# How to configure Firefox for privacy and security

[![Firefox privacy and security hardening guide (2022 revised edition)](firefox-privacy-and-security-hardening-guide-2022-revised-edition.jpg)](https://www.youtube.com/watch?v=s-vwthG28ks "Firefox privacy and security hardening guide (2022 revised edition)")

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## Setup guide

### Step 1: install [Firefox](https://www.mozilla.org/en-US/firefox/new/)

Go to [https://www.mozilla.org/en-US/firefox/new/](https://www.mozilla.org/en-US/firefox/new/), download and install Firefox.

### Step 2: add [user.js](./user.js) to profile

> Heads-up: enables [Mullvad DNS over HTTPS](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/).

> Heads-up: see [arkenfox/user.js](https://github.com/arkenfox/user.js/) to explore more settings.

#### Start Firefox, paste “about:profiles” in address bar and press enter.

#### Find default profile root directory and copy to clipboard.

#### Download user.js to default profile root directory.

> Heads-up: replace `/Users/sunknudsen/Library/Application Support/Firefox/Profiles/rzrw17yo.default-release` with default profile root directory copied to clipboard.

```console
$ cd "/Users/sunknudsen/Library/Application Support/Firefox/Profiles/rzrw17yo.default-release"

$ curl --fail --remote-name https://sunknudsen.com/privacy-guides/how-to-configure-firefox-for-privacy-and-security/user.js
```

### Step 3: restart Firefox

### Step 4: install [Firefox Multi-Account Containers](https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/) and [Privacy Badger](https://addons.mozilla.org/en-US/firefox/addon/privacy-badger17/) extensions

#### Go to [https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/](https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/) and click “Add to Firefox”.

#### Go to [https://addons.mozilla.org/en-US/firefox/addon/privacy-badger17/](https://addons.mozilla.org/en-US/firefox/addon/privacy-badger17/) and click “Add to Firefox”.

> Heads-up: when asked to allow extension to run in private windows, check box and click “Okay”.

### Step 5: set default search engine to DuckDuckGo

### Step 6: configure containers (see episode)

### Step 7: check for DNS and WebRTC leaks

Go to [https://mullvad.net/en/check](https://mullvad.net/en/check).

![Connection check](connection-check.png)

No DNS leaks

No WebRTC leaks

👍

---

## Usage guide

### Temporarily disable cookie and site data deletion (useful when Firefox is restarted to install update or one wishes to reboot computer while persisting Firefox sessions)

> Heads-up: “Delete cookies and site data when Firefox is closed” will be enabled again next time Firefox starts.

Start Firefox, paste “about:preferences#privacy” in address bar and press enter.

Disable “Delete cookies and site data when Firefox is closed”.

👍

---

## Want things back the way they were before following this guide? No problem!

### Delete `user.js` and set Firefox settings as they were before following guide.

👍


# How to setup system-wide [Mullvad DNS over HTTPS](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/) on iOS and macOS

[![How to setup system-wide Mullvad DNS over HTTPS on iOS and macOS](how-to-setup-system-wide-mullvad-dns-over-https-on-ios-and-macos.jpg)](https://www.youtube.com/watch?v=DvjxUN5ZYvE "How to setup system-wide Mullvad DNS over HTTPS on iOS and macOS")

## Requirements

- iPhone running iOS 14 and up
- Mac running Big Sur and up

## iOS guide

> Heads-up: some apps bypass system-wide Mullvad DNS over HTTPS, see https://github.com/paulmillr/encrypted-dns.

### Step 1 (if applicable): disable [Lockdown Mode](https://support.apple.com/en-us/HT212650)

### Step 2: open “Safari” and download [mullvad-doh.mobileconfig](./mullvad-doh.mobileconfig) configuration profile

### Step 3: install “mullvad-doh.mobileconfig” configuration profile

Open “Settings”, click “Profile Downloaded” and, finally, click “Install”

### Step 4 (if applicable): enable Lockdown Mode

### Step 5: check for DNS leaks

Go to [https://mullvad.net/en/check](https://mullvad.net/en/check).

![Connection check](connection-check-ios.png)

No DNS leaks

👍

---

## macOS guide

> Heads-up: some apps bypass system-wide Mullvad DNS over HTTPS, see [https://github.com/paulmillr/encrypted-dns](https://github.com/paulmillr/encrypted-dns).

> Heads-up: when using [Little Snitch](https://www.obdev.at/products/littlesnitch/index.html) or [Lulu](https://objective-see.org/products/lulu.html), system-wide Mullvad DNS over HTTPS is disabled given a single network filter can be enabled at a time (restriction imposed by iOS/macOS).

> Heads-up: given above, one should [configure](../how-to-configure-firefox-for-privacy-and-security) Firefox to use DNS over HTTPS as a failsafe.

> Heads-up: for sensitive use cases, use [Tor](https://www.torproject.org/).

### Step 1 (if applicable): disable [Lockdown Mode](https://support.apple.com/en-us/HT212650)

### Step 2: download [mullvad-doh.mobileconfig](./mullvad-doh.mobileconfig) configuration profile

### Step 3: install “mullvad-doh.mobileconfig” configuration profile

Open “System Settings”, search for “Profiles”, click “Profiles”, click “+”, open “mullvad-doh.mobileconfig”, click “Continue” and, finally, click “Install”.

### Step 4 (if applicable): enable Lockdown Mode

### Step 5: check for DNS leaks

Go to [https://mullvad.net/en/check](https://mullvad.net/en/check).

![Connection check](connection-check-macos.png)

No DNS leaks

👍

---

## Want things back the way they were before following this guide? No problem!

### Delete configuration profile.

👍


# How to setup hardened Ubuntu environment on Intel computer

## Requirements

The following hardware is required.

- Computer [compatible](https://ubuntu.com/download/desktop) with Ubuntu 22.04.1 LTS
- USB flash drive (used to create Ubuntu for desktops bootable installer, 4GB min)
- USB flash drive (used to install Ubuntu for desktops, 16GB min)

## Recommendations

Physically removing internal disk(s) and wireless interface(s) if not soldered to motherboard or disabling interface(s) using BIOS if soldered is recommended to strengthen data persistence and air gap hardening.

Installing Ubuntu for desktops on [datAshur PRO²](https://istorage-uk.com/product/datashur-pro2/) USB flash drive is recommended to enforce access control, data persistence and tamper resistance hardening.

## Bootable installer creation guide

### Step 1: install [Raspberry Pi Imager](https://www.raspberrypi.com/software/)

#### macOS

Go to https://www.raspberrypi.com/software/, download and install Raspberry Pi Imager.

#### Ubuntu (or other Debian-based OS)

> Heads-up: depends on [Qt](https://www.qt.io/).

```shell-session
$ sudo add-apt-repository -y universe

$ sudo apt install -y rpi-imager
```

### Step 2: disable Raspberry Pi Imager [telemetry](https://github.com/raspberrypi/rpi-imager#telemetry)

#### macOS

```shell-session
$ defaults write org.raspberrypi.Imager.plist telemetry -bool NO
```

#### Ubuntu (or other Debian-based OS)

```shell-session
$ mkdir -p ~/.config/Raspberry\ Pi

$ cat << "EOF" > ~/.config/Raspberry\ Pi/Imager.conf
[General]
telemetry=false
EOF
```

### Step 3: download [Ubuntu for desktops](https://ubuntu.com/desktop)

> Heads-up: for additional security, [verify](https://ubuntu.com/tutorials/how-to-verify-ubuntu) Ubuntu for desktops download.

Go to https://ubuntu.com/download/desktop and download Ubuntu 22.04.1 LTS.

### Step 4: create Ubuntu for desktops bootable installer

Open “Raspberry Pi Imager”, click “CHOOSE OS”, then “Use custom”, select Ubuntu for desktops `.iso`, click “CHOOSE STORAGE”, select USB flash drive and, finally, click “WRITE”.

![Raspberry Pi Imager](./assets/rpi-imager.png)

👍

## Installation guide

### Step 1 (optional): physically remove internal disk(s)

### Step 2 (optional): initialize datAshur PRO² and enable bootable mode (see product [documentation](https://istorage-uk.com/product-documentation/) for instructions)

### Step 3: insert both USB flash drives into computer

### Step 4 (if applicable): enable “Secure Boot” and disable “Boot Order Lock”

![Secure Boot](./assets/enable-secure-boot.jpg)

![Boot Order Lock](./assets/disable-boot-order-lock.jpg)

### Step 5: boot to Ubuntu for desktops bootable installer and select “Try or Install Ubuntu”

![Try or Install Ubuntu](./assets/try-or-install-ubuntu.jpg)

### Step 6: connect Ethernet cable or connect to Wi-Fi network

### Step 7: install Ubuntu

#### Click “Install Ubuntu”

![Install Ubuntu](./assets/install-ubuntu.jpg)

#### Choose keyboard layout and click “Continue”

![Keyboard layout](./assets/keyboard-layout.jpg)

#### Select “Minimal installation” and click “Continue”

![Updates and other software](./assets/updates-and-other-software.jpg)

#### Select “Something else” and click “Continue”

![Installation type](./assets/installation-type.jpg)

#### Delete all partitions on USB flash drive on which Ubuntu for desktops is being installed

![Delete partitions](./assets/delete-partitions.jpg)

#### Create 512MB EFI partition on USB flash drive on which Ubuntu for desktops is being installed

![EFI partition](./assets/efi-partition.jpg)

#### Create ext4 partition and set mount point to `/` on USB flash drive on which Ubuntu for desktops is being installed

![ext4 partition](./assets/ext4-partition.jpg)

#### Choose “Device for boot loader installation” and click “Install now”

![Install now](./assets/install-now.jpg)

#### Confirm changes about to be written to disk and click “Continue”

> WARNING: make sure changes only apply to USB flash drive on which Ubuntu for desktops is being installed.

![Write the changes to disk](./assets/write-the-changes-to-disk.jpg)

#### Choose timezone and click “Continue”

![Where are you](./assets/where-are-you.jpg)

#### Choose credentials, select “Log in automatically” (optional) and click “Continue”

![Who are you](./assets/who-are-you.jpg)

#### Reboot

## Configuration guide

### Step 1: disable telemetry

![Help improve Ubuntu](./assets/help-improve-ubuntu.jpg)

### Step 2: run `update-manager` and click “Install Now”

![Software Updater](./assets/software-updater.jpg)

### Step 3: reboot

### Step 4 (if applicable): enable “Boot Order Lock”

![Boot Order Lock](./assets/enable-boot-order-lock.jpg)

### Step 5 (optional): center new windows

```shell-session
$ gsettings set org.gnome.mutter center-new-windows true
```

### Step 6 (optional): enable dark mode

```shell-session
$ gsettings set org.gnome.desktop.interface color-scheme prefer-dark

$ gsettings set org.gnome.desktop.interface gtk-theme Yaru-dark
```

### Step 7: disable auto-mount

```shell-session
$ gsettings set org.gnome.desktop.media-handling automount false
```

### Step 8: add `universe` APT repository

```shell-session
$ sudo add-apt-repository -y universe
```

### Step 9: install `curl`, `libfuse2`, `overlayroot` and `zbar-tools`

```shell-session
$ sudo apt install -y curl libfuse2 overlayroot zbar-tools
```

### Step 10 (if applicable): download [Superbacked](https://superbacked.com/) and allow executing `superbacked.AppImage` as program

#### Download Superbacked

> Heads-up: replace `ABCDEFGH` with your license code.

> Heads-up: for additional security, [verify](/faq/release-integrity) Superbacked download.

```shell-session
$ curl --fail --location --output ~/Desktop/superbacked.AppImage "https://superbacked.com/api/downloads/superbacked-std-x64-latest.AppImage?license=ABCDEFGH"
```

#### Allow executing `superbacked.AppImage` as program

Right-click “superbacked.AppImage”, click “Properties”, click “Permissions” and, finally, select “Allow executing file as program”.

![Allow executing file as program](./assets/allow-executing-file-as-program.jpg)

### Step 11: set `ext4` and `vfat` filesystems to read-only

```shell-session
$ sudo sed -i 's/errors=remount-ro/errors=remount-ro,noload,ro/g' /etc/fstab

$ sudo sed -i 's/umask=0077/umask=0077,ro/g' /etc/fstab
```

### Step 12: disable `fsck.repair`

```shell-session
$ sudo sed -i 's/quiet splash/quiet splash fsck.repair=no/g' /etc/default/grub

$ sudo update-grub
```

### Step 13: set `overlayroot` to `tmpfs`

```shell-session
$ sudo sed -i 's/overlayroot=""/overlayroot="tmpfs"/g' /etc/overlayroot.conf
```

### Step 14: clear Bash history

```shell-session
$ history -cw
```

### Step 15: reboot

> Heads-up: filesystem will be mounted as read-only following reboot.

```shell-session
$ sudo systemctl reboot
```

### Step 16: shutdown

> Heads-up: filesystem is ready for optional hardware read-only hardening.

```shell-session
$ sudo systemctl poweroff
```

### Step 17 (optional): physically remove internal disk(s) and wireless interface(s) if not soldered to motherboard or disable interface(s) using BIOS if soldered

![Disable interfaces](./assets/disable-interfaces.jpg)

### Step 18 (optional): enable datAshur PRO² global read-only (see product [documentation](https://istorage-uk.com/product-documentation/) for instructions)

👍


# How to setup hardened Ubuntu environment on Raspberry Pi

## Requirements

The following hardware is required.

- [Raspberry Pi 4](https://www.raspberrypi.com/products/raspberry-pi-4-model-b/) (2GB min)
- Raspberry Pi [15W USB-C Power Supply](https://www.raspberrypi.com/products/type-c-power-supply/)
- Raspberry Pi [keyboard](https://www.raspberrypi.com/products/raspberry-pi-keyboard-and-hub/) and [mouse](https://www.raspberrypi.com/products/raspberry-pi-mouse/) (or equivalent)
- Raspberry Pi [Micro HDMI to Standard HDMI (A/M) Cable](https://www.raspberrypi.com/products/micro-hdmi-to-standard-hdmi-a-cable/) (or equivalent)
- microSD card or USB flash drive (used to install Ubuntu for desktops, 16GB min)
- HDMI display (720p min)

## Recommendations

Installing Ubuntu for desktops on [datAshur PRO²](https://istorage-uk.com/product/datashur-pro2/) USB flash drive is recommended to enforce access control, data persistence and tamper resistance hardening.

## Bootable installer creation guide

### Step 1: install [Raspberry Pi Imager](https://www.raspberrypi.com/software/)

#### macOS

Go to https://www.raspberrypi.com/software/, download and install Raspberry Pi Imager.

#### Ubuntu (or other Debian-based OS)

> Heads-up: depends on [Qt](https://www.qt.io/).

```shell-session
$ sudo add-apt-repository -y universe

$ sudo apt install -y rpi-imager
```

### Step 2: disable Raspberry Pi Imager [telemetry](https://github.com/raspberrypi/rpi-imager#telemetry)

#### macOS

```shell-session
$ defaults write org.raspberrypi.Imager.plist telemetry -bool NO
```

#### Ubuntu (or other Debian-based OS)

```shell-session
$ mkdir -p ~/.config/Raspberry\ Pi

$ cat << "EOF" > ~/.config/Raspberry\ Pi/Imager.conf
[General]
telemetry=false
EOF
```

### Step 3: download [Ubuntu for desktops](https://ubuntu.com/desktop)

> Heads-up: for additional security, [verify](https://ubuntu.com/tutorials/how-to-verify-ubuntu) Ubuntu for desktops download.

Go to https://ubuntu.com/download/raspberry-pi and download Ubuntu Desktop 22.04.1 LTS.

### Step 4: copy Ubuntu for desktops to USB flash drive

Open “Raspberry Pi Imager”, click “CHOOSE OS”, then “Use custom”, select Ubuntu for desktops `.img.xz`, click “CHOOSE STORAGE”, select USB flash drive and, finally, click “WRITE”.

![Raspberry Pi Imager](./assets/rpi-imager.png)

👍

## Installation guide

### Step 1: choose language and click “Continue”

![Welcome](./assets/welcome.jpg)

### Step 2: choose keyboard layout and click “Continue”

![Keyboard layout](./assets/keyboard-layout.jpg)

### Step 3: choose timezone and click “Continue”

![Where are you](./assets/where-are-you.jpg)

### Step 4: choose credentials, select “Log in automatically” (optional) and click “Continue”

![Who are you](./assets/who-are-you.jpg)

👍

## Configuration guide

### Step 1: disable telemetry

![Help improve Ubuntu](./assets/help-improve-ubuntu.jpg)

### Step 2: run `update-manager` and click “Install Now”

![Software Updater](./assets/software-updater.jpg)

### Step 3: reboot

### Step 4 (optional): center new windows

```shell-session
$ gsettings set org.gnome.mutter center-new-windows true
```

### Step 5 (optional): enable dark mode

```shell-session
$ gsettings set org.gnome.desktop.interface color-scheme prefer-dark

$ gsettings set org.gnome.desktop.interface gtk-theme Yaru-dark
```

### Step 6: disable auto-mount

```shell-session
$ gsettings set org.gnome.desktop.media-handling automount false
```

### Step 7: add `universe` APT repository

```shell-session
$ sudo add-apt-repository -y universe
```

### Step 8: install `curl`, `libfuse2`, `overlayroot`, `zbar-tools` and `zlib1g-dev`

```shell-session
$ sudo apt install -y curl libfuse2 overlayroot zbar-tools zlib1g-dev
```

### Step 9 (if applicable): download [Superbacked](https://superbacked.com/) and allow executing `superbacked.AppImage` as program

#### Download Superbacked

> Heads-up: replace `ABCDEFGH` with your license code.

> Heads-up: for additional security, [verify](/faq/release-integrity) Superbacked download.

```shell-session
$ curl --fail --location --output ~/Desktop/superbacked.AppImage "https://superbacked.com/api/downloads/superbacked-std-arm64-latest.AppImage?license=ABCDEFGH"
```

#### Allow executing `superbacked.AppImage` as program

Right-click “superbacked.AppImage”, click “Properties”, click “Permissions” and, finally, select “Allow executing file as program”.

![Allow executing file as program](./assets/allow-executing-file-as-program.jpg)

### Step 10: disable Bluetooth and Wi-Fi

```shell-session
$ cat << "EOF" | sudo tee -a /boot/firmware/config.txt
dtoverlay=disable-bt
dtoverlay=disable-wifi
EOF
```

### Step 11: set `ext4` and `vfat` filesystems to read-only

```shell-session
$ sudo sed -i 's/discard,x-systemd.growfs/discard,noload,ro/g' /etc/fstab

$ sudo sed -i 's/defaults/defaults,ro/g' /etc/fstab
```

### Step 12: disable `fsck.repair`

```shell-session
$ sudo sed -i 's/splash/splash fsck.repair=no/g' /boot/firmware/cmdline.txt
```

### Step 13: set `overlayroot` to `tmpfs`

```shell-session
$ sudo sed -i 's/overlayroot=""/overlayroot="tmpfs"/g' /etc/overlayroot.conf
```

### Step 14: clear Bash history

```shell-session
$ history -cw
```

### Step 15: reboot

> Heads-up: filesystem will be mounted as read-only following reboot.

```shell-session
$ sudo systemctl reboot
```

### Step 16: shutdown

> Heads-up: filesystem is ready for optional hardware read-only hardening.

```shell-session
$ sudo systemctl poweroff
```

### Step 17 (optional): enable datAshur PRO² global read-only (see product [documentation](https://istorage-uk.com/product-documentation/) for instructions)

👍


# How to disable CUPS printer job history on macOS

[![macOS stores a copy of everything one prints forever](macos-stores-a-copy-of-everything-one-prints-forever.jpg)](https://www.youtube.com/watch?v=eAgfeVNKdoo "macOS stores a copy of everything one prints forever")

## Requirements

- Computer running macOS Monterey or Ventura

## Setup guide

### Step 1: clear job history

> Heads-up: purges `/var/spool/cups`.

```shell
$ cancel -a -x
```

### Step 2: create `/usr/local/sbin` directory

```shell
sudo mkdir -p /usr/local/sbin
sudo chown ${USER}:admin /usr/local/sbin
```

### Step 3: create `cups.sh` script

```shell
cat << "EOF" > /usr/local/sbin/cups.sh
#! /bin/sh

set -e

if grep -qe '^PreserveJobHistory Off$' /etc/cups/cupsd.conf; then
  exit 0
fi

echo "PreserveJobHistory Off" | sudo tee -a /etc/cups/cupsd.conf

sudo launchctl unload /System/Library/LaunchDaemons/org.cups.cupsd.plist

sudo launchctl load /System/Library/LaunchDaemons/org.cups.cupsd.plist
EOF
```

### Step 4: make `cups.sh` executable

```shell
chmod +x /usr/local/sbin/cups.sh
```

### Step 5: create `local.cups.plist` launch daemon

```shell
cat << "EOF" | sudo tee /Library/LaunchDaemons/local.cups.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
    <string>local.cups</string>

    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/sbin/cups.sh</string>
    </array>

    <key>RunAtLoad</key>
    <true/>
  </dict>
</plist>
EOF
```

### Step 6: reboot

👍

---

## Want things back the way they were before following this guide? No problem!

### Step 1: delete `PreserveJobHistory Off` line from `cupsd.conf`

```shell
sudo sed -i "" "/PreserveJobHistory Off/d" /etc/cups/cupsd.conf
```

### Step 2: delete `cups.sh` script

```shell
sudo rm /usr/local/sbin/cups.sh
```

### Step 3: delete `local.cups.plist` launch daemon

```shell
sudo rm /Library/LaunchDaemons/local.cups.plist
```

### Step 4: reload CUPS

```shell
sudo launchctl unload /System/Library/LaunchDaemons/org.cups.cupsd.plist

sudo launchctl load /System/Library/LaunchDaemons/org.cups.cupsd.plist
```

### Step 5: reboot

👍


# How to use COLDCARD devices on Tails

## Requirements

- [Tails USB flash drive or SD card](../how-to-install-tails-on-usb-flash-drive-or-sd-card)
- [COLDCARD](https://coldcard.com/) device

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- When copy/pasting commands that start with `cat << "EOF"`, select all lines at once (from `cat << "EOF"` to `EOF` inclusively) as they are part of the same (single) command

## Setup guide

### Step 1: boot to Tails

### Step 2: enable persistence (if not already enabled)

Click “Applications”, then “Favorites”, then “Configure persistent volume”, set passphrase, click “Create”, make sure “Personal Data” is enabled, click “Save” and, finally, click “Restart Now”.

### Step 3: boot to Tails, unlock persistent storage and set admin password (required to install dependencies and [ckcc](https://coldcard.com/docs/cli) and run coldcard.sh)

> Heads-up: if keyboard layout of computer isn’t “English (US)”, set “Keyboard Layout”.

Click “+” under “Additional Settings”, then “Administration Password”, set password, click “Add” and, finally, click “Start Tails”.

### Step 4: install dependencies

```console
$ sudo apt update

$ sudo apt install -y python3-pip python3-setuptools
```

### Step 5: install ckcc

> Heads-up: ignore “Failed building wheel for pyaes” error (if present).

```console
$ torsocks pip3 install --user 'ckcc-protocol[cli]'
```

### Step 6: copy ckcc to persistent storage

```console
$ mkdir -p /home/amnesia/Persistent/.local

$ cp -r /home/amnesia/.local/{bin,lib} /home/amnesia/Persistent/.local/
```

### Step 7: download [51-coinkite.rules](https://github.com/Coldcard/ckcc-protocol/blob/master/51-coinkite.rules)

```console
$ torsocks curl --output /home/amnesia/Persistent/51-coinkite.rules https://raw.githubusercontent.com/Coldcard/ckcc-protocol/master/51-coinkite.rules
```

### Step 8: create coldcard.sh script

```console
$ cat << "EOF" > /home/amnesia/Persistent/coldcard.sh
#! /bin/bash

set -e

if [ "$(id -u)" -ne 0 ]; then
  echo 'Please run as root'
  exit
fi

sudo cp /home/amnesia/Persistent/51-coinkite.rules /etc/udev/rules.d/
sudo -u amnesia cp -r /home/amnesia/Persistent/.local /home/amnesia/

echo 'export PATH=$PATH:$HOME/.local/bin' >> /home/amnesia/.bashrc
EOF

$ chmod +x /home/amnesia/Persistent/coldcard.sh
```

👍

---

## Usage guide

### Step 1: boot to Tails, unlock persistent storage and set admin password (required to run coldcard.sh)

> Heads-up: if keyboard layout of computer isn’t “English (US)”, set “Keyboard Layout”.

Click “+” under “Additional Settings”, then “Administration Password”, set password, click “Add” and, finally, click “Start Tails”.

### Step 2: run coldcard.sh

```console
$ sudo /home/amnesia/Persistent/coldcard.sh
```

👍


# How to copy “Raspberry Pi OS Lite” to microSD card or external solid state drive on Linux

## Requirements

- Linux computer

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## Guide

### Step 1: extract “Raspberry Pi OS Lite” archive

```console
$ unxz 2022-04-04-raspios-bullseye-arm64-lite.img.xz
```

### Step 2: copy “Raspberry Pi OS Lite” to microSD card or external solid state drive

> **WARNING: BE VERY CAREFUL WHEN RUNNING `DD` AS DATA CAN BE PERMANENTLY DESTROYED (BEGINNERS SHOULD CONSIDER USING [BALENAETCHER](https://www.balena.io/etcher/) INSTEAD).**

> Heads-up: run `sudo fdisk --list` to find device name of microSD card or external solid state drive to overwrite with “Raspberry Pi OS Lite” (`sda` in the following example).

> Heads-up: replace `sdn` with device name of microSD card or external solid state drive (`sda` in the following example) and `2022-04-04-raspios-bullseye-arm64-lite.img` with current image.

```console
$ sudo fdisk --list
Disk /dev/nvme0n1: 931.51 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: Samsung SSD 970 EVO Plus 1TB
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: F053B657-4758-4775-98B1-27256D3B46C9

Device           Start        End    Sectors   Size Type
/dev/nvme0n1p1    2048    1050623    1048576   512M EFI System
/dev/nvme0n1p2 1050624    2050047     999424   488M Linux filesystem
/dev/nvme0n1p3 2050048 1953523711 1951473664 930.5G Linux filesystem


Disk /dev/mapper/nvme0n1p3_crypt: 930.52 GiB, 999137738752 bytes, 1951440896 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mapper/debian--vg-root: 930.52 GiB, 999133544448 bytes, 1951432704 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sda: 465.76 GiB, 500107862016 bytes, 976773168 sectors
Disk model: PSSD T7 Touch
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 33553920 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Device     Boot Start       End   Sectors   Size Id Type
/dev/sda1        2048 976773119 976771072 465.8G  7 HPFS/NTFS/exFAT

$ sudo umount /dev/sdn*
umount: /dev/sda: not mounted.
umount: /dev/sda1: not mounted.

$ sudo dd bs=1M if=2022-04-04-raspios-bullseye-arm64-lite.img of=/dev/sdn
1908+0 records in
1908+0 records out
2000683008 bytes (2.0 GB, 1.9 GiB) copied, 6.56049 s, 305 MB/s
```

👍


# How to harden Samsung T7 Touch

## Requirements

- [Samsung T7 Touch](https://semiconductor.samsung.com/consumer-storage/portable-ssd/t7-touch/)
- macOS computer

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## Guide

### Step 1 (optional): create APFS snapshot

> Heads-up: snapshot can be used to restore filesystem clean-uninstalling Samsung software (see [guide](../../../how-to-use-time-machine-and-apfs-snapshots-on-macos)).

```console
$ tmutil localsnapshot
NOTE: local snapshots are considered purgeable and may be removed at any time by deleted(8).
Created local snapshot with date: 2022-04-09-064120
```

### Step 2 (Apple Silicon computers): enable third-party system extensions

Once computer is powered off, long-press power button to boot computer to load startup options.

Click “Options”, then “Continue”, then “Utilities”, then “Startup Security Utility”, then “Security Policy…”, select “Reduced Security”, enable “Allow user management of kernel extensions from identified developers”, click “OK”, enter password, click  and, finally, click “Restart”.

### Step 3: download and install “Portable SSD Software 1.0 for Mac”

Go to https://semiconductor.samsung.com/consumer-storage/portable-ssd/t7-touch/#resources and download “Portable SSD Software 1.0 for Mac”.

Double-click “SamsungPortableSSD_Setup_Mac_1.0.zip” (if present), double-click “SamsungPortableSSD_Setup_Mac_1.0.pkg” and follow wizard.

When “System Extension Blocked” warning is thrown, click “Open Security Preferences”, click lock, enter password, click “Unlock” and, finally, click “Allow” (when asked to restart computer, click “Not Now”).

Wait for installation to complete and click “Restart”.

### Step 4: update firmware (if updates are available)

Connect Samsung T7 Touch to Mac and double-click “SamsungPortableSSD_1.0” shortcut on desktop.

Click on “UPDATE” and then “UPDATE” (again) to initiate update.

### Step 5: enable “Security Mode” and “Fingerprint Unlock”

Click “Samsung T7 Touch”, then “SETTINGS”, enable “Security Mode”, enter password and password confirmation and, finally, click “DONE”.

Enable “Fingerprint Unlock”, enter password, follow instructions and, finally, click “DONE”.

👍

## Optional cleanup guide

### Step 1: uninstall “Portable SSD Software 1.0 for Mac”

Run following using “Terminal” app, click “OK” and, finally, enter password.

```console
$ osascript ~/Library/Application\ Support/Portable_SSD/CleanupT7PlusAll.scpt
```

### Step 2 (Apple Silicon computers): disable third-party system extensions

Once computer is powered off, long-press power button to boot computer to load startup options.

Click “Options”, then “Continue”, then “Utilities”, then “Startup Security Utility”, then “Security Policy…”, disable “Allow user management of kernel extensions from identified developers”, select Full Security”, click “OK”, enter password, click  and, finally, click “Restart”.

👍


# How to connect to self-hosted hardened Bitcoin node on Tails

## Requirements

- [Hardened Bitcoin node](../..)
- [Tails USB flash drive or SD card](../../../how-to-install-tails-on-usb-flash-drive-or-sd-card) (used to run [Electrum](https://electrum.org/#home))
- Linux or macOS computer (used to copy pi-electrs credentials from Bitcoin node to Tails computer)
- FAT32-formatted USB flash drive

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- When copy/pasting commands that start with `cat << "EOF"`, select all lines at once (from `cat << "EOF"` to `EOF` inclusively) as they are part of the same (single) command

## Setup guide part 1 (on Linux or macOS computer)

### Step 1: log in to server or Raspberry Pi

> Heads-up: replace `~/.ssh/pi` with path to private key and `pi@10.0.1.181` with server or Raspberry Pi SSH destination.

```shell
ssh -i ~/.ssh/pi pi@10.0.1.181
```

### Step 2: insert FAT32-formatted USB flash drive into server or Raspberry Pi

> Heads-up: on macOS FAT32 is labelled as “MSDOS (FAT)”.

### Step 3: mount FAT32-formatted USB flash drive, copy hostname and pi-electrs.auth_private over and unmount FAT32-formatted USB flash drive

> Heads-up: run `sudo fdisk -l` to find device and replace `sdb1` with device (if needed)

```console
$ sudo fdisk -l /dev/sd*
Disk /dev/sda: 931.51 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: PSSD T7 Touch
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 33553920 bytes
Disklabel type: dos
Disk identifier: 0xcb15ae4d

Device     Boot  Start        End    Sectors   Size Id Type
/dev/sda1         8192     532479     524288   256M  c W95 FAT32 (LBA)
/dev/sda2       532480 1953523711 1952991232 931.3G 83 Linux


Disk /dev/sda1: 256 MiB, 268435456 bytes, 524288 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 33553920 bytes
Disklabel type: dos
Disk identifier: 0x00000000


Disk /dev/sda2: 931.26 GiB, 999931510784 bytes, 1952991232 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 33553920 bytes


Disk /dev/sdb: 29.88 GiB, 32080200192 bytes, 62656641 sectors
Disk model: Flash Drive
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Device     Boot Start      End  Sectors  Size Id Type
/dev/sdb1        2048 62656511 62654464 29.9G  b W95 FAT32


Disk /dev/sdb1: 29.88 GiB, 32079085568 bytes, 62654464 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

$ sudo mkdir -p /tmp/usb

$ sudo mount /dev/sdb1 /tmp/usb

$ sudo cp /var/lib/tor/electrs/{hostname,pi-electrs.auth_private} /tmp/usb

$ sudo umount /dev/sdb1
```

### Step 4: remove FAT32-formatted USB flash drive from server or Raspberry Pi

## Setup guide part 2 (on Tails computer)

### Step 1: boot to Tails

### Step 2: enable persistence (if not already enabled)

Click “Applications”, then “Favorites”, then “Configure persistent volume”, set passphrase, click “Create”, make sure “Personal Data” is enabled, click “Save” and, finally, click “Restart Now”.

### Step 3: boot to Tails, unlock persistent storage and set admin password (required to run electrum.sh)

> Heads-up: if keyboard layout of computer isn’t “English (US)”, set “Keyboard Layout”.

Click “+” under “Additional Settings”, then “Administration Password”, set password, click “Add” and, finally, click “Start Tails”.

### Step 4: create electrum.sh script

Insert FAT32-formatted USB flash drive into Tails computer, click “Places”, then “Computer”, then click FAT32-formatted USB flash drive, enter admin password (if required), double-click “hostname” and “pi-electrs.auth_private” and, finally, replace `HOSTNAME` and `PI_ELECTRS_AUTH_PRIVATE` with corresponding values.

```console
$ HOSTNAME=v6tqyvqxt4xsy7qthvld3truapqj3wopx7etayw6gni5odeezwqnouqd.onion

$ PI_ELECTRS_AUTH_PRIVATE=v6tqyvqxt4xsy7qthvld3truapqj3wopx7etayw6gni5odeezwqnouqd:descriptor:x25519:ZAELCI54J2B7MU7UW3SZBGZRB542RY6MQMMVF3PQ4TYLLG43WV2A

$ cat << EOF > /home/amnesia/Persistent/electrum.sh
#! /bin/bash

set -e

if [ "\$(id -u)" -ne 0 ]; then
  echo 'Please run as root'
  exit
fi

umask u=rwx,go=

sudo -u debian-tor mkdir -p /var/lib/tor/auth

umask u=rw,go=

echo "$PI_ELECTRS_AUTH_PRIVATE" | sudo -u debian-tor tee /var/lib/tor/auth/pi-electrs.auth_private > /dev/null
echo 'ClientOnionAuthDir /var/lib/tor/auth' | sudo -u debian-tor tee -a /etc/tor/torrc > /dev/null
systemctl restart tor
sudo -u amnesia electrum --oneserver --server $HOSTNAME:50001:t --proxy socks5:127.0.0.1:9050 > /dev/null 2>&1
EOF

$ chmod +x /home/amnesia/Persistent/electrum.sh
```

### Step 5 (optional): secure erase FAT32-formatted USB flash drive

> Heads-up: data on selected disk will be permanently destroyed… choose disk carefully.

> Heads-up: secure erasing FAT32-formatted USB flash drive can take a long time (potentially hours) depending on performance and size of drive.

Click “Application”, then “Utilities”, then “Disks”, select FAT32-formatted USB flash drive, click “-”, then “Delete”, then “+”, then “Next”, enter “Volume Name”, enable “Erase”, select “For use with all systems and devices (FAT)” and, finally, click “Create”.

👍

---

## Usage guide (on Tails computer)

### Step 1: boot to Tails, unlock persistent storage and set admin password (required to run electrum.sh)

> Heads-up: if keyboard layout of computer isn’t “English (US)”, set “Keyboard Layout”.

Click “+” under “Additional Settings”, then “Administration Password”, set password, click “Add” and, finally, click “Start Tails”.

### Step 2: run electrum.sh

```console
$ sudo /home/amnesia/Persistent/electrum.sh
```

👍


# How to connect to self-hosted hardened Bitcoin node on macOS

## Requirements

- [Hardened Bitcoin node](../..)
- Computer running macOS Big Sur or Monterey (used to copy pi-electrs credentials from Bitcoin node and run [Electrum](https://electrum.org/#home))
- FAT32-formatted USB flash drive

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## Setup guide

### Step 1: log in to server or Raspberry Pi

> Heads-up: replace `~/.ssh/pi` with path to private key and `pi@10.0.1.181` with server or Raspberry Pi SSH destination.

```shell
ssh -i ~/.ssh/pi pi@10.0.1.181
```

### Step 2: insert FAT32-formatted USB flash drive into server or Raspberry Pi

> Heads-up: on macOS FAT32 is labelled as “MSDOS (FAT)”.

### Step 3: mount FAT32-formatted USB flash drive, copy hostname and pi-electrs.auth_private over and unmount FAT32-formatted USB flash drive

> Heads-up: run `sudo fdisk -l` to find device and replace `sdb1` with device (if needed)

```console
$ sudo fdisk -l /dev/sd*
Disk /dev/sda: 931.51 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: PSSD T7 Touch
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 33553920 bytes
Disklabel type: dos
Disk identifier: 0xcb15ae4d

Device     Boot  Start        End    Sectors   Size Id Type
/dev/sda1         8192     532479     524288   256M  c W95 FAT32 (LBA)
/dev/sda2       532480 1953523711 1952991232 931.3G 83 Linux


Disk /dev/sda1: 256 MiB, 268435456 bytes, 524288 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 33553920 bytes
Disklabel type: dos
Disk identifier: 0x00000000


Disk /dev/sda2: 931.26 GiB, 999931510784 bytes, 1952991232 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 33553920 bytes


Disk /dev/sdb: 29.88 GiB, 32080200192 bytes, 62656641 sectors
Disk model: Flash Drive
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Device     Boot Start      End  Sectors  Size Id Type
/dev/sdb1        2048 62656511 62654464 29.9G  b W95 FAT32


Disk /dev/sdb1: 29.88 GiB, 32079085568 bytes, 62654464 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

$ sudo mkdir -p /tmp/usb

$ sudo mount /dev/sdb1 /tmp/usb

$ sudo cp /var/lib/tor/electrs/{hostname,pi-electrs.auth_private} /tmp/usb

$ sudo umount /dev/sdb1
```

### Step 4: remove FAT32-formatted USB flash drive from server or Raspberry Pi

### Step 5: download [Tor Browser](https://www.torproject.org/) (and optionally verify PGP signature, learn how [here](../../../how-to-verify-pgp-digital-signatures-using-gnupg-on-macos))

> Heads-up: check out “How to install and use Electrum over Tor on macOS” [guide](../../../how-to-install-and-use-electrum-over-tor-on-macos) for hardened Electrum and Tor Browser installation instructions.

### Step 6: install Tor Browser

### Step 7: set temporary environment variables

Insert FAT32-formatted USB flash drive into computer, click “Finder”, then FAT32-formatted USB flash drive, select and right-click “hostname” and “pi-electrs.auth_private”, select “Open With”, click “Other…”, select “TextEdit”, click “Open” and, finally, replace `HOSTNAME` and `PI_ELECTRS_AUTH_PRIVATE` with corresponding values.

```console
$ HOSTNAME=v6tqyvqxt4xsy7qthvld3truapqj3wopx7etayw6gni5odeezwqnouqd.onion

$ PI_ELECTRS_AUTH_PRIVATE=v6tqyvqxt4xsy7qthvld3truapqj3wopx7etayw6gni5odeezwqnouqd:descriptor:x25519:ZAELCI54J2B7MU7UW3SZBGZRB542RY6MQMMVF3PQ4TYLLG43WV2A
```

### Step 8: create folders

```console
$ umask u=rwx,go=

$ mkdir -p ~/.local/etc/tor

$ mkdir -p ~/.local/var/lib/tor/auth
```

### Step 9: create `torrc`

```console
$ umask u=rw,go=

$ echo -e "ClientOnly 1\nClientOnionAuthDir $HOME/.local/var/lib/tor/auth" > ~/.local/etc/tor/torrc
```

### Step 10: create `pi-electrs.auth_private`

```console
$ umask u=rw,go=

$ echo "$PI_ELECTRS_AUTH_PRIVATE" > ~/.local/var/lib/tor/auth/pi-electrs.auth_private
```

### Step 11: reset umask to defaults

```console
$ umask u=rwx,go=rx
```

### Step 12: create tor alias

```console
$ echo "alias tor=\"/Applications/Tor\ Browser.app/Contents/Resources/TorBrowser/Tor/tor -f $HOME/.local/etc/tor/torrc\"" >> ~/.zshrc
```

### Step 13: create electrum alias

```console
$ echo "alias electrum=\"/Applications/Electrum.app/Contents/MacOS/run_electrum --oneserver --server $HOSTNAME:50001:t --proxy socks5:127.0.0.1:9050\"" >> ~/.zshrc
```

### Step 14: source ~/.zshrc

```console
$ source ~/.zshrc
```

### Step 15 (optional): secure erase FAT32-formatted USB flash drive

> Heads-up: data on selected disk will be permanently destroyed… choose disk carefully.

> Heads-up: secure erasing FAT32-formatted USB flash drive can take a long time (potentially hours) depending on performance and size of drive.

Open “Disk Utility”, select FAT32-formatted USB flash drive, click “Erase”, click “Security Options…”, move slider to first notch (“This option writes a pass of random data…”), click “OK” and, finally, click “Erase”.

👍

---

## Usage guide

### Step 1: run tor

```console
$ tor
Apr 09 10:56:44.769 [notice] Tor 0.4.6.10 (git-22fd351cf582aa2b) running on Darwin with Libevent 2.1.12-stable, OpenSSL 1.1.1n, Zlib 1.2.11, Liblzma N/A, Libzstd N/A and Unknown N/A as libc.
Apr 09 10:56:44.769 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://support.torproject.org/faq/staying-anonymous/
Apr 09 10:56:44.769 [notice] Read configuration file "/Users/sunknudsen/.local/etc/tor/torrc".
Apr 09 10:56:44.771 [notice] Opening Socks listener on 127.0.0.1:9050
Apr 09 10:56:44.772 [notice] Opened Socks listener connection (ready) on 127.0.0.1:9050
Apr 09 10:56:44.000 [notice] Bootstrapped 0% (starting): Starting
Apr 09 10:56:45.000 [notice] Starting with guard context "default"
Apr 09 10:56:46.000 [notice] Bootstrapped 5% (conn): Connecting to a relay
Apr 09 10:56:46.000 [notice] Bootstrapped 10% (conn_done): Connected to a relay
Apr 09 10:56:46.000 [notice] Bootstrapped 14% (handshake): Handshaking with a relay
Apr 09 10:56:46.000 [notice] Bootstrapped 15% (handshake_done): Handshake with a relay done
Apr 09 10:56:46.000 [notice] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits
Apr 09 10:56:46.000 [notice] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits
Apr 09 10:56:46.000 [notice] Bootstrapped 95% (circuit_create): Establishing a Tor circuit
Apr 09 10:56:47.000 [notice] Bootstrapped 100% (done): Done
```

Bootstrapped 100% (done): Done

👍

### Step 2: run electrum

```console
$ electrum
```

👍


# How to install LUKS-encrypted Debian operating system using bootable installer

## Requirements

- Debian-compatible computer with [AES instruction set](https://en.wikipedia.org/wiki/AES_instruction_set)
- Debian bootable installer (learn how to create one on Debian-based operating system [here](../how-to-create-debian-bootable-installer-on-debian-based-operating-system) or on macOS [there](../how-to-create-debian-bootable-installer-on-macos))

## Guide

### Step 1: insert bootable installer

### Step 2: disable [Compatibility Support Module (CSM)](https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#CSM_booting) (also known as “Legacy Support”) and enable [Secure Boot](https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Secure_Boot)

> Heads-up: step is non-deterministic given manufacturers use different BIOS keys to boot to BIOS and menus to set [UEFI](https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface) features.

> Heads-up: on some computers, a “Fast Boot” feature is enabled making it hard to enter BIOS keys… disconnecting disk temporarily disables “Fast Boot”.

On HP EliteDesk 800 G2 Mini, press <kbd>F10</kbd> when HP logo appears, go to “Advanced” tab, select “Secure Boot Configuration”, press <kbd>enter</kbd>, select “Legacy Support Disable and Secure Boot Enable” under “Configure Legacy Support and Secure Boot”, press <kbd>F10</kbd>, when asked to save changes, select “Yes” and, finally, press <kbd>enter</kbd>.

### Step 3: boot to bootable installer

> Heads-up: step is non-deterministic given manufacturers use different BIOS keys and default boot orders.

On HP EliteDesk 800 G2 Mini, press <kbd>F9</kbd> when HP logo appears, select bootable installer device and, finally, press <kbd>enter</kbd>.

### Step 4: start installation

Select “Install” and press <kbd>enter</kbd>.

### Step 5: select language

Select language and press <kbd>enter</kbd>.

### Step 6: select location

Select country, territory or area and press <kbd>enter</kbd>.

### Step 7: configure keyboard

Select keymap and press <kbd>enter</kbd>.

### Step 8: configure network

#### Set hostname

Enter hostname and press <kbd>enter</kbd>.

#### Set domain

Enter domain (typically left blank) and press <kbd>enter</kbd>.

### Step 9: set up users and passwords

#### Set root password

> Heads-up: truly random 5-word passphrase or 12-character password (or longer) recommended.

Enter root password, press <kbd>enter</kbd>, re-enter password and, finally, press <kbd>enter</kbd>.

#### Set full name of new user

Enter full name of new user and press <kbd>enter</kbd>.

#### Set username of new user

Enter account username (typically left as-is) and press <kbd>enter</kbd>.

#### Set password of new user

> Heads-up: truly random 5-word passphrase or 12-character password (or longer) recommended.

Enter user password, press <kbd>enter</kbd>, re-enter password and, finally, press <kbd>enter</kbd>.

### Step 10: configure clock

Select time zone and press <kbd>enter</kbd>.

### Step 11: partition disks

#### Set partitioning method

Select “Guided - use entire disk and set up encrypted LVM” and press <kbd>enter</kbd>.

#### Set disk to partition

> Heads-up: data on selected device will be permanently destroyed.

Select device and press <kbd>enter</kbd>.

#### Set partitioning scheme

Select “All files in one partition (recommended for new users)” and press <kbd>enter</kbd>.

When asked to write changes to disk, select “Yes” and, finally, press <kbd>enter</kbd>.

#### Overwrite encrypted partition

> Heads-up: can be cancelled at the expense of slightly weaker encryption.

#### Set encryption passphrase

> Heads-up: truly random 5-word passphrase or 12-character password (or longer) recommended.

> Heads-up: can be set to user password at the expense of reduction in security.

Enter encryption passphrase, press <kbd>enter</kbd>, re-enter passphrase and, finally, press <kbd>enter</kbd>.

#### Set volume group size

Enter amount (typically left as-is) and press <kbd>enter</kbd>.

#### Delete “swap” logical volume

Select “Configure the Logical Volume Manager” and press <kbd>enter</kbd>.

When asked to write changes to disk, select “Yes” and press <kbd>enter</kbd>.

Select “Delete logical volume”, press <kbd>enter</kbd>, select “root” and, finally, press <kbd>enter</kbd>.

Select “Delete logical volume”, press <kbd>enter</kbd>, select “swap_1” and, finally, press <kbd>enter</kbd>.

Select “Create logical volume”, press <kbd>enter</kbd>, select volume group, press <kbd>enter</kbd>, enter “root” as “Logical volume name”, press <kbd>enter</kbd>, enter “Logical volume size” (typically left as-is) and, finally, press <kbd>enter</kbd>.

Select “Finish” and press <kbd>enter</kbd>.

Select “LVM” logical volume “#1”, press <kbd>enter</kbd>, select “Use as”, press <kbd>enter</kbd>, select “Ext4 journaling file system”, press <kbd>enter</kbd>, select “Mount point”, press <kbd>enter</kbd>, select “/ - the root file system”, press <kbd>enter</kbd>, select “Done setting up the partition” and, finally, press <kbd>enter</kbd>.

![Partitions](./partitions.png)

Select “Finish partitioning and write changes to disk” and press <kbd>enter</kbd>.

When “Do you want to return to the partitioning menu?” warning is displayed, select “No” and, finally, press <kbd>enter</kbd>.

When “Write the changes to disks” prompt is displayed, select “Yes” and, finally, press <kbd>enter</kbd>.

### Step 12: configure package manager

#### Set archive mirror country

Select Debian archive mirror country and press <kbd>enter</kbd>.

#### Set archive mirror

Select Debian archive mirror and press <kbd>enter</kbd>.

#### Set proxy

Enter HTTP proxy (typically left blank) and press <kbd>enter</kbd>.

### Step 13: configure popularity-contest

Select “No” and press <kbd>enter</kbd>.

### Step 14: select software

![Software selection](./software-selection.png)

Using <kbd>space bar</kbd>, disable everything except “SSH server”, select “SSH server” and, finally, press <kbd>enter</kbd>.

### Step 15: finish installation

Remove bootable installer from computer and press <kbd>enter</kbd>.

👍


# How to create Debian bootable installer on macOS

## Requirements

- macOS computer
- USB flash drive (data will be permanently destroyed)

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## Guide

### Step 1: install [Homebrew](https://brew.sh/)

```console
$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

$ uname -m | grep arm64 && echo 'export PATH=$PATH:/opt/homebrew/bin' >> ~/.zshrc && source ~/.zshrc
```

### Step 2: disable Homebrew analytics

```shell
brew analytics off
```

### Step 3: install dependencies

```shell
brew install gnupg
```

### Step 4: import “Debian CD signing key” PGP public key

```console
$ gpg --keyserver keyring.debian.org --recv-keys 0xDA87E80D6294BE9B
gpg: Total number processed: 1
gpg:               imported: 1
```

### Step 5: set [Debian](https://www.debian.org/) release semver environment variable

> Heads-up: replace `11.2.0` with [latest release](https://www.debian.org/download) semver.

```shell
DEBIAN_RELEASE_SEMVER=11.2.0
```

### Step 6: download latest version of [Debian](https://www.debian.org/), checksum and associated PGP signature

```console
$ cd /tmp

$ curl --fail --location --remote-name https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-${DEBIAN_RELEASE_SEMVER}-amd64-netinst.iso
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   359  100   359    0     0    464      0 --:--:-- --:--:-- --:--:--   464
100  378M  100  378M    0     0  20.6M      0  0:00:18  0:00:18 --:--:-- 23.6M

$ curl --fail --location --remote-name https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/SHA512SUMS
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   494  100   494    0     0    918      0 --:--:-- --:--:-- --:--:--   918

$ curl --fail --location --remote-name https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/SHA512SUMS.sign
```

### Step 7: verify integrity of `SHA512SUMS`

```console
$ gpg --verify SHA512SUMS.sign
gpg: assuming signed data in 'SHA512SUMS'
gpg: Signature made Sat 18 Dec 2021 03:45:36 PM EST
gpg:                using RSA key DF9B9C49EAA9298432589D76DA87E80D6294BE9B
gpg: Good signature from "Debian CD signing key <debian-cd@lists.debian.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: DF9B 9C49 EAA9 2984 3258  9D76 DA87 E80D 6294 BE9B

$ shasum --algorithm 512 --check --ignore-missing SHA512SUMS
debian-11.2.0-amd64-netinst.iso: OK
```

Good signature

👍

OK

👍

### Step 8: create bootable installer

> **WARNING: BE VERY CAREFUL WHEN RUNNING `DD` AS DATA CAN BE PERMANENTLY DESTROYED (BEGINNERS SHOULD CONSIDER USING [BALENAETCHER](https://www.balena.io/etcher/) INSTEAD).**

> Heads-up: run `diskutil list` to find disk ID of USB flash drive to overwrite with bootable installer (`disk4` in the following example).

> Heads-up: replace `diskn` and `rdiskn` with disk ID of microSD card (`disk4` and `rdisk4` in the following example) and `debian-11.2.0-amd64-netinst.iso` with current image.

> Heads-up: please ignore “The disk you attached was not readable by this computer.” error and click “Eject”.

```console
$ diskutil list
/dev/disk0 (internal):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                         500.3 GB   disk0
   1:             Apple_APFS_ISC                         524.3 MB   disk0s1
   2:                 Apple_APFS Container disk3         494.4 GB   disk0s2
   3:        Apple_APFS_Recovery                         5.4 GB     disk0s3

/dev/disk3 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +494.4 GB   disk3
                                 Physical Store disk0s2
   1:                APFS Volume Macintosh HD            15.3 GB    disk3s1
   2:              APFS Snapshot com.apple.os.update-... 15.3 GB    disk3s1s1
   3:                APFS Volume Preboot                 412.3 MB   disk3s2
   4:                APFS Volume Recovery                807.3 MB   disk3s3
   5:                APFS Volume Data                    322.3 GB   disk3s5
   6:                APFS Volume VM                      2.1 GB     disk3s6

/dev/disk4 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     Apple_partition_scheme                        *32.1 GB    disk4
   1:        Apple_partition_map                         4.1 KB     disk4s1
   2:                  Apple_HFS                         2.7 MB     disk4s2

$ sudo diskutil unmount /dev/diskn
disk4 was already unmounted or it has a partitioning scheme so use "diskutil unmountDisk" instead

$ sudo diskutil unmountDisk /dev/diskn (if previous step fails)
Unmount of all volumes on disk4 was successful

$ sudo dd bs=1m if=debian-${DEBIAN_RELEASE_SEMVER}-amd64-netinst.iso of=/dev/rdisk4
378+0 records in
378+0 records out
396361728 bytes transferred in 15.700749 secs (25244766 bytes/sec)
```

👍


# How to create Debian bootable installer on Debian-based operating system

## Requirements

- Computer running Debian-based operating system
- USB flash drive (data will be permanently destroyed)

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## Guide

### Step 1: install dependencies

```
$ sudo apt update

$ sudo apt install curl gnupg
```

### Step 2: import “Debian CD signing key” PGP public key

```console
$ gpg --keyserver keyring.debian.org --recv-keys 0xDA87E80D6294BE9B
gpg: key DA87E80D6294BE9B: public key "Debian CD signing key <debian-cd@lists.debian.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
```

### Step 3: set [Debian](https://www.debian.org/) release semver environment variable

> Heads-up: replace `11.2.0` with [latest release](https://www.debian.org/download) semver.

```shell
DEBIAN_RELEASE_SEMVER=11.2.0
```

### Step 4: download latest version of [Debian](https://www.debian.org/), checksum and associated PGP signature

> Heads-up: replace `amd64` with architecture of computer on which Debian will be installed (run `dpkg --print-architecture` on Linux to get architecture).

```console
$ cd /tmp

$ curl --fail --location --remote-name https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-${DEBIAN_RELEASE_SEMVER}-amd64-netinst.iso
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   359  100   359    0     0    518      0 --:--:-- --:--:-- --:--:--   517
100  378M  100  378M    0     0  21.3M      0  0:00:17  0:00:17 --:--:-- 24.3M

$ curl --fail --location --remote-name https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/SHA512SUMS
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   494  100   494    0     0    713      0 --:--:-- --:--:-- --:--:--   712

$ curl --fail --location --remote-name https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/SHA512SUMS.sign
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   833  100   833    0     0   1032      0 --:--:-- --:--:-- --:--:--  1032
```

### Step 5: verify integrity of `SHA512SUMS`

```console
$ gpg --verify SHA512SUMS.sign
gpg: assuming signed data in 'SHA512SUMS'
gpg: Signature made Sat 18 Dec 2021 03:45:36 PM EST
gpg:                using RSA key DF9B9C49EAA9298432589D76DA87E80D6294BE9B
gpg: Good signature from "Debian CD signing key <debian-cd@lists.debian.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: DF9B 9C49 EAA9 2984 3258  9D76 DA87 E80D 6294 BE9B

$ sha512sum --check --ignore-missing SHA512SUMS
debian-11.2.0-amd64-netinst.iso: OK
```

Good signature

👍

OK

👍

### Step 5: create bootable installer

> **WARNING: BE VERY CAREFUL WHEN RUNNING `DD` AS DATA CAN BE PERMANENTLY DESTROYED (BEGINNERS SHOULD CONSIDER USING [BALENAETCHER](https://www.balena.io/etcher/) INSTEAD).**

> Heads-up: run `sudo fdisk --list` to find device name of USB flash drive to overwrite with bootable installer (`sda` in the following example).

> Heads-up: replace `sdn` with device name of USB flash drive (`sda` in the following example).

```console
$ sudo fdisk --list
Disk /dev/nvme0n1: 931.51 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: Samsung SSD 970 EVO Plus 1TB
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: F053B657-4758-4775-98B1-27256D3B46C9

Device           Start        End    Sectors   Size Type
/dev/nvme0n1p1    2048    1050623    1048576   512M EFI System
/dev/nvme0n1p2 1050624    2050047     999424   488M Linux filesystem
/dev/nvme0n1p3 2050048 1953523711 1951473664 930.5G Linux filesystem


Disk /dev/mapper/nvme0n1p3_crypt: 930.52 GiB, 999137738752 bytes, 1951440896 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mapper/debian--vg-root: 930.52 GiB, 999133544448 bytes, 1951432704 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sda: 29.88 GiB, 32080200192 bytes, 62656641 sectors
Disk model: Flash Drive
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x2a6b8479

Device     Boot Start    End Sectors  Size Id Type
/dev/sda1  *        0 774143  774144  378M  0 Empty
/dev/sda2        4060   9243    5184  2.5M ef EFI (FAT-12/16/32)

$ sudo umount /dev/sdn*
umount: /dev/sda: not mounted.
umount: /dev/sda1: not mounted.
umount: /dev/sda2: not mounted.

$ sudo dd bs=1M if=debian-${DEBIAN_RELEASE_SEMVER}-amd64-netinst.iso of=/dev/sdn
378+0 records in
378+0 records out
396361728 bytes (396 MB, 378 MiB) copied, 18.4317 s, 21.5 MB/s
```

👍


# How to benchmark computer for Bitcoin computation

## Requirements

- Linux computer running Debian-based operating system

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## Guide

### Step 1: install dependencies

```console
$ sudo apt update

$ sudo apt install -y bc curl openssl sysbench
```

### Step 2: download (and optionally verify) [benchmark.sh](./benchmark.sh) ([PGP signature](./benchmark.sh.asc), [PGP public key](https://sunknudsen.com/sunknudsen.asc))

```shell
curl --fail --output $HOME/benchmark.sh https://sunknudsen.com/privacy-guides/how-to-self-host-hardened-bitcoin-node/misc/how-to-benchmark-computer-for-bitcoin-computation/benchmark.sh
chmod +x $HOME/benchmark.sh
```

### Step 3: run benchmark.sh

> Heads-up: benchmark should take between 5 and 10 minutes, but can take longer on slower hardware.

```console
$ $HOME/benchmark.sh
Initiating…
Do you confirm model of disk on which “/home/sun/test-7d82aa” is stored is “Samsung SSD 970 EVO Plus 1TB” (y or n)?
y
Benchmarking SHA256 computing…
Benchmarking CPU…
Benchmarking memory…
Preparing sysbench fileio dataset…
Benchmarking disk using 16K block size…
Benchmarking disk using 1M block size…

Result:

openssl value in thousands of bytes processed per second
sysbench_cpu value in events per second
sysbench_memory, sysbench_disk_prepare and sysbench_disk_rndrw values in MiB per second
score value in times faster than Raspberry Pi 4 4GB with Samsung T7 Touch SSD 1TB

{
  "disk_model": "Samsung SSD 970 EVO Plus 1TB",
  "disk_transport": "nvme",
  "cpu_model": "Intel(R) Core(TM) i5-6500T CPU @ 2.50GHz",
  "openssl": "1450665.57",
  "sysbench_cpu": "3810.87",
  "sysbench_memory": "8488.63",
  "sysbench_disk_prepare": "892.94",
  "sysbench_disk_rndrw": {
    "16k_read": "15.90",
    "16k_write": "10.60",
    "1m_read": "669.23",
    "1m_write": "445.99"
  },
  "score": "10.05"
}

Done
```

### Step 4 (optional): publish JSON code block to GitHub discussion

Go to https://github.com/sunknudsen/privacy-guides/discussions/220 and publish JSON code block as comment.

```json
{
  "disk_model": "Samsung SSD 970 EVO Plus 1TB",
  "disk_transport": "nvme",
  "cpu_model": "Intel(R) Core(TM) i5-6500T CPU @ 2.50GHz",
  "openssl": "1450665.57",
  "sysbench_cpu": "3810.87",
  "sysbench_memory": "8488.63",
  "sysbench_disk_prepare": "892.94",
  "sysbench_disk_rndrw": {
    "16k_read": "15.90",
    "16k_write": "10.60",
    "1m_read": "669.23",
    "1m_write": "445.99"
  },
  "score": "10.05"
}
```

👍


# How to install and use Trezor Suite on Tails

## Requirements

- [Tails USB flash drive or SD card](../how-to-install-tails-on-usb-flash-drive-or-sd-card)

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## Setup guide

### Step 1: boot to Tails and set admin password (required to [create optional exFAT partition](#step-2-optional-create-exfat-partition-on-tails-usb-flash-drive-or-sd-card))

> Heads-up: if keyboard layout of computer isn’t “English (US)”, set “Keyboard Layout”.

Click “+” under “Additional Settings”, then “Administration Password”, set password, click “Add” and, finally, click “Start Tails”.

### Step 2 (optional): create exFAT partition on Tails USB flash drive or SD card

> Heads-up: partition used to move files between Tails and other operating systems such as macOS.

Click “Applications”, then “Utilities”, then “Disks”, select USB flash drive or SD card, click “Free Space”, then “+”, set “Partition Size”, click “Next”, set “Volume Name”, select “Other”, click “Next”, select “exFAT” and, finally, click “Create”.

### Step 3: enable persistence

Click “Applications”, then “Favorites”, then “Configure persistent volume”, set passphrase, click “Create”, make sure “Personal Data” is enabled, click “Save” and, finally, click “Restart Now”.

### Step 4: boot to Tails, unlock persistent storage and set admin password (required to [configure firewall](#step-1-configure-firewall))

> Heads-up: if keyboard layout of computer isn’t “English (US)”, set “Keyboard Layout”.

Click “+” under “Additional Settings”, then “Administration Password”, set password, click “Add” and, finally, click “Start Tails”.

### Step 5: establish network connection using ethernet cable or Wi-Fi and wait for Tor to be ready

Connected to Tor successfully

👍

### Step 6: import “SatoshiLabs 2021 Signing Key” PGP public key

> Heads-up: if [step 10](#step-10-verify-trezor-suite-release-learn-how-here) fails, replace `2021` by current year.

```console
$ torsocks curl https://trezor.io/security/satoshilabs-2021-signing-key.asc | gpg --import
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2407  100  2407    0     0   2060      0  0:00:01  0:00:01 --:--:--  2060
gpg: key 0xE21B6950A2ECB65C: 1 signature not checked due to a missing key
gpg: key 0xE21B6950A2ECB65C: public key "SatoshiLabs 2021 Signing Key" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: no ultimately trusted keys found
```

imported: 1

👍

### Step 7: set [Trezor Suite](https://suite.trezor.io/) release semver environment variable

> Heads-up: replace `21.12.2` with [latest release](https://suite.trezor.io/) semver.

```shell
TREZOR_SUITE_RELEASE_SEMVER=21.12.2
```

### Step 8: download “Trezor Suite” release

```console
$ torsocks curl --fail --output ~/Downloads/trezor-suite.AppImage https://suite.trezor.io/web/static/desktop/Trezor-Suite-${TREZOR_SUITE_RELEASE_SEMVER}-linux-x86_64.AppImage
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  176M  100  176M    0     0  1565k      0  0:01:55  0:01:55 --:--:-- 1598k
```

### Step 9: download “Trezor Suite” release PGP signature

```console
$ torsocks curl --fail --output ~/Downloads/trezor-suite.AppImage.asc https://suite.trezor.io/web/static/desktop/Trezor-Suite-${TREZOR_SUITE_RELEASE_SEMVER}-linux-x86_64.AppImage.asc
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   833  100   833    0     0    933      0 --:--:-- --:--:-- --:--:--   932
```

### Step 10: verify “Trezor Suite” release (learn how [here](../how-to-verify-pgp-digital-signatures-using-gnupg-on-macos))

```console
$ gpg --verify ~/Downloads/trezor-suite.AppImage.asc
gpg: assuming signed data in '/home/amnesia/Downloads/trezor-suite.AppImage'
gpg: Signature made Wed 08 Dec 2021 05:45:00 PM UTC
gpg:                using RSA key EB483B26B078A4AA1B6F425EE21B6950A2ECB65C
gpg: Good signature from "SatoshiLabs 2021 Signing Key" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: EB48 3B26 B078 A4AA 1B6F  425E E21B 6950 A2EC B65C
```

Good signature

👍

### Step 11: make trezor-suite.AppImage persistent

```shell
cp ~/Downloads/trezor-suite.AppImage ~/Persistent/trezor-suite.AppImage
chmod +x ~/Persistent/trezor-suite.AppImage
```

👍

---

## Usage guide

> Heads-up: following steps are not persistent.

### Step 1: configure firewall

```console
$ sudo iptables -I OUTPUT 3 -o lo -s 127.0.0.1/32 -d 127.0.0.1/32 -p tcp --dport 21325 --syn -m owner --uid-owner amnesia -m conntrack --ctstate NEW -j ACCEPT
[sudo] password for amnesia:
```

### Step 2: open “Trezor Suite” and insert device

Click “Places”, then “Persistent” and double-click “trezor-suite.AppImage”.

### Step 3: enable Tor

Click gear icon, then “Application” and enable “Tor” and “Open trezor.io links as .onion links”.

### Step 4: enable other coins (Bitcoin enabled by default)

Click gear icon, then “Crypto” and enable coins.

👍


# How to audit source code of proprietary Electron app

[![How to audit source code of proprietary Electron app](how-to-audit-source-code-of-proprietary-electron-app.jpg)](https://www.youtube.com/watch?v=s4S7qgCkVCc "How to audit source code of proprietary Electron app")

## Requirements

- Computer running macOS Big Sur or Monterey or disposable [Tails USB flash drive or SD card](../how-to-install-tails-on-usb-flash-drive-or-sd-card)

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## macOS guide

### Step 1: install [Homebrew](https://brew.sh/)

```console
$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

$ uname -m | grep arm64 && echo 'export PATH=$PATH:/opt/homebrew/bin' >> ~/.zshrc && source ~/.zshrc
```

### Step 2: disable Homebrew analytics

```shell
brew analytics off
```

### Step 3: install dependencies

```shell
brew install node tree
```

### Step 4: extract source code

> Heads-up: replace `QR\ Bridge.app` with Electron app one wishes to audit.

```console
$ npx asar extract /Applications/QR\ Bridge.app/Contents/Resources/app.asar ~/Desktop/source
npx: installed 17 in 6.041s
```

### Step 5 (optional): list files

```console
$ tree ~/Desktop/source -I node_modules
/Users/sunknudsen/Desktop/source
├── LICENSE
├── README.md
├── app
│   ├── confirmation.wav
│   ├── index.html
│   ├── preload.js
│   ├── renderer.js
│   └── style.css
├── icon.ai
├── main.js
├── package.json
└── qr-bridge.code-workspace

1 directory, 11 files
```

### Step 6: audit app

> Heads-up: `code` is a command line utility that opens file or folder in [Visual Studio Code](https://code.visualstudio.com/).

> Heads-up: **please respect license**… being able to audit app does not mean app (including its source code) should be considered public domain.

```shell
code ~/Desktop/source
```

### Step 7: check if app calls home

Use application-layer firewall such as [Little Snitch](https://www.obdev.at/products/littlesnitch/index.html) or [Lulu](https://objective-see.com/products/lulu.html).

👍

## Tails guide

### Step 1: boot to Tails and set admin password (required to run commands using `sudo`)

> Heads-up: if keyboard layout of computer isn’t “English (US)”, set “Keyboard Layout”.

Click “+” under “Additional Settings”, then “Administration Password”, set password, click “Add” and, finally, click “Start Tails”.

### Step 2: import [Node.js](https://nodejs.org/en/)’s PGP public key

```shell
torsocks curl -fsSL https://deb.nodesource.com/gpgkey/nodesource.gpg.key | gpg --dearmor | sudo tee /usr/share/keyrings/nodesource.gpg > /dev/null
```

### Step 3: enable Node.js’s repository

> Heads-up: run `cat /etc/debian_version` to find Debian version.

#### Debian 10 (buster)

```console
$ echo -e "deb [signed-by=/usr/share/keyrings/nodesource.gpg] tor+https://deb.nodesource.com/node_16.x buster main\ndeb-src [signed-by=/usr/share/keyrings/nodesource.gpg] tor+https://deb.nodesource.com/node_16.x buster main" | sudo tee /etc/apt/sources.list.d/nodesource.list > /dev/null

$ sudo apt update
```

#### Debian 11 (bullseye)

```console
$ echo -e "deb [signed-by=/usr/share/keyrings/nodesource.gpg] tor+https://deb.nodesource.com/node_16.x bullseye main\ndeb-src [signed-by=/usr/share/keyrings/nodesource.gpg] tor+https://deb.nodesource.com/node_16.x bullseye main" | sudo tee /etc/apt/sources.list.d/nodesource.list > /dev/null

$ sudo apt update
```

### Step 4: find Node.js version

```console
$ sudo apt-cache madison nodejs
    nodejs | 16.13.1-deb-1nodesource1 | tor+https://deb.nodesource.com/node_16.x buster/main amd64 Packages
    nodejs | 12.22.7~dfsg-2 | tor+https://cdn-fastly.deb.debian.org/debian sid/main amd64 Packages
    nodejs | 12.22.5~dfsg-2~11u1 | tor+https://cdn-fastly.deb.debian.org/debian bullseye/main amd64 Packages
    nodejs | 10.24.0~dfsg-1~deb10u1 | tor+https://cdn-fastly.deb.debian.org/debian buster/main amd64 Packages
    nodejs | 10.24.0~dfsg-1~deb10u1 | tor+https://cdn-fastly.deb.debian.org/debian-security buster/updates/main amd64 Packages
```

### Step 5: install dependencies

> Heads-up: replace `nodejs=16.13.1-deb-1nodesource1` with version found at [step 4](#step-4-find-nodejs-version).

```shell
sudo apt install -y nodejs=16.13.1-deb-1nodesource1 tree
```

### Step 6: extract “resources” directory from AppImage

> Heads-up: replace `qr-bridge.AppImage` with Electron app one wishes to audit.

```console
$ ./qr-bridge.AppImage --appimage-extract resources
squashfs-root/resources
squashfs-root/resources/app-update.yml
squashfs-root/resources/app.asar
```

### Step 7: extract source code

> Heads-up: ignore torsocks warnings (if present).

```console
$ torsocks npx asar extract squashfs-root/resources/app.asar ~/Desktop/source
Need to install the following packages:
  asar
Ok to proceed? (y) y
```

### Step 8 (optional): list files

```console
$ tree ~/Desktop/source -I node_modules
/home/amnesia/Desktop/source
├── app
│   ├── confirmation.wav
│   ├── index.html
│   ├── preload.js
│   ├── renderer.js
│   └── style.css
├── icon.ai
├── LICENSE
├── main.js
├── package.json
├── qr-bridge.code-workspace
└── README.md

1 directory, 11 files
```

### Step 9: audit app

> Heads-up: **please respect license**… being able to audit app does not mean app (including its source code) should be considered public domain.

Audit source code using “Text Editor”.

👍


# How to self-host hardened Jitsi server

## Requirements

- [Hardened Debian server](../how-to-configure-hardened-debian-server)
- Linux or macOS computer

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- When copy/pasting commands that start with `cat << "EOF"`, select all lines at once (from `cat << "EOF"` to `EOF` inclusively) as they are part of the same (single) command

## Setup guide

### Step 1: create DNS record

Create “A” record (example: meet.sunknudsen.com) that points to IP of server.

### Step 2: log in to server

> Heads-up: replace `~/.ssh/server` with path to private key and `server-admin@185.193.126.203` with server SSH destination.

```shell
ssh -i ~/.ssh/server server-admin@185.193.126.203
```

### Step 3: switch to root

When asked, enter root password.

```shell
su -
```

### Step 4: set hostname environment variable

> Heads-up: replace `meet.sunknudsen.com` with hostname from [step 1](#step-1-create-dns-record).

```shell
JITSI_HOSTNAME=meet.sunknudsen.com
```

### Step 5: install dependencies

```console
$ apt update

$ apt install -y apt-transport-https curl gnupg lsb-release nginx-full
```

### Step 6: import [Jitsi](https://jitsi.org/)’s PGP public key

```shell
curl -fsSL https://download.jitsi.org/jitsi-key.gpg.key | gpg --dearmor > /usr/share/keyrings/jitsi.gpg
```

### Step 7: enable Jitsi’s repository

```shell
echo -e "deb [signed-by=/usr/share/keyrings/jitsi.gpg] https://download.jitsi.org stable/" > /etc/apt/sources.list.d/jitsi.list
apt update
```

### Step 8: install Jitsi

> Heads-up: when asked to enter hostname, enter hostname from [step 1](#step-1-create-dns-record).

> Heads-up: when asked which SSL certificate to use, select “Generate a new self-signed certificate”.

```shell
apt install -y jitsi-meet
```

### Step 9: configure firewall

```shell
iptables -A INPUT -p tcp --dport 80 --syn -m connlimit --connlimit-above 50 -j DROP
iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 --syn -m connlimit --connlimit-above 50 -j DROP
iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
iptables -A INPUT -p tcp --dport 5349 -m state --state NEW -j ACCEPT
iptables -A INPUT -p udp --dport 10000 -m state --state NEW -j ACCEPT
iptables-save > /etc/iptables/rules.v4
```

If network is dual stack (IPv4 + IPv6) run:

```shell
ip6tables -A INPUT -p tcp --dport 80 --syn -m connlimit --connlimit-above 50 -j DROP
ip6tables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 443 --syn -m connlimit --connlimit-above 50 -j DROP
ip6tables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 5349 -m state --state NEW -j ACCEPT
ip6tables -A INPUT -p udp --dport 10000 -m state --state NEW -j ACCEPT
ip6tables-save > /etc/iptables/rules.v6
```

### Step 10: generate [Let’s Encrypt](https://letsencrypt.org/) SSL certificate

```shell
/usr/share/jitsi-meet/scripts/install-letsencrypt-cert.sh
```

Congratulations!

👍

### Step 11 (optional): enable host authentication

#### Configure Prosody

```console
$ cp /etc/prosody/conf.avail/$JITSI_HOSTNAME.cfg.lua /etc/prosody/conf.avail/$JITSI_HOSTNAME.cfg.lua.backup

$ sed -i -E 's/authentication = "anonymous"/authentication = "internal_plain"/' /etc/prosody/conf.avail/$JITSI_HOSTNAME.cfg.lua

$ cat << EOF >> /etc/prosody/conf.avail/$JITSI_HOSTNAME.cfg.lua

VirtualHost "guest.$JITSI_HOSTNAME"
    authentication = "anonymous"
    c2s_require_encryption = false
EOF
```

#### Configure Jicofo

```shell
echo "org.jitsi.jicofo.auth.URL=XMPP:$JITSI_HOSTNAME" > /etc/jitsi/jicofo/sip-communicator.properties
```

#### Configure Jitsi

```console
$ cp /etc/jitsi/meet/$JITSI_HOSTNAME-config.js /etc/jitsi/meet/$JITSI_HOSTNAME-config.js.backup

$ sed -i -E "s/\/\/ anonymousdomain: 'guest.example.com'/anonymousdomain: 'guest.$JITSI_HOSTNAME'/" /etc/jitsi/meet/$JITSI_HOSTNAME-config.js
```

#### Create host credentials

> Heads-up: replace `sun` with desired username.

```shell
prosodyctl register sun $JITSI_HOSTNAME
```

#### Restart Jitsi components

```console
$ systemctl restart prosody

$ systemctl restart jicofo

$ systemctl restart jitsi-videobridge2
```

👍

---

## Usage guide

### Install [Jitsi Meet Electron](https://github.com/jitsi/jitsi-meet-electron)

> Heads-up: although guests can join calls from browser (Chromium-based browser recommended), using Jitsi Meet Electron tends to be more reliable.

Download and install [latest](https://github.com/jitsi/jitsi-meet-electron/releases/latest) release of Jitsi Meet Electron.

👍

### Configure Jitsi Meet Electron to use self-hosted server instead of [meet.jit.si](https://meet.jit.si)

Click gear icon, expand “Advanced Settings” and set “Server URL” to “https://” followed by hostname from [step 1](#step-1-create-dns-record).

👍


# How to manage Trezor devices using trezorctl on macOS or Tails

[![How to manage Trezor devices using trezorctl on macOS or Tails](how-to-manage-trezor-devices-using-trezorctl-on-macos-or-tails.jpg)](https://www.youtube.com/watch?v=0yWBYL9_uq4 "How to manage Trezor devices using trezorctl on macOS or Tails")

## Requirements

- Computer running macOS Big Sur or Monterey or [Tails USB flash drive or SD card](../how-to-install-tails-on-usb-flash-drive-or-sd-card)
- [Trezor](https://trezor.io/) device

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## Setup guide (macOS-only)

> Heads-up: [trezorctl](https://wiki.trezor.io/Using_trezorctl_commands_with_Trezor) is pre-installed on [Tails](https://tails.boum.org/) so setup guide can be [skipped](#usage-guide).

### Step 1: install [Homebrew](https://brew.sh/)

```console
$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

$ uname -m | grep arm64 && echo 'export PATH=$PATH:/opt/homebrew/bin' >> ~/.zshrc && source ~/.zshrc
```

### Step 2: disable Homebrew analytics

```shell
brew analytics off
```

### Step 3: install [libusb](https://libusb.info/)

```shell
brew install libusb
```

### Step 4: install [attrs](https://www.attrs.org/en/stable/) and [trezorctl](https://wiki.trezor.io/Using_trezorctl_commands_with_Trezor)

```shell
pip3 install --user attrs trezor
```

### Step 5: source Python 3 `bin` directory

> Heads-up: replace `3.8` with semver of latest version of Python 3 found using `ls $HOME/Library/Python`.

```shell
echo 'export PATH=$PATH:$HOME/Library/Python/3.8/bin' >> ~/.zshrc
source ~/.zshrc
```

👍

---

## Usage guide

> Heads-up: on Tails, one needs to add `torsocks` before `trezorctl` commands (example: `torsocks trezorctl firmware-update`).

### Install or update firmware

> Heads-up: connect device in [bootloader mode](https://wiki.trezor.io/User_manual:Updating_the_Trezor_device_firmware__T1) before running command.

> Heads-up: Trezor devices [ship without firmware](https://wiki.trezor.io/Firmware) so one needs to install firmware before [setting up device](#setup-device).

```console
$ trezorctl firmware-update
Best available version: 1.10.1
Downloading from https://wallet.trezor.io/data/firmware/1/trezor-1.10.1.bin
Trezor One firmware with embedded v2 image (1.8.0 or later)
Firmware version 1.10.1 build 0
Signatures are valid.
Firmware fingerprint: 36400becf1cdddec22b8150d56ff59eef76d37fef60dc465a6f82b4858903886
Embedded v2 image fingerprint: 58738454f7640ddf9fdf462c347bc489a3c6adaacd22225833edbe7fc49704df
Extracting embedded firmware image.
```

### Setup device

> Heads-up: replace `--strength 256` with `--strength 128` for 12-word mnemonic.

```console
$ trezorctl device setup --strength 256 --passphrase-protection --pin-protection --label "My Trezor One" --backup-type single
Please confirm action on your Trezor device.
Use the numeric keypad to describe number positions. The layout is:
    7 8 9
    4 5 6
    1 2 3
Please enter new PIN:
Please enter new PIN again:
Device successfully initialized
```

### Change PIN

```console
$ trezorctl change-pin
Please confirm action on your Trezor device.
Use the numeric keypad to describe number positions. The layout is:
    7 8 9
    4 5 6
    1 2 3
Please enter current PIN:
Please enter new PIN:
Please enter new PIN again:
PIN changed
```

### Set label

```console
$ trezorctl set-label "My Trezor One"
Please confirm action on your Trezor device.
Settings applied
```

### Factory reset device

> Heads-up: connect device in [bootloader mode](https://wiki.trezor.io/User_manual:Updating_the_Trezor_device_firmware__T1) before running command.

```console
$ trezorctl wipe-device --bootloader
Wiping user data and firmware!
Error: trezord: read/48 failed with code 400: device disconnected during action
```


# How to install and use Electrum over Tor on macOS

[![How to install and use Electrum over Tor on macOS](how-to-install-and-use-electrum-over-tor-on-macos.jpg)](https://www.youtube.com/watch?v=QQsAu-9brYY "How to install and use Electrum over Tor on macOS")

## Requirements

- Computer running macOS Big Sur or Monterey

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- Press <kbd>ctrl+c</kbd> to stop running command before closing “Terminal” app

## Setup guide

### Step 1: install [Homebrew](https://brew.sh/)

```console
$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

$ uname -m | grep arm64 && echo 'export PATH=$PATH:/opt/homebrew/bin' >> ~/.zshrc && source ~/.zshrc
```

### Step 2: disable Homebrew analytics

```shell
brew analytics off
```

### Step 3: install [GnuPG](https://gnupg.org/)

```shell
brew install gnupg
```

### Step 4: install [Electrum](https://electrum.org/#home)

#### Import ThomasV’s PGP public key

```console
$ curl https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/ThomasV.asc | gpg --import
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  4739  100  4739    0     0  29073      0 --:--:-- --:--:-- --:--:-- 29073
gpg: key 0x2BD5824B7F9470E6: public key "Thomas Voegtlin (https://electrum.org) <thomasv@electrum.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
```

imported: 1

👍

#### Download Electrum release

Go to https://electrum.org/#download and download latest release and associated PGP signature to `~/Downloads` folder.

#### Verify Electrum release (learn how [here](../how-to-verify-pgp-digital-signatures-using-gnupg-on-macos))

> Heads-up: replace `4.2.1` with [latest release](https://electrum.org/#download) semver.

```console
$ gpg --verify ~/Downloads/electrum-4.2.1.dmg.asc
gpg: assuming signed data in '/Users/sunknudsen/Downloads/electrum-4.2.1.dmg'
gpg: Signature made Sun 27 Mar 12:31:59 2022 EDT
gpg:                using RSA key 637DB1E23370F84AFF88CCE03152347D07DA627C
gpg: Can't check signature: No public key
gpg: Signature made Sun 27 Mar 09:55:54 2022 EDT
gpg:                using RSA key 0EEDCFD5CAFB459067349B23CA9EEEC43DF911DC
gpg: Can't check signature: No public key
gpg: Signature made Sun 27 Mar 01:57:04 2022 EDT
gpg:                using RSA key 6694D8DE7BE8EE5631BED9502BD5824B7F9470E6
gpg: Good signature from "Thomas Voegtlin (https://electrum.org) <thomasv@electrum.org>" [unknown]
gpg:                 aka "ThomasV <thomasv1@gmx.de>" [unknown]
gpg:                 aka "Thomas Voegtlin <thomasv1@gmx.de>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 6694 D8DE 7BE8 EE56 31BE  D950 2BD5 824B 7F94 70E6
```

Good signature

👍

#### Install Electrum

Double-click “electrum-4.2.1.dmg” and drag-and-drop “Electrum” into “Applications” folder.

### Step 5: install [Tor Browser](https://www.torproject.org/) (used to connect to Electrum public servers over Tor)

> Heads-up: using public servers can [compromised privacy of wallet](https://sunknudsen.com/self-hosting-bitcoin-full-node-on-raspberry-pi-updated/) (learn how to self-host Bitcoin node [here](../how-to-self-host-hardened-bitcoin-node)).

#### Import “Tor Browser Developers (signing key)” PGP public key

```console
$ gpg --keyserver hkps://keys.openpgp.org --recv-keys 0x4E2C6E8793298290
gpg: key 0x4E2C6E8793298290: public key "Tor Browser Developers (signing key) <torbrowser@torproject.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
```

imported: 1

👍

#### Download “Tor Browser” release

Go to https://www.torproject.org/download/ and download latest release and associated PGP signature to `~/Downloads` folder.

#### Verify “Tor Browser” release (learn how [here](../how-to-verify-pgp-digital-signatures-using-gnupg-on-macos))

> Heads-up: replace `11.0.10` with [latest release](https://www.torproject.org/download/) semver.

```console
$ gpg --verify ~/Downloads/TorBrowser-11.0.10-osx64_en-US.dmg.asc
gpg: assuming signed data in '/Users/sunknudsen/Downloads/TorBrowser-11.0.10-osx64_en-US.dmg'
gpg: Signature made Tue  5 Apr 20:06:23 2022 EDT
gpg:                using RSA key 0xE53D989A9E2D47BF
gpg: Good signature from "Tor Browser Developers (signing key) <torbrowser@torproject.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7  DE68 4E2C 6E87 9329 8290
     Subkey fingerprint: 6131 88FC 5BE2 176E 3ED5  4901 E53D 989A 9E2D 47BF
```

Good signature

👍

#### Install “Tor Browser”

Double-click “TorBrowser-11.0.10-osx64_en-US.dmg” and drag-and-drop “Tor Browser” into “Applications” folder.

👍

---

## Usage guide

### Step 1: start Tor SOCKSv5 proxy

```console
$ /Applications/Tor\ Browser.app/Contents/Resources/TorBrowser/Tor/tor
Jun 21 08:20:47.065 [notice] Tor 0.4.5.8 (git-27e5e33d2ca35de8) running on Darwin with Libevent 2.1.11-stable, OpenSSL 1.1.1k, Zlib 1.2.11, Liblzma N/A, Libzstd N/A and Unknown N/A as libc.
Jun 21 08:20:47.065 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Jun 21 08:20:47.065 [notice] Configuration file "/var/tmp/dist/tor/etc/tor/torrc" not present, using reasonable defaults.
Jun 21 08:20:47.067 [notice] Opening Socks listener on 127.0.0.1:9050
Jun 21 08:20:47.067 [notice] Opened Socks listener connection (ready) on 127.0.0.1:9050
Jun 21 08:20:47.000 [notice] Bootstrapped 0% (starting): Starting
Jun 21 08:20:47.000 [notice] Starting with guard context "default"
Jun 21 08:20:48.000 [notice] Bootstrapped 5% (conn): Connecting to a relay
Jun 21 08:20:48.000 [notice] Bootstrapped 10% (conn_done): Connected to a relay
Jun 21 08:20:48.000 [notice] Bootstrapped 14% (handshake): Handshaking with a relay
Jun 21 08:20:49.000 [notice] Bootstrapped 15% (handshake_done): Handshake with a relay done
Jun 21 08:20:49.000 [notice] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits
Jun 21 08:20:49.000 [notice] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits
Jun 21 08:20:49.000 [notice] Bootstrapped 95% (circuit_create): Establishing a Tor circuit
Jun 21 08:20:51.000 [notice] Bootstrapped 100% (done): Done
```

Done

👍

### Step 2: start Electrum using Tor SOCKSv5 proxy

> Heads-up: append `--testnet` for Testnet.

```shell
/Applications/Electrum.app/Contents/MacOS/run_electrum --proxy socks5:127.0.0.1:9050
```


# How to install and use VeraCrypt on Tails

[![How to install VeraCrypt persistently on Tails](how-to-install-veracrypt-persistently-on-tails.jpg)](https://www.youtube.com/watch?v=ZlWNmpFxk1g "How to install VeraCrypt persistently on Tails")

## Requirements

- [Tails USB flash drive or SD card](../how-to-install-tails-on-usb-flash-drive-or-sd-card)

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## Setup guide

### Step 1: boot to Tails and set admin password (required to [create optional exFAT partition](#step-2-optional-create-exfat-partition-on-tails-usb-flash-drive-or-sd-card))

> Heads-up: if keyboard layout of computer isn’t “English (US)”, set “Keyboard Layout”.

Click “+” under “Additional Settings”, then “Administration Password”, set password, click “Add” and, finally, click “Start Tails”.

### Step 2 (optional): create exFAT partition on Tails USB flash drive or SD card

> Heads-up: partition used to move files between Tails and other operating systems such as macOS.

Click “Applications”, then “Utilities”, then “Disks”, select USB flash drive or SD card, click “Free Space”, then “+”, set “Partition Size”, click “Next”, set “Volume Name”, select “Other”, click “Next”, select “exFAT” and, finally, click “Create”.

### Step 3: enable persistence

Click “Applications”, then “Favorites”, then “Configure persistent volume”, set passphrase, click “Create”, make sure “Personal Data” is enabled, click “Save” and, finally, click “Restart Now”.

### Step 4: boot to Tails, unlock persistent storage and set admin password (required to mount VeraCrypt volumes)

> Heads-up: if keyboard layout of computer isn’t “English (US)”, set “Keyboard Layout”.

Click “+” under “Additional Settings”, then “Administration Password”, set password, click “Add” and, finally, click “Start Tails”.

### Step 5: establish network connection using ethernet cable or Wi-Fi and wait for Tor to be ready

Connected to Tor successfully

👍

### Step 6: import “VeraCrypt Team (2018 - Supersedes Key ID=0x54DDD393)” PGP public key

```console
$ torsocks curl https://www.idrix.fr/VeraCrypt/VeraCrypt_PGP_public_key.asc | gpg --import
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  5434  100  5434    0     0   4461      0  0:00:01  0:00:01 --:--:--  4461
gpg: key 0x821ACD02680D16DE: 1 signature not checked due to a missing key
gpg: key 0x821ACD02680D16DE: public key "VeraCrypt Team (2018 - Supersedes Key ID=0x54DDD393) <veracrypt@idrix.fr>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: no ultimately trusted keys found
```

imported: 1

👍

### Step 7: set [VeraCrypt](https://veracrypt.fr/en/Home.html) release semver environment variable

> Heads-up: replace `1.25.4` with [latest release](https://www.veracrypt.fr/en/Downloads.html) semver.

```shell
VERACRYPT_RELEASE_SEMVER=1.25.4
```

### Step 8: download VeraCrypt release

Click “Applications”, then “Tor Browser”, go to https://www.veracrypt.fr/en/Downloads.html and download latest release of “Linux Generic Installer” and associated PGP signature.

### Step 9: verify VeraCrypt release (learn how [here](../how-to-verify-pgp-digital-signatures-using-gnupg-on-macos))

```console
$ gpg --verify ~/Tor\ Browser/veracrypt-$VERACRYPT_RELEASE_SEMVER-setup.tar.bz2.sig
gpg: assuming signed data in '/home/amnesia/Tor Browser/veracrypt-1.25.4-setup.tar.bz2'
gpg: Signature made Fri 03 Dec 2021 05:57:28 PM UTC
gpg:                using RSA key 5069A233D55A0EEB174A5FC3821ACD02680D16DE
gpg: Good signature from "VeraCrypt Team (2018 - Supersedes Key ID=0x54DDD393) <veracrypt@idrix.fr>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 5069 A233 D55A 0EEB 174A  5FC3 821A CD02 680D 16DE
```

Good signature

👍

### Step 10: extract VeraCrypt release

```shell
cd ~/Tor\ Browser
tar --extract --file ~/Tor\ Browser/veracrypt-$VERACRYPT_RELEASE_SEMVER-setup.tar.bz2 veracrypt-$VERACRYPT_RELEASE_SEMVER-setup-gui-x64
```

### Step 11: run installer, click “Extract .tar Package File”, accept license terms, click “OK” and, finally, click “OK” (again).

```shell
./veracrypt-$VERACRYPT_RELEASE_SEMVER-setup-gui-x64
```

### Step 12: extract `veracrypt` binary to ~/Persistent

```shell
cd ~/Persistent
tar --extract --file /tmp/veracrypt_${VERACRYPT_RELEASE_SEMVER}_amd64.tar.gz --strip-components 2 usr/bin/veracrypt
```

### Step 13: create `veracrypt.AppImage`

```shell
echo -n "./veracrypt" > veracrypt.AppImage
chmod +x veracrypt.AppImage
```

👍

---

## Usage guide

Click “Places”, then “Persistent” and double-click “veracrypt.AppImage”.

👍


# How to install Tails on USB flash drive or SD card

[![Why Tails is not only for hacktivists and whistleblowers and how to get started](why-tails-is-not-only-for-hacktivists-and-whistleblowers-and-how-to-get-started.jpg)](https://www.youtube.com/watch?v=kZ4NHz-gjLo "Why Tails is not only for hacktivists and whistleblowers and how to get started")

## Requirements

- USB flash drive or SD card (faster is better)
- Computer running macOS Big Sur or Monterey or Debian-based operating system

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## Guide (macOS)

### Step 1: install [Homebrew](https://brew.sh/)

```console
$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

$ uname -m | grep arm64 && echo 'export PATH=$PATH:/opt/homebrew/bin' >> ~/.zshrc && source ~/.zshrc
```

### Step 2: disable Homebrew analytics

```shell
brew analytics off
```

### Step 3: install [GnuPG](https://gnupg.org/)

```shell
brew install gnupg
```

### Step 4: import “Tails developers” PGP public key

```console
$ curl https://tails.boum.org/tails-signing.key | gpg --import
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 1341k  100 1341k    0     0  1568k      0 --:--:-- --:--:-- --:--:-- 1567k
gpg: key 0xDBB802B258ACD84F: 2170 signatures not checked due to missing keys
gpg: key 0xDBB802B258ACD84F: public key "Tails developers (offline long-term identity key) <tails@boum.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: key 0xA3A31BAD5A2A5B10: no user ID for key signature packet of class 10
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   3  signed:   1  trust: 0-, 0q, 0n, 0m, 0f, 3u
gpg: depth: 1  valid:   1  signed:   0  trust: 1-, 0q, 0n, 0m, 0f, 0u
```

imported: 1

👍

### Step 5: download [Tails](https://tails.boum.org/) release

Go to https://tails.boum.org/install/download/index.en.html and download latest release and associated PGP signature (found under “or download the OpenPGP signature”) to `~/Downloads` folder.

### Step 6: verify Tails release (learn how [here](../how-to-verify-pgp-digital-signatures-using-gnupg-on-macos))

> Heads-up: replace `4.29` with [latest release](https://tails.boum.org/install/download/index.en.html) semver.

```console
$ gpg --verify ~/Downloads/tails-amd64-4.29.img.sig
gpg: assuming signed data in '/Users/sunknudsen/Downloads/tails-amd64-4.29.img'
gpg: Signature made Mon  4 Apr 08:10:52 2022 EDT
gpg:                using RSA key 753F901377A309F2731FA33F7BFBD2B902EE13D0
gpg: Good signature from "Tails developers (offline long-term identity key) <tails@boum.org>" [unknown]
gpg:                 aka "Tails developers <tails@boum.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: A490 D0F4 D311 A415 3E2B  B7CA DBB8 02B2 58AC D84F
     Subkey fingerprint: 753F 9013 77A3 09F2 731F  A33F 7BFB D2B9 02EE 13D0
```

Good signature

👍

### Step 7: copy Tails to USB flash drive or SD card

> **WARNING: BE VERY CAREFUL WHEN RUNNING `DD` AS DATA CAN BE PERMANENTLY DESTROYED (BEGINNERS SHOULD CONSIDER USING [BALENAETCHER](https://www.balena.io/etcher/) INSTEAD).**

> Heads-up: run `diskutil list` to find disk ID of USB flash drive or SD card to overwrite with Tails (`disk4` in the following example).

> Heads-up: replace `diskn` and `rdiskn` with disk ID of USB flash drive or SD card (`disk4` and `rdisk4` in the following example) and `tails-amd64-4.29.img` with current image.

```console
$ diskutil list
/dev/disk0 (internal):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                         500.3 GB   disk0
   1:             Apple_APFS_ISC                         524.3 MB   disk0s1
   2:                 Apple_APFS Container disk3         494.4 GB   disk0s2
   3:        Apple_APFS_Recovery                         5.4 GB     disk0s3

/dev/disk3 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +494.4 GB   disk3
                                 Physical Store disk0s2
   1:                APFS Volume Macintosh HD            15.3 GB    disk3s1
   2:              APFS Snapshot com.apple.os.update-... 15.3 GB    disk3s1s1
   3:                APFS Volume Preboot                 412.4 MB   disk3s2
   4:                APFS Volume Recovery                807.3 MB   disk3s3
   5:                APFS Volume Data                    386.2 GB   disk3s5
   6:                APFS Volume VM                      2.1 GB     disk3s6

/dev/disk4 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     FDisk_partition_scheme                        *32.1 GB    disk4
   1:               Windows_NTFS Untitled                32.1 GB    disk4s1

$ sudo diskutil unmount /dev/diskn
disk4 was already unmounted or it has a partitioning scheme so use "diskutil unmountDisk" instead

$ sudo diskutil unmountDisk /dev/diskn (if previous step fails)
Unmount of all volumes on disk4 was successful

$ sudo dd bs=1m if=$HOME/Downloads/tails-amd64-4.29.img of=/dev/rdiskn
1147+0 records in
1147+0 records out
1202716672 bytes transferred in 50.591479 secs (23773108 bytes/sec)

$ sudo diskutil unmountDisk /dev/diskn
Unmount of all volumes on disk4 was successful
```

👍

## Guide (Debian-based operating system)

### Step 1: install dependencies

```console
$ sudo apt update

$ sudo apt install curl gnupg
```

### Step 2: import “Tails developers” PGP public key

```console
$ curl https://tails.boum.org/tails-signing.key | gpg --import
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 1341k  100 1341k    0     0   517k      0  0:00:02  0:00:02 --:--:--  517k
gpg: key DBB802B258ACD84F: 2172 signatures not checked due to missing keys
gpg: key DBB802B258ACD84F: public key "Tails developers (offline long-term identity key) <tails@boum.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: no ultimately trusted keys found
```

imported: 1

👍

### Step 3: set Tails release semver environment variable

> Heads-up: replace `4.29` with [latest release](https://tails.boum.org/install/download/index.en.html) semver.

```shell
TAILS_RELEASE_SEMVER=4.29
```

### Step 4: download Tails release

```console
$ curl --fail --location --remote-name https://mirrors.edge.kernel.org/tails/stable/tails-amd64-${TAILS_RELEASE_SEMVER}/tails-amd64-${TAILS_RELEASE_SEMVER}.img

$ curl --fail --location --remote-name https://tails.boum.org/torrents/files/tails-amd64-${TAILS_RELEASE_SEMVER}.img.sig
```

### Step 5: verify Tails release (learn how [here](../how-to-verify-pgp-digital-signatures-using-gnupg-on-macos))

```console
$ gpg --verify tails-amd64-${TAILS_RELEASE_SEMVER}.img.sig
gpg: assuming signed data in 'tails-amd64-4.29.img'
gpg: Signature made Mon 04 Apr 2022 08:10:52 AM EDT
gpg:                using RSA key 753F901377A309F2731FA33F7BFBD2B902EE13D0
gpg: Good signature from "Tails developers (offline long-term identity key) <tails@boum.org>" [unknown]
gpg:                 aka "Tails developers <tails@boum.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: A490 D0F4 D311 A415 3E2B  B7CA DBB8 02B2 58AC D84F
     Subkey fingerprint: 753F 9013 77A3 09F2 731F  A33F 7BFB D2B9 02EE 13D0
```

Good signature

👍

### Step 6: copy Tails to USB flash drive or SD card

> **WARNING: BE VERY CAREFUL WHEN RUNNING `DD` AS DATA CAN BE PERMANENTLY DESTROYED (BEGINNERS SHOULD CONSIDER USING [BALENAETCHER](https://www.balena.io/etcher/) INSTEAD).**

> Heads-up: run `sudo fdisk --list` to find device name of USB flash drive or SD card to overwrite with Tails (`sda` in the following example).

> Heads-up: replace `sdn` with device name of USB flash drive or SD card (`sda` in the following example).

```console
$ sudo fdisk --list
Disk /dev/nvme0n1: 931.51 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: Samsung SSD 970 EVO Plus 1TB
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: F053B657-4758-4775-98B1-27256D3B46C9

Device           Start        End    Sectors   Size Type
/dev/nvme0n1p1    2048    1050623    1048576   512M EFI System
/dev/nvme0n1p2 1050624    2050047     999424   488M Linux filesystem
/dev/nvme0n1p3 2050048 1953523711 1951473664 930.5G Linux filesystem


Disk /dev/mapper/nvme0n1p3_crypt: 930.52 GiB, 999137738752 bytes, 1951440896 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mapper/debian--vg-root: 930.52 GiB, 999133544448 bytes, 1951432704 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sda: 29.88 GiB, 32080200192 bytes, 62656641 sectors
Disk model: Flash Drive
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Device     Boot Start      End  Sectors  Size Id Type
/dev/sda1        2048 62656511 62654464 29.9G  7 HPFS/NTFS/exFAT

$ sudo umount /dev/sdn*
umount: /dev/sda: not mounted.
umount: /dev/sda1: not mounted.

$ sudo dd bs=1M if=tails-amd64-${TAILS_RELEASE_SEMVER}.img of=/dev/sdn
1147+0 records in
1147+0 records out
1202716672 bytes (1.2 GB, 1.1 GiB) copied, 62.9469 s, 19.1 MB/s
```

👍


# How to use Time Machine and APFS snapshots on macOS

[![How to use Time Machine and APFS snapshots on macOS](how-to-use-time-machine-and-apfs-snapshots-on-macos.jpg)](https://www.youtube.com/watch?v=PY2gzNrK9Wc "How to use Time Machine and APFS snapshots on macOS")

## Time Machine setup guide

### Step 1: exclude folders from Time Machine

> Heads-up: excluded folders vary depending on use case.

![Format Time Machine drive](./exclude.png)

### Step 2: format Time Machine disk as “Mac OS Extended (Journaled, Encrypted)” using “Disk Utility”

> WARNING: DATA ON TIME MACHINE DISK WILL BE PERMANENTLY DELETED.

![Format Time Machine drive](./format.png)

### Step 3: enable “Encrypt Backup Disk” and click “Use as Backup Disk”

![Format Time Machine drive](./enable-time-machine.png)

### Step 4: confirm encryption is enabled and enable “Show Time Machine in menu bar”

![Format Time Machine drive](./confirm-encryption.png)

Encrypted

👍

---

## Time Machine usage guide

### Create backup

Click “Time Machine” menu bar icon and then “Back Up Now” or run `tmutil startbackup`.

### Delete specific backup

Heads-up: use `tmutil listbackups` to list backups.

```console
$ sudo tmutil delete "/Volumes/LaCie/Backups.backupdb/Sun’s MacBook Pro/2021-04-05-161636"
Deleting: /Volumes/LaCie/Backups.backupdb/Sun’s MacBook Pro/2021-04-05-161636
Deleted (43.5M): /Volumes/LaCie/Backups.backupdb/Sun’s MacBook Pro/2021-04-05-161636
Total deleted: 43.5M
```

Total deleted: 43.5M

👍

---

## APFS snapshot usage guide

### Create local APFS snapshot

```console
$ tmutil localsnapshot
Created local snapshot with date: 2021-04-05-162425
```

Created local snapshot with date: 2021-04-05-162425

👍

### List local APFS snapshots

```console
$ tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2021-04-05-162416.local
com.apple.TimeMachine.2021-04-05-162425.local
```

### Mount local read-only APFS snapshot

> Heads-up: use `umount /tmp/snapshot` to unmount snapshot.

> Heads-up: replace `com.apple.TimeMachine.2021-04-05-162416.local` with snapshot from [List local APFS snapshots](#list-local-apfs-snapshots).

```shell
mkdir -p /tmp/snapshot
mount_apfs -s com.apple.TimeMachine.2021-04-05-162416.local / /tmp/snapshot
open /tmp/snapshot
```

### Restore local APFS snapshot

Restart computer and press <kbd>cmd+r</kbd> to boot to recovery mode.

Select “Restore From Time Machine Backup”, then “Macintosh HD”, choose local snapshot, click “Continue” and “Continue” again to confirm.

### Delete specific local APFS snapshot

> Heads-up: use `tmutil listlocalsnapshotdates` to list local snapshot dates.

```console
$ tmutil deletelocalsnapshots 2021-04-05-162416
Deleted local snapshot '2021-04-05-162416'
```

Deleted local snapshot '2021-04-05-162416'

👍

### Delete all local APFS snapshot

```console
$ tmutil deletelocalsnapshots /
Deleted 1 Time Machine local snapshots for volume group containing disk '/'
com.apple.TimeMachine.2021-04-05-162425.local
```

Deleted 1 Time Machine local snapshots for volume group containing disk '/'

👍


# How to verify PGP digital signatures using GnuPG on macOS

[![How to verify PGP digital signatures using GnuPG on macOS](how-to-verify-pgp-digital-signatures-using-gnupg-on-macos.jpg)](https://www.youtube.com/watch?v=WnNfunEJdQY "How to verify PGP digital signatures using GnuPG on macOS")

## Requirements

- Computer running macOS Big Sur or Monterey

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## Setup guide

### Step 1: install [Homebrew](https://brew.sh/)

```console
$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

$ uname -m | grep arm64 && echo 'export PATH=$PATH:/opt/homebrew/bin' >> ~/.zshrc && source ~/.zshrc
```

### Step 2: disable Homebrew analytics

```shell
brew analytics off
```

### Step 3: install [GnuPG](https://gnupg.org/)

```shell
brew install gnupg
```

👍

---

## Usage guide

### Import signer’s PGP public key using key server…

> Heads-up: replace `0x8C9CA674C47CA060` with signer’s public key ID.

```console
$ gpg --keyserver hkps://keys.openpgp.org --recv-keys 0x8C9CA674C47CA060
gpg: key 8C9CA674C47CA060: public key "Sun Knudsen <hello@sunknudsen.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
```

imported: 1

👍

### …or using PGP public key URL

> Heads-up: replace `https://sunknudsen.com/sunknudsen.asc` with signer’s public key URL.

```console
$ curl https://sunknudsen.com/sunknudsen.asc | gpg --import
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2070  100  2070    0     0   1881      0  0:00:01  0:00:01 --:--:--  1899
gpg: key 8C9CA674C47CA060: 1 signature not checked due to a missing key
gpg: key 8C9CA674C47CA060: public key "Sun Knudsen <hello@sunknudsen.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
```

imported: 1

👍

### Verify signer’s PGP public key using fingerprint

> Heads-up: replace `hello@sunknudsen.com` with signer’s email and use published fingerprints to verify signer’s cryptographic identity (learn how [here](../how-to-encrypt-sign-and-decrypt-messages-using-gnupg-on-macos#verify-suns-pgp-public-key-using-fingerprint)).

```console
$ gpg --fingerprint hello@sunknudsen.com
gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
pub   rsa4096 2019-10-17 [C]
      C4FB DDC1 6A26 2672 920D  0A0F C132 3A37 7DE1 4C8B
uid           [ unknown] Sun Knudsen <hello@sunknudsen.com>
sub   rsa4096 2019-10-17 [E] [expires: 2021-10-25]
sub   rsa4096 2019-10-17 [A] [expires: 2021-10-25]
sub   rsa4096 2019-10-17 [S] [expires: 2021-10-25]
```

### Verify signed message

> Heads-up: run `gpg`, paste message, press <kbd>enter</kbd> and, finally, press <kbd>ctrl-d</kbd>.

```console
$ gpg
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
gpg: Go ahead and type your message ...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

bc1qpy3h47z7pxlpctmfl4e43vu96yutflku2mrsds
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQSceIfhtfy84t/tDhwCxDrQctV3gwUCYeFZGgAKCRACxDrQctV3
g0m+AP9xoftZV147sWJc7sqpYXpysdW5iiB5NhCaKqGmQ92GpgD/S4AZqzHEUzME
ifFv0pnoSCEAyxDnEHoUk5SCGCkobAc=
=uDIU
-----END PGP SIGNATURE-----
bc1qpy3h47z7pxlpctmfl4e43vu96yutflku2mrsds
gpg: Signature made Fri 14 Jan 06:06:02 2022 EST
gpg:                using EDDSA key 9C7887E1B5FCBCE2DFED0E1C02C43AD072D57783
gpg: Good signature from "Sun Knudsen <hello@sunknudsen.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: E786 274B C92B 47C2 3C1C  F44B 8C9C A674 C47C A060
     Subkey fingerprint: 9C78 87E1 B5FC BCE2 DFED  0E1C 02C4 3AD0 72D5 7783
```

Good signature

👍

### Verify signed [file](https://sunknudsen.com/privacy-guides/how-to-clean-uninstall-macos-apps-using-appcleaner-open-source-alternative/app-cleaner.sh) using [detached signature](https://sunknudsen.com/privacy-guides/how-to-clean-uninstall-macos-apps-using-appcleaner-open-source-alternative/app-cleaner.sh.asc)

```console
$ gpg --verify app-cleaner.sh.asc
gpg: assuming signed data in 'app-cleaner.sh'
gpg: Signature made Wed 29 Dec 10:42:13 2021 EST
gpg:                using EDDSA key 9C7887E1B5FCBCE2DFED0E1C02C43AD072D57783
gpg: Good signature from "Sun Knudsen <hello@sunknudsen.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: E786 274B C92B 47C2 3C1C  F44B 8C9C A674 C47C A060
     Subkey fingerprint: 9C78 87E1 B5FC BCE2 DFED  0E1C 02C4 3AD0 72D5 7783
```

Good signature

👍


# How to make sure app is not running in the background on macOS

[![How to make sure app is not running in the background on macOS](how-to-make-sure-app-is-not-running-in-the-background-on-macos.jpg)](https://www.youtube.com/watch?v=mSibcNslSK8 "How to make sure app is not running in the background on macOS")

## Requirements

- Computer running macOS Catalina or Big Sur

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- When copy/pasting commands that start with `cat << "EOF"`, select all lines at once (from `cat << "EOF"` to `EOF` inclusively) as they are part of the same (single) command

## Setup guide

> Heads-up: following steps illustrate how to make sure “Adobe Creative Suite” is not running in the background, but same logic should apply any app.

### Step 1: find app launch agent and daemon bundle identifier prefix

```console
$ ls -A1 {,~}/Library/LaunchAgents /Library/LaunchDaemons
/Library/LaunchAgents:
at.obdev.LittleSnitchHelper.plist
at.obdev.LittleSnitchUIAgent.plist
com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist
com.adobe.AdobeCreativeCloud.plist
com.adobe.GC.AGM.plist
com.adobe.GC.Invoker-1.0.plist
com.adobe.ccxprocess.plist

/Library/LaunchDaemons:
at.obdev.littlesnitchd.plist
com.adobe.ARMDC.Communicator.plist
com.adobe.ARMDC.SMJobBlessHelper.plist
com.adobe.acc.installer.v2.plist
com.adobe.agsservice.plist
com.apple.installer.osmessagetracing.plist
local.pf.plist
local.pmset.plist
local.spoof.plist
org.virtualbox.startup.plist
org.wireshark.ChmodBPF.plist

/Users/sunknudsen/Library/LaunchAgents/:
com.adobe.GC.Invoker-1.0.plist
local.borg-wrapper.plist
org.virtualbox.vboxwebsrv.plist
```

com.adobe

👍

### Step 2: disable app launch agents and daemons

> Heads-up: don’t worry if you see “Could not find specified service” warnings.

```shell
BUNDLE_IDENTIFIER_PREFIX="com.adobe"
sudo launchctl unload -w /Library/{LaunchAgents,LaunchDaemons}/$BUNDLE_IDENTIFIER_PREFIX*.plist
launchctl unload -w {,~}/Library/LaunchAgents/$BUNDLE_IDENTIFIER_PREFIX*.plist
```

### Step 3: disable app extensions

Open “System Preferences”, click “Extensions” and disable app extensions (if any).

![core-sync](./core-sync.png)

### Step 4: add `kill-apps` helper to `.zshrc`

> Heads-up: following step assumes macOS is configured to use “Z shell” (running `echo $SHELL` should return `/bin/zsh`).

```shell
cat << "EOF" >> ~/.zshrc

# Kill apps that match string
function kill-apps() {
  IFS=$'\n'
  red=$(tput setaf 1)
  normal=$(tput sgr0)
  if [ -z "$1" ] || [ "$1" = "--help" ]; then
    printf "%s\n" "Usage: kill-apps string"
    return 0
  fi
  printf "%s\n" "Finding apps that match “$1”…"
  sleep 1
  processes=($(pgrep -afil "$1"))
  if [ ${#processes[@]} -eq 0 ]; then
    printf "%s\n" "No apps found"
    return 0
  else
    printf "%s\n" "${processes[@]}"
    printf "$red%s$normal" "Kill found apps (y or n)? "
    read -r answer
    if [ "$answer" = "y" ]; then
      printf "%s\n" "Killing found apps…"
      sleep 1
      for process in "${processes[@]}"; do
        echo $process | awk '{print $1}' | xargs sudo kill 2>&1 | grep -v "No such process"
      done
      printf "%s\n" "Done"
      return 0
    fi
  fi
}
EOF
source ~/.zshrc
```

👍

---

## Usage guide

### Make sure “Adobe Creative Suite” is not running in the background

```console
$ kill-apps adobe
Finding apps that match "adobe"…
46639 /Library/Application Support/Adobe/Adobe Desktop Common/IPCBox/AdobeIPCBroker.app/Contents/MacOS/AdobeIPCBroker -launchedbyvulcan /Applications/Adobe Premiere Pro 2020/Adobe Premiere Pro 2020.app/Contents/MacOS/Adobe Premiere Pro 2020
46645 /Library/Application Support/Adobe/Creative Cloud Libraries/CCLibrary.app/Contents/MacOS/../libs/node /Library/Application Support/Adobe/Creative Cloud Libraries/CCLibrary.app/Contents/MacOS/../js/server.js
46653 /Applications/Utilities/Adobe Creative Cloud Experience/CCXProcess/CCXProcess.app/Contents/MacOS/../libs/Adobe_CCXProcess.node /Applications/Utilities/Adobe Creative Cloud Experience/CCXProcess/CCXProcess.app/Contents/MacOS/../js/main.js
46655 /Applications/Adobe Premiere Pro 2020/Adobe Premiere Pro 2020.app/Contents/MacOS/LogTransport2.app/Contents/MacOS/LogTransport2 86E222CE52861AEA0A490D4D@AdobeID 1 0 NOVALUE NOVALUE
Kill found apps (y or n)? y
Password:
Done
```

Done

👍


# How to reset app privacy permissions on macOS

[![How to reset app privacy permissions on macOS](how-to-reset-app-privacy-permissions-on-macos.jpg)](https://www.youtube.com/watch?v=g_5uk5UkLgw "How to reset app privacy permissions on macOS")

## Guide

> Heads-up: make sure [System Integrity Protection](https://support.apple.com/en-us/HT204899) (SIP) is enabled using `csrutil status`.

> Heads-up: available privacy permissions are `Accessibility`, `AddressBook`, `All`, `AppleEvents`, `Calendar`, `Camera`, `ContactsFull`, `ContactsLimited`, `Facebook`, `FileProviderDomain`, `FileProviderPresence`, `LinkedIn`, `Liverpool`, `Location`, `MediaLibrary`, `Microphone`, `Motion`, `Photos`, `PhotosAdd`, `PostEvent`, `Reminders`, `ScreenCapture`, `ShareKit`, `SinaWeibo`, `Siri`, `SpeechRecognition`, `SystemPolicyAllFiles`, `SystemPolicyDesktopFolder`, `SystemPolicyDeveloperFiles`, `SystemPolicyDocumentsFolder`, `SystemPolicyNetworkVolumes`, `SystemPolicyRemovableVolumes`, `SystemPolicySysAdminFiles`, `SystemPolicyDownloadsFolder`, `TencentWeibo`, `Twitter`, `Ubiquity`, `Willow`.

> Heads-up: “Location Services” is handled differently so `tccutil` has no effect.

### Reset single privacy permission for single app

```console
$ mdls -name kMDItemCFBundleIdentifier -r /Applications/Signal.app
org.whispersystems.signal-desktop

$ tccutil reset Camera org.whispersystems.signal-desktop
Successfully reset Camera approval status for org.whispersystems.signal-desktop
```

Successfully reset Camera approval status for org.whispersystems.signal-desktop

👍

### Reset all privacy permissions for single app

```console
$ mdls -name kMDItemCFBundleIdentifier -r /Applications/Signal.app
org.whispersystems.signal-desktop

$ tccutil reset All org.whispersystems.signal-desktop
Successfully reset All approval status for org.whispersystems.signal-desktop
```

Successfully reset All approval status for org.whispersystems.signal-desktop

👍

### Reset single privacy permission for all apps

```console
$ tccutil reset Camera
Successfully reset Camera
```

Successfully reset Camera

👍

### Reset all privacy permissions for all apps

```console
$ tccutil reset All
Successfully reset All
```

Successfully reset All

👍


# How to configure strongSwan client on headless Debian-based Linux computer (DEPRECATED: guide is no longer maintained)

[![How to configure strongSwan client on headless Debian-based Linux computer](how-to-configure-strongswan-client-on-headless-debian-based-linux-computer.jpg)](https://www.youtube.com/watch?v=fW1TUByQqk8 "How to configure strongSwan client on headless Debian-based Linux computer")

## Requirements

- [Self-hosted hardened strongSwan IKEv2/IPsec VPN server](../how-to-self-host-hardened-strongswan-ikev2-ipsec-vpn-server-for-ios-and-macos)
- Linux or macOS computer (referred to as “certificate authority computer”)
- Debian-based Linux computer (referred to as “client computer”)

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- When copy/pasting commands that start with `cat << "EOF"`, select all lines at once (from `cat << "EOF"` to `EOF` inclusively) as they are part of the same (single) command

## Guide

### Step 1: create client key and cert using certificate authority from [How to self-host hardened strongSwan IKEv2/IPsec VPN server for iOS and macOS](../how-to-self-host-hardened-strongswan-ikev2-ipsec-vpn-server-for-ios-and-macos) (on certificate authority computer).

#### Navigate to `strongswan-certs` directory

```shell
cd ~/Desktop/strongswan-certs
```

#### Set client common name

```shell
STRONGSWAN_CLIENT_NAME=bob
```

#### Update OpenSSL config file

```shell
cat << EOF > openssl.cnf
[ req ]
distinguished_name = req_distinguished_name
attributes = req_attributes
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_min = 2
countryName_max = 2
countryName_default = US
0.organizationName = Organization Name (eg, company)
0.organizationName_default = Self-hosted strongSwan VPN
commonName = Common Name (eg, fully qualified host name)
commonName_max = 64
[ req_attributes ]
challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20
[ ca ]
subjectKeyIdentifier = hash
basicConstraints = critical, CA:true
keyUsage = critical, cRLSign, keyCertSign
[ server ]
authorityKeyIdentifier = keyid
subjectAltName = DNS:vpn-server.com
extendedKeyUsage = serverAuth, 1.3.6.1.5.5.8.2.2
[ client ]
authorityKeyIdentifier = keyid
subjectAltName = email:$STRONGSWAN_CLIENT_NAME@vpn-server.com
extendedKeyUsage = serverAuth, 1.3.6.1.5.5.8.2.2
EOF
```

#### Generate client cert

```console
$ openssl genrsa -out $STRONGSWAN_CLIENT_NAME.key 4096
Generating RSA private key, 4096 bit long modulus
............................++
...........++
e is 65537 (0x10001)

$ openssl req -new -config openssl.cnf -extensions client -key $STRONGSWAN_CLIENT_NAME.key -subj "/C=US/O=Self-hosted strongSwan VPN/CN=$STRONGSWAN_CLIENT_NAME@vpn-server.com" -out $STRONGSWAN_CLIENT_NAME.csr

$ openssl x509 -req -extfile openssl.cnf -extensions client -in $STRONGSWAN_CLIENT_NAME.csr -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650 -out $STRONGSWAN_CLIENT_NAME.crt
Signature ok
subject=/C=US/O=Self-hosted strongSwan VPN/CN=bob@vpn-server.com
Getting CA Private Key
```

### Step 2: log in to client computer

> Heads-up: replace `~/.ssh/pi` with path to private key and `pi@10.0.1.248` with SSH destination of client computer.

```shell
ssh -i ~/.ssh/pi pi@10.0.1.248
```

### Step 3: switch to root

```shell
su -
```

### Step 4: configure firewall

> Heads-up: input rules are likely already configured (run `iptables-save` and `ip6tables-save` to check).

#### Configure IPv4 rules

```shell
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --dport 500 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp --dport 4500 -m state --state NEW -j ACCEPT
```

#### Configure IPv6 rules (if network is dual stack)

```shell
ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -A OUTPUT -p udp --dport 500 -m state --state NEW -j ACCEPT
ip6tables -A OUTPUT -p udp --dport 4500 -m state --state NEW -j ACCEPT
```

#### make firewall rules persistent

```shell
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
```

### Step 5: update APT index

```shell
apt update
```

### Step 6: install strongSwan

Heads-up: if you are shown an “Old runlevel management superseded” warning, answer “Ok”.

```shell
apt install -y strongswan libcharon-extra-plugins
```

### Step 7: configure strongSwan

#### Set strongSwan client name and server IP environment variables

> Heads-up: replace `185.193.126.203` with IP of strongSwan server.

```shell
STRONGSWAN_CLIENT_NAME=bob
STRONGSWAN_SERVER_IP=185.193.126.203
```

#### Back up and overwrite `/etc/ipsec.conf`

```shell
cp /etc/ipsec.conf /etc/ipsec.conf.backup
cat << EOF > /etc/ipsec.conf
conn ikev2
  auto=start
  ike=aes256gcm16-prfsha512-ecp384!
  esp=aes256gcm16-ecp384!
  dpdaction=restart
  closeaction=restart
  keyingtries=%forever
  leftid=$STRONGSWAN_CLIENT_NAME@vpn-server.com
  leftsourceip=%config
  leftauth=eap-tls
  leftcert=$STRONGSWAN_CLIENT_NAME.crt
  right=$STRONGSWAN_SERVER_IP
  rightid=vpn-server.com
  rightsubnet=0.0.0.0/0
  rightauth=pubkey
EOF
```

#### Back up and overwrite `/etc/ipsec.secrets`

```shell
cp /etc/ipsec.secrets /etc/ipsec.secrets.backup
cat << EOF > /etc/ipsec.secrets
: RSA $STRONGSWAN_CLIENT_NAME.key
EOF
```

#### Disable unused plugins

```shell
cd /etc/strongswan.d/charon
sed -i 's/load = yes/load = no/' ./*.conf
sed -i 's/load = no/load = yes/' ./eap-tls.conf ./aes.conf ./dhcp.conf ./farp.conf ./gcm.conf ./hmac.conf ./kernel-netlink.conf ./nonce.conf ./openssl.conf ./pem.conf ./pgp.conf ./pkcs12.conf ./pkcs7.conf ./pkcs8.conf ./pubkey.conf ./random.conf ./revocation.conf ./sha2.conf ./socket-default.conf ./stroke.conf ./x509.conf
cd -
```

### Step 8: copy certs and key to client and make private directory root-only.

On certificate authority computer, run:

```shell
cat << EOF
cat << "_EOF" > /etc/ipsec.d/cacerts/ca.crt
$(cat ca.crt)
_EOF
EOF
```

On client computer, run output from previous command:

```shell
cat << "_EOF" > /etc/ipsec.d/cacerts/ca.crt
-----BEGIN CERTIFICATE-----
MIIFWzCCA0OgAwIBAgIJAIBFc1JHIb/zMA0GCSqGSIb3DQEBCwUAMEsxCzAJBgNV
BAYTAlVTMSMwIQYDVQQKDBpTZWxmLWhvc3RlZCBzdHJvbmdTd2FuIFZQTjEXMBUG
A1UEAwwOdnBuLXNlcnZlci5jb20wHhcNMjAxMjA5MTYyMDA4WhcNMzAxMjA3MTYy
MDA4WjBLMQswCQYDVQQGEwJVUzEjMCEGA1UECgwaU2VsZi1ob3N0ZWQgc3Ryb25n
U3dhbiBWUE4xFzAVBgNVBAMMDnZwbi1zZXJ2ZXIuY29tMIICIjANBgkqhkiG9w0B
AQEFAAOCAg8AMIICCgKCAgEAyYp9BcqpYob99NMEPbfpjRvBXujnoFA440MyF2kx
2uJZliBxgJbZZMEIg4dGgbHDIJ3Pz9WuJZczhw35xjbcTo2JFPQ0In4KcbV8qdyb
1KQgvbuES9H4pb+QJDn46l/Djqhc4KU9jGzxvgVZF8GkwsIOP6vMrdarpzH2vG+8
dNvvgB9LMDjMU4grbkqBwrCr8hJVrcoo6GRlmUP9hnGirUd5cSE9ycIgJsPssPuc
eCOocoewKiYFLjLTPMZyElhu8K1Rcn09EizcOJeaaaaLQTG67r2tD6wMW9aAtmz+
acdJ98s3yp5mJt4SnMGnEN3VoTTCOBm2jXBH2hSh1sM/INP6bLSrYme4SkTwvSMD
8ebipybd3tcvBoQnRc3lWgI4JKyB5lRJTyExB8di9euLQ+XExpxcRKNmsrcbrLwU
1+YX0JnQ6XZNhreSqm8HN6iUn57CPdD+wMFnqHeq+kVxdEkTObnIYhyw9CMmGVHO
/YhsMCbrw9w5lpPp2/FgXvxkkpL2hwoQF8YoGmXi1zXKE5DEGegeM9fZaExdIPJr
CXvf30Xq3+ntfv9PkMvWeFcH5Hxo30tZ5u1c3R8YM/32iVAVgo1d80XUnXo3/Y89
hOTNL2+M8CBc6rsIEcvs4KUClb5hwliiIignMdShfdAdzOgQYAZW0aZJs2Eg4vp4
hlsCAwEAAaNCMEAwHQYDVR0OBBYEFA6byRT0reX3U+qj3VP9H+3ggglNMA8GA1Ud
EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4ICAQAX
9yWi8WWi1fn8NVaWTsspZahzN58h8JngEcl9YFJEw+K41gztfgFp6nl4T6HJP4dX
+gcRT9uSLjQsBR58bdiE8oXHVePhpl3UdEg4tdZ7mHbB09aKRhtSmPx1LDIp+Zxk
71xH4ZYw1IvdSNZv/autMkHL+SQToXRLzrq7UZtg0SJWnP6Z9CBlpDKUu8jQuWUl
Y5kkKj4kCRF7mETuRKk/eW86qVCmbScSlItrHkHf6Y+53/aKVs5bCHuHkEJZ8j0E
q3jHrNhvl2VkVxD+1zsjrYXeJxux5zZUSBJ6gj+Hb/0VHoDJ8JFp1ZEB1AeZUY5u
dc2ObiCfMCBx9iiPdVian93K37quaijeIROA+JVOLFB7tPXyRlyECD311Sjt4YjV
zp/rK3DOfjuvu3hOx2dixvypOdb3r3e0F9ni9iurn7kgBT8u/+Z+FXTUZ8FFNgKX
hTQUcwkFfgRe2N71oRAzkMpjaXr8IvGLJ+kZ1koRHd/D6JU5/bSmW0K/5LxnW6K8
/W/oTUc1Uu5tZ2LgXXieOCUz/h8EQ1UA6t0h1czgwpz/gPESJuhV1Y/POP7FCYHD
i7SLtWmIrt4dbGFwascWBzEBOG+rx6ilEFnrqRpoBCcl5B6aj2iTAS8lmuJaYMTJ
JJAKOaEm18Vl0ntydZ1BSldekjJNYFCENvCNXp/vRg==
-----END CERTIFICATE-----
_EOF
```

On certificate authority computer, run:

```shell
cat << EOF
cat << "_EOF" > /etc/ipsec.d/private/$STRONGSWAN_CLIENT_NAME.key
$(cat $STRONGSWAN_CLIENT_NAME.key)
_EOF
EOF
```

On client computer, run output from previous command:

```shell
cat << "_EOF" > /etc/ipsec.d/private/bob.key
-----BEGIN RSA PRIVATE KEY-----
MIIJJwIBAAKCAgEAm7IuJck8H0xM9Fa07gh2ZDzSW9NNCUWavhmr+hse4ZcpFbNN
1D6uaa9sWBNReVzd9PRo7cJwzhTqMYsNF5nLrhdeAlIE9ans/maZlIf4EJ4fNZV8
WqJ2ySWrPNhc7rcKXgyQPSzD3g+N+GmuzfvoQczFOVgT+H8LGeQIM+qjJRJk+UOY
mMov4UAV38SWbMy4vWid2uDVU9jJRSIbUU7CTV3uvZ/XQJRQxtBBxKpGiZiVoImx
iHKrP9cSHlvY5RqfCsS8OxO6YvyIyYE/no6wG0D+H9fd7g8U7jXRphL0mJK5XOAP
DRjYUfQms6dGeswtMoxhj7282ryOOLOt04IZsjUIqzIzSxvqhdLMBKuD2SJAzC/E
x+5rmGFFpHQbAatvHGffhinzQH842+Pi73Qdkx9NEGaXZJWkWC6S4SAR5olBZKxp
4H9lyhUUqMbluoRp0NngeQT8TEinRKiO2KtDx6DpWlIwIfxAzv76wyDbRBgzmaa3
F31EM41Bu3/ch+BL7tnxVJhyugFFuESLYuIam3gm2XK9ZndWIuKyvH3/sLvuhxwf
sFvvOG/SObYenBQozYgS0LzNTzTLaoZIhkI/UsKQjGnPPCcc1hhB33mkNNwEtVyn
q3o5d1YVTN6q6LVx+BOHA1dJjCpMUME2bwql3WefVWRoD22WWizk6KcQfW0CAwEA
AQKCAgB4pvE/8tuWXWhdCDwZIZGtR7yzz+CoyLmLixVMMWwS4TLDUDmFujUqTPim
oAHJDIAr7KLLbJxB9s8tKVYx7cp61DzTi3+wZ8fxtMxa36sKJZ6FxZuiGLf4VCqI
chpCGrH8A7xay6/VCzS3Rh5iHU30f5xuPaTsMncFz0HUCYX3mnOI/iroa/YClcjd
qNfw5AxdKw74qLZnzVzbJ/0HWwMTNTFm3NDPiJ+4EXaF0nXq9sUsrMdYt5OhWyb9
Q6umjqSkkaRUG4uaXZwamwAT/PrXg9vqDTw72JAdsLMQASxud3URVcgUHCa2C39a
RMxHKKX1v/dyjlQlJW0I36RafT0vOHMsqjxG919vLfiMFztn8AZejsYcMCe8qYMq
aybQQNMR3aW+f4OEbLidRxujmxN3hvVVkyEppr/J5qzgkFB51zb30ooDTp90SE2y
5ArXXI2N/e+JXh2R08ev1ScI32rSmRa/Xw33IfyO8XOnUepAvfB586XEUIa6CXNC
r2rJJ/OHgXEktyEGQfxJ6lORINPpx+qh74gg8YW7rLKKeKOJM1i85w8Trs/NHKB6
Ok0sn2V0RsJT1csqA0SSRc1kRMmJxj6dBrWXbp2eeo/nNBfX7kwGoouK9pMYXZv/
aNx/0ZuN3uC62kkvWvCotifRggjnHxCSBtNljwaRySGDByBIAQKCAQEAzpZyVJDN
KUyFps6+oTgAfo5xDyWTEZpFkrDMyA2eJ0cxHWSMdVnK5U858oTGWeAK2kNDnznI
cfDtgjsorZqYYqPK6SI3/iYKw6NqA1E7hMJF78aitXVxhj0OiCN2hpMoFmm9wdcE
4XRru9/bEbSmc2NGrL25gKvYJ+1CZ6QRMUhlW6P3JjKPcmopCKKTobxErLiyOjnY
G8ne7UvY4M8d9ElpdDfNHaVw0+wkGemw/8s82QhkTFagMv9cTH8rwoe4fcKWbhn0
6QNxowLMVecdyhd5GAnxRb1ccFal58y0byivge4MtVeZlsvGuPjD4bXwMIUvcVS+
XswhijwbtaUebQKCAQEAwO+XHFtxA9ByIFD66fJ84/HWGyoYP/hDpexrxJrLjJuP
i6Y23RtewVs7LFmj88i29xLUjJ3vp7syQ8iGxPz0hxd4i/QQI8Jed1lV+6eiQbv0
eHRP7P7QlyhUpjT5KYVAn7vEA4r51vtIQ4aIawF2S29ZvZO+4PJFb/gyOmtz+mPO
6Ok25KgzVX22DgqGYVcETGasaCioob37QjOrSu9Bid2hrzmf+Et5SyhvyRKOSVAw
SxRUqp5tCp2P2h1Xn/BO7kCzypkRyhDRTqcEMuVdnBWEN4oceA+Xyzfq62VLCb/5
z0sa7le46MWCNG+DaMLgZtwfCWDxQD/MQrT/luF7AQKCAQBGAtJoOlJtBpPcvf/4
nwP738YM/gzjUEb3uZcMzSCl6wiID4VSV8XdBIZ82+ZkmvrSkS0fjvORObckBWx5
uQSfmSaw73nOVZIcTwskaKklCrms0sJdgJmihpqgJHSMkt5pChjW0knDJjNEjk6t
p20peaF/9SQiqRouHcf9W6q/6ur+rYial1Pp0HRrir1BeI5FgqpT9Tp54GX+QVAU
j9x051QnoKmQvHqKN2LcrUfgyD2sx51GCa1s2wGqowZvfJNXe1SDp6RKO3KNbetV
yWddD6toLCZqHgxvvc2nysXzTfR8sfH4muFgK1sDYLrxiTkHGHvFipShh8huEoTJ
gFXZAoIBADOptHAOeFPKJFVM+fNdUF4Fawy5F+dBRnQOu8jYnnrXSPffGT/ZzWS/
VjgJBOMJsxyz+SByRjNG6C3Ia3YiOiRWf5wSTaQVrxAMZv7NI6CwgMUkeCaBET/4
t7oN405f9S8Qq2s7cq1DelVCmBL3QELw3TnrbyhzF27lKiYEkfjRcx1hHaba92wE
DpTx8ovsLiV7NN1rTcSJx9cxWMPnD0iohVwTdSeapi8e89gG1P0CsPvZxNYvOAmo
qVWBl+4m/ivEPaCZnm7aVAHYrUInswpRpKbun7LykfYD0i8YX6CLvIvqk5qQ+N2z
zarW1Xxe+pHwjYsIX3GR49NU/j/bvwECggEAXgBQQjW0i5sMU53zBcc7BYaDdLIz
kreFUV1+sfE5Z4tBtjks86ujnA11lrfpojN7alo0FbpkDqBiJCl2inCVryZWhHuM
jjSfmJmc3Yu7mkCP7ClLhBbuJYvAK8NNwoMhKzpz4SCncM7icsyKBomOCfWyJtCt
pnG3Kv8lcZdpmbaYxtbum2MMaTuZQPDJwIe+TXgwUWs5JpaVaoA+pxg7hVVm/etl
Q792SFlYfocvqZ7NVNQ29YizcUHCoUmYNbBaRWJBFDF5TKywv+rBx+k8lfYz2AZC
ImQBryT2Ndf0PcKX0yKfUfd78Cg5+X9mt8LTfHN8HDoMirMCANbpMFRgHQ==
-----END RSA PRIVATE KEY-----
_EOF
```

On certificate authority computer, run:

```shell
cat << EOF
cat << "_EOF" > /etc/ipsec.d/certs/$STRONGSWAN_CLIENT_NAME.crt
$(cat $STRONGSWAN_CLIENT_NAME.crt)
_EOF
EOF
```

On client computer, run output from previous command:

```shell
cat << "_EOF" > /etc/ipsec.d/certs/bob.crt
-----BEGIN CERTIFICATE-----
MIIFfjCCA2agAwIBAgIJAN19ZfXadJDLMA0GCSqGSIb3DQEBBQUAMEsxCzAJBgNV
BAYTAlVTMSMwIQYDVQQKDBpTZWxmLWhvc3RlZCBzdHJvbmdTd2FuIFZQTjEXMBUG
A1UEAwwOdnBuLXNlcnZlci5jb20wHhcNMjAxMjEwMTE1MjU3WhcNMzAxMjA4MTE1
MjU3WjBPMQswCQYDVQQGEwJVUzEjMCEGA1UECgwaU2VsZi1ob3N0ZWQgc3Ryb25n
U3dhbiBWUE4xGzAZBgNVBAMMEmJvYkB2cG4tc2VydmVyLmNvbTCCAiIwDQYJKoZI
hvcNAQEBBQADggIPADCCAgoCggIBAJuyLiXJPB9MTPRWtO4IdmQ80lvTTQlFmr4Z
q/obHuGXKRWzTdQ+rmmvbFgTUXlc3fT0aO3CcM4U6jGLDReZy64XXgJSBPWp7P5m
mZSH+BCeHzWVfFqidsklqzzYXO63Cl4MkD0sw94Pjfhprs376EHMxTlYE/h/Cxnk
CDPqoyUSZPlDmJjKL+FAFd/ElmzMuL1ondrg1VPYyUUiG1FOwk1d7r2f10CUUMbQ
QcSqRomYlaCJsYhyqz/XEh5b2OUanwrEvDsTumL8iMmBP56OsBtA/h/X3e4PFO41
0aYS9JiSuVzgDw0Y2FH0JrOnRnrMLTKMYY+9vNq8jjizrdOCGbI1CKsyM0sb6oXS
zASrg9kiQMwvxMfua5hhRaR0GwGrbxxn34Yp80B/ONvj4u90HZMfTRBml2SVpFgu
kuEgEeaJQWSsaeB/ZcoVFKjG5bqEadDZ4HkE/ExIp0SojtirQ8eg6VpSMCH8QM7+
+sMg20QYM5mmtxd9RDONQbt/3IfgS+7Z8VSYcroBRbhEi2LiGpt4JtlyvWZ3ViLi
srx9/7C77occH7Bb7zhv0jm2HpwUKM2IEtC8zU80y2qGSIZCP1LCkIxpzzwnHNYY
Qd95pDTcBLVcp6t6OXdWFUzequi1cfgThwNXSYwqTFDBNm8Kpd1nn1VkaA9tllos
5OinEH1tAgMBAAGjYTBfMB8GA1UdIwQYMBaAFA6byRT0reX3U+qj3VP9H+3ggglN
MB0GA1UdEQQWMBSBEmJvYkB2cG4tc2VydmVyLmNvbTAdBgNVHSUEFjAUBggrBgEF
BQcDAQYIKwYBBQUIAgIwDQYJKoZIhvcNAQEFBQADggIBAF7fnx51tOGfdKKx3FiL
UwdVBs9gW/Ox4MjqjawinUgab0+5T5r4C8SbunBFUiLx+GdbqlhXDQBkqK94xYM4
/aQ7sUScDfgOm7E/wryZ7zQLow223lD0SHGeGAvGDtX/uyraWYEPL7RXyQwkScpk
Qp+hpsJJdYD4lEpNLfm7UwZcimqoT2kae0T7veDGmoyL9ii2OWvdj/pNOmFjPa1w
Cfe8J9TfPXdvzT25VpiMZlUSxlbfK9IP/UePfhA+tyFwhE6c9XPlz2yYuh/U9HLb
iscVXqIJGbj7YrDADPII0JG+Ayu7vD7sKlDMhseJh4B8sR2XediAYIEHh1J9nDf0
kxrjrQb/1kwriB1rk8vmSGuQ21vIoIVFDcB1RzW4nx+fOz91C5x1IubvQrn2P4oU
wn99CZo10YMFxG8ThhEI0VkPMj77h8SJ14ymslbKigQlbxnAgqdhMCRjK6hNHi7s
BI/ZS+hXP2C3A/6R7kt05ycoYI4xXzTKV2PIZXfgOt81xayidTeE8470Hc0B8+iU
zHyJhIjephqU6Pf4bjfJlu2/adjQNsAz9E+7UBeHJHlFHUxdtd63weD01IcBm+ZT
BxnbLQPPagoNdg6xVBEXi9OtBWWY+wHOb8ak1lTmGWrdFvOOxHszJl88yX+TNkLW
UpTExBlA0rjkNBDdlkNfRSRF
-----END CERTIFICATE-----
_EOF
```

On client computer, run `chmod -R 600 /etc/ipsec.d/private`

### Step 9: restart strongSwan

```shell
systemctl restart strongswan
```

### Step 10: confirm strongSwan client is connected

```console
$ ipsec status
Security Associations (1 up, 0 connecting):
       ikev2[1]: ESTABLISHED 3 minutes ago, 10.0.1.248[bob@vpn-server.com]...185.193.126.203[vpn-server.com]
       ikev2{1}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c3fcabed_i c2b0c4cd_o
       ikev2{1}:   10.0.2.171/32 === 0.0.0.0/0
```

ESTABLISHED

👍

### Step 11: confirm client computer public IP matches strongSwan server IP

```console
curl https://checkip.amazonaws.com
185.193.126.203
```

185.193.126.203

👍

> Heads-up: use following steps to assign static IP to strongSwan client.

### Step 12: log in to server

> Heads-up: replace `185.193.126.203` with IP of strongSwan server.

```shell
ssh -i ~/.ssh/vpn-server vpn-server-admin@185.193.126.203
```

### Step 13: switch to root

```shell
su -
```

### Step 14: assign static IP to strongSwan client

> Heads-up: replace `10.0.2.171` with IP assigned to strongSwan client by strongSwan server (see [step 10](#step-10-confirm-strongswan-client-is-connected)).

```console
$ client_ip=10.0.2.171

$ client_mac=$(cat /var/lib/misc/dnsmasq.leases | grep $client_ip | awk '{print $2}')

$ echo "dhcp-host=$client_mac,10.0.2.2" >> /etc/dnsmasq.d/01-dhcp-strongswan.conf

$ cat /etc/dnsmasq.d/01-dhcp-strongswan.conf
interface=strongswan0
dhcp-range=10.0.2.10,10.0.2.254,255.255.255.0
port=0
dhcp-host=7a:a7:9f:c0:9d:b0,10.0.2.2
```

dhcp-host=7a:a7:9f:c0:9d:b0,10.0.2.2

👍

### Step 15: restart dnsmasq

```shell
systemctl restart dnsmasq
```

### Step 16: log in to client computer

> Heads-up: replace `~/.ssh/pi` with path to private key and `pi@10.0.1.248` with SSH destination of client computer.

```shell
ssh -i ~/.ssh/pi pi@10.0.1.248
```

### Step 17: switch to root

```shell
su -
```

### Step 18: restart strongSwan

```shell
systemctl restart strongswan
```

### Step 19: confirm strongSwan client has IP `10.0.2.2`

```console
$ ipsec status
Security Associations (1 up, 0 connecting):
       ikev2[1]: ESTABLISHED 3 minutes ago, 10.0.1.248[bob@vpn-server.com]...185.193.126.203[vpn-server.com]
       ikev2{1}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c3fcabed_i c2b0c4cd_o
       ikev2{1}:   10.0.2.2/32 === 0.0.0.0/0
```

10.0.2.2/32

👍


# How to configure Borg client on macOS using command-line

[![How to configure Borg client on macOS using command-line](how-to-configure-borg-client-on-macos-using-command-line.jpg)](https://www.youtube.com/watch?v=g73XmszOwYs "How to configure Borg client on macOS using command-line")

## Requirements

- Borg server ([self-hosted](../how-to-self-host-hardened-borg-server) or cloud-based such as [BorgBase](https://www.borgbase.com/) or [rsync.net](https://rsync.net/products/attic.html))
- Computer running macOS Catalina or Big Sur

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- When copy/pasting commands that start with `cat << "EOF"`, select all lines at once (from `cat << "EOF"` to `EOF` inclusively) as they are part of the same (single) command

## Setup guide

> Heads-up: steps 1 to 4 are only required if using BorgBase or rsync.net (don’t forget to enable 2FA).

### Step 1: create `borg` SSH key pair (if using BorgBase or rsync.net)

When asked for file in which to save key, enter `borg`.

When asked for passphrase, use output from `openssl rand -base64 24` (and store passphrase in password manager).

Use `borg.pub` public key when configuring Borg server.

```console
$ mkdir ~/.ssh

$ cd ~/.ssh

$ ssh-keygen -t rsa -C "borg"
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/sunknudsen/.ssh/id_rsa): borg
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in borg.
Your public key has been saved in borg.pub.
The key fingerprint is:
SHA256:9DzU/jDPyR/vGe8k2Yn1p31wF8UxLzCmYEj//D6+oYk borg
The key's randomart image is:
+---[RSA 3072]----+
|     ...o   +  +.|
|      .o . + o  =|
|        o o . . o|
|       . * .   o |
|        S * +  ..|
|           o B++=|
|            o.O**|
|         . +.. *O|
|        E o.+o.+O|
+----[SHA256]-----+

$ cat borg.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCwCdu7RCOmISZQ5cr43lDRPrFoxCXcVfCREYsdTIBEoQrIwyg1jZyzQMf9kORIGcNe5+olIj1aK9qVg0hCEeDSJosSsMP5o8tQJzNu5aYCtnADlZ+AuCgp5CpL1vECMaQsfQV9nju3ScE/+0C/MSYVvDx5sbRvi1XuutBbCAZtlUa7Rn7S8/X08XLFasM7KhFz7AH2Hvvi1i3Cg1WqkRKzpXE/uxntZ/qZxBdpa2WEN/phD4LgmmCbzKJYflhJNKJnYQZxGveGsdexdrDpEbajVECBw/0ntS5/YYaLxzqCrNGyCRdAajIccuOLQjRGzr9U5mdzVpHhkCLjbIDQ1JHxtb9nHxNgvGep7z0UCqawdcJN2nEr1D7Khu7Mh8mryR7iBxqEdPfdARuQn3kMFH+YA5NASTus9p/MR1cavJmBq3u88oNje8q+szkBsQDb1h0n0eAzjjDXRSxgm8bdtpi07TjTNCc+AmhYiym+MYXmbxqMO6pnjjE1I+ht3a8zUU0= borg
```

### Step 2: create `borg-append-only` SSH key pair (if using BorgBase or rsync.net)

When asked for file in which to save key, enter `borg-append-only`.

When asked for passphrase, leave field empty for no passphrase (this public key will be used for append-only operations).

Use `borg-append-only.pub` public key when configuring Borg server.

```console
$ ssh-keygen -t rsa -C "borg-append-only"
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/sunknudsen/.ssh/id_rsa): borg-append-only
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in borg-append-only.
Your public key has been saved in borg-append-only.pub.
The key fingerprint is:
SHA256:Se6MQbWpFg0lWI2+fJ1IVPtUCs/ZRYrgtpz4F3hi2ow borg-append-only
The key's randomart image is:
+---[RSA 3072]----+
|     o++o.+   ..o|
|    . .=o+ * * o |
|     .o.= + B o  |
|     ..=.= *     |
|     .+oSoB.+    |
|     .o=oBoo .   |
|      ..E + .    |
|           .     |
|                 |
+----[SHA256]-----+

$ cat borg-append-only.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC2cmGUEKwopEN0vpHl2yNoV/wvm21D1hOP/8V886iCawgYpP5SUNpuVTDEgZEFJSvTMtfPaBicln0ULx8bp5NAiOQ8uPIvJD3xaacwISwvCVSYXY8jnQG3eRuhbKCU0aVFLONjnAvo288+NWbVcLw8Y166MPyk+tVz76plmv0LGefrZ0yPG99MngR3E5BLQk1EWQoH1kWGGHNFecFtMLq3usX23Ee4e605gfkWWoj7xSgpujfCHi/re6u7B25cn5t2eR7Ee0qRe/O2Sid2yIma7zK2l9NA0+k7pGngyXUTnGx9bI4+xM5qY0ZJcOQk03UJh52Gx8zXFASOxdGO71FiHvYKz60yyd5dUetPcBOYUygdejdBeBS36bh6SisXE/iI6aOfB/ViZd2ZNne1Fb7ijakyNsDCVEAWkMGJxnN8ZCapGsfG9YhKk/fU92Yxjos+AB1IC3M9Qjq5p8fZGsKdRtzJ3zxtTyk5dQEziAbmBVIJYyFohx/aCUB+MVF9xaM= borg-append-only
```

### Step 3: configure SSH keys and create repo (if using BorgBase)

#### Configure SSH keys

Go to [SSH Keys](https://www.borgbase.com/account) and add `borg.pub` and `borg-append-only.pub` keys.

![Add SSH key](./borgbase-add-ssh-key.png)

![SSH keys](./borgbase-ssh-keys.png)

#### Create repo

Go to [Repositories](https://www.borgbase.com/account) and add repository.

![Add repository](./borgbase-add-repository.png)

![Repositories](./borgbase-repositories.png)

### Step 4: generate and upload `authorized_keys` file (if using rsync.net)

#### Set environment variables

```shell
BORG_USERNAME="18434"
BORG_STORAGE_QUOTA="500G"
BORG_HOSTNAME="ch-s011.rsync.net"
```

#### Generate `authorized_keys` file

```shell
cat << EOF > ~/Desktop/authorized_keys
command="borg1 serve --restrict-to-repository /data1/home/$BORG_USERNAME/backup --storage-quota $BORG_STORAGE_QUOTA",restrict $(cat ~/.ssh/borg.pub)
command="borg1 serve --append-only --restrict-to-repository /data1/home/$BORG_USERNAME/backup --storage-quota $BORG_STORAGE_QUOTA",restrict $(cat ~/.ssh/borg-append-only.pub)
EOF
```

#### Upload `authorized_keys` file

```shell
scp ~/Desktop/authorized_keys $BORG_USERNAME@$BORG_HOSTNAME:.ssh/authorized_keys
```

### Step 5: install [Homebrew](https://brew.sh/)

```console
$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

$ uname -m | grep arm64 && echo 'export PATH=$PATH:/opt/homebrew/bin' >> ~/.zshrc && source ~/.zshrc
```

### Step 6: disable Homebrew analytics

```shell
brew analytics off
```

### Step 7: install [FUSE for macOS](https://osxfuse.github.io/), [Borg](https://www.borgbackup.org/) and [Borg Wrapper](https://github.com/sunknudsen/borg-wrapper)

> Heads-up: when installing Borg using `brew install borgbackup`, one can no longer run `brew mount` (see [issue](https://github.com/borgbackup/borg/issues/5522)) so I created a [tap](https://github.com/borgbackup/homebrew-tap) that includes a patched version of [borgbackup](https://formulae.brew.sh/formula/borgbackup) called [borgbackup-fuse](https://github.com/borgbackup/homebrew-tap/blob/master/Formula/borgbackup-fuse.rb).

> Heads-up: if `brew install --cask macfuse` fails, try `brew cask install macfuse` (see [issue](https://github.com/Homebrew/brew/issues/9382)).

```shell
brew install --cask macfuse
brew install borgbackup/tap/borgbackup-fuse
brew install --cask sunknudsen/tap/borg-wrapper
```

### Step 8: configure Borg

#### Generate Borg passphrase using `openssl` and add passphrase to “Keychain Access”

```shell
security add-generic-password -D secret -U -a $USER -s borg-passphrase -w $(openssl rand -base64 24)
```

#### Initialize Borg repo

> Heads-up: replace `borg@185.112.147.115:backup` with self-hosted or cloud-based repo.

```console
$ export BORG_PASSCOMMAND="security find-generic-password -a $USER -s borg-passphrase -w"

$ export BORG_RSH="ssh -i ~/.ssh/borg"

$ borg init --encryption=keyfile-blake2 "borg@185.112.147.115:backup"
Enter passphrase for key '/Users/sunknudsen/.ssh/borg':

By default repositories initialized with this version will produce security
errors if written to with an older version (up to and including Borg 1.0.8).

If you want to use these older versions, you can disable the check by running:
borg upgrade --disable-tam ssh://borg@185.112.147.115/./backup

See https://borgbackup.readthedocs.io/en/stable/changes.html#pre-1-0-9-manifest-spoofing-vulnerability for details about the security implications.

IMPORTANT: you will need both KEY AND PASSPHRASE to access this repo!
Use "borg key export" to export the key, optionally in printable format.
Write down the passphrase. Store both at safe place(s).

```

#### Back up `~/.config/borg` and `~/Library/Keychains` folders (learn how [here](../how-to-back-up-and-encrypt-data-using-rsync-and-veracrypt-on-macos))

> Heads-up: both key (stored in `~/.config/borg`) and passphrase (stored in `~/Library/Keychains`) are required to decrypt backup.

### Step 9: set environment variables

> Heads-up: replace `borg@185.112.147.115:backup` with self-hosted or cloud-based repo and set backup name.

```shell
BORG_REPO="borg@185.112.147.115:backup"
BACKUP_NAME="$USER-macbook-pro"
```

### Step 10: create `/usr/local/bin/borg-backup.sh` script

```shell
cat << EOF > /usr/local/bin/borg-backup.sh
#! /bin/sh

set -e

repo="$BORG_REPO"
prefix="$BACKUP_NAME-"

export BORG_PASSCOMMAND="security find-generic-password -a $USER -s borg-passphrase -w"
export BORG_RSH="ssh -i ~/.ssh/borg-append-only"

borg create \\
  --filter "AME" \\
  --list \\
  --stats \\
  --verbose \\
  "\$repo::\$prefix{now:%F-%H%M%S}" \\
  "$HOME/.ssh" \\
  "$HOME/Library/Keychains"

printf "%s\n" "Done"
EOF
chmod +x /usr/local/bin/borg-backup.sh
```

### Step 11: edit `/usr/local/bin/borg-backup.sh` script

```shell
vi /usr/local/bin/borg-backup.sh
```

### Step 12: create `/usr/local/bin/borg-list.sh` script

```shell
cat << EOF > /usr/local/bin/borg-list.sh
#! /bin/sh

set -e

prefix="$BACKUP_NAME-"
repo="$BORG_REPO"

export BORG_PASSCOMMAND="security find-generic-password -a $USER -s borg-passphrase -w"
export BORG_RSH="ssh -i ~/.ssh/borg-append-only"

borg list --prefix "\$prefix" "\$repo"

printf "%s\n" "Done"
EOF
chmod +x /usr/local/bin/borg-list.sh
```

### Step 13: create `/usr/local/bin/borg-check.sh` script

```shell
cat << EOF > /usr/local/bin/borg-check.sh
#! /bin/sh

set -e

prefix="$BACKUP_NAME-"
repo="$BORG_REPO"

export BORG_PASSCOMMAND="security find-generic-password -a $USER -s borg-passphrase -w"
export BORG_RSH="ssh -i ~/.ssh/borg-append-only"

borg check --prefix "\$prefix" "\$repo"

printf "%s\n" "Done"
EOF
chmod +x /usr/local/bin/borg-check.sh
```

### Step 14: create `/usr/local/bin/borg-restore.sh` script

```shell
cat << EOF > /usr/local/bin/borg-restore.sh
#! /bin/sh

set -e

function umount()
{
  if [ -d "\$mount_point" ]; then
    borg umount \$mount_point
  fi
}

trap umount ERR INT

mount_point="\${TMPDIR}borg"
prefix="$BACKUP_NAME-"
repo="$BORG_REPO"

mkdir -p \$mount_point

export BORG_PASSCOMMAND="security find-generic-password -a $USER -s borg-passphrase -w"
export BORG_RSH="ssh -i ~/.ssh/borg-append-only"

borg mount --prefix "\$prefix" "\$repo" "\$mount_point"

open \$mount_point

printf "Restore data and press enter"

read -r answer

umount

printf "%s\n" "Done"
EOF
chmod +x /usr/local/bin/borg-restore.sh
```

### Step 15: create `/usr/local/bin/borg-prune.sh` script

```shell
cat << EOF > /usr/local/bin/borg-prune.sh
#! /bin/sh

set -e

prefix="$BACKUP_NAME-"
repo="$BORG_REPO"

export BORG_PASSCOMMAND="security find-generic-password -a $USER -s borg-passphrase -w"
export BORG_RSH="ssh -i ~/.ssh/borg"

borg prune --keep-hourly 24 --keep-daily 31 --keep-weekly 52 --keep-monthly -1 --list --prefix "\$prefix" --stats "\$repo"

printf "%s\n" "Done"
EOF
chmod +x /usr/local/bin/borg-prune.sh
```

### Step 16: create `/usr/local/var/log` directory

```shell
mkdir -p /usr/local/var/log
```

### Step 17: run “Borg Wrapper”

```shell
open /Applications/Borg\ Wrapper.app
```

> Heads-up: given “Borg Wrapper” is developed outside the [Apple Developer Program](https://developer.apple.com/programs/), macOS prevents opening the app without explicit user consent (granted by clicking “Open Anyway” in “System Preferences” / “Privacy & Security”).

![Allow app 1](./allow-app-1.png)

![Allow app 2](./allow-app-2.png)

![Allow app 3](./allow-app-3.png)

Backup completed

👍

### Step 18: schedule backup every hour using launchd

```shell
mkdir -p ~/Library/LaunchAgents
cat << "EOF" > ~/Library/LaunchAgents/local.borg-wrapper.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
    <string>local.borg-wrapper</string>

    <key>ProgramArguments</key>
    <array>
      <string>open</string>
      <string>/Applications/Borg Wrapper.app</string>
    </array>

    <key>RunAtLoad</key>
    <false/>

    <key>StartCalendarInterval</key>
    <dict>
      <key>Minute</key>
      <integer>0</integer>
    </dict>
  </dict>
</plist>
EOF
launchctl load ~/Library/LaunchAgents/local.borg-wrapper.plist
```

👍

---

## Usage guide

### Backup

```console
$ borg-backup.sh
Creating archive at "borg@185.112.147.115:backup::sunknudsen-macbook-pro-{now:%F-%H%M%S}"
A /Users/sunknudsen/Library/Keychains/4FD89B1C-70AF-58EC-8026-35E97A08F9FE/keychain-2.db-wal
Remote: Storage quota: 314.36 kB out of 10.00 GB used.
Remote: Storage quota: 318.04 kB out of 10.00 GB used.
------------------------------------------------------------------------------
Archive name: sunknudsen-macbook-pro-2020-12-02-081439
Archive fingerprint: 781c5ca9dac166264250bdbe2c87aa1f9fb5f817cafd66d1e720dfdaa443f625
Time (start): Wed, 2020-12-02 08:14:41
Time (end):   Wed, 2020-12-02 08:14:42
Duration: 0.29 seconds
Number of files: 28
Utilization of max. archive size: 0%
------------------------------------------------------------------------------
                       Original size      Compressed size    Deduplicated size
This archive:                6.81 MB            312.77 kB              3.54 kB
All archives:               13.62 MB            625.53 kB            316.18 kB

                       Unique chunks         Total chunks
Chunk index:                      29                   56
------------------------------------------------------------------------------
Done
```

Done

👍

### List

```console
$ borg-list.sh
sunknudsen-macbook-pro-2020-12-02-081338 Wed, 2020-12-02 08:13:41 [c01b3400ec076adb993a2c268cd48810da9acc122614cdc4c87e00075464c1ee]
sunknudsen-macbook-pro-2020-12-02-081439 Wed, 2020-12-02 08:14:41 [781c5ca9dac166264250bdbe2c87aa1f9fb5f817cafd66d1e720dfdaa443f625]
Done
```

Done

👍

### Check

```console
$ borg-check.sh
Done
```

Done

👍

### Restore

```console
$ borg-restore.sh
mount_macfuse: the file system is not available (1)
umount: /var/folders/dl/mbmsd2m51nb8dvhmtz114j8w0000gn/T/borg: not currently mounted
```

> Heads-up: given “FUSE for macOS” is a third-party extension, macOS prevents using the extension without explicit user consent (granted by clicking “Allow” in “System Preferences” / “Privacy & Security”).

![Allow extension 1](./allow-extension-1.png)

![Allow extension 2](./allow-extension-2.png)

```console
$ borg-restore.sh
Restore data and press enter
Done
```

Done

👍

### Prune

```console
$ borg-prune.sh
Enter passphrase for key '/Users/sunknudsen/.ssh/borg':
Keeping archive: sunknudsen-macbook-pro-2020-12-02-081439 Wed, 2020-12-02 08:14:41 [781c5ca9dac166264250bdbe2c87aa1f9fb5f817cafd66d1e720dfdaa443f625]
Pruning archive: sunknudsen-macbook-pro-2020-12-02-081338 Wed, 2020-12-02 08:13:41 [c01b3400ec076adb993a2c268cd48810da9acc122614cdc4c87e00075464c1ee] (1/1)
------------------------------------------------------------------------------
                       Original size      Compressed size    Deduplicated size
Deleted data:               -6.81 MB           -312.76 kB             -3.52 kB
All archives:                6.81 MB            312.77 kB            312.65 kB

                       Unique chunks         Total chunks
Chunk index:                      27                   28
------------------------------------------------------------------------------
Done
```

Done

👍


# How to self-host hardened Borg server

[![How to self-host hardened Borg server](how-to-self-host-hardened-borg-server.jpg)](https://www.youtube.com/watch?v=rzEaxL6F2Eg "How to self-host hardened Borg server")

## Requirements

- [Hardened Debian server](../how-to-configure-hardened-debian-server) or [hardened Raspberry Pi](../how-to-configure-hardened-raspberry-pi)
- Linux or macOS computer

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- When copy/pasting commands that start with `cat << "EOF"`, select all lines at once (from `cat << "EOF"` to `EOF` inclusively) as they are part of the same (single) command

## Setup guide

### Step 1: create `borg` SSH key pair (on computer)

When asked for file in which to save key, enter `borg`.

When asked for passphrase, use output from `openssl rand -base64 24` (and store passphrase in password manager).

```console
$ mkdir ~/.ssh

$ cd ~/.ssh

$ ssh-keygen -t rsa -C "borg"
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/sunknudsen/.ssh/id_rsa): borg
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in borg.
Your public key has been saved in borg.pub.
The key fingerprint is:
SHA256:9DzU/jDPyR/vGe8k2Yn1p31wF8UxLzCmYEj//D6+oYk borg
The key's randomart image is:
+---[RSA 3072]----+
|     ...o   +  +.|
|      .o . + o  =|
|        o o . . o|
|       . * .   o |
|        S * +  ..|
|           o B++=|
|            o.O**|
|         . +.. *O|
|        E o.+o.+O|
+----[SHA256]-----+

$ cat borg.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCwCdu7RCOmISZQ5cr43lDRPrFoxCXcVfCREYsdTIBEoQrIwyg1jZyzQMf9kORIGcNe5+olIj1aK9qVg0hCEeDSJosSsMP5o8tQJzNu5aYCtnADlZ+AuCgp5CpL1vECMaQsfQV9nju3ScE/+0C/MSYVvDx5sbRvi1XuutBbCAZtlUa7Rn7S8/X08XLFasM7KhFz7AH2Hvvi1i3Cg1WqkRKzpXE/uxntZ/qZxBdpa2WEN/phD4LgmmCbzKJYflhJNKJnYQZxGveGsdexdrDpEbajVECBw/0ntS5/YYaLxzqCrNGyCRdAajIccuOLQjRGzr9U5mdzVpHhkCLjbIDQ1JHxtb9nHxNgvGep7z0UCqawdcJN2nEr1D7Khu7Mh8mryR7iBxqEdPfdARuQn3kMFH+YA5NASTus9p/MR1cavJmBq3u88oNje8q+szkBsQDb1h0n0eAzjjDXRSxgm8bdtpi07TjTNCc+AmhYiym+MYXmbxqMO6pnjjE1I+ht3a8zUU0= borg
```

### Step 2: create `borg-append-only` SSH key pair (on computer)

When asked for file in which to save key, enter `borg-append-only`.

When asked for passphrase, leave field empty for no passphrase.

```console
$ ssh-keygen -t rsa -C "borg-append-only"
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/sunknudsen/.ssh/id_rsa): borg-append-only
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in borg-append-only.
Your public key has been saved in borg-append-only.pub.
The key fingerprint is:
SHA256:Se6MQbWpFg0lWI2+fJ1IVPtUCs/ZRYrgtpz4F3hi2ow borg-append-only
The key's randomart image is:
+---[RSA 3072]----+
|         +....   |
|         .B o..  |
|         ooB.o ..|
|         .E.....+|
|        S. o. oo+|
|        . o o.o+=|
|       . o = +**+|
|        o o o.*=B|
|         . . o o=|
+----[SHA256]-----+

$ cat borg-append-only.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC2cmGUEKwopEN0vpHl2yNoV/wvm21D1hOP/8V886iCawgYpP5SUNpuVTDEgZEFJSvTMtfPaBicln0ULx8bp5NAiOQ8uPIvJD3xaacwISwvCVSYXY8jnQG3eRuhbKCU0aVFLONjnAvo288+NWbVcLw8Y166MPyk+tVz76plmv0LGefrZ0yPG99MngR3E5BLQk1EWQoH1kWGGHNFecFtMLq3usX23Ee4e605gfkWWoj7xSgpujfCHi/re6u7B25cn5t2eR7Ee0qRe/O2Sid2yIma7zK2l9NA0+k7pGngyXUTnGx9bI4+xM5qY0ZJcOQk03UJh52Gx8zXFASOxdGO71FiHvYKz60yyd5dUetPcBOYUygdejdBeBS36bh6SisXE/iI6aOfB/ViZd2ZNne1Fb7ijakyNsDCVEAWkMGJxnN8ZCapGsfG9YhKk/fU92Yxjos+AB1IC3M9Qjq5p8fZGsKdRtzJ3zxtTyk5dQEziAbmBVIJYyFohx/aCUB+MVF9xaM= borg-append-only
```

### Step 3: generate SSH authorized keys heredoc (on computer)

#### Set Borg storage quota environment variable

```shell
BORG_STORAGE_QUOTA="10G"
```

#### Generate heredoc (the output of following command will be used at [step 8](#create-homeborgsshauthorized_keys-using-heredoc-generated-at-step-2))

```shell
cat << EOF
cat << "_EOF" > /home/borg/.ssh/authorized_keys
command="borg serve --restrict-to-repository /home/borg/backup --storage-quota $BORG_STORAGE_QUOTA",restrict $(cat ~/.ssh/borg.pub)
command="borg serve --append-only --restrict-to-repository /home/borg/backup --storage-quota $BORG_STORAGE_QUOTA",restrict $(cat ~/.ssh/borg-append-only.pub)
_EOF
EOF
```

### Step 4: log in to server or Raspberry Pi

> Heads-up: replace `~/.ssh/server` with path to private key and `server-admin@185.112.147.115` with server or Raspberry Pi SSH destination.

```shell
ssh -i ~/.ssh/server server-admin@185.112.147.115
```

### Step 5: switch to root

When asked, enter root password.

```shell
su -
```

### Step 6: create `borg` user

When asked for password, use output from `openssl rand -base64 24` (and store password in password manager).

All other fields are optional, press <kbd>enter</kbd> to skip them and then press <kbd>Y</kbd>.

```console
$ adduser borg
Adding user `borg' ...
Adding new group `borg' (1000) ...
Adding new user `borg' (1000) with group `borg' ...
Creating home directory `/home/borg' ...
Copying files from `/etc/skel' ...
New password:
Retype new password:
passwd: password updated successfully
Changing the user information for borg
Enter the new value, or press ENTER for the default
	Full Name []:
	Room Number []:
	Work Phone []:
	Home Phone []:
	Other []:
Is the information correct? [Y/n] Y
```

### Step 7: update APT index

```shell
apt update
```

### Step 8: install [Borg](https://github.com/borgbackup/borg)

```shell
apt install -y borgbackup
```

### Step 9: configure borg SSH authorized keys

#### Create `.ssh` directory

```shell
mkdir -p /home/borg/.ssh
```

#### Create `/home/borg/.ssh/authorized_keys` using heredoc generated at [step 2](#generate-heredoc-the-output-of-following-command-will-be-used-at-step-8)

```shell
cat << "_EOF" > /home/borg/.ssh/authorized_keys
command="borg serve --restrict-to-repository /home/borg/backup --storage-quota 10G",restrict ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCwCdu7RCOmISZQ5cr43lDRPrFoxCXcVfCREYsdTIBEoQrIwyg1jZyzQMf9kORIGcNe5+olIj1aK9qVg0hCEeDSJosSsMP5o8tQJzNu5aYCtnADlZ+AuCgp5CpL1vECMaQsfQV9nju3ScE/+0C/MSYVvDx5sbRvi1XuutBbCAZtlUa7Rn7S8/X08XLFasM7KhFz7AH2Hvvi1i3Cg1WqkRKzpXE/uxntZ/qZxBdpa2WEN/phD4LgmmCbzKJYflhJNKJnYQZxGveGsdexdrDpEbajVECBw/0ntS5/YYaLxzqCrNGyCRdAajIccuOLQjRGzr9U5mdzVpHhkCLjbIDQ1JHxtb9nHxNgvGep7z0UCqawdcJN2nEr1D7Khu7Mh8mryR7iBxqEdPfdARuQn3kMFH+YA5NASTus9p/MR1cavJmBq3u88oNje8q+szkBsQDb1h0n0eAzjjDXRSxgm8bdtpi07TjTNCc+AmhYiym+MYXmbxqMO6pnjjE1I+ht3a8zUU0= borg
command="borg serve --append-only --restrict-to-repository /home/borg/backup --storage-quota 10G",restrict ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC2cmGUEKwopEN0vpHl2yNoV/wvm21D1hOP/8V886iCawgYpP5SUNpuVTDEgZEFJSvTMtfPaBicln0ULx8bp5NAiOQ8uPIvJD3xaacwISwvCVSYXY8jnQG3eRuhbKCU0aVFLONjnAvo288+NWbVcLw8Y166MPyk+tVz76plmv0LGefrZ0yPG99MngR3E5BLQk1EWQoH1kWGGHNFecFtMLq3usX23Ee4e605gfkWWoj7xSgpujfCHi/re6u7B25cn5t2eR7Ee0qRe/O2Sid2yIma7zK2l9NA0+k7pGngyXUTnGx9bI4+xM5qY0ZJcOQk03UJh52Gx8zXFASOxdGO71FiHvYKz60yyd5dUetPcBOYUygdejdBeBS36bh6SisXE/iI6aOfB/ViZd2ZNne1Fb7ijakyNsDCVEAWkMGJxnN8ZCapGsfG9YhKk/fU92Yxjos+AB1IC3M9Qjq5p8fZGsKdRtzJ3zxtTyk5dQEziAbmBVIJYyFohx/aCUB+MVF9xaM= borg-append-only
_EOF
```

#### Change ownership of `/home/borg/.ssh`

```
chown -R borg:borg /home/borg/.ssh
```

👍


# How to configure hardened Raspberry Pi

[![How to configure hardened Raspberry Pi](how-to-configure-hardened-raspberry-pi.jpg)](https://www.youtube.com/watch?v=6R8uKdstnts "How to configure hardened Raspberry Pi")

## Requirements

- [Raspberry Pi 4](https://www.raspberrypi.com/products/raspberry-pi-4-model-b/)
- microSD card or external solid state drive (with USB-A connector)
- microSD card reader or secure digital (SD) card reader with microSD to SD adapter (if using microSD card)
- USB-C power adapter (minimum 3A)
- Keyboard (with USB-A connector)
- Micro HDMI to HDMI cable
- macOS or Linux computer

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- When copy/pasting commands that start with `cat << "EOF"`, select all lines at once (from `cat << "EOF"` to `EOF` inclusively) as they are part of the same (single) command

## Guide

### Step 1: create SSH key pair (on macOS)

When asked for file in which to save key, enter `pi`.

When asked for passphrase, use output from `openssl rand -base64 24` (and store passphrase in password manager).

```console
$ mkdir ~/.ssh

$ cd ~/.ssh

$ ssh-keygen -t ed25519 -C "pi"
Generating public/private ed25519 key pair.
Enter file in which to save the key (/Users/sunknudsen/.ssh/id_ed25519): pi
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in pi.
Your public key has been saved in pi.pub.
The key fingerprint is:
SHA256:U3hEUQC0GAyCOPaks1Xv04ouoN9ezwtfK4CnUxKqAms pi
The key's randomart image is:
+--[ED25519 256]--+
|... .o..oo=+.    |
|+. o ..o +       |
|..+ . o o o      |
| o o.  . o       |
|  +. o. S        |
|.o. o +o o       |
|oo.  =+.o .      |
|=E ooo *.. .     |
|o...=o  =o.      |
+----[SHA256]-----+

$ cat pi.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLwQ2fk5VvoKJ6PNdJfmtum6fTAIn7xG5vbFm0YjEGY pi
```

### Step 2: generate heredoc (the output of following command will be used at [step 13](#step-13-configure-pi-ssh-authorized-keys))

```shell
cat << EOF
cat << "_EOF" > ~/.ssh/authorized_keys
$(cat ~/.ssh/pi.pub)
_EOF
EOF
```

### Step 3: download latest version of 64-bit [Raspberry Pi OS Lite](https://www.raspberrypi.com/software/operating-systems/#raspberry-pi-os-64-bit)

### Step 4: copy “Raspberry Pi OS Lite” to microSD card or external solid state drive (follow [these](./misc/how-to-copy-raspberry-pi-os-lite-to-microsd-card-or-external-solid-state-drive-on-linux) steps instead of step 4 if on Linux)

> **WARNING: BE VERY CAREFUL WHEN RUNNING `DD` AS DATA CAN BE PERMANENTLY DESTROYED (BEGINNERS SHOULD CONSIDER USING [BALENAETCHER](https://www.balena.io/etcher/) INSTEAD).**

> Heads-up: run `diskutil list` to find disk ID of microSD card or external solid state drive to overwrite with “Raspberry Pi OS Lite” (`disk4` in the following example).

> Heads-up: replace `diskn` and `rdiskn` with disk ID of microSD card or external solid state drive (`disk4` and `rdisk4` in the following example) and `2022-04-04-raspios-bullseye-arm64-lite.img` with current image.

```console
$ diskutil list
/dev/disk0 (internal):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                         500.3 GB   disk0
   1:             Apple_APFS_ISC                         524.3 MB   disk0s1
   2:                 Apple_APFS Container disk3         494.4 GB   disk0s2
   3:        Apple_APFS_Recovery                         5.4 GB     disk0s3

/dev/disk3 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +494.4 GB   disk3
                                 Physical Store disk0s2
   1:                APFS Volume Macintosh HD            15.3 GB    disk3s1
   2:              APFS Snapshot com.apple.os.update-... 15.3 GB    disk3s1s1
   3:                APFS Volume Preboot                 412.4 MB   disk3s2
   4:                APFS Volume Recovery                807.3 MB   disk3s3
   5:                APFS Volume Data                    384.5 GB   disk3s5
   6:                APFS Volume VM                      2.1 GB     disk3s6

/dev/disk4 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     FDisk_partition_scheme                        *15.9 GB    disk4
   1:               Windows_NTFS Untitled                15.9 GB    disk4s1

$ sudo diskutil unmount /dev/diskn
disk4 was already unmounted or it has a partitioning scheme so use "diskutil unmountDisk" instead

$ sudo diskutil unmountDisk /dev/diskn (if previous step fails)
Unmount of all volumes on disk4 was successful

$ sudo dd bs=1m if=$HOME/Downloads/2022-04-04-raspios-bullseye-arm64-lite.img of=/dev/rdiskn
1908+0 records in
1908+0 records out
2000683008 bytes transferred in 38.390485 secs (52114033 bytes/sec)

$ sudo diskutil unmountDisk /dev/diskn
Unmount of all volumes on disk4 was successful
```

### Step 5: configure keyboard

### Step 6: create user

When asked for user, use `pi-admin`.

When asked for password, use output from `openssl rand -base64 24` (and store password in password manager).

### Step 7: configure Wi-Fi (if not using ethernet)

```shell
sudo raspi-config
```

Select “System Options”, then “Wireless LAN”, choose country, then select “OK”, enter “SSID” and, finally, enter passphrase.

### Step 8: disable auto login

```shell
sudo raspi-config
```

Select “System Options”, then “Boot / Auto Login” and, finally, select “Console”.

### Step 9: enable SSH

```shell
sudo raspi-config
```

Select “Interface Options”, then “SSH”, then “Yes”, then “OK” and, finally, select “Finish”.

When asked if you wish to reboot, select “No”.

### Step 10: find IP of Raspberry Pi (see `eth0` if using ethernet or `wlan0` if using Wi-Fi)

```shell
ip a
```

### Step 11: log in to Raspberry Pi over SSH

> Heads-up: replace `10.0.1.94` with IP of Raspberry Pi.

> Heads-up: when asked for passphrase, enter passphrase from [step 5](#step-6-create-user).

```shell
ssh pi-admin@10.0.1.94
```

### Step 12: disable pi Bash history

```shell
sed -i -E 's/^HISTSIZE=/#HISTSIZE=/' ~/.bashrc
sed -i -E 's/^HISTFILESIZE=/#HISTFILESIZE=/' ~/.bashrc
echo "HISTFILESIZE=0" >> ~/.bashrc
history -c; history -w
source ~/.bashrc
```

### Step 13: configure pi SSH authorized keys

#### Create `.ssh` directory

```shell
mkdir ~/.ssh
```

#### Create `~/.ssh/authorized_keys` using heredoc generated at [step 2](#step-2-generate-heredoc-the-output-of-following-command-will-be-used-at-step-13)

```shell
cat << "_EOF" > ~/.ssh/authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLwQ2fk5VvoKJ6PNdJfmtum6fTAIn7xG5vbFm0YjEGY pi
_EOF
```

### Step 14: log out

```shell
exit
```

### Step 15: log in

> Heads-up: replace `10.0.1.94` with IP of Raspberry Pi.

> Heads-up: when asked for passphrase, enter passphrase from [step 1](#step-1-create-ssh-key-pair-on-macos).

```shell
ssh -i ~/.ssh/pi pi-admin@10.0.1.94
```

### Step 16: switch to root

```shell
sudo su -
```

### Step 17: disable root Bash history

```shell
echo "HISTFILESIZE=0" >> ~/.bashrc
history -c; history -w
source ~/.bashrc
```

### Step 18: disable pi sudo `nopassword` “feature”

```shell
rm /etc/sudoers.d/010_*
```

### Step 19: set root password

When asked for password, use output from `openssl rand -base64 24` (and store password in password manager).

```console
$ passwd
New password:
Retype new password:
passwd: password updated successfully
```

### Step 20: disable root login and password authentication

```shell
sed -i -E 's/^(#)?PermitRootLogin (prohibit-password|yes)/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i -E 's/^(#)?PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart ssh
```

### Step 21: disable Bluetooth and Wi-Fi

> Heads-up: step will take effect after reboot.

#### Disable Bluetooth

```shell
echo "dtoverlay=disable-bt" >> /boot/config.txt
```

#### Disable Wi-Fi (if using ethernet)

```shell
echo "dtoverlay=disable-wifi" >> /boot/config.txt
```

### Step 22: configure sysctl (if network is IPv4-only)

> Heads-up: only run following if network is IPv4-only.

```shell
cp /etc/sysctl.conf /etc/sysctl.conf.backup
cat << "EOF" >> /etc/sysctl.conf
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
EOF
sysctl -p
```

### Step 23: enable nftables and configure firewall rules

#### Enable nftables

```shell
systemctl enable nftables
systemctl start nftables
```

#### Configure firewall rules

```shell
nft flush ruleset
nft add table ip firewall
nft add chain ip firewall input { type filter hook input priority 0 \; policy drop \; }
nft add rule ip firewall input iif lo accept
nft add rule ip firewall input iif != lo ip daddr 127.0.0.0/8 drop
nft add rule ip firewall input tcp dport ssh accept
nft add rule ip firewall input ct state established,related accept
nft add chain ip firewall forward { type filter hook forward priority 0 \; policy drop \; }
nft add chain ip firewall output { type filter hook output priority 0 \; policy drop \; }
nft add rule ip firewall output oif lo accept
nft add rule ip firewall output tcp dport { http, https } accept
nft add rule ip firewall output udp dport { domain, ntp } accept
nft add rule ip firewall output ct state established,related accept
```

If network is IPv4-only, run:

```shell
nft add table ip6 firewall
nft add chain ip6 firewall input { type filter hook input priority 0 \; policy drop \; }
nft add chain ip6 firewall forward { type filter hook forward priority 0 \; policy drop \; }
nft add chain ip6 firewall output { type filter hook output priority 0 \; policy drop \; }
```

If network is dual stack (IPv4 + IPv6) run:

```shell
nft add table ip6 firewall
nft add chain ip6 firewall input { type filter hook input priority 0\; policy drop\; }
nft add rule ip6 firewall input iif lo accept
nft add rule ip6 firewall input iif != lo ip6 daddr ::1 drop
nft add rule ip6 firewall input meta l4proto ipv6-icmp icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept
nft add rule ip6 firewall input meta l4proto ipv6-icmp icmpv6 type { nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect } ip6 hoplimit 255 accept
nft add rule ip6 firewall input tcp dport ssh accept
nft add rule ip6 firewall input ct state established,related accept
nft add chain ip6 firewall forward { type filter hook forward priority 0\; policy drop\; }
nft add chain ip6 firewall output { type filter hook output priority 0\; policy drop\; }
nft add rule ip6 firewall output oif lo accept
nft add rule ip6 firewall output meta l4proto ipv6-icmp icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept
nft add rule ip6 firewall output meta l4proto ipv6-icmp icmpv6 type { nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } ip6 hoplimit 255 accept
nft add rule ip6 firewall output tcp dport { http, https } accept
nft add rule ip6 firewall output udp dport { domain, ntp } accept
nft add rule ip6 firewall output ct state related,established accept
```

### Step 24: log out and log in to confirm firewall is not blocking SSH

#### Log out

```console
$ exit

$ exit
```

#### Log in

> Heads-up: replace `10.0.1.94` with IP of Raspberry Pi.

```shell
ssh -i ~/.ssh/pi pi-admin@10.0.1.94
```

### Step 25: switch to root

```shell
sudo su -
```

### Step 26: make firewall rules persistent

```shell
cat << "EOF" > /etc/nftables.conf
#!/usr/sbin/nft -f

flush ruleset

EOF
```

```shell
nft list ruleset >> /etc/nftables.conf
```

### Step 27: set timezone

See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones

```shell
timedatectl set-timezone America/Montreal
```

### Step 28: disable swap

```shell
systemctl disable dphys-swapfile
```

### Step 29: update APT index and upgrade packages

```console
$ apt update

$ apt upgrade -y
```

👍


# How to configure hardened Debian server

[![How to configure hardened Debian server](how-to-configure-hardened-debian-server.jpg)](https://www.youtube.com/watch?v=z8hizZRX5-4 "How to configure hardened Debian server")

## Requirements

- Computer, virtual private server (VPS) or dedicated server running Debian 10 (buster) or Debian 11 (bullseye) (lean how to install Debian [here](./misc/how-to-install-luks-encrypted-debian-operating-system-using-bootable-installer))
- Linux or macOS computer

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- When copy/pasting commands that start with `cat << "EOF"`, select all lines at once (from `cat << "EOF"` to `EOF` inclusively) as they are part of the same (single) command

## Guide

### Step 1: create SSH key pair (on computer)

When asked for file in which to save key, enter `server`.

When asked for passphrase, use output from `openssl rand -base64 24` (and store passphrase in password manager).

Use `server.pub` public key when setting up server.

```console
$ mkdir ~/.ssh

$ cd ~/.ssh

$ ssh-keygen -t ed25519 -C "server"
Generating public/private ed25519 key pair.
Enter file in which to save the key (/Users/sunknudsen/.ssh/id_ed25519): server
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in server.
Your public key has been saved in server.pub.
The key fingerprint is:
SHA256:NSvs5QpA6xisvKdeW9sPOAVoG4ShO2Ij4WBgB6z3sqk server
The key's randomart image is:
+--[ED25519 256]--+
|o++o             |
|+oo .            |
|=. +..    o      |
|=+o.o... . o     |
|==ooo  .S o      |
|=oo+..o. +       |
|...=.+... .      |
|  =.o +...       |
|E=o. . .o.       |
+----[SHA256]-----+

$ cat server.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE2b7hlrD66EJ+6xxzl9Ae++qmiAz9bBEg7bTwq/9941 server
```

### Step 2: log in to server as root

> Heads-up: replace `185.112.147.115` with IP of server.

> Heads-up: when asked for passphrase, enter passphrase from [step 1](#step-1-create-ssh-key-pair-on-computer).

```shell
ssh -i ~/.ssh/server root@185.112.147.115
```

### Step 3: disable root Bash history

```shell
echo "HISTFILESIZE=0" >> ~/.bashrc
history -c; history -w
source ~/.bashrc
```

### Step 4: set root password

When asked for password, use output from `openssl rand -base64 24` (and store password in password manager).

```console
$ passwd
New password:
Retype new password:
passwd: password updated successfully
```

### Step 5: create server-admin user

When asked for password, use output from `openssl rand -base64 24` (and store password in password manager).

All other fields are optional, press <kbd>enter</kbd> to skip them and then press <kbd>Y</kbd>.

```console
$ adduser server-admin
Adding user `server-admin' ...
Adding new group `server-admin' (1000) ...
Adding new user `server-admin' (1000) with group `server-admin' ...
Creating home directory `/home/server-admin' ...
Copying files from `/etc/skel' ...
New password:
Retype new password:
passwd: password updated successfully
Changing the user information for server-admin
Enter the new value, or press ENTER for the default
	Full Name []:
	Room Number []:
	Work Phone []:
	Home Phone []:
	Other []:
Is the information correct? [Y/n] Y
```

### Step 6: copy root `authorized_keys` file to server-admin home directory

```shell
mkdir /home/server-admin/.ssh
cp /root/.ssh/authorized_keys /home/server-admin/.ssh/authorized_keys
chown -R server-admin:server-admin /home/server-admin/.ssh
```

### Step 7: log out

```shell
exit
```

### Step 8: log in as server-admin

> Heads-up: replace `185.112.147.115` with IP of server.

> Heads-up: when asked for passphrase, enter passphrase from [step 1](#step-1-create-ssh-key-pair-on-computer).

```shell
ssh -i ~/.ssh/server server-admin@185.112.147.115
```

### Step 9: disable server-admin Bash history

```shell
sed -i -E 's/^HISTSIZE=/#HISTSIZE=/' ~/.bashrc
sed -i -E 's/^HISTFILESIZE=/#HISTFILESIZE=/' ~/.bashrc
echo "HISTFILESIZE=0" >> ~/.bashrc
history -c; history -w
source ~/.bashrc
```

### Step 10: switch to root

When asked, enter root password.

```shell
su -
```

### Step 11: disable root login and password authentication

```shell
sed -i -E 's/^(#)?PermitRootLogin (prohibit-password|yes)/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i -E 's/^(#)?PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart ssh
```

### Step 12: configure sysctl (if network is IPv4-only)

> Heads-up: only run the following if network is IPv4-only.

```shell
cp /etc/sysctl.conf /etc/sysctl.conf.backup
cat << "EOF" >> /etc/sysctl.conf
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
EOF
sysctl -p
```

### Step 13: enable nftables and configure firewall rules

#### Update APT index and install nftables

```console
$ apt update

$ apt install -y nftables
```

#### Enable nftables

```shell
systemctl enable nftables
systemctl start nftables
```

#### Configure firewall rules

```shell
nft flush ruleset
nft add table ip firewall
nft add chain ip firewall input { type filter hook input priority 0 \; policy drop \; }
nft add rule ip firewall input iif lo accept
nft add rule ip firewall input iif != lo ip daddr 127.0.0.0/8 drop
nft add rule ip firewall input tcp dport ssh accept
nft add rule ip firewall input ct state established,related accept
nft add chain ip firewall forward { type filter hook forward priority 0 \; policy drop \; }
nft add chain ip firewall output { type filter hook output priority 0 \; policy drop \; }
nft add rule ip firewall output oif lo accept
nft add rule ip firewall output tcp dport { http, https } accept
nft add rule ip firewall output udp dport { domain, ntp } accept
nft add rule ip firewall output ct state established,related accept
```

If network is IPv4-only, run:

```shell
nft add table ip6 firewall
nft add chain ip6 firewall input { type filter hook input priority 0 \; policy drop \; }
nft add chain ip6 firewall forward { type filter hook forward priority 0 \; policy drop \; }
nft add chain ip6 firewall output { type filter hook output priority 0 \; policy drop \; }
```

If network is dual stack (IPv4 + IPv6) run:

```shell
nft add table ip6 firewall
nft add chain ip6 firewall input { type filter hook input priority 0\; policy drop\; }
nft add rule ip6 firewall input iif lo accept
nft add rule ip6 firewall input iif != lo ip6 daddr ::1 drop
nft add rule ip6 firewall input meta l4proto ipv6-icmp icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept
nft add rule ip6 firewall input meta l4proto ipv6-icmp icmpv6 type { nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect } ip6 hoplimit 255 accept
nft add rule ip6 firewall input tcp dport ssh accept
nft add rule ip6 firewall input ct state established,related accept
nft add chain ip6 firewall forward { type filter hook forward priority 0\; policy drop\; }
nft add chain ip6 firewall output { type filter hook output priority 0\; policy drop\; }
nft add rule ip6 firewall output oif lo accept
nft add rule ip6 firewall output meta l4proto ipv6-icmp icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept
nft add rule ip6 firewall output meta l4proto ipv6-icmp icmpv6 type { nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } ip6 hoplimit 255 accept
nft add rule ip6 firewall output tcp dport { http, https } accept
nft add rule ip6 firewall output udp dport { domain, ntp } accept
nft add rule ip6 firewall output ct state related,established accept
```

### Step 14: log out and log in to confirm firewall is not blocking SSH

#### Log out

```console
$ exit

$ exit
```

#### Log in

> Heads-up: replace `185.112.147.115` with IP of server.

> Heads-up: when asked for passphrase, enter passphrase from [step 1](#step-1-create-ssh-key-pair-on-computer).

```shell
ssh -i ~/.ssh/server server-admin@185.112.147.115
```

#### Switch to root

When asked, enter root password.

```shell
su -
```

### Step 15: make firewall rules persistent

```shell
cat << "EOF" > /etc/nftables.conf
#!/usr/sbin/nft -f

flush ruleset

EOF
```

```shell
nft list ruleset >> /etc/nftables.conf
```

### Step 16: update APT index and upgrade packages

```console
$ apt update

$ apt upgrade -y
```

### Step 17: set timezone (the following is for Montreal time)

See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones

```shell
timedatectl set-timezone America/Montreal
```

👍


# How to clean uninstall macOS apps using AppCleaner open source alternative

[![How to clean uninstall macOS apps using AppCleaner open source alternative](how-to-clean-uninstall-macos-apps-using-appcleaner-open-source-alternative.jpg)](https://www.youtube.com/watch?v=0nVOB0EE5ps "How to clean uninstall macOS apps using AppCleaner open source alternative")

## Setup guide

### Step 1: create `/usr/local/bin` directory

```shell
sudo mkdir -p /usr/local/bin
sudo chown ${USER}:staff /usr/local/bin
```

### Step 2: download [app-cleaner.sh](./app-cleaner.sh) ([PGP signature](./app-cleaner.sh.asc), [PGP public key](https://sunknudsen.com/sunknudsen.asc))

```shell
curl --fail --output /usr/local/bin/app-cleaner.sh https://sunknudsen.com/privacy-guides/how-to-clean-uninstall-macos-apps-using-appcleaner-open-source-alternative/app-cleaner.sh
chmod +x /usr/local/bin/app-cleaner.sh
```

👍

---

## Usage guide

```console
$ app-cleaner.sh /Applications/AppCleaner.app
Checking for running processes…
Finding application data…
/Applications/AppCleaner.app
/Users/sunknudsen/Library/Preferences/net.freemacsoft.AppCleaner.plist
/Users/sunknudsen/Library/Saved Application State/net.freemacsoft.AppCleaner.savedState
Move application data to trash (y or n)? y
Moving application data to trash…
Done
```

Done

👍


# Privacy guides docs

## How to contribute

Thanks for contributing. 🙌

**Like project?** Please star [repository](https://github.com/sunknudsen/privacy-guides).

**Found a bug?** Please submit [issue](https://github.com/sunknudsen/privacy-guides/issues) or [signed](#how-to-sign-pull-requests) [pull request](https://github.com/sunknudsen/privacy-guides/pulls).

**Found a security vulnerability?** Please disclose vulnerability privately using the PGP public key and email found on [https://sunknudsen.com/contact](https://sunknudsen.com/contact).

**Wish to support the project?** Please visit [https://sunknudsen.com/donate](https://sunknudsen.com/donate).

## How to get help

Check out [discussions](https://github.com/sunknudsen/privacy-guides/discussions).

## How to sign pull requests

### Step 1: add PGP public key to GitHub account

Go to https://github.com/settings/keys, click “New GPG key”, paste your PGP public key and click “Add GPG key”.

### Step 2: enable Git [signing](https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work)

> Heads-up: replace `0x8C9CA674C47CA060` with your PGP public key ID.

```shell
git config --global commit.gpgsign true
git config --global gpg.program $(which gpg)
git config --global user.signingkey 0x8C9CA674C47CA060
```

### Step 3: submit pull request

👍


# How to back up and encrypt data using rsync and VeraCrypt on macOS

[![How to back up and encrypt data using rsync and VeraCrypt on macOS (see change log)](how-to-back-up-and-encrypt-data-using-rsync-and-veracrypt-on-macos-see-change-log.jpg)](https://www.youtube.com/watch?v=1cz_ViFB6eE "How to back up and encrypt data using rsync and VeraCrypt on macOS (see change log)")

> Heads-up: when using storage devices with wear-leveling (most flash storage devices), it is not possible to securely change password once it has been set (see [Wear-Leveling](https://www.veracrypt.fr/en/Wear-Leveling.html)).

## Requirements

- Computer running macOS Catalina or Big Sur
- USB flash drive or SD card formatted using FAT (4GiB file size limit) or exFAT filesystem (see [Journaling File Systems](https://www.veracrypt.fr/en/Journaling%20File%20Systems.html))

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- When copy/pasting commands that start with `cat << "EOF"`, select all lines at once (from `cat << "EOF"` to `EOF` inclusively) as they are part of the same (single) command

## Setup guide

### Step 1: install [Homebrew](https://brew.sh/)

```console
$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

$ uname -m | grep arm64 && echo 'export PATH=$PATH:/opt/homebrew/bin' >> ~/.zshrc && source ~/.zshrc
```

### Step 2: disable Homebrew analytics

```shell
brew analytics off
```

### Step 3: install [FUSE for macOS](https://osxfuse.github.io/) and [GnuPG](https://gnupg.org/)

> Heads-up: if `brew install --cask macfuse` fails, try `brew cask install macfuse` (see [issue](https://github.com/Homebrew/brew/issues/9382)).

```shell
brew install --cask macfuse
brew install gnupg
```

### Step 4: import VeraCrypt’s public key

```console
$ gpg --keyserver hkps://keys.openpgp.org --recv-keys 0x821ACD02680D16DE
gpg: key 0x821ACD02680D16DE: public key "VeraCrypt Team (2018 - Supersedes Key ID=0x54DDD393) <veracrypt@idrix.fr>" imported
gpg: Total number processed: 1
gpg:               imported: 1
```

### Step 5: download [VeraCrypt](https://www.veracrypt.fr/en/Home.html)

Go to https://www.veracrypt.fr/en/Downloads.html and download latest release and associated PGP signature to `~/Downloads` folder.

### Step 6: verify VeraCrypt release signature (learn how [here](../how-to-verify-pgp-digital-signatures-using-gnupg-on-macos))

> Heads-up: replace `VeraCrypt_1.24-Update7` with current release.

```console
$ gpg --verify ~/Downloads/VeraCrypt_1.24-Update7.dmg.sig
gpg: assuming signed data in '/Users/sunknudsen/Downloads/VeraCrypt_1.24-Update7.dmg'
gpg: Signature made Sat  8 Aug 14:20:27 2020 EDT
gpg:                using RSA key 5069A233D55A0EEB174A5FC3821ACD02680D16DE
gpg: Good signature from "VeraCrypt Team (2018 - Supersedes Key ID=0x54DDD393) <veracrypt@idrix.fr>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 5069 A233 D55A 0EEB 174A  5FC3 821A CD02 680D 16DE
```

Good signature

👍

### Step 7: install VeraCrypt

### Step 8: create and test VeraCrypt symlink

```console
$ ln -s /Applications/VeraCrypt.app/Contents/MacOS/VeraCrypt /usr/local/bin/veracrypt

$ veracrypt --text --version
VeraCrypt 1.24-Update7
```

VeraCrypt 1.24-Update7

👍

### Step 9: set backup volume path environment variable

```shell
BACKUP_VOLUME_PATH="/Volumes/Samsung BAR/backup"
```

### Step 10: create encrypted volume

> Heads-up: volume size cannot be increased later.

> Heads-up: Mac OS Extended filesystem required on macOS.

```console
$ veracrypt --text --create "$BACKUP_VOLUME_PATH"
Volume type:
 1) Normal
 2) Hidden
Select [1]:

Enter volume size (sizeK/size[M]/sizeG): 1G

Encryption Algorithm:
 1) AES
 2) Serpent
 3) Twofish
 4) Camellia
 5) Kuznyechik
 6) AES(Twofish)
 7) AES(Twofish(Serpent))
 8) Camellia(Kuznyechik)
 9) Camellia(Serpent)
 10) Kuznyechik(AES)
 11) Kuznyechik(Serpent(Camellia))
 12) Kuznyechik(Twofish)
 13) Serpent(AES)
 14) Serpent(Twofish(AES))
 15) Twofish(Serpent)
Select [7]:

Hash algorithm:
 1) SHA-512
 2) Whirlpool
 3) SHA-256
 4) Streebog
Select [1]:

Filesystem:
 1) None
 2) FAT
 3) Mac OS Extended
 4) exFAT
 5) APFS
Select [3]:

Enter password:
Re-enter password:

Enter PIM:

Enter keyfile path [none]:

Please type at least 320 randomly chosen characters and then press Enter:


Done: 100.000%  Speed:  24 MiB/s  Left: 0 s

Error: mount_macfuse: the file system is not available (1)
```

> Heads-up: given “FUSE for macOS” is a third-party extension, macOS prevents using the extension without explicit user consent (granted by clicking “Allow” in “System Preferences” / “Privacy & Security”).

![Allow extension 1](./allow-extension-1.png)

![Allow extension 2](./allow-extension-2.png)

```console
$ veracrypt --text --create "$BACKUP_VOLUME_PATH"
Volume type:
 1) Normal
 2) Hidden
Select [1]:

Enter volume size (sizeK/size[M]/sizeG): 1G

Encryption Algorithm:
 1) AES
 2) Serpent
 3) Twofish
 4) Camellia
 5) Kuznyechik
 6) AES(Twofish)
 7) AES(Twofish(Serpent))
 8) Camellia(Kuznyechik)
 9) Camellia(Serpent)
 10) Kuznyechik(AES)
 11) Kuznyechik(Serpent(Camellia))
 12) Kuznyechik(Twofish)
 13) Serpent(AES)
 14) Serpent(Twofish(AES))
 15) Twofish(Serpent)
Select [7]:

Hash algorithm:
 1) SHA-512
 2) Whirlpool
 3) SHA-256
 4) Streebog
Select [1]:

Filesystem:
 1) None
 2) FAT
 3) Mac OS Extended
 4) exFAT
 5) APFS
Select [3]:

Enter password:
Re-enter password:

Enter PIM:

Enter keyfile path [none]:

Please type at least 320 randomly chosen characters and then press Enter:


Done: 100.000%  Speed:  24 MiB/s  Left: 0 s

The VeraCrypt volume has been successfully created.
```

The VeraCrypt volume has been successfully created.

👍

### Step 11 (optional): mount, rename and dismount encrypted volume

By default, VeraCrypt encrypted volumes with Mac OS Extended filesystem are named “untitled”.

#### Mount encrypted volume

```console
$ veracrypt --text --mount --pim 0 --keyfiles "" --protect-hidden no "$BACKUP_VOLUME_PATH" /Volumes/Backup
Enter password for /Volumes/Samsung BAR/backup:
```

#### Rename encrypted volume

```console
$ diskutil rename "untitled" "Backup"
Volume on disk3 renamed to Backup
```

Volume on disk3 renamed to Backup

👍

#### Dismount encrypted volume

```shell
veracrypt --text --dismount "$BACKUP_VOLUME_PATH"
```

### Step 12: create `/usr/local/bin/backup.sh` script

```shell
cat << EOF > /usr/local/bin/backup.sh
#! /bin/sh

set -e
set -o pipefail

function dismount()
{
  if [ -d "\$mount_point" ]; then
    veracrypt --text --dismount "\$mount_point"
  fi
}

trap dismount ERR INT

volume_path="$BACKUP_VOLUME_PATH"
mount_point="/Volumes/Backup"

veracrypt --text --mount --pim "0" --keyfiles "" --protect-hidden "no" "\$volume_path" "\$mount_point"

mkdir -p "\$mount_point/Versioning"

files=(
  "$HOME/.gnupg"
  "$HOME/.ssh"
  "$HOME/Library/Keychains"
)

for file in "\${files[@]}"; do
  rsync \\
    -axRS \\
    --backup \\
    --backup-dir \\
    "\$mount_point/Versioning" \\
    --delete \\
    --suffix="\$(date +".%F-%H%M%S")" \\
    "\$file" \\
    "\$mount_point"
done

if [ "\$(find "\$mount_point/Versioning" -type f -ctime +90)" != "" ]; then
  printf "Do you wish to prune versions older than 90 days (y or n)? "
  read -r answer
  if [ "\$answer" = "y" ]; then
    find "\$mount_point/Versioning" -type f -ctime +90 -delete
    find "\$mount_point/Versioning" -type d -empty -delete
  fi
fi

open "\$mount_point"

printf "Inspect backup and press enter"

read -r answer

dismount

printf "Generate hash (y or n)? "
read -r answer
if [ "\$answer" = "y" ]; then
  openssl dgst -sha512 "\$volume_path"
fi

printf "%s\n" "Done"
EOF
chmod +x /usr/local/bin/backup.sh
```

### Step 13: edit `/usr/local/bin/backup.sh` script

```shell
vi /usr/local/bin/backup.sh
```

Press <kbd>i</kbd> to enter insert mode, edit backup script, press <kbd>esc</kbd> to exit insert mode and press <kbd>shift+z+z</kbd> to save and exit.

### Step 14: create `/usr/local/bin/check.sh` script

```shell
cat << EOF > /usr/local/bin/check.sh
#! /bin/sh

set -e
set -o pipefail

red=\$(tput setaf 1)
normal=\$(tput sgr0)

printf "Backup hash: "

read -r previous

current=\$(openssl dgst -sha512 "$BACKUP_VOLUME_PATH")

if [ "\$current" != "\$previous" ]; then
  printf "\$red%s\$normal\n" "Integrity check failed"
  exit 1
fi

printf "%s\n" "OK"
EOF
chmod +x /usr/local/bin/check.sh
```

### Step 15: create `/usr/local/bin/restore.sh` script

```shell
cat << EOF > /usr/local/bin/restore.sh
#! /bin/sh

set -e

function dismount()
{
  if [ -d "\$mount_point" ]; then
    veracrypt --text --dismount "\$mount_point"
  fi
}

trap dismount ERR INT

volume_path="$BACKUP_VOLUME_PATH"
mount_point="/Volumes/Backup"

veracrypt --text --mount --mount-options "readonly" --pim "0" --keyfiles "" --protect-hidden "no" "\$volume_path" "\$mount_point"

open "\$mount_point"

printf "Restore data and press enter"

read -r answer

dismount

printf "%s\n" "Done"
EOF
chmod +x /usr/local/bin/restore.sh
```

👍

---

## Usage guide

### Backup

> Heads-up: store hash in safe place such as password manager (not on same device as backup).

```console
$ backup.sh
Enter password for /Volumes/Samsung BAR/backup:
Inspect backup and press enter
Generate hash (y or n)? y
SHA512(/Volumes/Samsung BAR/backup)= 281a3b0afec6708eff9566effdfa67de357933527688dfa2dfabae5dda5b7681f0fb84f6cfec6c3f7ac20246517f18f40babbd4f337b254a55de30ff67d6dd2e
Done
```

Done

👍

### Check

```console
$ check.sh
Backup hash: SHA512(/Volumes/Samsung BAR/backup)= 281a3b0afec6708eff9566effdfa67de357933527688dfa2dfabae5dda5b7681f0fb84f6cfec6c3f7ac20246517f18f40babbd4f337b254a55de30ff67d6dd2e
OK
```

OK

👍

### Restore

```console
$ restore.sh
Enter password for /Volumes/Samsung BAR/backup:
Restore data and press enter
Done
```

Done

👍


# How to configure self-hosted VPN kill switch using PF firewall on macOS (DEPRECATED: guide is no longer maintained)

[![How to configure self-hosted VPN kill switch using PF firewall on macOS](how-to-configure-self-hosted-vpn-kill-switch-using-pf-firewall-on-macos.jpg)](https://www.youtube.com/watch?v=wsYYGrEXWnk "How to configure self-hosted VPN kill switch using PF firewall on macOS")

> Heads-up: when following this guide, IKEv2/IPsec VPNs will likely be unresponsive for about 60 seconds at boot and wake.

## Requirements

- Self-hosted virtual private network (VPN) with public IPv4 address
- Computer running macOS Catalina or Big Sur

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- When copy/pasting commands that start with `cat << "EOF"`, select all lines at once (from `cat << "EOF"` to `EOF` inclusively) as they are part of the same (single) command

## Guide

### Step 1: enable PF

Open “System Preferences”, click “Security & Privacy”, then “Firewall” and enable “Turn On Firewall”.

![firewall](./firewall.png)

Then, click “Firewall Options…”, disable all options except “Enable stealth mode”.

![firewall-options](./firewall-options.png)

### Step 2: confirm PF is enabled

```console
$ sudo pfctl -s info | grep "Status"
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 13:02:35           Debug: Urgent
```

Status: Enabled

👍

### Step 3: back up and overwrite `/etc/pf.conf`

> Heads-up: software updates will likely restore `/etc/pf.conf` to default. Remember to check `/etc/pf.conf` using `cat /etc/pf.conf` after updates and test kill switch.

```shell
sudo cp /etc/pf.conf /etc/pf.conf.backup
cat << "EOF" | sudo tee /etc/pf.conf
anchor "local.pf"
load anchor local.pf from "/etc/pf.anchors/local.pf"
EOF
```

### Step 4: list hardware network interfaces

```console
$ networksetup -listallhardwareports

Hardware Port: Wi-Fi
Device: en0
Ethernet Address: Redacted

Hardware Port: Thunderbolt 1
Device: en1
Ethernet Address: Redacted

Hardware Port: Thunderbolt 2
Device: en2
Ethernet Address: Redacted

Hardware Port: Bluetooth PAN
Device: en3
Ethernet Address: Redacted

Hardware Port: iPhone USB
Device: en4
Ethernet Address: Redacted

Hardware Port: Thunderbolt Ethernet
Device: en5
Ethernet Address: Redacted

Hardware Port: Thunderbolt Bridge
Device: bridge0
Ethernet Address: Redacted

VLAN Configurations
===================
```

### Step 4: find hardware network interface subnet prefix (example below is for `Wi-Fi` interface)

```console
$ networksetup -getinfo "Wi-Fi"
DHCP Configuration
IP address: 10.0.1.140
Subnet mask: 255.255.255.0
Router: 10.0.1.1
Client ID:
IPv6: Off
Wi-Fi ID: Redacted
```

Use following table to find bitmask using subnet mask.

For example, if subnet mask is `255.255.255.0`, bitmask is `/24` and subnet prefix is `10.0.1.0/24`.

| Subnet mask     | Bitmask |
| --------------- | ------- |
| 0.0.0.0         | /0      |
| 128.0.0.0       | /1      |
| 192.0.0.0       | /2      |
| 224.0.0.0       | /3      |
| 240.0.0.0       | /4      |
| 248.0.0.0       | /5      |
| 252.0.0.0       | /6      |
| 254.0.0.0       | /7      |
| 255.0.0.0       | /8      |
| 255.128.0.0     | /9      |
| 255.192.0.0     | /10     |
| 255.224.0.0     | /11     |
| 255.240.0.0     | /12     |
| 255.248.0.0     | /13     |
| 255.252.0.0     | /14     |
| 255.254.0.0     | /15     |
| 255.255.0.0     | /16     |
| 255.255.128.0   | /17     |
| 255.255.192.0   | /18     |
| 255.255.224.0   | /19     |
| 255.255.240.0   | /20     |
| 255.255.248.0   | /21     |
| 255.255.252.0   | /22     |
| 255.255.254.0   | /23     |
| 255.255.255.0   | /24     |
| 255.255.255.128 | /25     |
| 255.255.255.192 | /26     |
| 255.255.255.224 | /27     |
| 255.255.255.240 | /28     |
| 255.255.255.248 | /29     |
| 255.255.255.252 | /30     |
| 255.255.255.254 | /31     |
| 255.255.255.255 | /32     |

### Step 5: set environment variables

`KILLSWITCH_HARDWARE_INTERFACES` should include all used hardware network interfaces.

`KILLSWITCH_VPN_INTERFACE` should be set to VPN interface (use `ifconfig` to find interface).

`KILLSWITCH_TRUSTED_SUBNET_PREFIXES` should include all trusted subnet prefixes such as a home or office subnet prefixes (if trusted).

`KILLSWITCH_VPN_ENDPOINT_IPS` should include all VPN endpoint IPs.

```shell
KILLSWITCH_HARDWARE_INTERFACES="{ en0, en4, en5 }"
KILLSWITCH_TRUSTED_SUBNET_PREFIXES="{ 10.0.1.0/24 }"
KILLSWITCH_VPN_INTERFACE=ipsec0
KILLSWITCH_VPN_ENDPOINT_IPS="{ 185.193.126.203 }"
```

### Step 6: create PF strict anchor

This anchor blocks everything except DHCP and VPN requests.

```shell
cat << EOF | sudo tee /etc/pf.anchors/local.pf.strict
# Options
set block-policy drop
set ruleset-optimization basic
set skip on lo0

# Set variables
hardware_interfaces = "$KILLSWITCH_HARDWARE_INTERFACES"
vpn_endpoint_ips = "$KILLSWITCH_VPN_ENDPOINT_IPS"
vpn_interface = "$KILLSWITCH_VPN_INTERFACE"

# Block everything
block all # Use "block log all" to log blocked packets

# Allow DHCP requests (used to establish Wi-Fi connection)
pass on \$hardware_interfaces proto udp from port { 67, 68 } to port { 67, 68 } keep state

# Allow requests to VPN server (used to establish VPN connection)
pass on \$hardware_interfaces proto { tcp, udp } from any to \$vpn_endpoint_ips

# Allow all requests on VPN interface
pass on \$vpn_interface all
EOF
sudo chmod 644 /etc/pf.anchors/local.pf.strict
```

### Step 7: create PF trusted anchor

Same as strict but allows multicast DNS and local network requests.

```shell
cat << EOF | sudo tee /etc/pf.anchors/local.pf.trusted
# Options
set block-policy drop
set ruleset-optimization basic
set skip on lo0

# Set variables
hardware_interfaces = "$KILLSWITCH_HARDWARE_INTERFACES"
trusted_subnet_prefixes = "$KILLSWITCH_TRUSTED_SUBNET_PREFIXES"
vpn_endpoint_ips = "$KILLSWITCH_VPN_ENDPOINT_IPS"
vpn_interface = "$KILLSWITCH_VPN_INTERFACE"

# Block everything
block all # Use "block log all" to log blocked packets

# Allow DHCP requests (used to establish Wi-Fi connection)
pass on \$hardware_interfaces proto udp from port { 67, 68 } to port { 67, 68 } keep state

# Allow multicast DNS requests (used to find devices using Bonjour, disable these lines when you don’t trust the network)
pass on \$hardware_interfaces from \$trusted_subnet_prefixes to 255.255.255.255 keep state
pass on \$hardware_interfaces from 255.255.255.255 to \$trusted_subnet_prefixes keep state
pass on \$hardware_interfaces proto udp from \$trusted_subnet_prefixes port 5353 to 224.0.0.251 port 5353 keep state
pass on \$hardware_interfaces proto udp from 224.0.0.251 port 5353 to \$trusted_subnet_prefixes port 5353 keep state

# Allow local network requests (used to access local network, disable this line when you don’t trust the network)
pass on \$hardware_interfaces proto { tcp, udp } from \$trusted_subnet_prefixes to \$trusted_subnet_prefixes

# Allow requests to VPN server (used to establish VPN connection)
pass on \$hardware_interfaces proto { tcp, udp } from any to \$vpn_endpoint_ips

# Allow all requests on VPN interface
pass on \$vpn_interface all
EOF
sudo chmod 644 /etc/pf.anchors/local.pf.trusted
```

### Step 8: create `/etc/pf.anchors/local.pf` symlink

```shell
sudo ln -s /etc/pf.anchors/local.pf.strict /etc/pf.anchors/local.pf
```

### Step 9: restart PF

```shell
sudo pfctl -F all -f /etc/pf.conf
```

### Step 10: create `/usr/local/sbin` directory

```shell
sudo mkdir -p /usr/local/sbin
sudo chown ${USER}:admin /usr/local/sbin
```

### Step 11: source `/usr/local/sbin` directory

```shell
echo 'export PATH=$PATH:/usr/local/sbin' >> ~/.zshrc
source ~/.zshrc
```

### Step 12: create `/usr/local/sbin/strict.sh` convenience script

Use `socketfilterfw` to block specific apps.

```shell
cat << "EOF" > /usr/local/sbin/strict.sh
#! /bin/sh

if [ "$(id -u)" != "0" ]; then
  printf "%s\n" "This script must run as root"
  exit 1
fi

green=$(tput setaf 2)
normal=$(tput sgr0)

# /usr/libexec/ApplicationFirewall/socketfilterfw --blockapp /Applications/1Password\ 7.app
# /usr/libexec/ApplicationFirewall/socketfilterfw --blockapp /usr/local/Cellar/squid/4.8/sbin/squid
# printf "\n"

ln -sfn /etc/pf.anchors/local.pf.strict /etc/pf.anchors/local.pf

pfctl -e

printf "\n"

pfctl -F all -f /etc/pf.conf

printf "\n$green%s$normal\n" "Strict mode enabled"
EOF
chmod +x /usr/local/sbin/strict.sh
```

### Step 13: create `/usr/local/sbin/trusted.sh` convenience script

Use `socketfilterfw` to unblock specific apps (useful to allow 1Password’s [local sync](https://www.youtube.com/watch?v=eu3iP1njMRI) or Squid proxy for example).

```shell
cat << "EOF" > /usr/local/sbin/trusted.sh
#! /bin/sh

if [ "$(id -u)" != "0" ]; then
  printf "%s\n" "This script must run as root"
  exit 1
fi

function disable()
{
  /usr/local/sbin/strict.sh
  exit 0
}

trap disable INT

red=$(tput setaf 1)
normal=$(tput sgr0)

# /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /Applications/1Password\ 7.app
# /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /usr/local/Cellar/squid/4.8/sbin/squid
# printf "\n"

ln -sfn /etc/pf.anchors/local.pf.trusted /etc/pf.anchors/local.pf

pfctl -e

printf "\n"

pfctl -F all -f /etc/pf.conf

printf "\n$red%s$normal\n\n" "Trusted mode enabled (press ctrl+c to disable)"

while :
do
  sleep 60
done
EOF
chmod +x /usr/local/sbin/trusted.sh
```

### Step 14: create `/usr/local/sbin/disabled.sh` convenience script

```shell
cat << "EOF" > /usr/local/sbin/disabled.sh
#! /bin/sh

if [ "$(id -u)" != "0" ]; then
  printf "%s\n" "This script must run as root"
  exit 1
fi

function disable()
{
  /usr/local/sbin/strict.sh
  exit 0
}

trap disable INT

red=$(tput setaf 1)
normal=$(tput sgr0)

pfctl -d

printf "\n$red%s$normal\n\n" "Firewall disabled (press ctrl+c to enable)"

while :
do
  sleep 60
done
EOF
chmod +x /usr/local/sbin/disabled.sh
```

### Step 15: test convenience scripts

```console
$ sudo strict.sh
Password:
No ALTQ support in kernel
ALTQ related functions disabled
pfctl: pf already enabled

pfctl: Use of -f option, could result in flushing of rules
present in the main ruleset added by the system at startup.
See /etc/pf.conf for further details.

No ALTQ support in kernel
ALTQ related functions disabled
rules cleared
nat cleared
dummynet cleared
0 tables deleted.
64 states cleared
source tracking entries cleared
pf: statistics cleared
pf: interface flags reset

Strict mode enabled

$ sudo trusted.sh
No ALTQ support in kernel
ALTQ related functions disabled
pfctl: pf already enabled

pfctl: Use of -f option, could result in flushing of rules
present in the main ruleset added by the system at startup.
See /etc/pf.conf for further details.

No ALTQ support in kernel
ALTQ related functions disabled
rules cleared
nat cleared
dummynet cleared
0 tables deleted.
6 states cleared
source tracking entries cleared
pf: statistics cleared
pf: interface flags reset

Trusted mode enabled (press ctrl+c to disable)

$ sudo disabled.sh
No ALTQ support in kernel
ALTQ related functions disabled
pf disabled

Firewall disabled (press ctrl+c to enable)
```

### Step 16: make sure PF is set to strict at boot

```shell
cat << "EOF" | sudo tee /Library/LaunchDaemons/local.pf.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
    <string>local.pf</string>

    <key>ProgramArguments</key>
    <array>
      <string>/usr/local/sbin/strict.sh</string>
    </array>

    <key>RunAtLoad</key>
    <true/>
  </dict>
</plist>
EOF
```

👍

---

## Want things back the way they were before following this guide? No problem!

### Step 1: restore `/etc/pf.conf` from backup

```shell
sudo cp /etc/pf.conf.backup /etc/pf.conf
```

### Step 2: delete anchors, convenience scripts and launch daemon

#### Delete anchors

```shell
sudo rm /etc/pf.anchors/local.pf
sudo rm /etc/pf.anchors/local.pf.strict
sudo rm /etc/pf.anchors/local.pf.trusted
```

#### Delete convenience scripts

```shell
rm /usr/local/sbin/strict.sh
rm /usr/local/sbin/trusted.sh
rm /usr/local/sbin/disabled.sh
```

#### Delete launch daemon

```shell
sudo rm /Library/LaunchDaemons/local.pf.plist
```

### Step 3: restart PF

```shell
sudo pfctl -F all -f /etc/pf.conf
```

👍


# How to benchmark server performance using Speedtest and SysBench

[![How to benchmark server performance using Speedtest and SysBench](how-to-benchmark-server-performance-using-speedtest-and-sysbench.jpg)](https://www.youtube.com/watch?v=zcq2iZUcQQY "How to benchmark server performance using Speedtest and SysBench")

> Heads-up: Speedtest is known for tracking users therefore it is recommended to run the following benchmark tests on staging servers.

## Requirements

- Virtual private server (VPS) or dedicated server running Debian 10 (buster) or Debian 11 (bullseye)

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- When copy/pasting commands that start with `cat << "EOF"`, select all lines at once (from `cat << "EOF"` to `EOF` inclusively) as they are part of the same (single) command

## Setup guide

### Step 1: check if [backports](https://backports.debian.org/) repository is enabled

```shell
cat /etc/apt/sources.list | grep "backports"
```

### Step 2: enable backports repository (required if previous command returned nothing)

> Heads-up: run `cat /etc/debian_version` to find Debian version.

#### Debian 10 (buster)

```shell
cat << "EOF" >> /etc/apt/sources.list
deb http://deb.debian.org/debian buster-backports main
EOF
apt update
```

#### Debian 11 (bullseye)

```shell
cat << "EOF" >> /etc/apt/sources.list
deb http://deb.debian.org/debian bullseye-backports main
EOF
apt update
```

### Step 3: install apt-transport-https, cURL and GnuPG

```shell
apt update
apt install -y apt-transport-https curl gnupg2
```

### Step 4: import [Speedtest](https://www.speedtest.net/)’s PGP public key

```shell
curl -fsSL https://packagecloud.io/ookla/speedtest-cli/gpgkey | gpg --dearmor > /usr/share/keyrings/speedtest-cli.gpg
```

### Step 5: enable Speedtest’s repository

> Heads-up: run `cat /etc/debian_version` to find Debian version.

#### Debian 10 (buster)

```shell
echo -e "deb [signed-by=/usr/share/keyrings/speedtest-cli.gpg] https://packagecloud.io/ookla/speedtest-cli/debian/ buster main\ndeb-src [signed-by=/usr/share/keyrings/speedtest-cli.gpg] https://packagecloud.io/ookla/speedtest-cli/debian/ buster main" > /etc/apt/sources.list.d/speedtest-cli.list
apt update
```

#### Debian 11 (bullseye)

```shell
echo -e "deb [signed-by=/usr/share/keyrings/speedtest-cli.gpg] https://packagecloud.io/ookla/speedtest-cli/debian/ bullseye main\ndeb-src [signed-by=/usr/share/keyrings/speedtest-cli.gpg] https://packagecloud.io/ookla/speedtest-cli/debian/ bullseye main" > /etc/apt/sources.list.d/speedtest-cli.list
apt update
```

### Step 6: install Speedtest and SysBench

```shell
apt install -y speedtest sysbench
```

👍

---

## Usage guide

### Benchmark network

> Heads-up: depending on iptables or nftables firewall configuration, running following commands may be required.

#### iptables

```shell
iptables -A OUTPUT -p tcp -m tcp --dport 8080 -m state --state NEW -j ACCEPT
ip6tables -A OUTPUT -p tcp -m tcp --dport 8080 -m state --state NEW -j ACCEPT
```

#### nftables

> Heads-up: replace `firewall` if needed (see `nft list ruleset`).

```shell
nft add rule ip firewall output tcp dport http-alt accept
nft add rule ip6 firewall output tcp dport http-alt accept
```

```console
$ speedtest

   Speedtest by Ookla

     Server: Siminn - Reykjavik (id = 4818)
        ISP: 1984 ehf
    Latency:     0.56 ms   (0.04 ms jitter)
   Download:   952.13 Mbps (data used: 429.5 MB )
     Upload:   994.18 Mbps (data used: 1.6 GB )
Packet Loss:     0.0%
 Result URL: https://www.speedtest.net/result/c/541db9ff-1731-4998-b137-9d6dd959f6aa
```

Network download speed: 940.03 Mbps

Network upload speed: 941.49 Mbps

👍

### Benchmark CPU

```console
$ sysbench cpu --threads=$(nproc) run
sysbench 1.0.20 (using system LuaJIT 2.1.0-beta3)

Running the test with following options:
Number of threads: 1
Initializing random number generator from current time


Prime numbers limit: 10000

Initializing worker threads...

Threads started!

CPU speed:
    events per second:  4312.04

General statistics:
    total time:                          10.0002s
    total number of events:              43123

Latency (ms):
         min:                                    0.23
         avg:                                    0.23
         max:                                    0.64
         95th percentile:                        0.24
         sum:                                 9989.38

Threads fairness:
    events (avg/stddev):           43123.0000/0.00
    execution time (avg/stddev):   9.9894/0.00
```

CPU events per second: 4312.04

👍

### Benchmark memory

```console
$ sysbench memory --threads=$(nproc) run
sysbench 1.0.20 (using system LuaJIT 2.1.0-beta3)

Running the test with following options:
Number of threads: 1
Initializing random number generator from current time


Running memory speed test with the following options:
  block size: 1KiB
  total size: 102400MiB
  operation: write
  scope: global

Initializing worker threads...

Threads started!

Total operations: 62470941 (6246793.35 per second)

61006.78 MiB transferred (6100.38 MiB/sec)


General statistics:
    total time:                          10.0000s
    total number of events:              62470941

Latency (ms):
         min:                                    0.00
         avg:                                    0.00
         max:                                    0.23
         95th percentile:                        0.00
         sum:                                 4481.00

Threads fairness:
    events (avg/stddev):           62470941.0000/0.00
    execution time (avg/stddev):   4.4810/0.00
```

Memory speed: 6100.38 MiB/sec

👍

### Benchmark disk

> Heads-up: use `--file-block-size=16K` to simulate database or `apt install` workloads and `--file-block-size=1M` to simulate web server workload.

```console
$ sysbench fileio --file-total-size=8G prepare
sysbench 1.0.20 (using system LuaJIT 2.1.0-beta3)

128 files, 65536Kb each, 8192Mb total
Creating files for the test...
Extra file open flags: (none)
Creating file test_file.0
…
Creating file test_file.127
8589934592 bytes written in 81.95 seconds (99.96 MiB/sec).

$ sysbench fileio --file-block-size=16K --file-total-size=8G --file-test-mode=rndrw --threads=$(nproc) run
sysbench 1.0.20 (using system LuaJIT 2.1.0-beta3)

Running the test with following options:
Number of threads: 1
Initializing random number generator from current time


Extra file open flags: (none)
128 files, 64MiB each
8GiB total file size
Block size 16KiB
Number of IO requests: 0
Read/Write ratio for combined random IO test: 1.50
Periodic FSYNC enabled, calling fsync() each 100 requests.
Calling fsync() at the end of test, Enabled.
Using synchronous I/O mode
Doing random r/w test
Initializing worker threads...

Threads started!


File operations:
    reads/s:                      4042.23
    writes/s:                     2694.82
    fsyncs/s:                     8629.92

Throughput:
    read, MiB/s:                  63.16
    written, MiB/s:               42.11

General statistics:
    total time:                          10.0040s
    total number of events:              153609

Latency (ms):
         min:                                    0.00
         avg:                                    0.06
         max:                                   10.10
         95th percentile:                        0.15
         sum:                                 9963.22

Threads fairness:
    events (avg/stddev):           153609.0000/0.00
    execution time (avg/stddev):   9.9632/0.00

$ sysbench fileio --file-block-size=1M --file-total-size=8G --file-test-mode=rndrw --threads=$(nproc) run
sysbench 1.0.20 (using system LuaJIT 2.1.0-beta3)

Running the test with following options:
Number of threads: 1
Initializing random number generator from current time


Extra file open flags: (none)
128 files, 64MiB each
8GiB total file size
Block size 1MiB
Number of IO requests: 0
Read/Write ratio for combined random IO test: 1.50
Periodic FSYNC enabled, calling fsync() each 100 requests.
Calling fsync() at the end of test, Enabled.
Using synchronous I/O mode
Doing random r/w test
Initializing worker threads...

Threads started!


File operations:
    reads/s:                      63.57
    writes/s:                     42.38
    fsyncs/s:                     136.57

Throughput:
    read, MiB/s:                  63.57
    written, MiB/s:               42.38

General statistics:
    total time:                          10.3782s
    total number of events:              2390

Latency (ms):
         min:                                    0.01
         avg:                                    4.19
         max:                                  160.43
         95th percentile:                       15.00
         sum:                                10004.76

Threads fairness:
    events (avg/stddev):           2390.0000/0.00
    execution time (avg/stddev):   10.0048/0.00

$ sysbench fileio --file-total-size=8G cleanup
sysbench 1.0.20 (using system LuaJIT 2.1.0-beta3)

Removing test files...
```

Disk read throughput (16K): 63.16 MiB/s
Disk write throughput (16K): 42.11 MiB/s

Disk read throughput (1M): 63.57 MiB/s
Disk write throughput (1M): 42.38 MiB/s

👍


# How to disable IPv6 on iOS (cellular-only) and macOS

[![How to disable IPv6 on iOS (cellular-only) and macOS (see change log)](how-to-disable-ipv6-on-ios-cellular-only-and-macos-see-change-log.jpg)](https://www.youtube.com/watch?v=Nzx9T7GtmT4 "How to disable IPv6 on iOS (cellular-only) and macOS (see change log)")

> Heads-up: unfortunately this guide will not work on carriers or ISPs that have migrated their networks to IPv6-only.

## iOS guide

### Step 1 (on Mac): download and open [Apple Configurator 2](https://support.apple.com/apple-configurator)

### Step 2 (on Mac): create new profile using <kbd>cmd + n</kbd>

### Step 3 (on Mac): configure “General” settings

![apple-configurator-general](./apple-configurator-general.png)

### Step 4 (on iPhone): find APN settings

Open “Settings“, then “Cellular“, then “Cellular Data Network“.

![ios-cellular-data-network](./ios-cellular-data-network.png)

### Step 5 (on Mac): configure “Cellular” settings

![apple-configurator-cellular](./apple-configurator-cellular.png)

### Step 6 (on Mac): save provisioning profile

### Step 7 (on Mac): connect iPhone to Mac

### Step 8 (on Mac): double-click on iPhone

![apple-configurator-iphone](./apple-configurator-iphone.png)

### Step 9 (on Mac): click on “Profile” tab, then “Add Profiles…”, select saved provisioning profile and click “Add”

![apple-configurator-add-profile](./apple-configurator-add-profile.png)

### Step 10 (on iPhone): review profile

Open “Settings”, then “Profile Downloaded” and tap “Install”

![ios-install-profile](./ios-install-profile.png)

👍

## macOS guide

### Step 1: list network interfaces

```console
$ networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
Wi-Fi
iPhone USB
Thunderbolt Ethernet
```

### Step 2: disable IPv6

> Heads-up: use network interfaces found in [step 1](#step-1-list-network-interfaces) (most computers only have `Wi-Fi` interface)

```shell
networksetup -setv6off "Wi-Fi"
networksetup -setv6off "iPhone USB"
networksetup -setv6off "Thunderbolt Ethernet"
```

---

## Want things back the way they were before following this guide? No problem!

### Step 1 (on iPhone): remove provisioning profile

Open “Settings”, then “General”, then “Profile”, and tap provisioning profile, then “Remove Profile”.

![ios-remove-profile](./ios-remove-profile.png)

### Step 2 (on Mac): set network interfaces to automatic

```shell
networksetup -setv6automatic "Wi-Fi"
networksetup -setv6automatic "iPhone USB"
networksetup -setv6automatic "Thunderbolt Ethernet"
```

👍


# How to remove EXIF metadata from images on macOS

[![How to remove EXIF metadata from images on macOS](how-to-remove-exif-metadata-from-images-on-macos.jpg)](https://www.youtube.com/watch?v=mVMGiMFGgsU "How to remove EXIF metadata from images on macOS")

## Requirements

- Computer running macOS Catalina or Big Sur

## Setup guide

### Step 1: install [Homebrew](https://brew.sh/)

```console
$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

$ uname -m | grep arm64 && echo 'export PATH=$PATH:/opt/homebrew/bin' >> ~/.zshrc && source ~/.zshrc
```

### Step 2: disable analytics

```shell
brew analytics off
```

### Step 3: install [ExifTool](https://exiftool.org/)

```shell
brew install exiftool
```

👍

---

## Usage guide

### View EXIF metadata

```shell
exiftool -n /path/to/image.jpg
```

### Remove EXIF metadata

```shell
exiftool -all= /path/to/image.jpg
```


# How to encrypt, sign and decrypt messages using GnuPG on macOS

[![How to encrypt, sign and decrypt messages using GnuPG on macOS](how-to-encrypt-sign-and-decrypt-messages-using-gnupg-on-macos.jpg)](https://www.youtube.com/watch?v=mE8fL5Fu8x8 "How to encrypt, sign and decrypt messages using GnuPG on macOS")

> Heads-up: this is a “getting started” guide. Learn how to harden GnuPG [here](../how-to-generate-and-air-gap-pgp-private-keys-using-gnupg-tails-and-yubikey).

## Requirements

- Computer running macOS Big Sur or Monterey

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command

## Setup guide

### Step 1: install [Homebrew](https://brew.sh/)

```console
$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

$ uname -m | grep arm64 && echo 'export PATH=$PATH:/opt/homebrew/bin' >> ~/.zshrc && source ~/.zshrc
```

### Step 2: disable Homebrew analytics

```shell
brew analytics off
```

### Step 3: install [GnuPG](https://gnupg.org/)

```shell
brew install gnupg
```

### Step 4: generate PGP key pair

```console
$ gpg --full-generate-key
gpg (GnuPG) 2.3.4; Copyright (C) 2021 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

gpg: directory '/Users/sunknudsen/.gnupg' created
gpg: keybox '/Users/sunknudsen/.gnupg/pubring.kbx' created
Please select what kind of key you want:
   (1) RSA and RSA
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
   (9) ECC (sign and encrypt) *default*
  (10) ECC (sign only)
  (14) Existing key from card
Your selection? 9
Please select which elliptic curve you want:
   (1) Curve 25519 *default*
   (4) NIST P-384
   (6) Brainpool P-256
Your selection? 1
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: John Doe
Email address: john@example.net
Comment:
You selected this USER-ID:
    "John Doe <john@example.net>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: /Users/sunknudsen/.gnupg/trustdb.gpg: trustdb created
gpg: directory '/Users/sunknudsen/.gnupg/openpgp-revocs.d' created
gpg: revocation certificate stored as '/Users/sunknudsen/.gnupg/openpgp-revocs.d/1ADDDBA409558A8E80A4DF381535F6A0BB6BD636.rev'
public and secret key created and signed.

pub   ed25519 2021-12-29 [SC]
      1ADDDBA409558A8E80A4DF381535F6A0BB6BD636
uid                      John Doe <john@example.net>
sub   cv25519 2021-12-29 [E]
```

### Step 5: back up `~/.gnupg` folder (learn how [here](../how-to-back-up-and-encrypt-data-using-rsync-and-veracrypt-on-macos))

> Heads-up: files stored in `~/.gnupg` include private keys which, if lost, results in loosing one’s cryptographic identity (safeguard backup mindfully).

👍

---

## Usage guide

### Export PGP public key

> Heads-up: replace `john@example.net` and `johndoe` with email and name from [step 4](#step-4-generate-pgp-key-pair).

```shell
gpg --armor --export john@example.net > ~/johndoe.asc
```

### Import Sun’s PGP public key using key server…

```console
$ gpg --keyserver hkps://keys.openpgp.org --recv-keys 0x8C9CA674C47CA060
gpg: key 8C9CA674C47CA060: public key "Sun Knudsen <hello@sunknudsen.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
```

imported: 1

👍

### …or using PGP public key URL

> Heads-up: verify [web of trust](#verify-suns-pgp-public-key-using-web-of-trust) to list missing keys.

```console
$ curl https://sunknudsen.com/sunknudsen.asc | gpg --import
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2070  100  2070    0     0   1881      0  0:00:01  0:00:01 --:--:--  1899
gpg: key 8C9CA674C47CA060: 1 signature not checked due to a missing key
gpg: key 8C9CA674C47CA060: public key "Sun Knudsen <hello@sunknudsen.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
```

imported: 1

👍

### Verify Sun’s PGP public key using fingerprint

```console
$ gpg --fingerprint hello@sunknudsen.com
pub   ed25519 2021-12-28 [C]
      E786 274B C92B 47C2 3C1C  F44B 8C9C A674 C47C A060
uid           [ unknown] Sun Knudsen <hello@sunknudsen.com>
sub   ed25519 2021-12-28 [S] [expires: 2022-12-28]
sub   cv25519 2021-12-28 [E] [expires: 2022-12-28]
sub   ed25519 2021-12-28 [A] [expires: 2022-12-28]
```

Open https://sunknudsen.com/, https://github.com/sunknudsen/pgp-public-key and https://www.youtube.com/sunknudsen/about and make sure above fingerprint (“E786 274B C92B 47C2 3C1C &nbsp;F44B 8C9C A674 C47C A060”) matches published fingerprints.

👍

### Verify Sun’s PGP public key using web of trust

> Heads-up: `0xC1323A377DE14C8B` is Sun’s [legacy](https://github.com/sunknudsen/pgp-public-key/tree/master/legacy) public key.

```console
$ gpg --list-signatures hello@sunknudsen.com
pub   ed25519 2021-12-28 [C]
      E786274BC92B47C23C1CF44B8C9CA674C47CA060
uid           [ unknown] Sun Knudsen <hello@sunknudsen.com>
sig 3        8C9CA674C47CA060 2021-12-28  Sun Knudsen <hello@sunknudsen.com>
sig 3        C1323A377DE14C8B 2021-12-28  [User ID not found]
sub   ed25519 2021-12-28 [S] [expires: 2022-12-28]
sig          8C9CA674C47CA060 2021-12-28  Sun Knudsen <hello@sunknudsen.com>
sub   cv25519 2021-12-28 [E] [expires: 2022-12-28]
sig          8C9CA674C47CA060 2021-12-28  Sun Knudsen <hello@sunknudsen.com>
sub   ed25519 2021-12-28 [A] [expires: 2022-12-28]
sig          8C9CA674C47CA060 2021-12-28  Sun Knudsen <hello@sunknudsen.com>
```

### Paste, encrypt and sign message (enter line break and `ctrl+d` to quit edit mode)

```console
$ gpg --encrypt --sign --armor --output ~/Desktop/encrypted.asc --recipient john@example.net --recipient hello@sunknudsen.com
gpg: F56809CDE05DB014: There is no assurance this key belongs to the named user

sub  cv25519/F56809CDE05DB014 2021-12-28 Sun Knudsen <hello@sunknudsen.com>
 Primary key fingerprint: E786 274B C92B 47C2 3C1C  F44B 8C9C A674 C47C A060
      Subkey fingerprint: F375 2162 E3A4 3F6E 2762  D50B F568 09CD E05D B014

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N) y
This is a test!
```

### Decrypt message to stdout and decode quoted-printable characters

```console
$ gpg --decrypt ~/Desktop/encrypted.asc | perl -MMIME::QuotedPrint -0777 -nle 'print decode_qp($_)'
gpg: encrypted with cv25519 key, ID F56809CDE05DB014, created 2021-12-28
      "Sun Knudsen <hello@sunknudsen.com>"
gpg: encrypted with cv25519 key, ID F9220AB453F9B6E3, created 2021-12-29
      "John Doe <john@example.net>"
gpg: Signature made Wed 29 Dec 08:24:05 2021 EST
gpg:                using EDDSA key 1ADDDBA409558A8E80A4DF381535F6A0BB6BD636
gpg: Good signature from "John Doe <john@example.net>" [ultimate]
This is a test!
```

Good signature

👍

### Clear passphrase from GnuPG cache

```shell
gpg-connect-agent reloadagent /bye
```

> Heads-up: when sending [encrypted messages](#paste-encrypt-and-sign-message-enter-line-break-and-ctrld-to-quit-edit-mode), don’t forget to include your [public key](#export-pgp-public-key).


# How to protect Mac computers from cold boot attacks

[![How to protect Mac computers from cold boot attacks](how-to-protect-mac-computers-from-cold-boot-attacks.jpg)](https://www.youtube.com/watch?v=d_M18sq0TIQ "How to protect Mac computers from cold boot attacks")

## Guide

### Run following command using “Terminal” app.

```shell
sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25 standbydelaylow 0 standbydelayhigh 0
```

👍

`destroyfvkeyonstandby 1` tells macOS to destroy password when computer goes to standby mode.

`hibernatemode 25` tells macOS to store the content of the RAM to the hard drive and power off the RAM (which clears its data).

`standbydelaylow 0` tells macOS to enable standby mode immediately when battery is low and computer is put to sleep.

`standbydelayhigh 0` tells macOS to enable standby mode immediately when battery is high and computer is put to sleep.

Run `man pmset` using “Terminal” app for more information.

---

## Want things back the way they were before following this guide? No problem!

### Run the following `pmset` command using the Terminal.

```shell
sudo pmset -a destroyfvkeyonstandby 0 hibernatemode 3 standbydelaylow 10800 standbydelayhigh 86400
```

👍


# How to create Signal account without using personal phone number

[![How to create Signal account without using personal phone number](how-to-create-signal-account-without-using-personal-phone-number.jpg)](https://www.youtube.com/watch?v=b9aMJZjZ4pw "How to create Signal account without using personal phone number")

## Guide

### Step 1: create [Twilio](https://www.twilio.com/) account

Go to https://www.twilio.com/ and sign up (please consider using my [referral link](https://www.twilio.com/referral/EwWmgH) so we both get a 10 USD credit on account upgrade).

### Step 2: create “Forward voice” bin (used for phone call verification)

> Heads-up: don’t forget to replace `+12345678901` with your mobile phone number.

Go to https://www.twilio.com/console/twiml-bins, click +, set friendly name to `Forward voice` and paste snippet below in TwiML text area.

```xml
<?xml version="1.0" encoding="UTF-8" ?>
<Response>
  <Dial>
    +12345678901
  </Dial>
</Response>
```

### Step 3: create “Forward messaging” bin (used for SMS verification)

> Heads-up: don’t forget to replace `+12345678901` with your mobile phone number.

Go to https://www.twilio.com/console/twiml-bins, click +, set friendly name to `Forward messaging` and paste snippet below in TwiML text area.

```xml
<?xml version="1.0" encoding="UTF-8" ?>
<Response>
  <Message to="+12345678901">
    {{From}}: {{Body}}
  </Message>
</Response>
```

### Step 4: buy phone number

Go to https://www.twilio.com/console/phone-numbers/search and buy phone number.

### Step 5: configure phone number

Go to https://www.twilio.com/console/phone-numbers/incoming, click phone number, set “A Call Comes In” to “TwiML Bin” / “Forward voice”, set “A Message Comes In” to “TwiML Bin” / “Forward messaging” and click “Save”.

👍


# How to spoof MAC address and hostname automatically at boot on macOS

[![How to spoof MAC address and hostname automatically at boot on macOS](how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos.jpg)](https://www.youtube.com/watch?v=ASXANpr_zX8 "How to spoof MAC address and hostname automatically at boot on macOS")

> Heads-up: unfortunately, it is not possible to spoof MAC address on some Macs (see [issue](https://github.com/sunknudsen/privacy-guides/issues/15)).

## Requirements

- Computer running macOS Catalina or Big Sur

## Caveats

- When copy/pasting commands that start with `$`, strip out `$` as this character is not part of the command
- When copy/pasting commands that start with `cat << "EOF"`, select all lines at once (from `cat << "EOF"` to `EOF` inclusively) as they are part of the same (single) command

## Guide

### Step 1: create `/usr/local/sbin` directory

```shell
sudo mkdir -p /usr/local/sbin
sudo chown ${USER}:admin /usr/local/sbin
```

### Step 2: add `/usr/local/sbin` directory to `PATH` environment variable

```shell
echo 'export PATH=$PATH:/usr/local/sbin' >> ~/.zshrc
source ~/.zshrc
```

### Step 3: download [first-names.txt](./first-names.txt)

This list includes top 2048 most popular names for people aged 25 from the [USA Social Security Administration](https://www.ssa.gov/oact/babynames/limits.html) (last [updated](./misc/update-first-names.sh) on March 9th 2022).

```shell
curl --fail --output /usr/local/sbin/first-names.txt https://sunknudsen.com/privacy-guides/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos/first-names.txt
```

### Step 4: create `spoof.sh` script

```shell
cat << "EOF" > /usr/local/sbin/spoof.sh
#! /bin/sh

set -e
set -o pipefail

export LC_CTYPE=C

basedir=$(dirname "$0")

# Spoof computer name
first_name=$(sed "$(jot -r 1 1 2048)q;d" $basedir/first-names.txt | sed -e 's/[^a-zA-Z]//g')
model_name=$(system_profiler SPHardwareDataType | awk '/Model Name/ {$1=$2=""; print $0}' | sed -e 's/^[ ]*//')
computer_name="$first_name’s $model_name"
host_name=$(echo $computer_name | sed -e 's/’//g' | sed -e 's/ /-/g')
sudo scutil --set ComputerName "$computer_name"
sudo scutil --set LocalHostName "$host_name"
sudo scutil --set HostName "$host_name"
printf "%s\n" "Spoofed hostname to $host_name"

# Spoof MAC address of Wi-Fi interface
mac_address_prefix=$(networksetup -listallhardwareports | awk -v RS= '/en0/{print $NF}' | head -c 8)
mac_address_suffix=$(openssl rand -hex 3 | sed 's/$..$/\1:/g; s/.$//')
mac_address=$(echo "$mac_address_prefix:$mac_address_suffix" | awk '{print tolower($0)}')
networksetup -setairportpower en0 on
sudo /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport --disassociate
sudo ifconfig en0 ether "$mac_address"
printf "%s\n" "Spoofed MAC address of en0 interface to $mac_address"
EOF
```

### Step 5: make `spoof.sh` executable

```shell
chmod +x /usr/local/sbin/spoof.sh
```

### Step 6: create `local.spoof.plist` launch daemon

```shell
cat << "EOF" | sudo tee /Library/LaunchDaemons/local.spoof.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
    <string>local.spoof</string>

    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/sbin/spoof.sh</string>
    </array>

    <key>RunAtLoad</key>
    <true/>
  </dict>
</plist>
EOF
```

### Step 7: create `spoof-hook.sh` script

```shell
cat << "EOF" > /usr/local/sbin/spoof-hook.sh
#! /bin/sh

# Turn off Wi-Fi interface
networksetup -setairportpower en0 off
EOF
```

### Step 8: make `spoof-hook.sh` executable

```shell
chmod +x /usr/local/sbin/spoof-hook.sh
```

### Step 9: make sure `com.apple.loginwindow` does not exist

> Heads-up: if `com.apple.loginwindow` exists, one needs to backup user default carefully and consider using an abstraction that runs both current `LogoutHook` script and `/usr/local/sbin/spoof-hook.sh`.

```console
$ sudo defaults read com.apple.loginwindow
2021-09-27 06:58:02.301 defaults[2267:25227]
Domain com.apple.loginwindow does not exist
```

Domain com.apple.loginwindow does not exist

👍

### Step 10: configure user default (used to disable Wi-Fi interface at logout)

```shell
sudo defaults write com.apple.loginwindow LogoutHook "/usr/local/sbin/spoof-hook.sh"
```

### Step 11: reboot and confirm hostname and MAC address have been spoofed

#### Spoofed hostname

```console
$ scutil --get HostName
Ottos-MacBook-Pro
```

#### Spoofed MAC address

```console
$ ifconfig en0 | grep ether | awk '{print $2}'
98:01:a7:8e:0f:51
```

#### Hardware MAC address

```console
$ networksetup -listallhardwareports | awk -v RS= '/en0/{print $NF}'
98:01:a7:5e:d0:c2
```

“Spoofed hostname” is random and “Spoofed MAC address” does not match “Hardware MAC address”?

👍

---

## Want things back the way they were before following this guide? No problem!

### Step 1: delete files

```shell
rm /usr/local/sbin/first-names.txt
rm /usr/local/sbin/spoof-hook.sh
rm /usr/local/sbin/spoof.sh
sudo rm /Library/LaunchDaemons/local.spoof.plist
```

### Step 2: delete user default

```shell
sudo defaults delete com.apple.loginwindow LogoutHook
```

### Step 3: set computer name, local hostname and hostname

> Heads-up: replace `John` with your name.

```shell
sudo scutil --set ComputerName "John’s MacBook Pro"
sudo scutil --set LocalHostName "Johns-MacBook-Pro"
sudo scutil --set HostName "Johns-MacBook-Pro"
```

### Step 4: reboot

👍


# How to use multiple compartmentalized Firefox instances simultaneously using profiles

[![How to use multiple compartmentalized Firefox instances using profiles](how-to-use-multiple-compartmentalized-firefox-instances-using-profiles.jpg)](https://www.youtube.com/watch?v=Upib_vq_EB8 "How to use multiple compartmentalized Firefox instances using profiles")

## Guide

### Step 1: create Firefox profile

```shell
/Applications/Firefox.app/Contents/MacOS/firefox-bin -p
```

### Step 2: open “Script Editor” and paste following snippet

> Heads-up: replace `work` with profile name from [step 1](#step-1-create-firefox-profile).

```
do shell script "nohup /Applications/Firefox.app/Contents/MacOS/firefox-bin -p \"work\" --no-remote > /dev/null 2>&1 &"
```

![script-editor-step-1](./script-editor-step-1.png)

### Step 3: export script as application

Click “File”, then “Export…”, set “Export As” filename to “Firefox work” (or any other filename), select “Applications” folder (in “Favorites”), select “Application” file format and click “Save”.

![script-editor-step-2](./script-editor-step-2.png)

### Step 4: set Firefox app environment variable

> Heads-up: replace `Firefox work` with filename from [step 3](#step-3-export-script-as-application).

```shell
FIREFOX_APP="Firefox work.app"
```

### Step 5: configure app as agent and set icon

```shell
defaults write "/Applications/$FIREFOX_APP/Contents/Info.plist" LSUIElement -bool yes
cp "/Applications/Firefox.app/Contents/Resources/firefox.icns" "/Applications/$FIREFOX_APP/Contents/Resources/applet.icns"
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/$FIREFOX_APP"
```

👍
