I understand that the torrc in Tor Browser isn't meant to be edited and changes get reverted, so setting up a v3 client auth key on a client seems to take a lot of trial and error in getting all the permissions/paths right and the
ClientOnionAuthDir line to stick.
We have gotten clients to work, so I understand how it works, but the manual setup process How to setup Client Authorization for v3 Onion Services is far too complicated for an average user. Currently to set up clients we're generating bash files with the following commands, and having users download/run that script... but it seems to only work occasionally with the Linux (non-Torbrowser) config having the highest success, and the Mac setup rarely working.
ONIONURLHERE would be replaced with the 56 character v3 address, lowercase, without the
X25519KEYHERE would be replaced wih the 56 character X25519 private key all uppercase; and
HSNAME with the first 16 characters of the v3 address.
Windows client config: (saved as
conf.bat, copied to the Tor Browser directory and run from there)
mkdir "Browser\TorBrowser\Data\Tor\client_auth" && echo ClientOnionAuthDir TorBrowser\Data\Tor\client_auth>>"Browser\TorBrowser\Data\Tor\torrc" echo ONIONURLHERE:descriptor:x25519:X25519KEYHERE>"Browser\TorBrowser\Data\Tor\client_auth\HSNAME.auth_private"
Mac client config: (run from anywhere; for Tor Browser. why does this one seem to rarely work, what's wrong? when it doesn't work it doesn't work even if we manually open up Terminal and paste in the 2 lines.)
mkdir -m700 -p '~/Library/Application Support/TorBrowser-Data/Tor/client_auth' && echo 'ClientOnionAuthDir ~/Library/Application Support/TorBrowser-Data/Tor/client_auth' >> '~/Library/Application Support/TorBrowser-Data/Tor/torrc' echo 'ONIONURLHERE:descriptor:x25519:X25519KEYHERE' > '~/Library/Application Support/TorBrowser-Data/Tor/client_auth/HSNAME.auth_private'
Linux client config (run from anywhere, works most of the time; not using Tor Browser):
mkdir -m700 -p /var/lib/tor/client_auth && echo 'ClientOnionAuthDir /var/lib/tor/client_auth' >> /etc/tor/torrc echo 'ONIONURLHERE:descriptor:x25519:X25519KEYHERE' > /var/lib/tor/client_auth/HSNAME.auth_private
Is there a better way to do this? I haven't been able to figure out why this only seems to work sometimes. How do I make that line persist on Tor Browser; better yet is it possible to do it without editing a file that isn't meant to be edited? Is it possible to use the control port commands to set it up yet?