<commit_before># Hardware for SecureDrop

This document outlines requirements and recommended hardware for use with SecureDrop. If you have any questions, please contact <EMAIL>.

## SecureDrop Infrastructure

The SecureDrop infrastructure consists of different components, all of which are listed below. We recommend you read through the whole document and figure out what makes the most sense for your organization.

### App Server and Monitor Server

The *Application Server* (or *App Server* for short) runs the SecureDrop application. This server hosts both the website that sources access (*Source Interface*) and the website that journalists access (*Document Interface*). The *Monitor Server* keeps track of the *App Server* and sends out email alerts if something seems wrong. SecureDrop requires that you have:

 * 1 x physical server for the *Application Server*, which will run the SecureDrop application.
 * 1 x physical server for the *Monitor Server*, which sends emails about issues with the *App Server*.

The SecureDrop application requires a 64-bit operating system. You can repurpose old hardware if it is capable of running 64-bit Ubuntu. Otherwise, we recommend you get two [Intel NUCs](http://www.amazon.com/dp/B00F3F38O2/ref=wl_it_dp_o_pd_nS_ttl?_encoding=UTF8&colid=3NQVTBFZV73JA&coliid=IOKQL5QS1Q2NX&psc=1) with power cords. Make sure you also get the cables required to connect the NUCs to a monitor. Additionally, you will need to get the following [two 240 GB hard drives](http://www.amazon.com/dp/B00BQ8RKT4/ref=wl_it_dp_o_pd_nS_ttl?_encoding=UTF8&colid=3NQVTBFZV73JA&coliid=I319YS8KKXVZWS&psc=1) and a [4 GB (2GBx2) memory kit](http://www.amazon.com/Crucial-PC3-12800-204-Pin-Notebook-CT2CP25664BF160B/dp/B005MWQ6WC/ref=sr_1_2?s=electronics&ie=UTF8&qid=1411294165&sr=1-2).

#### Potential BIOS issue

The previous release of SecureDrop (0.2.1) was based on Ubuntu 12.04.1 (precise). We encountered issues installing this version of SecureDrop on some types of Intel NUCs. The problem manifested after installing Ubuntu on the NUC. The installation would complete, but rebooting after installation would not succeed.

We have not encountered this or any similar problems in testing the current release (0.3) with the Intel NUCs. Since 0.3 is based on Ubuntu 14.04.1 (trusty), we believe the issue has been resolved by Ubuntu.

If you do encounter issues booting Ubuntu on the NUCs, try [updating the BIOS according to these instructions](http://arstechnica.com/gadgets/2014/02/new-intel-nuc-bios-update-fixes-steamos-other-linux-booting-problems/).

### Secure Viewing Station (SVS)

The *Secure Viewing Station* is a machine that is kept offline and only ever used together with the Tails operating system. This machine will be used to generate GPG keys for all journalists with access to SecureDrop, as well as decrypt and view submitted documents. Since this machine will never touch the Internet or run an operating system other than Tails, it does not need a hard drive or network device. We recommend the following:

 * 1 x laptop without a hard drive, network interface card or wireless units.
 * 1 x encrypted, external hard drive to store documents on while working on a story.
 * 1 x offline printer.

We recommend that you either buy or repurpose an old laptop. Another option is to buy an [Intel NUC](http://www.amazon.com/dp/B00F3F38O2/ref=wl_it_dp_o_pd_nS_ttl?_encoding=UTF8&colid=3NQVTBFZV73JA&coliid=IOKQL5QS1Q2NX&psc=1) with a power cord and [4 GB of memory](http://www.amazon.com/Crucial-PC3-12800-204-Pin-Notebook-CT2CP25664BF160B/dp/B005MWQ6WC/ref=sr_1_2?s=electronics&ie=UTF8&qid=1411294165&sr=1-2), but note that you will also need to get a monitor and a wired keyboard and mouse. For the printer, we recommend the [HP Deskjet printer](http://www.amazon.com/HP-Deskjet-Printer-CH340A-B1H/dp/B003YGZIY0/ref=pd_sim_op_2?ie=UTF8&refRID=1BNF29AQ5S6C3SR0DS6V).

### Tails and Transfer Devices

The *Transfer Device* is the physical media used to transfer encrypted documents from the *Journalist Workstation* to the *Secure Viewing Station*. Additional devices are needed to run Tails. We recommend the following:

 * 1 x physical media for the system administrator to run Tails on.
 * 1 x physical media for the system administrator to transfer files with.
 * 1 x physical media for the journalist to run Tails on.
 * 1 x physical media for the journalist to transfer files with.
 * 1 x physical media with Tails for the *Secure Viewing Station*.
 * 1 x physical media with Tails for the *Secure Viewing Station* (backup).

We recommend getting [16 GB Leef Supra](http://www.amazon.com/dp/B00FWQTBZ2/ref=wl_it_dp_o_pC_nS_ttl?_encoding=UTF8&colid=3NQVTBFZV73JA&coliid=IX8TE9WOYD105) USB sticks to run Tails on, and [4 GB Patriot](http://www.amazon.com/Swivel-Flash-Drive-Memory-Stick/dp/B00M1GYD90/ref=sr_1_20?s=pc&ie=UTF8&qid=1417035771&sr=1-20&keywords=wellcore+4GB) USB sticks to use when transferring files. Each journalist should have two USB sticks. For the Secure Viewing Station and backup, we recommend getting [Corsair 64 GB](http://www.amazon.com/dp/B00EM71W1S/ref=wl_it_dp_o_pd_nS_ttl?_encoding=UTF8&colid=3NQVTBFZV73JA&coliid=I3KY4GZXC9PPV&psc=1) USB sticks.

Another alternative setup exists in which journalists do not transfer files on a USB stick, but instead use a CD-R or DVD-R. The encrypted documents are copied to the CD-R or DVD-R, then decrypted and read on the Secure Viewing Station. The disks are destroyed after first use. We recommend getting a [Samsung model burner](http://www.newegg.com/External-CD-DVD-Blu-Ray-Drives/SubCategory/ID-420) for this purpose.

### Two-factor authentication device

Two-factor authentication is used when connecting to different parts of the SecureDrop system, including the *Document Interface*. We recommend the following for each administrator or journalist with access to the system:

 * 1 x two-factor authentication device

We recommend using either a smartphone capable of running [Google Authenticator](https://support.google.com/accounts/answer/1066447?hl=en) or a [YubiKey](http://www.yubico.com/products/yubikey-hardware/yubikey/).

### Network firewall

An important part of SecureDrop's security model involves segmenting the infrastructure from the Internet and/or the corporate environment. For this reason, we recommend that you get:

 * 1 x firewall with pfSense and minimum three NICs.

We recommend getting a Netgate firewall with pfSense pre-installed, and you can choose from a firewall with [2 GB of system memory](http://store.netgate.com/NetgateAPU2.aspx) or one with [4 GB of system memory](http://store.netgate.com/APU4.aspx).

## Appendix
<commit_msg>Add note about network switch to Hardware Guide<commit_after># Hardware for SecureDrop

This document outlines requirements and recommended hardware for use with SecureDrop. If you have any questions, please contact <EMAIL>.

## SecureDrop Infrastructure

The SecureDrop infrastructure consists of different components, all of which are listed below. We recommend you read through the whole document and figure out what makes the most sense for your organization.

### App Server and Monitor Server

The *Application Server* (or *App Server* for short) runs the SecureDrop application. This server hosts both the website that sources access (*Source Interface*) and the website that journalists access (*Document Interface*). The *Monitor Server* keeps track of the *App Server* and sends out email alerts if something seems wrong. SecureDrop requires that you have:

 * 1 x physical server for the *Application Server*, which will run the SecureDrop application.
 * 1 x physical server for the *Monitor Server*, which sends emails about issues with the *App Server*.

The SecureDrop application requires a 64-bit operating system. You can repurpose old hardware if it is capable of running 64-bit Ubuntu. Otherwise, we recommend you get two [Intel NUCs](http://www.amazon.com/dp/B00F3F38O2/ref=wl_it_dp_o_pd_nS_ttl?_encoding=UTF8&colid=3NQVTBFZV73JA&coliid=IOKQL5QS1Q2NX&psc=1) with power cords. Make sure you also get the cables required to connect the NUCs to a monitor. Additionally, you will need to get the following [two 240 GB hard drives](http://www.amazon.com/dp/B00BQ8RKT4/ref=wl_it_dp_o_pd_nS_ttl?_encoding=UTF8&colid=3NQVTBFZV73JA&coliid=I319YS8KKXVZWS&psc=1) and a [4 GB (2GBx2) memory kit](http://www.amazon.com/Crucial-PC3-12800-204-Pin-Notebook-CT2CP25664BF160B/dp/B005MWQ6WC/ref=sr_1_2?s=electronics&ie=UTF8&qid=1411294165&sr=1-2).

#### Potential BIOS issue

The previous release of SecureDrop (0.2.1) was based on Ubuntu 12.04.1 (precise). We encountered issues installing this version of SecureDrop on some types of Intel NUCs. The problem manifested after installing Ubuntu on the NUC. The installation would complete, but rebooting after installation would not succeed.

We have not encountered this or any similar problems in testing the current release (0.3) with the Intel NUCs. Since 0.3 is based on Ubuntu 14.04.1 (trusty), we believe the issue has been resolved by Ubuntu.

If you do encounter issues booting Ubuntu on the NUCs, try [updating the BIOS according to these instructions](http://arstechnica.com/gadgets/2014/02/new-intel-nuc-bios-update-fixes-steamos-other-linux-booting-problems/).

### Secure Viewing Station (SVS)

The *Secure Viewing Station* is a machine that is kept offline and only ever used together with the Tails operating system. This machine will be used to generate GPG keys for all journalists with access to SecureDrop, as well as decrypt and view submitted documents. Since this machine will never touch the Internet or run an operating system other than Tails, it does not need a hard drive or network device. We recommend the following:

 * 1 x laptop without a hard drive, network interface card or wireless units.
 * 1 x encrypted, external hard drive to store documents on while working on a story.
 * 1 x offline printer.

We recommend that you either buy or repurpose an old laptop. Another option is to buy an [Intel NUC](http://www.amazon.com/dp/B00F3F38O2/ref=wl_it_dp_o_pd_nS_ttl?_encoding=UTF8&colid=3NQVTBFZV73JA&coliid=IOKQL5QS1Q2NX&psc=1) with a power cord and [4 GB of memory](http://www.amazon.com/Crucial-PC3-12800-204-Pin-Notebook-CT2CP25664BF160B/dp/B005MWQ6WC/ref=sr_1_2?s=electronics&ie=UTF8&qid=1411294165&sr=1-2), but note that you will also need to get a monitor and a wired keyboard and mouse. For the printer, we recommend the [HP Deskjet printer](http://www.amazon.com/HP-Deskjet-Printer-CH340A-B1H/dp/B003YGZIY0/ref=pd_sim_op_2?ie=UTF8&refRID=1BNF29AQ5S6C3SR0DS6V).

### Tails and Transfer Devices

The *Transfer Device* is the physical media used to transfer encrypted documents from the *Journalist Workstation* to the *Secure Viewing Station*. Additional devices are needed to run Tails. We recommend the following:

 * 1 x physical media for the system administrator to run Tails on.
 * 1 x physical media for the system administrator to transfer files with.
 * 1 x physical media for the journalist to run Tails on.
 * 1 x physical media for the journalist to transfer files with.
 * 1 x physical media with Tails for the *Secure Viewing Station*.
 * 1 x physical media with Tails for the *Secure Viewing Station* (backup).

We recommend getting [16 GB Leef Supra](http://www.amazon.com/dp/B00FWQTBZ2/ref=wl_it_dp_o_pC_nS_ttl?_encoding=UTF8&colid=3NQVTBFZV73JA&coliid=IX8TE9WOYD105) USB sticks to run Tails on, and [4 GB Patriot](http://www.amazon.com/Swivel-Flash-Drive-Memory-Stick/dp/B00M1GYD90/ref=sr_1_20?s=pc&ie=UTF8&qid=1417035771&sr=1-20&keywords=wellcore+4GB) USB sticks to use when transferring files. Each journalist should have two USB sticks. For the Secure Viewing Station and backup, we recommend getting [Corsair 64 GB](http://www.amazon.com/dp/B00EM71W1S/ref=wl_it_dp_o_pd_nS_ttl?_encoding=UTF8&colid=3NQVTBFZV73JA&coliid=I3KY4GZXC9PPV&psc=1) USB sticks.

Another alternative setup exists in which journalists do not transfer files on a USB stick, but instead use a CD-R or DVD-R. The encrypted documents are copied to the CD-R or DVD-R, then decrypted and read on the Secure Viewing Station. The disks are destroyed after first use. We recommend getting a [Samsung model burner](http://www.newegg.com/External-CD-DVD-Blu-Ray-Drives/SubCategory/ID-420) for this purpose.

### Two-factor authentication device

Two-factor authentication is used when connecting to different parts of the SecureDrop system, including the *Document Interface*. We recommend the following for each administrator or journalist with access to the system:

 * 1 x two-factor authentication device

We recommend using either a smartphone capable of running [Google Authenticator](https://support.google.com/accounts/answer/1066447?hl=en) or a [YubiKey](http://www.yubico.com/products/yubikey-hardware/yubikey/).

### Network firewall

An important part of SecureDrop's security model involves segmenting the infrastructure from the Internet and/or the corporate environment. For this reason, we recommend that you get:

 * 1 x firewall with pfSense and minimum three NICs.

We recommend getting a Netgate firewall with pfSense pre-installed, and you can choose from a firewall with [2 GB of system memory](http://store.netgate.com/NetgateAPU2.aspx) or one with [4 GB of system memory](http://store.netgate.com/APU4.aspx).

### Network Switch

If you firewall has fewer than **four** NICs, you will need an additional Ethernet switch to perform installation and maintenance tasks with the Admin Workstation. This switch is generally useful because it allows you to connect to your firewall's LAN port without taking down either of the SecureDrop servers, which is useful if you want to perform maintenance tasks from the Admin Workstation on the SecureDrop installation or the firewall configuration. This is possible without the switch if your firewall has enough ports, but you will need to perform some additional initial firewall setup to get this to work.

We recommend getting a [5-port Netgear ProSafe Ethernet Switch](http://www.amazon.com/NETGEAR-ProSafe-Gigabit-Ethernet-Desktop/dp/B0000BVYT3/ref=sr_1_fkmr1_1?ie=UTF8&qid=1418401631&sr=8-1-fkmr1&keywords=netgate+prosafe+5+port) or similar.

## Appendix

{'fraction_non_alphanumeric': 0.07259871184542145, 'fraction_numerical': 0.03626435172220666, 'mean_word_length': 5.133533705452984, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 2, 'lorem ipsum': 0, 'www.': 23, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5475590', 'n_tokens_mistral': 4654, 'n_tokens_neox': 4194, 'n_words': 1743}