How to smoothly and safely edit the Tor config file?

Question

Since I have set up my new relay on Debian 10 Buster, running the stable version, I learn on the go, and I don't hesitate to edit the Tor's global settings file:

/etc/tor/torrc

in order to remedy some issues.

I do that while the Tor service is stopped with:

# systemctl stop tor.service

and similarly, I start the service upon finished editing with:

# systemctl start tor.service

By watching Nyx the whole time, I found out, it has not an immediate effect.

It takes a lot of time for Nyx to actually disconnect (I did not use a stopwatch, but it could be a minute or so), but those systemctl commands complete without delay.

I am curious as to, why that is, and possibly if I can do anything in order not having to wait for my Tor relay to stop watching Nyx, whenever I want to edit the Tor's settings?

Answer 1

First to mention, I am running my relay from home, so I have physical access to it, but if you don't, always be prepared for the worst - have a backup of your relay keys, and a backup of your configuration before actually doing any big changes. This answer though, does not contain such a change, that you would need to worry.

---

Observation

I have found the reason behind the immediate execution is this self-explanatory contents of the tor.service file located in:

/lib/systemd/system/tor.service

containing only /bin/true for both start and stop action:

[Unit]
Description=Anonymizing overlay network for TCP (multi-instance-master)

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/true
ExecReload=/bin/true

[Install]
WantedBy=multi-user.target

---

I found there is another service file:

/lib/systemd/system/[email protected]

this is the real one. Meaning it contains:

[Unit]
Description=Anonymizing overlay network for TCP
After=network.target nss-lookup.target
PartOf=tor.service
ReloadPropagatedFrom=tor.service

[Service]
Type=notify
NotifyAccess=all
PIDFile=/run/tor/tor.pid
PermissionsStartOnly=yes
ExecStartPre=/usr/bin/install -Z -m 02755 -o debian-tor -g debian-tor -d /run/tor
ExecStartPre=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0 --verify-config
ExecStart=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0
ExecReload=/bin/kill -HUP ${MAINPID}
KillSignal=SIGINT
TimeoutStartSec=300
TimeoutStopSec=60
Restart=on-failure
LimitNOFILE=65536

# Hardening
AppArmorProfile=-system_tor
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=-/proc
ReadWriteDirectories=-/var/lib/tor
ReadWriteDirectories=-/var/log/tor
ReadWriteDirectories=-/run
CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH

---

Solution

Now, when we know the real service name, we can call this one as it does wait till it is stopped or started or reloaded like so:

# systemctl ACTION [email protected]

I have set up a .bash_aliases solution, and I'd like to share it with you.

---

Here is what my solution below can do for you:

1. It stops the Tor service - waits till this is done.

2. It runs my favorite text editor with the config file via safe way through sudoedit.

3. It starts the Tor service - waits till this is done.

4. Starts the Nyx monitor right after.

It could be customized, it has some potential.

---

# change these variables to correspond with your setup and preferences
tor_text_editor='/usr/local/bin/nano'
tor_text_editor_option_syntax='--syntax=nanorc'
tor_text_editor_option_viewonly='--view'
tor_config_file='/etc/tor/torrc'
tor_service_name='[email protected]'

# this serves the purpose of running nyx under non-privileged user;
# debian-tor is the default user under Debian GNU/Linux
alias nyx='sudo -u debian-tor nyx'

torrc_view()
{
    # open the Tor config file in the text editor in view-only mode
    "${tor_text_editor}" "${tor_text_editor_option_syntax}" "${tor_text_editor_option_viewonly}" "${tor_config_file}"
}

torrc_edit()
{
    # stop the Tor service; wait till it's down
    systemctl stop "${tor_service_name}"
    # launch the editor of choice through sudoedit to edit Tor's config file
    SUDO_EDITOR="${tor_text_editor} ${tor_text_editor_option_syntax}" sudoedit "${tor_config_file}"
    # start the Tor service; wait till it's up
    systemctl start "${tor_service_name}"
    # display the status of Tor service
    # without having to quit it manually: --no-pager
    # without shortening long lines: --full
    systemctl --no-pager --full status "${tor_service_name}"
    # run Nyx using the above alias
    nyx
}

# I avoid the dash (-) in function names
# because that would make the names non-POSIX
# I rather define aliases later on, here
alias torrc-view='torrc_view'
alias torrc-edit='torrc_edit'

Feel free to add your own tweaks in your own answer!