1

When I try to start tor with invalid permission, I get the following error:

$ ./start-tor.sh 
[sudo] password for user: 
Oct 08 18:20:32.210 [notice] Tor 0.4.0.5 running on Linux with Libevent 2.0.21-stable, OpenSSL 1.1.0k, Zlib 1.2.8, Liblzma N/A, and Libzstd N/A.
Oct 08 18:20:32.210 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Oct 08 18:20:32.217 [notice] Read configuration file "/usr/local/etc/tor/torrc".
Oct 08 18:20:32.244 [warn] Permissions on directory /home/www/secret/ are too permissive.
Oct 08 18:20:32.244 [warn] Failed to parse/validate config: Failed to configure rendezvous options. See logs for details.
Oct 08 18:20:32.244 [err] Reading config failed--see warnings above.

then I :

$ sudo chmod 700 /home/www/secret/

and tor fires up fine but my hidden_service fails to come live on the tor network with nginx. The urls just hangs. No error from server at all.

If I:

$ sudo chmod 770 /home/www/secret/

My tor url comes up live. Problem disappears.

The problem come in when I try and reboot the device with systemd trying to start it. Even if I get systemd to start it correctly, the webservices won't come live until I chmod 770 the directory, following a service start.

How do I get my webservice permissions to work for tor startup and hidden_directory services at the same time?

My startup script:

$ cat ../start-tor.sh 
#! /bin/bash

sudo -u www-data 'tor'


$ ls -la
total 2748
drwxrwxr-x 10 www-data www-data    4096 Oct  5 21:25 .
drwxr-xr-x  8 www-data www-data    4096 Jun 17 06:28 ..
drwxrwx---  8 www-data www-data    4096 Oct  8 18:20 secret
-rwxrwxr-x  1 www-data www-data      37 Sep  5 05:39 start-tor.sh
-rwxrwxr-x  1 www-data www-data      35 Aug  1 01:22 stop-tor.sh
drwxrwxr-x  3 www-data www-data    4096 Sep  4 16:22 .tor
-rwxrwxr-x  1 www-data www-data     697 Aug  1 02:08 tor.sh

Updated: edits in /etc/tor/torrc

HiddenServiceDir /home/www/secret/
HiddenServiceVersion 2
HiddenServicePort 80 127.0.0.1:80

nginx config:

$ sudo cat /etc/nginx/sites-available/hidden_service 
server {
        listen 80;
        listen [::]:80;
        server_name 3vvvvvvvb.onion;
        root /home/www/secret;
        index index.html index.php;
        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;
        charset     utf-8;


        location / {
                try_files $uri $uri/ @uwsgi;
        }
        location /media  {
                alias /home/www/secret/html/media;  # your Django project's media files - amend as required
        }
        location /static {
                alias /home/www/secret/html/static; # your Django project's static files - amend as required
        }
        location @uwsgi {
                uwsgi_pass      django;
                include /home/www/secret/html/uwsgi_params;
        }


        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;

        }
}

UPDATE:

This issue hooked back into uwsgi and after unglueing uwsgi, has yielded an entirely different issue.

0

You didn't say how you edited your torrc file or which linux distro you are using so let me explain how I do it.

By default, your tor hostname and private key are in /var/lib/tor. If you change the permissions to this directory or the ones under it, you will have problems.

For example:

This is what I uncomment in /etc/tor/torrc

HiddenServiceDir /var/lib/tor/hidden_service/ 
HiddenServicePort 80 127.0.0.1:80

HiddenServiceDir is where Tor saves my hostname and private key. This is not where you want to be putting the files for your website. This should actually be secret and not allowed for anyone to see except you or someone can spoof your website.

| improve this answer | |
  • I should have posted torrc. It was already pointing at the correct directory. I updated the post – brad Oct 8 '19 at 20:48
  • Where are you saving your web files like index.html? If it is in /home/www then you need to change your HiddenServiceDir to be something completely different. – JSEvans Oct 9 '19 at 5:19
  • my index.html is in /home/www/secret/ which is my webservices directory. Its pointing to the correct directory. RE: "HiddenServiceDir to be something completely different". It should be pointed at my webservices directory which is it. Remember, the webservices work following chmod 770 – brad Oct 9 '19 at 7:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.