hidden_services only works with invalid permissions

Question

When I try to start tor with invalid permission, I get the following error:

$ ./start-tor.sh 
[sudo] password for user: 
Oct 08 18:20:32.210 [notice] Tor 0.4.0.5 running on Linux with Libevent 2.0.21-stable, OpenSSL 1.1.0k, Zlib 1.2.8, Liblzma N/A, and Libzstd N/A.
Oct 08 18:20:32.210 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Oct 08 18:20:32.217 [notice] Read configuration file "/usr/local/etc/tor/torrc".
Oct 08 18:20:32.244 [warn] Permissions on directory /home/www/secret/ are too permissive.
Oct 08 18:20:32.244 [warn] Failed to parse/validate config: Failed to configure rendezvous options. See logs for details.
Oct 08 18:20:32.244 [err] Reading config failed--see warnings above.

then I :

$ sudo chmod 700 /home/www/secret/

and tor fires up fine but my hidden_service fails to come live on the tor network with nginx. The urls just hangs. No error from server at all.

If I:

$ sudo chmod 770 /home/www/secret/

My tor url comes up live. Problem disappears.

The problem come in when I try and reboot the device with systemd trying to start it. Even if I get systemd to start it correctly, the webservices won't come live until I chmod 770 the directory, following a service start.

How do I get my webservice permissions to work for tor startup and hidden_directory services at the same time?

My startup script:

$ cat ../start-tor.sh 
#! /bin/bash

sudo -u www-data 'tor'


$ ls -la
total 2748
drwxrwxr-x 10 www-data www-data    4096 Oct  5 21:25 .
drwxr-xr-x  8 www-data www-data    4096 Jun 17 06:28 ..
drwxrwx---  8 www-data www-data    4096 Oct  8 18:20 secret
-rwxrwxr-x  1 www-data www-data      37 Sep  5 05:39 start-tor.sh
-rwxrwxr-x  1 www-data www-data      35 Aug  1 01:22 stop-tor.sh
drwxrwxr-x  3 www-data www-data    4096 Sep  4 16:22 .tor
-rwxrwxr-x  1 www-data www-data     697 Aug  1 02:08 tor.sh

Updated: edits in /etc/tor/torrc

HiddenServiceDir /home/www/secret/
HiddenServiceVersion 2
HiddenServicePort 80 127.0.0.1:80

nginx config:

$ sudo cat /etc/nginx/sites-available/hidden_service 
server {
        listen 80;
        listen [::]:80;
        server_name 3vvvvvvvb.onion;
        root /home/www/secret;
        index index.html index.php;
        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;
        charset     utf-8;


        location / {
                try_files $uri $uri/ @uwsgi;
        }
        location /media  {
                alias /home/www/secret/html/media;  # your Django project's media files - amend as required
        }
        location /static {
                alias /home/www/secret/html/static; # your Django project's static files - amend as required
        }
        location @uwsgi {
                uwsgi_pass      django;
                include /home/www/secret/html/uwsgi_params;
        }


        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;

        }
}

UPDATE:

This issue hooked back into uwsgi and after unglueing uwsgi, has yielded an entirely different issue.

Answer 1

You didn't say how you edited your torrc file or which linux distro you are using so let me explain how I do it.

By default, your tor hostname and private key are in /var/lib/tor. If you change the permissions to this directory or the ones under it, you will have problems.

For example:

This is what I uncomment in /etc/tor/torrc

HiddenServiceDir /var/lib/tor/hidden_service/ 
HiddenServicePort 80 127.0.0.1:80

HiddenServiceDir is where Tor saves my hostname and private key. This is not where you want to be putting the files for your website. This should actually be secret and not allowed for anyone to see except you or someone can spoof your website.

Answer 2

The problem is that you do need a separate users for your Tor instance and NGinX. You have a tor or debian-tor user for the Tor running - and all the permissions must and has to be 700, nothing else. You need to do a chown for both tor's user and group and make them 700. It will not prevent Tor from opening the listening port that is available for NGinX. Check carefully how you're launching Tor and it's auto-start script with it's actual config. Feel free to drop me a line if you need any further help!