14

With the packaging of Tor in Debian and Ubuntu set where neither will ship the latest version of Tor for users as it is in the Debian "experimental" repository, what alternative repositories are safest for use in securing a system with Tor? If there are no alternative repositories considered safest, what is the best route for swiftly building the software locally for use?

Improve this question
0

2 Answers 2

Reset to default
11

Actually, we're very happy with our Debian packager. He works hard to make sure the version of Tor shipped in various Debians is safe and stable.

But Ubuntu has indeed been a source of frustration over the years. Read the Ubuntu bug ticket for some of the sordid details -- especially the parts where I start repeating the phrase "remote root vulnerability" as the months go by with no resolution. (Ok, in retrospect it looks like it only took them three months after notification to resolve the fact that they were shipping an obsolete version of Tor with a serious security vulnerability. Felt like longer at the time. But still, three months? Really?)

The best way to install the right Tor debs, either because you're on Ubuntu or because you want to get quicker updates than Debian stable allows, is to use the deb repository at deb.torproject.org.

For most users, building Tor on your own is a much worse idea than using the deb. The Tor deb has great features like automatically raising your ulimit -n, running Tor as a different user, etc. If you really want to be bleeding-edge, you can still use a deb even then: see Lunar's directions on using deb nightly builds.

Improve this answer
2
  • 1
    "only took them three months after notification"... wow, the fact that it's "only" three months makes me very, very sad. I guess I don't use Ubuntu for a reason.
    – user5
    Commented Sep 28, 2013 at 19:56
  • 1
    Tor bundle is more secure anyway.
    – sineau
    Commented Sep 29, 2013 at 8:50
1

Probably you should look at "build from source - way".

E.g. simle script:

root@onion:/usr/src/tor# cat /etc/crontab
5  5    * * *   anonymous       /bin/bash /usr/src/tor/buildscript.sh

root@onion:/usr/src/tor# cat buildscript.sh 
#!/bin/bash

if [ ! -e "tor" ]; then
        git clone https://git.torproject.org/tor.git 
        cd tor
else
        cd tor
        make clean
        git pull
fi

./autogen.sh
./configure
make

Nowadays, there are plenty of options from configure are enabled by default, you need no much more motions. Just install dependencies dev's packages.

Improve this answer
2
  • 1
    This script lacks error handling. At least run it with set -e. And of course you don't get any of the integration that the package provides.
    – weasel - Peter Palfrader
    Commented Oct 5, 2013 at 7:01
  • This is example, How to achieve, what topic starter want to achieve. You may improve it as you wish.
    – perpetuity
    Commented Oct 5, 2013 at 7:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .