1

Currently running TBB 7.0a3 on OS X 10.15. Cannot get any other app to use Tor on any port when bundle is running. Some digging turned up torrc file which contained line:

SocksPort unix:"/Users/will/Library/Application Support/TorBrowser-Data/Tor/socks.socket"

Clearly this works for TBB and hardens it somehow, but I have need of using other applications through tor, so can someone please recommend a way of adding an open SOCKS port of 9150 or 9050 without compromising security? Thanks. My applications support using usernames and passwords for SOCKS, if that helps.

Improve this question

2 Answers 2

Reset to default
0

You can simply add another SocksPort entry. So this is completely legitimate:

SocksPort 9051
SocksPort 9052 IsolateDestAddr
SocksPort unix:/var/run/tor/socks/socks1

The impact on security should be minimal. TCP/IP Ports are not bound to unix permissions, hence, other user on your system can access and potentially attack the port. The main goal of unix sockets, though, is to be able to disable IP networking in the Browser which still possible as long as the unix socket stays enabled too.

Improve this answer
2
  • Thank you for your help. No variation of that appears to work for me. Was your example adding 3 socks ports?
    – will
    Commented May 15, 2017 at 1:01
  • 2
    Looks like multiple SocksPorts is currently broken in the alpha builds. Have a look at ticket 20761. The fix should be included in 7.0a4 about to be released in the next few days.
    – Peter Gerber
    Commented May 15, 2017 at 8:27
0

Well, first of all - you need to use SocksPort : - for a greater good! Add the explicit IP address - see the offical manual for further details. This directive with ip+port combo works fine if specified multiple times, but if there's only a port number - it glitches sometimes. It's an old problem, but actually it's not a problem at all: if you're about to open the port for internal usage in your LAN, for example, or in your VPN segment - you do know IP address, and it's static - so there's no problem to just type it in. But - be warned: ther's no user+pass authentication that will check the passwords, so if you are opening TCP port - it is open, the authentication is used only to separate the data streams, no login credentials are actually checked against any backend! Using different login+pass combos for your app has it's uses - it will separate the data streams. But if you need to use a SocksPort without degrading a security - here what you can do:

  • If you have all the apps on the single computer - just use SocksPort 127.0.0.1:9050 and be about your business. It will not ruin the security - because of the fact that all the apps are on one machine, they are supposed to be already secured and do not need a deeper/stronger isolation from each other.
  • If you have your apps on different VM's or on different hosts in LAN - opening just a socksport will degrade securuty. Use socat or similar program on both sides to "extend" the filesystem socket through network, i.e. on tor side it works like sock->tcp**+authorization/access-control** - and on the program hosting hosts/VMs it's vice versa

Feel free to ask if you have any further questions!

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .