Tails cheatsheet

┌──────────────────────────────┐
│         Tails Desktop        │
│  Tor Browser, Thunderbird,   │
│  KeePassXC, OnionShare, MAT2 │
├──────────────────────────────┤
│     All Apps → Tor Network   │
│   (iptables enforced rules)  │
├──────────────────────────────┤
│   Debian Live (in RAM only)  │
├──────────────────────────────┤
│   USB Stick (read-only OS +  │
│   optional encrypted persist)│
└──────────────────────────────┘

Key design decisions:

• Firewall rules block all non-Tor traffic at the kernel level via iptables/netfilter
• DNS is resolved through Tor (no DNS leaks possible)
• System clock is set via Tor consensus to avoid time-based fingerprinting
• MAC address is spoofed automatically on boot before any network connection

Always verify the download to prevent supply-chain attacks. Tails provides an OpenPGP signature for every release.

# Download the USB image
wget https://tails.net/install/download/tails-amd64-X.Y.img

# Download the OpenPGP signature
wget https://tails.net/install/download/tails-amd64-X.Y.img.sig

# Import the Tails signing key
wget https://tails.net/tails-signing.key
gpg --import tails-signing.key

# Verify the image
gpg --verify tails-amd64-X.Y.img.sig tails-amd64-X.Y.img
# Must show "Good signature from Tails developers"
# Fingerprint: A490 D0F4 D311 A415 3E2B B7CA DBB8 02B2 58AC D84F

Alternative: use the Tails website's JavaScript verification tool in-browser, which computes a SHA-256 hash client-side and compares against the expected value.

# List block devices to find your USB
lsblk

# Write image directly to USB (replace /dev/sdX)
# WARNING: this erases everything on the target device
sudo dd if=tails-amd64-X.Y.img of=/dev/sdX bs=16M status=progress oflag=direct

# Sync and safely remove
sync

Alternatively, use GNOME Disks ("Restore Disk Image" function) for a GUI approach.

Tails replaced balenaEtcher with Rufus in 2025 due to privacy concerns (Etcher was sending the image filename, USB model, and user IP to the Balena company).

Do not use balenaEtcher. It leaks identifying telemetry.

Tails still documents balenaEtcher for macOS but recommends dd or Raspberry Pi Imager if you want to avoid Etcher telemetry.

# Identify the USB device
diskutil list

# Unmount the USB
diskutil unmountDisk /dev/diskN

# Write the image (use rdiskN for raw device - much faster)
sudo dd if=tails-amd64-X.Y.img of=/dev/rdiskN bs=16m

sync

Minimum USB requirements: 8 GB capacity. Recommended: 16 GB or larger to allow persistent storage.

If the machine uses Secure Boot, you may need to disable it in BIOS. Tails does not ship with signed bootloaders for all hardware.

The Tails Welcome Screen appears on every boot:

Additional Settings options:

After the Welcome Screen:

The Tor Connection assistant guides you through:

The notification area clock icon turns green with an onion symbol when Tor is fully connected.

• The persistent volume is not hidden - its existence is visible on the USB
• If you are forced to decrypt, all persistent data is exposed
• Tails does not support hidden volumes (unlike VeraCrypt)
• Backup your persistent data - USB drives fail

# Backup persistent storage to another encrypted drive
# Mount an external encrypted drive first, then:
rsync -av --progress /home/amnesia/Persistent/ /media/amnesia/backup/

# Delete persistent storage completely
# (Recreate from Persistent Storage settings)
# This securely wipes the LUKS header, making data unrecoverable

Bridges are unlisted Tor relays used to circumvent censorship. Pluggable transports disguise Tor traffic as other protocols.

Configure bridges in Tails:

# Custom bridge format:
obfs4 IP:PORT FINGERPRINT cert=CERT iat-mode=0

Getting custom bridges:

# Via Tor Project website
https://bridges.torproject.org

# Via email (from Gmail/Riseup only)
# Send email to [email protected]
# Body: get transport obfs4

Tor Browser includes a circuit display showing the path your traffic takes.

You > Guard Node (entry) > Middle Relay > Exit Node > Destination
      [Country A]           [Country B]    [Country C]

Each tab in Tor Browser uses a different circuit. Click the padlock icon in the URL bar to see the current circuit and request a new one.

# If admin password is set, you can interact with Tor:

# View Tor circuit info via control port
sudo -u debian-tor tor-ctrl GETINFO circuit-status

# Signal Tor to build new circuits
sudo -u debian-tor tor-ctrl SIGNAL NEWNYM

# Check Tor connection status
systemctl status tor@default

# View Tor logs
sudo journalctl -u tor@default -f

Pre-configured Firefox ESR hardened for Tor. Key differences from standard Firefox:

• All traffic routed through Tor SOCKS proxy (127.0.0.1:9050)
• JavaScript enabled by default but can be set to "Safest" security level
• NoScript pre-installed
• Letterboxing enabled (resizes content to standard sizes to prevent window-size fingerprinting)
• WebRTC disabled (prevents IP leaks)
• No browser history, cookies cleared on exit

Security Levels (shield icon in toolbar):
  Standard  - JavaScript enabled, all features on
  Safer     - JS disabled on non-HTTPS, some fonts/media blocked
  Safest    - JS disabled everywhere, fonts/media blocked

Thunderbird + Torbirdy:

- Email client pre-configured for Tor
- PGP encryption via OpenPGP built-in (Enigmail deprecated)
- All connections route through Tor
- Strips email metadata headers automatically
- IMAP/SMTP over Tor (use .onion mail servers when possible)

OnionShare:

# Share files over Tor without a server
# Applications → OnionShare

# Creates a temporary .onion address for:
# - Sharing files (upload to recipients)
# - Receiving files (others upload to you)
# - Hosting a simple website
# - Anonymous chat room

# The .onion address is only active while OnionShare runs
# Recipients need Tor Browser to access it

KeePassXC:

- Password manager with TOTP support
- Database stored in Persistent Storage
- Use a strong master password + key file for defense in depth
- Path: ~/Persistent/keepassxc.kdbx

MAT2 (Metadata Anonymisation Toolkit):

# Remove metadata from files before sharing
# Supports: images, PDFs, office docs, audio, video, archives

# Check metadata
mat2 --show document.pdf

# Clean a single file (creates cleaned copy)
mat2 document.pdf
# Output: document.cleaned.pdf

# Clean in-place
mat2 --inplace photo.jpg

# Clean all files in a directory
mat2 *.pdf

# Right-click any file in Files → "Remove metadata"

GnuPG:

# Generate a GPG key pair
gpg --full-generate-key

# Encrypt a file for a recipient
gpg --encrypt --recipient [email protected] file.txt

# Sign a file
gpg --detach-sign --armor file.txt

# Verify a signature
gpg --verify file.txt.asc file.txt

# Export public key for sharing
gpg --armor --export [email protected] > pubkey.asc

# GPG keys persist if GnuPG is enabled in Persistent Storage

LUKS Disk Encryption:

# Create an encrypted volume on an external drive
# Applications → Disks → Select drive → Format → LUKS + Ext4

# Command line alternative (admin password required):
sudo cryptsetup luksFormat /dev/sdX1
sudo cryptsetup open /dev/sdX1 encrypted_vol
sudo mkfs.ext4 /dev/mapper/encrypted_vol
sudo mount /dev/mapper/encrypted_vol /mnt

# Close when done
sudo umount /mnt
sudo cryptsetup close encrypted_vol

Electrum Bitcoin Wallet:

- Lightweight Bitcoin wallet routed through Tor
- Wallet data persists if Electrum is enabled in Persistent Storage
- Use for anonymous transactions
- Connects to Electrum servers via Tor

Tails automatically randomizes your MAC address before connecting to any network.

The spoofed MAC appears as a random vendor OUI. Different MAC on every boot. Can be disabled in Welcome Screen if it causes connectivity issues.

Why it matters: your real MAC address is a hardware identifier logged by routers, access points, and captive portals. Spoofing prevents linking your device across sessions.

Tails includes an "Unsafe Browser" for one specific purpose: logging into captive portals (hotels, airports, cafes).

- Connects DIRECTLY to the network (NOT through Tor)
- Clearly marked with red warning theme
- Only use to authenticate with captive portals
- Close immediately after portal login
- Tor Browser then routes normally through the open connection

WARNING: Traffic through the Unsafe Browser reveals your real IP
to the captive portal and any observer on the local network.

Enable it: Welcome Screen - Additional Settings - Unsafe Browser.

By default, Tails has no root/admin password - this prevents accidental system modification and limits malware impact.

Enable when needed:
  Welcome Screen > Additional Settings > Administration Password

Use cases:
  - Installing additional packages (apt)
  - Running commands as root
  - Configuring advanced networking
  - Accessing system logs
  - Mounting internal hard drives (forensics)

# Once set, use sudo normally:
sudo apt update
sudo apt install <package>

The admin password only lasts for the current session. It is never persisted.

Install extra packages that auto-reinstall on every boot (requires Persistent Storage).

# Method 1: GUI
# Install a package normally with apt (admin password required)
sudo apt update && sudo apt install <package>
# Tails notification: "Install Every Time" or "Install Only Once"
# Select "Install Every Time" to persist

# Method 2: Manual configuration
# Packages are stored in:
/live/persistence/TailsData_unlocked/apt/cache
/live/persistence/TailsData_unlocked/apt/lists

# Persistent config at:
/live/persistence/TailsData_unlocked/live-additional-software.conf

Useful additions for security work:

sudo apt install git python3-pip vim tmux nmap whois

Running Tails in a VM reduces some security properties:

When VMs are acceptable:

• Testing and learning Tails functionality
• When the host OS is also hardened (e.g., Qubes-Whonix)
• When physical USB boot is not possible

# QEMU/KVM example (Linux host):
qemu-system-x86_64 \
  -enable-kvm \
  -m 2048 \
  -boot d \
  -drive file=tails-amd64-X.Y.img,format=raw,readonly=on \
  -net nic -net user

# Clone Tails USB to another USB
# Applications → Tails → Tails Installer → Clone the current Tails
# This copies the full Tails system (NOT persistent storage)

# Manual upgrade (automatic upgrades preferred):
# Tails checks for updates on Tor connection
# Notification appears when an upgrade is available
# Follow the guided upgrade process

# If automatic upgrade fails:
# 1. Download new Tails image
# 2. Boot from current Tails USB
# 3. Use Tails Installer to upgrade from the .img file

# Full manual reinstall:
# Use dd or Rufus to write new image (wipes persistent storage!)
# Backup ~/Persistent first

For red team operators and researchers conducting anonymous OSINT or infrastructure research:

Account creation:
- Use Tails + Tor Browser to create accounts
- Use temporary email services over Tor (.onion preferred)
- Never reuse identities across Tails sessions
- Use KeePassXC in persistent storage to manage credentials

Infrastructure research:
- All reconnaissance through Tor Browser or proxychains
- Use the session's unique Tor circuit
- Request new identity (Ctrl+Shift+U) between targets
- Do not mix personal and operational browsing

OPSEC checklist:

Never do any of the following:

• Use your personal computer
• Connect from home/work network
• Access personal accounts in the same session
• Keep unencrypted copies of submitted material
• Tell anyone which USB is your Tails drive

Hardware fingerprinting:
- Display resolution, USB devices, CPU info can leak
  through browser or OS-level queries
- Tor Browser mitigates some (letterboxing) but not all

Cold boot attacks:
- RAM contents can be recovered for seconds-minutes
  after power off using physical access
- Tails overwrites RAM on shutdown to mitigate this
- Does NOT protect against liquid nitrogen attacks
  (RAM frozen before shutdown)

Evil maid attacks:
- An attacker with physical access to your USB can
  modify the bootloader or OS to install backdoors
- Tails does not have Secure Boot verification on all platforms
- Mitigate: keep USB on your person at all times

BIOS/UEFI/firmware implants:
- Tails cannot detect or protect against compromised
  firmware on the host machine
- A rootkit in BIOS/UEFI persists across all OS boots
- Use trusted hardware or hardware you control
- Intel ME / AMD PSP run below the OS - invisible to Tails

DMA attacks:
- Thunderbolt/FireWire/PCIe devices can read/write RAM
  directly, bypassing OS protections
- Disable unused ports in BIOS when possible

The Tails project explicitly recommends against using VPNs with Tails. This is a deliberate architectural decision.

If your threat model requires hiding Tor usage from your ISP, use Tor bridges instead of a VPN. If you need a VPN for non-Tor traffic, use a separate OS or VM.

The USB drive itself is a physical artifact that can be found, seized, or forensically analyzed.

For maximum deniability: use Tails without persistent storage, boot from a generic USB that could plausibly contain anything, and physically destroy the drive after use.

• Tails
• Tails Documentation
• Tor Project
• OnionShare
• KeePassXC
• Tails Known Issues
• Tor Bridges
• MAT2

• Whonix (Tor-enforced anonymity OS with gateway isolation)
• Qubes OS (Security through compartmentalization with Xen)
• GrapheneOS (Hardened mobile OS for privacy-focused devices)
• Anonymization (Identity separation and OPSEC methodology)
• Cellular OPSEC (Mobile threat model, IMSI catchers, baseband)
• Mullvad VPN (Privacy-focused VPN with anonymous signup)
• OPSEC Checklist (Operational security verification steps)