0

Most torify documentation is about accessing non-hidden services.

Yet .onion address look like real tcp addresses, does torify make those available.

1

The torsocks program (the actual name of the torify alias) can connect to hidden services fine. For example:

torsocks curl https://3g2upl4pq6kufc4m.onion
6
  • Need small clarification: My executable needs to connects to services on the local network. Will those connections still work? – Aleksandr Levchuk Dec 31 '20 at 2:06
  • 1
    If you use torsocks, it will not allow you to connect to services on the local network for safety reasons. If that's what you want to do, you might find proxychains helpful (using the localnet option). – Steve Dec 31 '20 at 3:05
  • I got curl to work in 3 modes: torsocks, proxychains, and privproxy with curl --proxy option. Yet, for some reason my executable does not connect to the onion address in any of those modes. – Aleksandr Levchuk Dec 31 '20 at 16:01
  • 1
    What executable are you using? torsocks does not work for all executables. The problem is probably DNS related, so you might want to look into the MapAddress torrc option to map the onion name to an IP address. For example something like MapAddress 192.0.2.10 qwerty.onion, and then torsocks curl 192.0.2.10. – Steve Dec 31 '20 at 17:28
  • 1
    @AleksandrLevchuk Torsocks (and proxychains) uses symbol interposition to intercept glibc calls. If you're using a program that doesn't dynamically link to glibc (such as Go programs), torsocks won't work and any network requests will bypass Tor. – Steve Dec 31 '20 at 18:48
1

If the hidden service is HTTP AND your client for some reason does not support torsocks, then you may benefit from a nginx revers proxy listening on local ports

WARNINGS:

  • This nginx process will not be listen on 0.0.0.0 because it's torified. It will only listen to localhost (127.0.0.1). This is good because on 0.0.0.0 you may be reachable on a public port and will become proxy to the hidden service for anyone on the non-tor Internet.
  • Every user on the operating system will get access to the hidden service
  1. Edit /etc/nginx/sites-enabled/default
server {
    listen 127.0.0.1:1234 default_server;

    location / {
       proxy_pass https://3g2upl4pq6kufc4m.onion;

       # Timeout
       proxy_connect_timeout       5m;
       proxy_send_timeout          5m;
       proxy_read_timeout          5m;
       send_timeout                5m;

       # Settings for cache
       proxy_set_header       Host $host;
       proxy_buffering        on;
       proxy_cache            STATIC;
       proxy_cache_valid      200  5m;
       proxy_cache_use_stale  error timeout invalid_header updating
                              http_500 http_502 http_503 http_504;
     }
}
  1. Edit /etc/nginx/nginx.conf
http {

    ## 2021-01-01
    proxy_cache_path  /opt/nginx/cache  levels=1:2
    keys_zone=STATIC:10m inactive=24h  max_size=1g;
  1. Run:
sudo mkdir -p /opt/nginx/
  1. Start nginx in torifyed mode:
sudo torsocks nginx
  1. Now you can use regular local HTTP connections, e.g.:
curl 127.0.0.1:1234

To stop, use regular kill because systemctl will not work:

ps axf | grep -v grep | grep nginx  # lookup PID

kill PID_GOES_HERE

Let nginx restart automatically (systemd)

Now instead of starting and stopping ngingx manually, edit systemd script so it does it automatically every time the process crashes or the system reboots.

Edit /lib/systemd/system/nginx.service

  • Simply add /usr/bin/torsocks in front of every Exec command
  • So Exec commands should looks similar to this:
ExecStart=/usr/bin/torsocks /usr/sbin/nginx -g 'daemon on; master_process on;'
ExecReload=/usr/bin/torsocks /usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
ExecStop=/usr/bin/torsocks /sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid
  1. Make script changes effective: sudo systemctl daemon-reload
  2. Manually kill your current nginx
  3. sudo systemctl restart nginx

Historical details

  • "Connection timed out" in /var/log/nginx/error.log and all connections to the onion address stop working. Restarting tor for the client mitigates the issue temporarily. To to prevent the issue I increased the connection timeout and added caching for 5 minutes.
1
  • 1
    Just a suggestion, you might find socat easier to use. For example, /usr/bin/socat TCP-LISTEN:1234,fork SOCKS4A:127.0.0.1:3g2upl4pq6kufc4m.onion:80,socksport=9050 – Steve Dec 31 '20 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.