a 3rd unlabeled listing (for the persistent volume). Choose the third listing.

  3. In the the vault file manager, select the persistent volume’s listing in the lower left sidebar. It will be named N GB encrypted, where N is the size of the persistent volume. Enter the persistent volume passphrase to unlock and mount it. When prompted, select the option to Forget password immediately.

  4. In a dom0 terminal (Qubes Application menu ▸ System Tools ▸ Other ▸ Xfce Terminal), run the securedrop-manage command to import the Admin Workstation settings and credentials:

securedrop-manage configure --target admin

The command will print out the imported details to confirm before proceeding.

  1. In the vault file manager, right-click on the TailsData sidebar entry, then select Unmount and shut down the sd-admin-vault qube (using the Qube widget in the upper right panel).

Import Administrator KeePassXC database#

  1. Use the Devices Widget in the upper right panel to attach the Tails Admin Workstation USB drive to the sd-admin-vault qube. As before, there will be 3 listings for the USB flash drive in the widget: one for the base drive, one for the Tails partition (labeled Tails), and a 3rd unlabeled listing (for the persistent volume). Choose the third listing.

  1. Launch KeePassXC in sd-admin-vault (Qubes Application menu ▸ Apps ▸ sd-admin-vault ▸ KeePassXC). Select the persistent volume’s listing in the lower left sidebar. It will be named N GB encrypted, where N is the size of the persistent volume. Enter the persistent volume passphrase to unlock and mount it. When prompted, select the option to Forget password immediately.

  2. Locate the KeePassXC password database. It should be in the Persistent directory, and will typically be named keepassx.kdbx or similar.

  3. Drag and drop the password database to copy it to the Home directory of sd-admin-vault.

  1. In the sd-admin-vault file manager, right-click on the TailsData sidebar entry, then select Unmount and disconnect the Tails Admin Workstation USB.

  2. In the file manager window that displays the home directory, open the copy you made of the password database by double-clicking it.

  3. If the database is passwordless, KeePassXC may display a security warning when opening it. To preserve convenient passwordless access, you can protect the database using a key file, via Database ▸ Database settings ▸ Security ▸ Add additional protection ▸ Add Key File ▸ Generate. This key file has to be selected when you open the database, but KeePassXC will remember the last selection.

  4. Inspect each section of the password database to ensure that it contains only the information required by the Administrator to manage your SecureDrop servers.

  5. Close the application window and shut down the sd-admin-vault qube.

Test new Admin Workstation#

Decommission Tails Admin Workstation#

The USB flash drives used for SecureDrop are all encrypted, either with LUKS or Veracrypt. To securely wipe this kind of storage media, it is necessary to re-format and re-encrypt the drive, following the same steps used in their initial creation. This will destroy the encryption headers, making any data on the drives unrecoverable.

You may also choose to destroy the drives by physical means, such as using a hammer or purpose-built shredder to pulverize the drive.