0

I'm running Tor 0.4.2.7 on Ubuntu Server 20.04, and I'm trying to create an onion service following the instructions here.

My torrc file looks like this:

HiddenServiceDir /home/tofol/hidden_service
HiddenServicePort 80 127.0.0.1:81

And I can connect to my web on port 81 successfully. I restart Tor using:

sudo service tor restart

Which restarts successfully. However, both the private_key and hostname files are missing from the hidden_service folder when I would expect them to be there. If the hidden_service folder isn't there when I restart Tor, Tor does not automatically create it either. Tor restarts correctly each time and produces no log file notices (I have log files enabled in torrc).

Can anybody please help me generate these two files?

EDIT:

rebooting my machine gave me some warnings in syslog which I resolved by running:

sudo chown -R debian-tor hidden_service
sudo chmod 700 hidden_service

Now syslog gives me:

systemd[1]: Starting Anonymizing overlay network for TCP...
tor[1034]: [notice] Tor 0.4.2.7 running on Linux with Libevent 2.1.11-stable, OpenSSL 1.1.1f, Zlib 1.2.11, Liblzma 5.2.4, and Libzstd 1.4.4.
tor[1034]: [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
tor[1034]: [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc".
tor[1034]: [notice] Read configuration file "/etc/tor/torrc".
tor[1034]: Configuration was valid
tor[1037]: [notice] Tor 0.4.2.7 running on Linux with Libevent 2.1.11-stable, OpenSSL 1.1.1f, Zlib 1.2.11, Liblzma 5.2.4, and Libzstd 1.4.4.
tor[1037]: [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
tor[1037]: [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc".
tor[1037]: [notice] Read configuration file "/etc/tor/torrc".
tor[1037]: [notice] Opening Socks listener on 127.0.0.1:9050
tor[1037]: [notice] Opened Socks listener on 127.0.0.1:9050
systemd[1]: tor@default.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: tor@default.service: Failed with result 'exit-code'.
systemd[1]: Failed to start Anonymizing overlay network for TCP.

Although service tor status tells me Tor is running. /var/log/tor/notices.log doesn't give me anything. I still don't have private_key or hostname in my hidden_service folder.

  • My guess is that tor wants more restrictive permissions for the hidden service directory. Try using a directory that only the tor user has access to like /var/lib/tor/hidden_service. – Steve May 17 at 18:31
  • I found some issues in syslog when rebooting my machine which I detail above in my question. They now seem resolved ('Configuration was valid') but Tor still doesn't start. – Shunyata Kharg May 17 at 19:59
  • Since you're using systemd, see if the logs at journalctl -u tor@default.service give any more details. And since you're running it as a service, it may have hardening enabled. In this case it is probably not allowed to access files in your home directory. Run systemctl cat tor@default.service and look for entries like AppArmorProfile, ReadOnlyDirectories, or ProtectHome. – Steve May 17 at 20:49
  • 1
    that was it, thank you @Steve - in fact the answer was already in your first comment. Will write an answer to my own question. – Shunyata Kharg May 18 at 8:55
1

Thanks to @Steve, I ran the following:

systemctl cat tor@default.service

Which gave me:

# Hardening
AppArmorProfile=-system_tor
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=-/proc
ReadWriteDirectories=-/var/lib/tor
ReadWriteDirectories=-/var/log/tor
ReadWriteDirectories=-/run
CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH

From this I understood that my hidden_service directory had to live under /var/lib/tor/ - I then moved it to that location (/var/lib/tor/hidden_service), edited my torrc to reflect the change and restarted Tor. I now have both files.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.