Since two days, I'm running a Tor relay I call charon. I heard about arm that shows you some statistics about your relay, which sounds like a great tool to have.
For it to work, you have to enable the ControlPort, which is a password-protected way to control your relay from the outside. I have the idea to enable the ControlPort and set up arm, but I want it to be only accessible by localhost, which I will set up an appropriate rule in my firewall for.
Will it work this way?
This doesn't require additional configuration, by default the ControlPort will bind to 127.0.0.1 on the local loopback interface and as such it will only be accessible through the localhost.
You should however also include either a HashedControlPassword or a CookieAuthentication or alternatively use a UNIX socket and use UNIX filesystem permissions to restrict access to the control port, as it not only provides information but allows Tor to be reconfigured.
A control auth cookie is enabled by default on the Tor debian packages at /var/run/tor/control.authcookie, as is a ControlPort through a UNIX socket located at /var/run/tor/control, which anyone who is a member of the debian-tor group can access by issuing the command arm -s /var/run/tor/control.
P.S. Thanks for running a relay!
