1

I am Trying to troubleshoot Tor on Raspberry pi3 based on instructions at https://learn.adafruit.com/onion-pi/install-tor.html

I appear to be able to connect to the Wi-fi, but my IP does not seem to be changing. Output after Tor command is Here. I look into the torrc file and it is empty. I do not know where to find any more settings to help troubleshoot. Any ideas where to start?

pi@raspberrypi:~ $ tor
Feb 14 05:32:48.936 [notice] Tor v0.2.5.12 (git-6350e21f2de7272f) running on Linux with Libevent 2.0.21-stable, OpenSSL 1.0.1t and Zlib 1.2.8.
Feb 14 05:32:48.936 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Feb 14 05:32:48.936 [notice] Read configuration file "/etc/tor/torrc".
Feb 14 05:32:48.945 [notice] You configured a non-loopback address '192.168.42.1:53' for DNSPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted.
Feb 14 05:32:48.945 [notice] You configured a non-loopback address '192.168.42.1:9040' for TransPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted.
Feb 14 05:32:48.947 [notice] You configured a non-loopback address '192.168.42.1:53' for DNSPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted.
Feb 14 05:32:48.947 [notice] You configured a non-loopback address '192.168.42.1:9040' for TransPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted.
Feb 14 05:32:48.947 [notice] Opening Socks listener on 127.0.0.1:9050
Feb 14 05:32:48.947 [warn] Could not bind to 127.0.0.1:9050: Address already in use. Is Tor already running?
Feb 14 05:32:48.947 [notice] Opening DNS listener on 192.168.42.1:53
Feb 14 05:32:48.947 [warn] Could not bind to 192.168.42.1:53: Permission denied
Feb 14 05:32:48.947 [notice] Opening Transparent pf/netfilter listener on 192.168.42.1:9040
Feb 14 05:32:48.947 [warn] Could not bind to 192.168.42.1:9040: Address already in use. Is Tor already running?
Feb 14 05:32:48.947 [warn] Failed to parse/validate config: Failed to bind one of the listener ports.
Feb 14 05:32:48.947 [err] Reading config failed--see warnings above.
pi@raspberrypi:~ $
  • I think you're experiencing the same issues as this user. – cacahuatl Feb 15 '17 at 7:32
2

The guide tells you how to start tor through this command:

 sudo service tor start (or 'stop' to stop it if its already running)

In your log output you see that you start it by just writing the 'tor' command as a non-root user. This is most likely why it fails, because you need to be root to let tor access the network ports and bind to that (which you also see fails in the log output).

  • Ok, This makes sense here, but I have this running as a boot at start using -sudo update-rc.d tor enable. Should not that have started it at root? – Lance Loomis Feb 15 '17 at 21:08
  • I tried command -sudo service tor status -l and got this: {docs.google.com/document/d/…} – Lance Loomis Feb 15 '17 at 21:15
-2

It's a common Linux and Unix problem not related just to Tor. The root of the problem is that you can't bind a port 53, which is a lower port or privileged port - i.e. all ports with < 1024 or sometimes 2048 are requiring a root privileges to bind to them. How to fix it - a very simple checklist for Tor! Here it is:

  • First of all check if it's not already taken by some other app netstat -nalp | grep ":53" | grep "0.0.0.0:*" - this will show you what pid and program listens on it, if there's any. If your desired bind point is already taken - free it first. DNSPort 53 according to docs can have address, so if it's just a port(and no DNSListenAddress directive) - it will try to bind to 0.0.0.0 i.e. to all IP's of the host at the binding moment. If you have DNSListenAddress - it can also take IP and port. Pehaps you should be more specific in your port-53-occupying app's config and in Tor's torrc? Specify IP addresses in both configs and you will be just fine.
  • If the port/binding-point is free - start tor as root and add the very last line in your torrc config User tor-unprivileged-user - that's how it works: at first, tor starts as a current user it is runned from and binds to all the network points(ports, ip+ports combo's), no network activity so far, so no leaks are possible. After that - if there's a User directive in the last line of the config - it drops/switches-to the username specified. Only after that any files are open(geoip db's, caches, HS keys, etc) and network activities are takin it's place

Usually an ISC BIND with process called named is residing on all the 53 ports, it's configs are in Debian usually in /etc/bind folder. The main one is named.conf but in Debian and other distro's it's split up and included from it. Find the one with options {} container in it and add this option: listen-on { X1.Y1.Z1.V1; X2.Y2.Z2.V2; }; - it will bind to the specific IP addresses only. Watch for semicolons! A semicolon after every IP and after the closing curly bracket.

Feel free to ask questions if you need any further help!

  • "so if it's just a port(and no DNSListenAddress directive) - it will try to bind to 0.0.0.0 i.e. to all IP's" Wrong again, Alexey. It will bind to 127.0.0.1 if it's just a port. DNSListenAddress is deprecated and should no longer be used, you only need DNSPort which handles the address definition aswell. – cacahuatl Feb 15 '17 at 1:46
  • "If the port/binding-point is free - start tor as root and add the very last line in your torrc config User tor-unprivileged-user" This is a bad idea because they've already got a Tor service setup, as it made obvious in their question. This will only make things worse. – cacahuatl Feb 15 '17 at 1:47
  • "It's a common Linux and Unix problem not related just to Tor. The root of the problem is that you can't bind a port 53, which is a lower port or privileged port" This isn't the problem, the problem is Tor is already running and they're trying to get the logs as a user, rather using the pre-existing service file. – cacahuatl Feb 15 '17 at 1:49
  • This entire answer is confusing trash that does nothing but mislead the user. – cacahuatl Feb 15 '17 at 1:49
  • @canonizingironize instead of bursting in "flames" you better actually read what I have answered. I'm glad that 127.0.0.1 became default by fact(proved it on my latest upgrade), but I'm not sure that author's old Tor version does it too: I've seen the 0.0.0.0 bindings for a Tor from official OS repo's. Also - it's not a fact that Tor is already running because this case port 53 would have "Address already in use" message rather that "Permission denied", Read The Fine Manual. – Alexey Vesnin Feb 16 '17 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.