nyx - Unable to connect to tor. Maybe it's running without a ControlPort?

Question

I'm running Ubuntu 18.04 server, headless and installed tor using the debian instructions on the tor project. However, nyx will not run to show me tor connection information, when I enter nyx I receive the message: Unable to connect to tor. Maybe it's running without a ControlPort?

However, I can see tor running when I run top.

   921 root      20   0   75448  19400   6356 S   0.3  0.5   0:03.12 tor  

But, when I run systemctl | grep tor I see:

● tor.service            loaded active exited    Anonymizing overlay network for TCP (multi-instance-master)                  
● [email protected]    loaded failed failed    Anonymizing overlay network for TCP                

I've configured my 'tor service' in /usr/share/tor/tor-service-defaults-torrc and that file's contents are:

DataDirectory /var/lib/tor
PidFile /run/tor/tor.pid
RunAsDaemon 1
User debian-tor

ControlSocket /run/tor/control GroupWritable RelaxDirModeCheck
ControlSocketsGroupWritable 1
SocksPort unix:/run/tor/socks WorldWritable
SocksPort 9050

ControlPort 9051
CookieAuthentication 1
CookieAuthFileGroupReadable 1
CookieAuthFile /run/tor/control.authcookie

Log notice syslog

Any help to get nyx working and improve my tor implementation is appreciated.

Answer 1

I found the answer in this post the issue was that another tor service was running, blocking access to the control port. The following code fixed the problem:

sudo netstat -plnt | fgrep 9050

To find the other service hogging the control port.

sudo killall tor

To kill all tor processes.

sudo systemctl start tor.service

Then I ran journalctl -xe to make sure that tor booted correctly.

Answer 2

sudo -u debian-tor nyx

Solution is running nyx as user tor (i.e. debian-tor in Ubuntu 18.04). In this case just these 2 lines about control port needed in torrc.

ControlPort 9051
CookieAuthentication 1

Answer 3

Well, running nyx as Tor user (it's named mostly as tor or debian-tor in a packaged binaries) has it's uses, but only if you're using a unix socket for a Control Protocol. The truth is that the Tor control protocol does not provide a fully-featured authentication system with all the necessary protections like brute force defense et cetera. So, if you're operating on a machine physically - yes, it's OK to use tor's user. If you're connecting to the machine remotely - forget the unix socket and use the TCP port properly encapsulated into a really secure wrapper: STunnel with the full client and server verification with easyRSA is the easiest way, but it's secure enough to be trusted. Also keep in mind, that nyx has to be running constantly, i.e. in a screen detached terminal, so you will see actual data. If you need to collect the data and check it out from time to time - nyx is not a right tool: I recommend using rrdtool or Zabbix for this task - and the filesystem socket will do you good in that case.