4

How can I find out how to configure wget to work securely with torify? The official documentation for doing it seems outdated.

I'm using Ubuntu Linux 16.04, with tor installed from the repositories, but using the stand-alone browser bundle is accepteable as long as it can be used through the command line/scripts.

I know that I can use torify wget [url] and it will download file/s, and I know that using the suggested method from this post (getting public IP address) that running this:

wget http://ipinfo.io/ip -qO -

and then running this

torify wget http://ipinfo.io/ip -qO -

do successfully return different IP addresses.

But a lot of sources always imply that it's not that simple and other identifying information could be leaked by wget.

This link (which seems official) specifically mentions configuring wget for torify

There it says for Unix/Linux to edit /home/user/.bashrc and add these lines:

http_proxy=http://127.0.0.1:8123/
HTTP_PROXY=$http_proxy
export http_proxy HTTP_PROXY

And then it says to edit /etc/wgetrc and add these lines:

http_proxy = http://localhost:8118
use_proxy = on

But doing that causes torify wget to fail with this error:

Connecting to localhost (localhost)|127.0.0.1|:8118... [Sep 06 21:55:50] WARNING torsocks[3680]: [connect] Connection to a local address are denied since it might be a TCP DNS query to a local DNS server. Rejecting it for safety reasons. (in tsocks_connect() at connect.c:186)
failed: Operation not permitted.
Retrying.

I really have no idea what that error message or those config lines mean. What do they mean? Is this still the right way to configure wget for use with torify? Because really the main problem here is that the link that recommends those configurations clearly states that that is all "Old Advice (outdated)."

Is there any new, up-to-date advice?

What about Tails? Is any of this configuration necessary to make wget work securely running in Tails?

Please keep in mind that I don't know much about advanced networking and the inner workings of tor. Beginner-friendly advice would be preferred, but any information would be appreciated. Thank you.

Related questions:

3

Personally, I think the wiki stuff is outdated and needs some kinda purge with fire.

Here's how Tails does it:

#!/bin/sh
unset http_proxy
unset HTTP_PROXY
unset https_proxy
unset HTTPS_PROXY

exec torsocks /usr/lib/wget/wget --passive-ftp "$@"

This script is set as the default wget (through dpkg-divert, so that non-torified wget would be hard to accidentally run) and will wrap any call to wget. This does the following:

  1. Unsetting the http{,s}_proxy environment variables stop wget trying to use a proxy outside of Tor and potentially either contaminating another proxy with traffic intended to be anonymous (e.g. torsocks connects to some proxy over Tor) and to avoid it trying to use localhost resources causing the torsocks failure you saw before.

  2. Using torsocks (at least >=2.0) is a pretty robust method for wrapping applications that don't natively support SOCKS5, while there are problems it can encounter it's unlikely to encounter them in wget. This should force all connections to go out over Tor.

  3. --passive-ftp on the command line or passive_ftp = on in wgetrc stops the use of "Active" FTP. This is an application level leak, specifically because FTP uses two channels, one for commands and the other for data. "Active" FTP works by the client (e.g. wget) sending the server an IP and a Port to connect to to send the contents of the file. Since the client sends what it believes to be it's IP to the server, this clearly leaks local information to the remote party, this is more likely a LAN IP address ("Active" FTP is mostly superceded by "Passive" because it doesn't play well with NAT) than it's real public IP, but still constitutes a leak.

Other things to consider, the User-Agent send by wget will often provide a version number and a platform, for example Tails (2.5) will currently provide Wget/1.16 (linux-gnu) as the User-Agent, different operating systems will likely have different versions of wget in their software libraries at different times and so an observer might be able to guess at your current platform. From a real world example I can see that this wget Wget/1.17.1 (linux-gnueabihf), seen frequently "pinging" an onion service I run over a long period of time, is Linux running on an ARM system with a HardFloat ABI (abihf) which likely makes it a small ARM SoC device. If I cared, I could query the popular distros for such devices and try to discover which of them was shipping version 1.17.1 of Wget currently. Either fake the User-Agent to match and hope no one takes a closer look, which is prone to failure with your faked user-agent slipping out of real-world use (I see a lot of wget/python-urllib/curl with user-agents claiming to be Firefox 31.0 to fake being Tor Browser, while 31.0 hasn't been used on Tor Browser in a long time, it just makes them stand out more and become increasingly less anonymous) or use a common distro (Ubuntu, as is your case, would be a fine candidate) or distro like Tails which is designed to provide a consistent anonymity set to all of its users.

  • Thank you so much for the great answer Canonizing Ironize! Just using Tails' wget script just seems way too easy, but your fantastic breakdown of what it does makes it seem like it might work. Unsetting those variables sounds like a root task, but I don't think I want to run torsocks or wget as root. I'll have to experiment. What I don't understand is why Torsocks is a better option than Torify! I thought Torify was just a wrapper designed specifically for calling other applications through torsocks. Is it opening new security holes while it's doing that?. Thank you again! – InverseTelecine Sep 7 '16 at 20:09
  • in modern torsocks versions torsocks, torify and usewithtor are all the same. unsetting the variables doesn't require root, they're only unset from the local shell, meaning they won't affect anything outside of the script, there's nothing in there that requires root. – cacahuatl Sep 7 '16 at 20:29
  • Yeah, I should have just tried unsetting the variables before mentioning it. My bad for asking stupid questions I could answer myself more quickly. Anyway, I really couldn't have asked for a better answer here. Thank you again for all your time! – InverseTelecine Sep 7 '16 at 20:37
  • For anyone else who's trying this: the only thing that needs to be changed in that Tails script to make it work in Ubuntu is to change /usr/lib/wget/wget to /usr/bin/wget. Or if that doesn't work, run $ which wget to find out the path to your system's wget and use it instead. – InverseTelecine Sep 7 '16 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.