I want to set up a personal Tor SOCKS5 proxy on my Linux VPS to use it on mobile devices and whatnot. Apparently, Tor can only protect its control port, SOCKS5 stays open. How do I set a lightweight, password-protected Tor SOCKS5 proxy? Seems like I need to set up another proxy, which would tunnel traffic through Tor. Where do I start?
2 Answers
Here's the Tor manual.
You can set:
Socks5ProxyUsername username
Socks5ProxyPassword password
When you start the Tor service.
If you are asking how to create a proxy server in general apart from Tor, then you should probably ask that in the Unix/Linux Stackexchange depending on your Linux distribution.
-
Tor daemon can make open relay connections through another socks proxy, and Socks5ProxyUsername Socks5ProxyPassword set credentials for that proxy. So no, it's not it.– RoffenNov 15, 2019 at 21:49
-
-
as @Roffen has pointed out, this is not the solution. I'm surprised that there is no standard solution for this. how did you solve it? Aug 20, 2021 at 3:23
I have recently stumbled upon the same issue, so I'd write my solution for Linux for future users.
Let's assume our Linux machine has an IP 1.2.3.4, and we want to run our proxy with authentication on a port 9051.
I've chosen Dante as a server for chaining Socks proxies. The algorithm is the following:
- Start TOR, e.g. on the default port 9050 (localhost only, not the external interface: check
SocksPort
intorrc
), and put it to autostart:
sudo systemctl start tor.service
sudo systemctl enable tor.service
Install Dante server from your Linux distribution package manager (e.g.
sudo apt-get install dante-server
).Configure
/etc/sockd.conf
, a config file for Dante:
logoutput: /var/log/sockd.log
internal: 1.2.3.4 port = 9051
external: 1.2.3.4
socksmethod: username # if you'd like to use existing OS
# user accounts for authentication
user.privileged: root
user.unprivileged: nobody
client pass {
from: 0/0 to: 0/0
log: error connect disconnect
}
socks pass {
from: 0/0 to: 0/0
log: error connect disconnect
}
route {
from: 0.0.0.0/0 to: 0.0.0.0/0 via: 127.0.0.1 port = 9050
proxyprotocol: socks_v4 socks_v5
method: none
}
Here route
is the key section, telling us to redirect all successfully authenticated incoming connections to a local TOR server.
- Run Dante server and put it to autostart:
sudo systemctl start sockd.service
sudo systemctl enable sockd.service
Make sure our port 9051 is open in the firewall.
On your client device, specify SOCKS5 proxy, IP 1.2.3.4, port 9051, and any of the OS users registered on your server with their password.
-
Probably a stupid question but why add a layer where actually there is already a sock5 proxy in tor daemon with the risk of mistype or badly configuring it and have leaks as consequences ?– vigilianSep 19, 2022 at 15:25
-
@vigilian, since socks5 in tor doesn't support authentication. At least, I haven't found any way to configure it natively. Sep 20, 2022 at 17:38
-
It does actually. I does it with the answer from above. Or do you speak about something else ? But what could be interesting is maybe the responsiveness of the vps with Dante or without it and directly into tor. Directly into tor it’s pretty slow I might say.– vigilianOct 3, 2022 at 17:27
-
1Socks5ProxyUsername and Socks5ProxyPassword from the answer above are for outgoing connections, to redirect TOR traffic through some external proxy, e.g. in case the provider blocks TOR. While the original question was about how to block guests from performing incoming connections. Oct 4, 2022 at 23:31
-
@DmitryTsirkov is right as far as I could see in my tests. Setting Socks5ProxyUsername and Socks5ProxyPassword will be accepted by Tor (since it's a valid config for another purpose), but I still can connect without username and password to my Tor proxy. With the currently "best" answer people will set up their tor proxy, open it to anyone, and think they are protected because they think they set a username and password. I haven't found an easy solution, but setting up another proxy like in this answer, or SSH tunneling, are possible.– oliApr 18 at 7:26