0

I run Ubuntu 16.04LTS and I'm trying to reinstall TOR because it stopped working...

Right now I'm trying to verify TOR package I downloaded and I'm having problems with the verification. When I enter this command

gpg --keyserver pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290

I get this response

gpg: requesting key 0x4E2C6E8793298290 from hkp server pool.sks-keyservers.net
?: invalid HTTP proxy (socks5-hostname://127.0.0.1:9050): unsupported URI
gpgkeys: HTTP fetch error 7: couldn't connect: Success
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0
gpg: keyserver communications error: keyserver unreachable
gpg: keyserver communications error: public key not found
gpg: keyserver receive failed: public key not found

What to do?

  • Looks like you've misconfigured GnuPG, trying to give it a SOCKS proxy when it expects an HTTP proxy. – cacahuatl Feb 2 '18 at 19:39
  • That's helpful, thanks, but I'm a newbie at Linux and is there a way to fix it? – Jerry777 Feb 3 '18 at 2:58
  • Given that that configuration isn't default on ubuntu I can only assume it's a configuration change you've made yourself. – cacahuatl Feb 3 '18 at 3:01
  • I didn't consciously do that. The only thing I often do is update my Tor & system software via Software Updater. So since I'm not even sure I know what an http proxy is, I can only guess that this might work (from my reading): gpg --keyserver pool.sks-keyservers.net --keyserver-options http-proxy=socks5-hostname://127.0.0.1:9050 --recv-keys 0x4E2C6E8793298290 – Jerry777 Feb 3 '18 at 3:15
  • I tried the command gpg --keyserver-options http-proxy=socks5-hostname://127.0.0.1:9050,debug,verbose --keyserver pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290 – Jerry777 Feb 3 '18 at 3:32
1

These are the instructions from the official Tor Browser User Manual in case the Ubuntu torbrowser-launcher package hasn't updated the gpg key that is required to install Tor Browser. When I updated the Tor Browser Developers signing key I noticed that the key that I updated will expire in less than one year.

  1. Navigate to the Tor Browser download page.

  2. Download the GNU/Linux .tar.xz file

  3. (Recommended) Verify the file's signature. The steps for verifying the file's signature are shown below.

  4. When the download is complete, extract the archive with the command tar -xf [TB archive] or with the Archive Manager.

  5. Navigate to the newly extracted Tor Browser directory. Right click on start-tor-browser.desktop, open Properties and change the permission to Allow executing file as program by clicking the checkbox. Double-click the icon to start up Tor Browser for the first time.

  6. Alternatively, from inside the Tor Browser directory, you can also start from the command line by running:

    ./start-tor-browser
    

How to verify Tor Browser's signature

Fetching the Tor Developers key

The Tor Browser team signs Tor Browser releases. Import the Tor Browser Developers signing key (0xEF6E286DDA85EA2A4BA7DE684E2C6E8793298290):

gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org

This should show you something like:

gpg: key 4E2C6E8793298290: public key "Tor Browser Developers (signing key) <torbrowser@torproject.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
pub   rsa4096 2014-12-15 [C] [expires: 2020-08-24]
      EF6E286DDA85EA2A4BA7DE684E2C6E8793298290
uid           [ unknown] Tor Browser Developers (signing key) <torbrowser@torproject.org>
sub   rsa4096 2018-05-26 [S] [expires: 2020-09-12]

After importing the key, you can save it to a file (identifying it by fingerprint here):

gpg --output ./tor.keyring --export 0xEF6E286DDA85EA2A4BA7DE684E2C6E8793298290

Verifying the signature

To verify the signature of the package you downloaded, you will need to download the corresponding ".asc" signature file as well as the installer file itself, and verify it with a command that asks GnuPG to verify the file that you downloaded.

The example below assumes that you downloaded these two files to your Downloads folder.

gpgv --keyring ./tor.keyring ~/Downloads/tor-browser-linux64-9.0_en-US.tar.xz{.asc,}

The result of the command should produce something like this:

gpgv: Signature made 07/08/19 04:03:49 Pacific Daylight Time
gpgv:                using RSA key EB774491D9FF06E2
gpgv: Good signature from "Tor Browser Developers (signing key) <torbrowser@torproject.org>"
  • Thanks for your reply. I did what you said but though I tried it a few ways, gedit opened nothing. Fortunately TOR version 7.5 doesn't need to be installed so I can run it directly. – Jerry777 Feb 3 '18 at 16:59
  • Thanks for your help but I'm OK now. Tor Browser version 7.5 runs easily on my system without installation just by unpacking it and running the launching file. In contrast Tor re-installation through Ubuntu Software I couldn't get to work no matter how I uninstalled/reinstalled or what special commands I used. I don't mind running it directly. In fact that might be better, because I verified the signature of the Tor download I unzipped, but I never verified the Ubuntu Software one. – Jerry777 Feb 3 '18 at 23:07
  • I fully understand that because in the beginning I downloaded Tor Browser from the official Tor website and ran it directly too, but that lasted only about 24 hours because I don't give up easy. I searched the internet and found nothing, so I had to figure it out for myself, because I reasoned that it must be a bug and I wanted to put the bug fix online to share it with everyone who is affected by the same bug. If you look at my profile you will see that I registered for Tor Q&A only 9 days ago, and the reason why I registered here was to share this solution. – karel Feb 3 '18 at 23:14
  • Dear karel: I appreciate your help but I hope you are not implying that I "give up" more "easily" than you. Our purposes are different. To run it directly actually serves my purposes better than installation (I realize now, for a couple of reasons I don't need to get into). And BTW it still works fine thank God. – Jerry777 Feb 4 '18 at 15:01
  • I think the way you're doing it also automatically updates itself like mine. I don't know because I haven't checked yet, but I have both Tor Browsers installed, so I'll find out soon enough. If so the advantages of using the Ubuntu repo package are that it launches the usual way from the Dash (see the screenshot in my answer) and it survives a distribution upgrade the same way. – karel Feb 4 '18 at 15:13
0

Maybe this isn't a proper answer, but realizing I had another laptop with Ubuntu 16.04LTS, and realizing from cacauati that by main laptop's configuration was abnormal, and not knowing how to make it normal, instead I was able to complete the TOR package verification easily by copying the files to the other laptop and running the standard TOR-website commands there.

0

For the benefit of other newbie users here, and as a more proper answer, I found that all I needed to do to restore keyserver download function (the step before verifing the TOR package) was to open /home/.gnupg/gpg.conf with a text editor, find the line

keyserver-options http-proxy=socks5-hostname://127.0.0.1:9050

and put a # in front of it to de-activate it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.