0

Since I have set up my new relay on Debian 10 Buster, running the stable version, I learn on the go, and I don't hesitate to edit the Tor's global settings file:

/etc/tor/torrc

in order to remedy some issues.

I do that while the Tor service is stopped with:

# systemctl stop tor.service

and similarly, I start the service upon finished editing with:

# systemctl start tor.service

By watching Nyx the whole time, I found out, it has not an immediate effect.

It takes a lot of time for Nyx to actually disconnect (I did not use a stopwatch, but it could be a minute or so), but those systemctl commands complete without delay.

I am curious as to, why that is, and possibly if I can do anything in order not having to wait for my Tor relay to stop watching Nyx, whenever I want to edit the Tor's settings?

  • You can get tor to reload the torrc file by sending a SIGHUP to the process (kill -SIGHUP $pid), without having to restart tor. This doesn’t work for every setting, but works for many of them. – Steve Mar 12 at 14:03
0

First to mention, I am running my relay from home, so I have physical access to it, but if you don't, always be prepared for the worst - have a backup of your relay keys, and a backup of your configuration before actually doing any big changes. This answer though, does not contain such a change, that you would need to worry.


Observation

I have found the reason behind the immediate execution is this self-explanatory contents of the tor.service file located in:

/lib/systemd/system/tor.service

containing only /bin/true for both start and stop action:

[Unit]
Description=Anonymizing overlay network for TCP (multi-instance-master)

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/true
ExecReload=/bin/true

[Install]
WantedBy=multi-user.target

I found there is another service file:

/lib/systemd/system/tor@default.service

this is the real one. Meaning it contains:

[Unit]
Description=Anonymizing overlay network for TCP
After=network.target nss-lookup.target
PartOf=tor.service
ReloadPropagatedFrom=tor.service

[Service]
Type=notify
NotifyAccess=all
PIDFile=/run/tor/tor.pid
PermissionsStartOnly=yes
ExecStartPre=/usr/bin/install -Z -m 02755 -o debian-tor -g debian-tor -d /run/tor
ExecStartPre=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0 --verify-config
ExecStart=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0
ExecReload=/bin/kill -HUP ${MAINPID}
KillSignal=SIGINT
TimeoutStartSec=300
TimeoutStopSec=60
Restart=on-failure
LimitNOFILE=65536

# Hardening
AppArmorProfile=-system_tor
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=-/proc
ReadWriteDirectories=-/var/lib/tor
ReadWriteDirectories=-/var/log/tor
ReadWriteDirectories=-/run
CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH

Solution

Now, when we know the real service name, we can call this one as it does wait till it is stopped or started or reloaded like so:

# systemctl ACTION tor@default.service

I have set up a .bash_aliases solution, and I'd like to share it with you.


Here is what my solution below can do for you:

  1. It stops the Tor service - waits till this is done.

  2. It runs my favorite text editor with the config file via safe way through sudoedit.

  3. It starts the Tor service - waits till this is done.

  4. Starts the Nyx monitor right after.

It could be customized, it has some potential.


# change these variables to correspond with your setup and preferences
tor_text_editor='/usr/local/bin/nano'
tor_text_editor_option_syntax='--syntax=nanorc'
tor_text_editor_option_viewonly='--view'
tor_config_file='/etc/tor/torrc'
tor_service_name='tor@default.service'

# this serves the purpose of running nyx under non-privileged user;
# debian-tor is the default user under Debian GNU/Linux
alias nyx='sudo -u debian-tor nyx'

torrc_view()
{
    # open the Tor config file in the text editor in view-only mode
    "${tor_text_editor}" "${tor_text_editor_option_syntax}" "${tor_text_editor_option_viewonly}" "${tor_config_file}"
}

torrc_edit()
{
    # stop the Tor service; wait till it's down
    systemctl stop "${tor_service_name}"
    # launch the editor of choice through sudoedit to edit Tor's config file
    SUDO_EDITOR="${tor_text_editor} ${tor_text_editor_option_syntax}" sudoedit "${tor_config_file}"
    # start the Tor service; wait till it's up
    systemctl start "${tor_service_name}"
    # display the status of Tor service
    # without having to quit it manually: --no-pager
    # without shortening long lines: --full
    systemctl --no-pager --full status "${tor_service_name}"
    # run Nyx using the above alias
    nyx
}

# I avoid the dash (-) in function names
# because that would make the names non-POSIX
# I rather define aliases later on, here
alias torrc-view='torrc_view'
alias torrc-edit='torrc_edit'

Feel free to add your own tweaks in your own answer!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.