3

I want to set up a personal Tor SOCKS5 proxy on my Linux VPS to use it on mobile devices and whatnot. Apparently, Tor can only protect its control port, SOCKS5 stays open. How do I set a lightweight, password-protected Tor SOCKS5 proxy? Seems like I need to set up another proxy, which would tunnel traffic through Tor. Where do I start?

Improve this question

2 Answers 2

Reset to default
3

Here's the Tor manual.

You can set:

Socks5ProxyUsername username
Socks5ProxyPassword password

When you start the Tor service.

If you are asking how to create a proxy server in general apart from Tor, then you should probably ask that in the Unix/Linux Stackexchange depending on your Linux distribution.

Improve this answer
3
  • Tor daemon can make open relay connections through another socks proxy, and Socks5ProxyUsername Socks5ProxyPassword set credentials for that proxy. So no, it's not it.
    – Roffen
    Nov 15, 2019 at 21:49
  • Also make sure that you do not have Socks4Proxy set.
    – Steve
    Nov 25, 2019 at 18:30
  • as @Roffen has pointed out, this is not the solution. I'm surprised that there is no standard solution for this. how did you solve it?
    – hidden_elephant
    Aug 20, 2021 at 3:23
1

I have recently stumbled upon the same issue, so I'd write my solution for Linux for future users.

Let's assume our Linux machine has an IP 1.2.3.4, and we want to run our proxy with authentication on a port 9051.

I've chosen Dante as a server for chaining Socks proxies. The algorithm is the following:

  1. Start TOR, e.g. on the default port 9050 (localhost only, not the external interface: check SocksPort in torrc), and put it to autostart:
sudo systemctl start tor.service
sudo systemctl enable tor.service

  1. Install Dante server from your Linux distribution package manager (e.g. sudo apt-get install dante-server).

  2. Configure /etc/sockd.conf, a config file for Dante:

logoutput: /var/log/sockd.log
internal: 1.2.3.4 port = 9051
external: 1.2.3.4
socksmethod: username # if you'd like to use existing OS
                      # user accounts for authentication
user.privileged: root
user.unprivileged: nobody
client pass {
    from: 0/0 to: 0/0
    log: error connect disconnect
}
socks pass {
    from: 0/0 to: 0/0
    log: error connect disconnect
}
route {
    from: 0.0.0.0/0 to: 0.0.0.0/0 via: 127.0.0.1 port = 9050
    proxyprotocol: socks_v4 socks_v5
    method: none
}

Here route is the key section, telling us to redirect all successfully authenticated incoming connections to a local TOR server.

  1. Run Dante server and put it to autostart:
sudo systemctl start sockd.service
sudo systemctl enable sockd.service

  1. Make sure our port 9051 is open in the firewall.

  2. On your client device, specify SOCKS5 proxy, IP 1.2.3.4, port 9051, and any of the OS users registered on your server with their password.

Improve this answer
5
  • Probably a stupid question but why add a layer where actually there is already a sock5 proxy in tor daemon with the risk of mistype or badly configuring it and have leaks as consequences ?
    – vigilian
    Sep 19, 2022 at 15:25
  • @vigilian, since socks5 in tor doesn't support authentication. At least, I haven't found any way to configure it natively.
    – Dmitry Tsirkov
    Sep 20, 2022 at 17:38
  • It does actually. I does it with the answer from above. Or do you speak about something else ? But what could be interesting is maybe the responsiveness of the vps with Dante or without it and directly into tor. Directly into tor it’s pretty slow I might say.
    – vigilian
    Oct 3, 2022 at 17:27
  • 1
    Socks5ProxyUsername and Socks5ProxyPassword from the answer above are for outgoing connections, to redirect TOR traffic through some external proxy, e.g. in case the provider blocks TOR. While the original question was about how to block guests from performing incoming connections.
    – Dmitry Tsirkov
    Oct 4, 2022 at 23:31
  • @DmitryTsirkov is right as far as I could see in my tests. Setting Socks5ProxyUsername and Socks5ProxyPassword will be accepted by Tor (since it's a valid config for another purpose), but I still can connect without username and password to my Tor proxy. With the currently "best" answer people will set up their tor proxy, open it to anyone, and think they are protected because they think they set a username and password. I haven't found an easy solution, but setting up another proxy like in this answer, or SSH tunneling, are possible.
    – oli
    Apr 18 at 7:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .