<commit_before>Ubuntu Install Guide
====================

The *Admin Workstation*, running Tails, should be used to download and verify
Ubuntu Server.  The *Application Server* and the *Monitor Server* specifically
require the 64-bit version of `Ubuntu Server 14.04.2 LTS (Trusty Tahr)
<http://old-releases.ubuntu.com/releases/14.04.2/>`__. The image you want to get
is named ``ubuntu-14.04.2-server-amd64.iso``. In order to verify the
installation media, you should also download the files named ``SHA256SUMS`` and
``SHA256SUMS.gpg``.

.. note:: Downloading Ubuntu over Tails may take a very long time because it's
          being done over Tor.

Verify the Ubuntu installation media
------------------------------------

First, you should verify the Ubuntu image you downloaded hasn't been modified by
a malicious attacker or otherwise corrupted. We can do so by checking its
integrity with cryptographic signatures and hashes. 

First, we will download *Ubuntu Image Signing Key* and verify its 
*fingerprint*. ::

    gpg --keyserver hkp://qdigse2yzvuglcix.onion --recv-key "<KEY>"

.. note:: It is important you type this out correctly. If you are not
          copy-pasting this command, we recommend you double-check you have
          entered it correctly before pressing enter.

Again, when passing the full public key fingerprint to the ``--recv-key`` command, GPG
will implicitly verify that the fingerprint of the key received matches the
argument passed.

.. caution:: If GPG warns you that the fingerprint of the key received
             does not match the one requested **do not** proceed with
             the installation. If this happens, please email us at
             <EMAIL>.

Verify the ``SHA256SUMS`` file and move on to the next step if you see
"Good Signature" in the output. ::

    gpg --verify SHA256SUMS.gpg SHA256SUMS

The next and final step is to verify the Ubuntu image. ::

    sha256sum -c <(grep ubuntu-14.04.2-server-amd64.iso SHA256SUMS)


If the final verification step is successful, you should see the
following output in your terminal. ::

    ubuntu-14.04.2-server-amd64.iso: OK

.. caution:: If you do not see the line above it is not safe to proceed with the
             installation. If this happens, please contact us at
             <EMAIL>.

Create the Ubuntu installation media
------------------------------------

To create the Ubuntu installation media, you can either burn the ISO image to a
CD-R or create a bootable USB stick.  As a reliable method we recommend using
the ``dd`` command to copy the hybrid ISO directly to a USB drive rather than a
utility like UNetbootin which can result in errors. Once you have a CD or USB
with an ISO image of Ubuntu on it, you may begin the Ubuntu installation on both
SecureDrop servers.

To use `dd` you first need to find where the USB device you wish to install
Tails on has been mapped. Simply running the command ``lsblk`` in the terminal
will give you a list of your block storage device mappings (this includes hard
drives and USB). If the USB you are writing the Ubuntu installer to is of a
different size or brand than the USB you are running Tails from, it should be
easy to identify which USB has which sdX identifier. If you are unsure, try
running ``lsblk`` before and after plugging in the USB you are using for the
Ubuntu installer.

If your USB is mapped to /dev/sdX and you are currently in the directory that
contains the Ubuntu ISO, you would use dd like so: ::

    sudo dd conv=fdatasync if=ubuntu-14.04.2-server-amd64.iso of=/dev/sdX


Install Ubuntu
--------------

The steps below are the same for both the *Application Server* and the
*Monitor Server*.

Start by inserting the Ubuntu installation media into the server. Boot
or reboot the server with the installation media inserted, and enter the
boot menu. To enter the boot menu, you need to press a key as soon as
you turn the server on. This key varies depending on server model, but
common choices are Esc, F2, F10, and F12. Often, the server will briefly
display a message on boot that shows which key should be pressed to
enter the boot menu. Once you've entered the boot menu, select the
installation media (USB or CD) and press Enter to boot it.

After booting the Ubuntu image, select **Install Ubuntu Server**.

|Ubuntu Server|

Follow the steps to select your language, country and keyboard settings.
Once that's done, let the installation process continue.

Configure the network manually
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The Ubuntu installer will try to autoconfigure networking for the server
you are setting up; however, SecureDrop 0.3 requires manual network
configuration. You can hit **Cancel** at any point during network
autoconfiguration to be given the choice to *Configure the network
manually*.

If network autoconfiguration completes before you can do this, the next
window will ask for your hostname. To get back to the choice of
configuring the network manually, **Cancel** the step that asks you to
set a hostname and choose the manu option that says **Configure the
network manually** instead.

For a production install with a pfSense network firewall in place, the
*Application Server* and the *Monitor Server* are on separate networks.
You may choose your own network settings at this point, but make sure
the settings you choose are unique on the firewall's network and
remember to propagate your choices through the rest of the installation
process.

Below is the configuration you should enter, assuming you used the
network settings from the network firewall guide. If you did not, adjust
these settings accordingly.

-  **Application Server**:

   -  Server IP address: 10.20.1.2
   -  Netmask (default is fine): 255.255.255.0
   -  Gateway: 10.20.1.1
   -  For DNS, use Google's name servers: 8.8.8.8
   -  Hostname: app
   -  Domain name should be left blank

-  **Monitor Server**:

   -  Server IP address: 10.20.2.2
   -  Netmask (default is fine): 255.255.255.0
   -  Gateway: 10.20.2.1
   -  For DNS, use Google's name servers: 8.8.8.8
   -  Hostname: mon
   -  Domain name should be left blank

Continue the installation
~~~~~~~~~~~~~~~~~~~~~~~~~

You can choose whatever username and password you would like. To make
things easier later you should use the same username and password on
both servers. Make sure to save this password in your admin KeePassX
database afterwards.

Click 'no' when asked to encrypt the home directory. Then configure your
time zone.

Partition the disks
~~~~~~~~~~~~~~~~~~~

Before setting up the server's disk partitions and filesystems in the
next step, you will need to decide if you would like to enable `*Full
Disk Encryption
(FDE)* <https://www.eff.org/deeplinks/2012/11/privacy-ubuntu-1210-full-disk-encryption>`__.
If the servers are ever powered down, FDE will ensure all of the
information on them stays private in case they are seized or stolen.

While FDE can be useful in some cases, we currently do not recommend
that you enable it because there are not many scenarios where it will be
a net security benefit for SecureDrop operators. Doing so will introduce
the need for more passwords and add even more responsibility on the
administrator of the system (see `this GitHub
issue <https://github.com/freedomofpress/securedrop/issues/511#issuecomment-50823554>`__<commit_msg>Adds warning about automatic reboots to FDE docs<commit_after>Ubuntu Install Guide
====================

The *Admin Workstation*, running Tails, should be used to download and verify
Ubuntu Server.  The *Application Server* and the *Monitor Server* specifically
require the 64-bit version of `Ubuntu Server 14.04.2 LTS (Trusty Tahr)
<http://old-releases.ubuntu.com/releases/14.04.2/>`__. The image you want to get
is named ``ubuntu-14.04.2-server-amd64.iso``. In order to verify the
installation media, you should also download the files named ``SHA256SUMS`` and
``SHA256SUMS.gpg``.

.. note:: Downloading Ubuntu over Tails may take a very long time because it's
          being done over Tor.

Verify the Ubuntu installation media
------------------------------------

First, you should verify the Ubuntu image you downloaded hasn't been modified by
a malicious attacker or otherwise corrupted. We can do so by checking its
integrity with cryptographic signatures and hashes. 

First, we will download *Ubuntu Image Signing Key* and verify its 
*fingerprint*. ::

    gpg --keyserver hkp://qdigse2yzvuglcix.onion --recv-key "<KEY>"

.. note:: It is important you type this out correctly. If you are not
          copy-pasting this command, we recommend you double-check you have
          entered it correctly before pressing enter.

Again, when passing the full public key fingerprint to the ``--recv-key`` command, GPG
will implicitly verify that the fingerprint of the key received matches the
argument passed.

.. caution:: If GPG warns you that the fingerprint of the key received
             does not match the one requested **do not** proceed with
             the installation. If this happens, please email us at
             <EMAIL>.

Verify the ``SHA256SUMS`` file and move on to the next step if you see
"Good Signature" in the output. ::

    gpg --verify SHA256SUMS.gpg SHA256SUMS

The next and final step is to verify the Ubuntu image. ::

    sha256sum -c <(grep ubuntu-14.04.2-server-amd64.iso SHA256SUMS)


If the final verification step is successful, you should see the
following output in your terminal. ::

    ubuntu-14.04.2-server-amd64.iso: OK

.. caution:: If you do not see the line above it is not safe to proceed with the
             installation. If this happens, please contact us at
             <EMAIL>.

Create the Ubuntu installation media
------------------------------------

To create the Ubuntu installation media, you can either burn the ISO image to a
CD-R or create a bootable USB stick.  As a reliable method we recommend using
the ``dd`` command to copy the hybrid ISO directly to a USB drive rather than a
utility like UNetbootin which can result in errors. Once you have a CD or USB
with an ISO image of Ubuntu on it, you may begin the Ubuntu installation on both
SecureDrop servers.

To use `dd` you first need to find where the USB device you wish to install
Tails on has been mapped. Simply running the command ``lsblk`` in the terminal
will give you a list of your block storage device mappings (this includes hard
drives and USB). If the USB you are writing the Ubuntu installer to is of a
different size or brand than the USB you are running Tails from, it should be
easy to identify which USB has which sdX identifier. If you are unsure, try
running ``lsblk`` before and after plugging in the USB you are using for the
Ubuntu installer.

If your USB is mapped to /dev/sdX and you are currently in the directory that
contains the Ubuntu ISO, you would use dd like so: ::

    sudo dd conv=fdatasync if=ubuntu-14.04.2-server-amd64.iso of=/dev/sdX


Install Ubuntu
--------------

The steps below are the same for both the *Application Server* and the
*Monitor Server*.

Start by inserting the Ubuntu installation media into the server. Boot
or reboot the server with the installation media inserted, and enter the
boot menu. To enter the boot menu, you need to press a key as soon as
you turn the server on. This key varies depending on server model, but
common choices are Esc, F2, F10, and F12. Often, the server will briefly
display a message on boot that shows which key should be pressed to
enter the boot menu. Once you've entered the boot menu, select the
installation media (USB or CD) and press Enter to boot it.

After booting the Ubuntu image, select **Install Ubuntu Server**.

|Ubuntu Server|

Follow the steps to select your language, country and keyboard settings.
Once that's done, let the installation process continue.

Configure the network manually
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The Ubuntu installer will try to autoconfigure networking for the server
you are setting up; however, SecureDrop 0.3 requires manual network
configuration. You can hit **Cancel** at any point during network
autoconfiguration to be given the choice to *Configure the network
manually*.

If network autoconfiguration completes before you can do this, the next
window will ask for your hostname. To get back to the choice of
configuring the network manually, **Cancel** the step that asks you to
set a hostname and choose the manu option that says **Configure the
network manually** instead.

For a production install with a pfSense network firewall in place, the
*Application Server* and the *Monitor Server* are on separate networks.
You may choose your own network settings at this point, but make sure
the settings you choose are unique on the firewall's network and
remember to propagate your choices through the rest of the installation
process.

Below is the configuration you should enter, assuming you used the
network settings from the network firewall guide. If you did not, adjust
these settings accordingly.

-  **Application Server**:

   -  Server IP address: 10.20.1.2
   -  Netmask (default is fine): 255.255.255.0
   -  Gateway: 10.20.1.1
   -  For DNS, use Google's name servers: 8.8.8.8
   -  Hostname: app
   -  Domain name should be left blank

-  **Monitor Server**:

   -  Server IP address: 10.20.2.2
   -  Netmask (default is fine): 255.255.255.0
   -  Gateway: 10.20.2.1
   -  For DNS, use Google's name servers: 8.8.8.8
   -  Hostname: mon
   -  Domain name should be left blank

Continue the installation
~~~~~~~~~~~~~~~~~~~~~~~~~

You can choose whatever username and password you would like. To make
things easier later you should use the same username and password on
both servers. Make sure to save this password in your admin KeePassX
database afterwards.

Click 'no' when asked to encrypt the home directory. Then configure your
time zone.

Partition the disks
~~~~~~~~~~~~~~~~~~~

Before setting up the server's disk partitions and filesystems in the
next step, you will need to decide if you would like to enable `*Full
Disk Encryption
(FDE)* <https://www.eff.org/deeplinks/2012/11/privacy-ubuntu-1210-full-disk-encryption>`__.
If the servers are ever powered down, FDE will ensure all of the
information on them stays private in case they are seized or stolen.

.. warning:: The Ansible playbooks for SecureDrop will enable nightly reboots
             after the ``cron-apt`` task runs for automatic updates. Using FDE
             would therefore require manual intervention every morning.
             Consequently **we strongly discourage the use of FDE.**

While FDE can be useful in some cases, we currently do not recommend
that you enable it because there are not many scenarios where it will be
a net security benefit for SecureDrop operators. Doing so will introduce
the need for more passwords and add even more responsibility on the
administrator of the system (see `this GitHub
issue <https://github.com/freedomofpress/securedrop/issues/511#issuecomment-50823554>`__
{'fraction_non_alphanumeric': 0.0778562858285562, 'fraction_numerical': 0.01893080922543661, 'mean_word_length': 3.607800982800983, 'pattern_counts': {'":': 0, '<': 17, '<?xml version=': 0, '>': 15, 'https://': 4, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 16, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 10, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6682822', 'n_tokens_mistral': 4249, 'n_tokens_neox': 3776, 'n_words': 2193}