<commit_before>Test the Installation
=====================

Test connectivity
-----------------

SSH to both servers over Tor
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

On the *Admin Workstation*, you should be able to SSH to the App
Server and the *Monitor Server*. ::

   ssh app
   ssh mon

The SSH aliases should have been configured automatically by running
the ``./securedrop-admin tailsconfig`` tool. If you're unable to connect via aliases,
try using the verbose command format to troubleshoot: ::

   ssh <username>@<app .onion>
   ssh <username>@<mon .onion>

.. tip:: You can find the Onion URLs for SSH in ``app-ssh-aths`` and
         ``mon-ssh-aths`` inside the ``install_files/ansible-base`` directory.

Log in to both servers via TTY
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

All access to the SecureDrop servers should be performed over SSH from the
*Admin Workstation*. To aid in troubleshooting, physical logins via TTY are
supported, but require 2FA to be configured. See the :doc:`2FA setup guide
<google_authenticator>` for information how to enable console logins.

Test the 2FA functionality by connecting a keyboard and display to each server,
then login with the Admin username. You will need:

* sudo password for the Admin username
* TOTP code from a 2FA app such as Google Authenticator or FreeOTP

Confirm that logging in via TTY prompts for a 2FA code, and that the code
generated by your smartphone app permits logging in to an interactive shell.

Sanity-check the install
------------------------

On each server:

#. Check that you can execute privileged commands by running ``sudo su``.
#. Verify that you are booted into a grsec kernel: run ``uname -r``
   and verify that the name of the running kernel ends with ``-grsec``.
#. Check the AppArmor status with ``sudo aa-status``. On a production
   instance all profiles should be in enforce mode.
#. Check the current applied iptables rules with ``iptables-save``. It
   should output *approximately* 50 lines.
#. You should have received an email alert from OSSEC when it first
   started. If not, review our :doc:`OSSEC Alerts
   Guide <ossec_alerts>`.

Test the web interfaces
-----------------------

#. Make sure the Source Interface is available, and that you can make a
   submission.

   - Do this by opening the Tor Browser and navigating to the onion
     URL from ``app-source-ths``. Proceed through the codename
     generation (copy this down somewhere) and you can submit a
     message or attach any random unimportant file.
   - Usage of the Source Interface is covered by our :doc:`Source User
     Manual <source>`.

#. Test that you can access the Journalist Interface, and that you can log
   in as the admin user you just created.

   - Open the Tor Browser and navigate to the onion URL from
     app-journalist-aths. Enter your password and two-factor
     authentication code to log in.
   - If you have problems logging in to the Admin/Journalist Interface,
     SSH to the *Application Server* and restart the ntp daemon to synchronize
     the time: ``sudo service ntp restart``. Also check that your
     smartphone's time is accurate and set to network time in its
     device settings.

#. Test replying to the test submission.
<commit_msg>Check AppArmor status on Application Server only<commit_after>Test the Installation
=====================

Test connectivity
-----------------

SSH to both servers over Tor
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

On the *Admin Workstation*, you should be able to SSH to the App
Server and the *Monitor Server*. ::

   ssh app
   ssh mon

The SSH aliases should have been configured automatically by running
the ``./securedrop-admin tailsconfig`` tool. If you're unable to connect via aliases,
try using the verbose command format to troubleshoot: ::

   ssh <username>@<app .onion>
   ssh <username>@<mon .onion>

.. tip:: You can find the Onion URLs for SSH in ``app-ssh-aths`` and
         ``mon-ssh-aths`` inside the ``install_files/ansible-base`` directory.

Log in to both servers via TTY
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

All access to the SecureDrop servers should be performed over SSH from the
*Admin Workstation*. To aid in troubleshooting, physical logins via TTY are
supported, but require 2FA to be configured. See the :doc:`2FA setup guide
<google_authenticator>` for information how to enable console logins.

Test the 2FA functionality by connecting a keyboard and display to each server,
then login with the Admin username. You will need:

* sudo password for the Admin username
* TOTP code from a 2FA app such as Google Authenticator or FreeOTP

Confirm that logging in via TTY prompts for a 2FA code, and that the code
generated by your smartphone app permits logging in to an interactive shell.

Sanity-check the install
------------------------

On each server:

#. Check that you can execute privileged commands by running ``sudo su``.
#. Verify that you are booted into a grsec kernel: run ``uname -r``
   and verify that the name of the running kernel ends with ``-grsec``.
#. Check the current applied iptables rules with ``iptables-save``. It
   should output *approximately* 50 lines.
#. You should have received an email alert from OSSEC when it first
   started. If not, review our :doc:`OSSEC Alerts
   Guide <ossec_alerts>`.

On the *Application Server*:

#. Check the AppArmor status with ``sudo aa-status``. On a production
   instance all profiles should be in enforce mode.

Test the web interfaces
-----------------------

#. Make sure the Source Interface is available, and that you can make a
   submission.

   - Do this by opening the Tor Browser and navigating to the onion
     URL from ``app-source-ths``. Proceed through the codename
     generation (copy this down somewhere) and you can submit a
     message or attach any random unimportant file.
   - Usage of the Source Interface is covered by our :doc:`Source User
     Manual <source>`.

#. Test that you can access the Journalist Interface, and that you can log
   in as the admin user you just created.

   - Open the Tor Browser and navigate to the onion URL from
     app-journalist-aths. Enter your password and two-factor
     authentication code to log in.
   - If you have problems logging in to the Admin/Journalist Interface,
     SSH to the *Application Server* and restart the ntp daemon to synchronize
     the time: ``sudo service ntp restart``. Also check that your
     smartphone's time is accurate and set to network time in its
     device settings.

#. Test replying to the test submission.

{'fraction_non_alphanumeric': 0.09993878175696358, 'fraction_numerical': 0.0021426385062748698, 'mean_word_length': 3.4245091401489507, 'pattern_counts': {'":': 0, '<': 17, '<?xml version=': 0, '>': 17, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5191673', 'n_tokens_mistral': 1768, 'n_tokens_neox': 1639, 'n_words': 926}