When I try to start tor with invalid permission, I get the following error:
$ ./start-tor.sh
[sudo] password for user:
Oct 08 18:20:32.210 [notice] Tor 0.4.0.5 running on Linux with Libevent 2.0.21-stable, OpenSSL 1.1.0k, Zlib 1.2.8, Liblzma N/A, and Libzstd N/A.
Oct 08 18:20:32.210 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Oct 08 18:20:32.217 [notice] Read configuration file "/usr/local/etc/tor/torrc".
Oct 08 18:20:32.244 [warn] Permissions on directory /home/www/secret/ are too permissive.
Oct 08 18:20:32.244 [warn] Failed to parse/validate config: Failed to configure rendezvous options. See logs for details.
Oct 08 18:20:32.244 [err] Reading config failed--see warnings above.
then I :
$ sudo chmod 700 /home/www/secret/
and tor fires up fine but my hidden_service fails to come live on the tor network with nginx. The urls just hangs. No error from server at all.
If I:
$ sudo chmod 770 /home/www/secret/
My tor url comes up live. Problem disappears.
The problem come in when I try and reboot the device with systemd trying to start it. Even if I get systemd to start it correctly, the webservices won't come live until I chmod 770 the directory, following a service start.
How do I get my webservice permissions to work for tor startup and hidden_directory services at the same time?
My startup script:
$ cat ../start-tor.sh
#! /bin/bash
sudo -u www-data 'tor'
$ ls -la
total 2748
drwxrwxr-x 10 www-data www-data 4096 Oct 5 21:25 .
drwxr-xr-x 8 www-data www-data 4096 Jun 17 06:28 ..
drwxrwx--- 8 www-data www-data 4096 Oct 8 18:20 secret
-rwxrwxr-x 1 www-data www-data 37 Sep 5 05:39 start-tor.sh
-rwxrwxr-x 1 www-data www-data 35 Aug 1 01:22 stop-tor.sh
drwxrwxr-x 3 www-data www-data 4096 Sep 4 16:22 .tor
-rwxrwxr-x 1 www-data www-data 697 Aug 1 02:08 tor.sh
Updated: edits in /etc/tor/torrc
HiddenServiceDir /home/www/secret/
HiddenServiceVersion 2
HiddenServicePort 80 127.0.0.1:80
nginx config:
$ sudo cat /etc/nginx/sites-available/hidden_service
server {
listen 80;
listen [::]:80;
server_name 3vvvvvvvb.onion;
root /home/www/secret;
index index.html index.php;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
charset utf-8;
location / {
try_files $uri $uri/ @uwsgi;
}
location /media {
alias /home/www/secret/html/media; # your Django project's media files - amend as required
}
location /static {
alias /home/www/secret/html/static; # your Django project's static files - amend as required
}
location @uwsgi {
uwsgi_pass django;
include /home/www/secret/html/uwsgi_params;
}
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
}
}
UPDATE:
This issue hooked back into uwsgi and after unglueing uwsgi, has yielded an entirely different issue.