A tutorial on how to install the Tails anonymous operating system on a Mac and set up and use encrypted email. Click the above image for the video tutorial.
Step by step instructions on how to download and verify Tails OS 4.2, burn it to a USB drive and run it from this flash drive on your Apple Mac OS X and then. Download Tor Browser for free. Browser for using Tor on Windows, Mac OS X or Linux. Tor Browser enables you to use Tor on Windows, Mac OS X, or Linux without needing to install any software. Tor is a software that bounces your communications around a distributed network of relays run by volunteers. The latest tweets from @regaltails.
Installing Tails on Mac:
- Download the newest version of Tails https://tails.boum.org/download/index.en.html
Verify Tails (optional):
- Download the Tails signing key https://tails.boum.org/doc/get/verify_the_iso_image_using_the_command_line/index.en.html
- Open Terminal (Applications/Utilities/Terminal)
- Specify the signature key location. Type in Terminal: cd downloads (or replace downloads with the directory in which you downloaded the key i.e desktop)
- Type (or copy to) in Terminal: cat tails-signing.key| gpg --keyid-format long -–import
- Download GPG Tools https://gpgtools.org/ and install
- Download the Tails signature https://tails.boum.org/download/index.en.html
- Terminal: cd[the ISO image directory] (only necessary if key has been downloaded to a different location)
- Type in Terminal: gpg --keyid-format long --verify tails-i386-0.22.1.iso.sig tails-i386-0.22.1.iso (If you downloaded a newer version of Tails, replace the iso name)
- If the ISO Image is correct:Good signature from 'Tails developers (signing key) '
- If the ISO Image is incorrect you will get: BAD signature from 'Tails developers (signing key) '
Burn a DVD image of Tails:
- Launch Disk Utility (Applications/Utilities/Disk Utility)
- Drag and drop your .iso file to the left pane in Disk Utility.
- Highlight the Tails .iso file, and click on the 'Burn' button in the toolbar.
- Select 'verify', then burn.
Start up Tails:
- Shut down your computer and press the alt/option key on restart.
- Select boot from disc.
- Login to tails, for 'more options' choose 'no' (unless you want to install additional software.)
- You can now connect to the internet and surf anonymously.
Installing tails on a USB flash drive:
- Insert USB flash device (8gb or larger).
- Launch the Tails Installer (Applications/Tails/Tails Installer)
- Select 'Clone and Install'.
- Select your USB flash device in the dropdown menu.
- Press 'install Tails'.
- To run Tails from the USB stick shut down Tails and log back into OSX. (Note: You still need the DVD to boot tails, I'm not sure if it is possible to boot from the USB flash drive only on a Mac. Instructions for USB only can be found here: https://tails.boum.org/doc/first_steps/installation/manual/mac/index.en.htmlI could not get this to work on the Macbook pro.)
To run Tails from the USB flash drive you need to install rEFInd:
- Download rEFInd http://sourceforge.net/projects/refind/
- Unzip.
- Open Terminal (Applications/Utilities/Terminal)
- Drag and drop the 'install.sh' file (from the refind folder you just downloaded) into Terminal and press 'Return'.
- Enter your admin password if prompted, and press 'Return'.
- If successful this will appear: Installation has completed successfully.
- Restart your computer, the rEFInd boot menu will appear. (You need both the Tails DVD and USB device inserted.)
- Select Linux.
- Login to Tails.
Create a persistent volume to save preferences etc:
- Launch Configure Persistent Volume (Applications/Tails/Configure Persistent Volume)
- Enter a password and select 'create'.
- For a list of the persistent volume features see: https://tails.boum.org/doc/first_steps/persistence/configure/index.en.html
- Restart Tails.
- Select yes to use the persistent volume.
- Enter your persistent volume password and login.
- Your configurations and passwords should now be saved to the USB device.
Adding your email account to Claws Mail:
- If you don't have a safe email account, sign up to mykolab or torguard etc or see if you can get a riseup account.
- Open Claws mail (Icon is situated in the Debian toolbar)
- Add your name (or pseudonym) and your email address. Select 'Forward'.
- Search for your email provider's 'client configuration'. Fill out the server address 'imap.(email provider).com', and your email address and password. Select your email clients encryption type. This should be specified on their client configuration page.
- Enter the server address again into the 'IMAP server directory.' Select 'Forward.'
- Enter the 'SMTP server address' and SSL type. Select 'Forward.'
- You should now be able to send and receive email.
If you can't send emails try the following:
- Open your Email Account Preferences (Configuration/Preferences for current account)
- Select 'Send' on the left hand pane, and in the 'Authentication method' dropdown box select 'Login'. Enter your email address and password.
- Go to 'Advanced', select the 'SMTP port' and 'IMAP port'. Make a note of the numbers.
- Open your web browser and search for 'IMAP port (name of your email provider)'. Check the IMAP and SMTP ports correspond to the ones you just noted, if not change them.
- Press 'Apply', and 'Ok'.
Set up PGP:
- Generate a new key pair, open your Account Preferences (Configuration/Preferences for current account). Select 'GPG' on the left-hand pane under 'Plugins'.
- Select 'Generate a new key pair.' Enter a password for your PGP key. Generate the keys.
- If you want other people to be able to find your key pair online, select 'Yes' to export your key to a keyserver.
- To add a contact's public key to your key library open Passwords and Encryption Keys. (System/Preferences/Passwords and Encryption Keys)
- Select 'Other Keys', and press the 'Search' icon.
- Enter your contacts email address and select 'Search'.
- Highlight your contact and select the 'Import' icon.
Using PGP encryption:
- Compose your email.
- Select the encryption type (Options/Privacy System/PGP Inline). (Only use PGP Mime if you know your recipients email client supports this.)
- Go to 'Options' and highlight 'Sign' and 'Encrypt'.
- To send the email you need to enter the password for your key.
The End
usb_bootable_disk_image
Corresponding ticket:
- Specific problems
- Growing system partition during boot
- Installing
- from Windows
- from macOS
A number of theproblems we've identified with the installation processwill be fixed by generating, distributing and installing Tails asa disk image that, once copied bit-by-bit to a USB stick, producesa final Tails (GPT, UEFI-bootable, ready to get a persistentvolume).
The list of tasks is being worked on in fundraising.git.It should be converted into subtasks of atsome point.
Generating
live-build can generate hdd images. Alternatively, we canpost-process our ISO image to create a USB-bootable disk image.
Open questions:
- What size should the system partition be? Do we grow the systempartition on first boot (from the initramfs) e.g.with cloud-init or the Rasbian tools(https://www.raspberrypi.org/downloads/noobs/,https://www.raspberrypi.org/downloads/raspbian/)?
- What about DVD support? Can we stop distributing an ISO imagesome day?
Growing system partition during boot
Corresponding ticket:
The plan is to do this in a partitioning script in the initramfs. There are different stages in the initramfs, which are explained in the (pretty useful) man page for initramfs-tools.
The initramfs in Tails is customized by live-boot, which is poorly documented.
Some notes about the initramfs/live-boot process
This is how the scripts in /scripts/live-realpremount are executed:
This is how /dev/sda1 is mounted:
/dev/sda1 is mounted before the scripts in /scripts/live-realpremount are executed.
The last stage executed before /dev/sda1 is mounted is init-premount.
Debugging
Useful kernel command-line parameters:
debug: Prints every command executed during initramfs to/run/initramfs/initramfs.debugbreak=premount: Drops into a shell before executing theinit-premountstage
Regal Tails Mac Os X
Distributing
XXX: impact on mirrors' storage space?
Installing
Common bits
- Self-installable executable download:
- We need to investigate if we can Cross-compile a 3rd party dd GUItool such as Etcher and distribute it from our website.
- Ask Etcher about self installable bundle.
from Windows
Etcher
See below 'from macOS'.
Rufus
- CLI mode: in progress but not on priority list of the developer
- Complicated UX
- too many options
- need to download supplementary files for syslinux version
- not clear which partition scheme to use even though it selects oneautomatically
- user has to manually choose to install our ISOhybrided image either usingISO or DD mode.
- License: GnuGPL
- : Boots (tested in legacy mode)
- When burnt in 'DD' mode, the checksums match!
Win32 Disk Imager
- Homepage: https://sourceforge.net/projects/win32diskimager/
- License: GPL
- Tested version: 1.0 from 2017-03-07
- Work on: Windows 7+
- UI is quite simple.
- Requires proper installing, clicking on the .exe is not enough (unlikeUUI).
- Doesn't have a filter for ISO images in its file chooser (but I couldchoose to see all files and select an ISO image).
- Takes 30 minutes to do the copy.
- Checksum of the resulting USB stick matches the checksum of the ISO image.
from macOS
Etcher
Regal Tails Mac Os Download
- Tested version: 1.3.1 from 2018-01-23
- Windows, macOS, Linux (deb & rpm)
- no official Debian images
- CLI mode: Etcher CLI is experimental, it's adifferent executable than the GUI one, so we can suppose that it can't be runto launch the GUI with the right options.
- License: Apache
- : images created with Etcher boot (in legacy mode at least) and checksums match
- Requires macOS 10.9 (Mavericks) or newer(which means a Mac from ~2007-2009 or newer)
- Takes 5 minutes to do the copy.
- Has both a portable and installable version for Windows
macOS Disk Utility
- Tested version: Mac OS X Lion
- I get an error ('invalid source') when I try to either:
- Copy a Tails 3.5 ISO image onto a USB stick.
- Restore the disk image of a full USB stick installed using @dd@.
- Restart the disk image of the system partition of a USB stick installed using @dd@.
- Insert USB flash device (8gb or larger).
- Launch the Tails Installer (Applications/Tails/Tails Installer)
- Select 'Clone and Install'.
- Select your USB flash device in the dropdown menu.
- Press 'install Tails'.
- To run Tails from the USB stick shut down Tails and log back into OSX. (Note: You still need the DVD to boot tails, I'm not sure if it is possible to boot from the USB flash drive only on a Mac. Instructions for USB only can be found here: https://tails.boum.org/doc/first_steps/installation/manual/mac/index.en.htmlI could not get this to work on the Macbook pro.)
To run Tails from the USB flash drive you need to install rEFInd:
- Download rEFInd http://sourceforge.net/projects/refind/
- Unzip.
- Open Terminal (Applications/Utilities/Terminal)
- Drag and drop the 'install.sh' file (from the refind folder you just downloaded) into Terminal and press 'Return'.
- Enter your admin password if prompted, and press 'Return'.
- If successful this will appear: Installation has completed successfully.
- Restart your computer, the rEFInd boot menu will appear. (You need both the Tails DVD and USB device inserted.)
- Select Linux.
- Login to Tails.
Create a persistent volume to save preferences etc:
- Launch Configure Persistent Volume (Applications/Tails/Configure Persistent Volume)
- Enter a password and select 'create'.
- For a list of the persistent volume features see: https://tails.boum.org/doc/first_steps/persistence/configure/index.en.html
- Restart Tails.
- Select yes to use the persistent volume.
- Enter your persistent volume password and login.
- Your configurations and passwords should now be saved to the USB device.
Adding your email account to Claws Mail:
- If you don't have a safe email account, sign up to mykolab or torguard etc or see if you can get a riseup account.
- Open Claws mail (Icon is situated in the Debian toolbar)
- Add your name (or pseudonym) and your email address. Select 'Forward'.
- Search for your email provider's 'client configuration'. Fill out the server address 'imap.(email provider).com', and your email address and password. Select your email clients encryption type. This should be specified on their client configuration page.
- Enter the server address again into the 'IMAP server directory.' Select 'Forward.'
- Enter the 'SMTP server address' and SSL type. Select 'Forward.'
- You should now be able to send and receive email.
If you can't send emails try the following:
- Open your Email Account Preferences (Configuration/Preferences for current account)
- Select 'Send' on the left hand pane, and in the 'Authentication method' dropdown box select 'Login'. Enter your email address and password.
- Go to 'Advanced', select the 'SMTP port' and 'IMAP port'. Make a note of the numbers.
- Open your web browser and search for 'IMAP port (name of your email provider)'. Check the IMAP and SMTP ports correspond to the ones you just noted, if not change them.
- Press 'Apply', and 'Ok'.
Set up PGP:
- Generate a new key pair, open your Account Preferences (Configuration/Preferences for current account). Select 'GPG' on the left-hand pane under 'Plugins'.
- Select 'Generate a new key pair.' Enter a password for your PGP key. Generate the keys.
- If you want other people to be able to find your key pair online, select 'Yes' to export your key to a keyserver.
- To add a contact's public key to your key library open Passwords and Encryption Keys. (System/Preferences/Passwords and Encryption Keys)
- Select 'Other Keys', and press the 'Search' icon.
- Enter your contacts email address and select 'Search'.
- Highlight your contact and select the 'Import' icon.
Using PGP encryption:
- Compose your email.
- Select the encryption type (Options/Privacy System/PGP Inline). (Only use PGP Mime if you know your recipients email client supports this.)
- Go to 'Options' and highlight 'Sign' and 'Encrypt'.
- To send the email you need to enter the password for your key.
The End
usb_bootable_disk_image
Corresponding ticket:
- Specific problems
- Growing system partition during boot
- Installing
- from Windows
- from macOS
A number of theproblems we've identified with the installation processwill be fixed by generating, distributing and installing Tails asa disk image that, once copied bit-by-bit to a USB stick, producesa final Tails (GPT, UEFI-bootable, ready to get a persistentvolume).
The list of tasks is being worked on in fundraising.git.It should be converted into subtasks of atsome point.
Generating
live-build can generate hdd images. Alternatively, we canpost-process our ISO image to create a USB-bootable disk image.
Open questions:
- What size should the system partition be? Do we grow the systempartition on first boot (from the initramfs) e.g.with cloud-init or the Rasbian tools(https://www.raspberrypi.org/downloads/noobs/,https://www.raspberrypi.org/downloads/raspbian/)?
- What about DVD support? Can we stop distributing an ISO imagesome day?
Growing system partition during boot
Corresponding ticket:
The plan is to do this in a partitioning script in the initramfs. There are different stages in the initramfs, which are explained in the (pretty useful) man page for initramfs-tools.
The initramfs in Tails is customized by live-boot, which is poorly documented.
Some notes about the initramfs/live-boot process
This is how the scripts in /scripts/live-realpremount are executed:
This is how /dev/sda1 is mounted:
/dev/sda1 is mounted before the scripts in /scripts/live-realpremount are executed.
The last stage executed before /dev/sda1 is mounted is init-premount.
Debugging
Useful kernel command-line parameters:
debug: Prints every command executed during initramfs to/run/initramfs/initramfs.debugbreak=premount: Drops into a shell before executing theinit-premountstage
Regal Tails Mac Os X
Distributing
XXX: impact on mirrors' storage space?
Installing
Common bits
- Self-installable executable download:
- We need to investigate if we can Cross-compile a 3rd party dd GUItool such as Etcher and distribute it from our website.
- Ask Etcher about self installable bundle.
from Windows
Etcher
See below 'from macOS'.
Rufus
- CLI mode: in progress but not on priority list of the developer
- Complicated UX
- too many options
- need to download supplementary files for syslinux version
- not clear which partition scheme to use even though it selects oneautomatically
- user has to manually choose to install our ISOhybrided image either usingISO or DD mode.
- License: GnuGPL
- : Boots (tested in legacy mode)
- When burnt in 'DD' mode, the checksums match!
Win32 Disk Imager
- Homepage: https://sourceforge.net/projects/win32diskimager/
- License: GPL
- Tested version: 1.0 from 2017-03-07
- Work on: Windows 7+
- UI is quite simple.
- Requires proper installing, clicking on the .exe is not enough (unlikeUUI).
- Doesn't have a filter for ISO images in its file chooser (but I couldchoose to see all files and select an ISO image).
- Takes 30 minutes to do the copy.
- Checksum of the resulting USB stick matches the checksum of the ISO image.
from macOS
Etcher
Regal Tails Mac Os Download
- Tested version: 1.3.1 from 2018-01-23
- Windows, macOS, Linux (deb & rpm)
- no official Debian images
- CLI mode: Etcher CLI is experimental, it's adifferent executable than the GUI one, so we can suppose that it can't be runto launch the GUI with the right options.
- License: Apache
- : images created with Etcher boot (in legacy mode at least) and checksums match
- Requires macOS 10.9 (Mavericks) or newer(which means a Mac from ~2007-2009 or newer)
- Takes 5 minutes to do the copy.
- Has both a portable and installable version for Windows
macOS Disk Utility
- Tested version: Mac OS X Lion
- I get an error ('invalid source') when I try to either:
- Copy a Tails 3.5 ISO image onto a USB stick.
- Restore the disk image of a full USB stick installed using @dd@.
- Restart the disk image of the system partition of a USB stick installed using @dd@.
Regal Tails Mac Os Catalina
from Linux
- GNOME Disks has a Restore Disk Image feature that basically does
ddwith a nice progress bar. - Investigate if we can get Etcher into Debian, which would allow allusers to follow the same process.
Regal Tails Mac Os 11
Upgrading
This approach does not make full, manual upgrades any simpler. For theideas we have to fix that other problem, see .
