Does torify/torsocks give access to hidden services?

Question

Most torify documentation is about accessing non-hidden services.

Yet .onion address look like real tcp addresses, does torify make those available.

Answer 1

The torsocks program (the actual name of the torify alias) can connect to hidden services fine. For example:

torsocks curl https://3g2upl4pq6kufc4m.onion

Answer 2

If the hidden service is HTTP AND your client for some reason does not support torsocks, then you may benefit from a nginx revers proxy listening on local ports

WARNINGS:

• This nginx process will not be listen on 0.0.0.0 because it's torified. It will only listen to localhost (127.0.0.1). This is good because on 0.0.0.0 you may be reachable on a public port and will become proxy to the hidden service for anyone on the non-tor Internet.
• Every user on the operating system will get access to the hidden service

1. Edit /etc/nginx/sites-enabled/default

server {
    listen 127.0.0.1:1234 default_server;

    location / {
       proxy_pass https://3g2upl4pq6kufc4m.onion;

       # Timeout
       proxy_connect_timeout       5m;
       proxy_send_timeout          5m;
       proxy_read_timeout          5m;
       send_timeout                5m;

       # Settings for cache
       proxy_set_header       Host $host;
       proxy_buffering        on;
       proxy_cache            STATIC;
       proxy_cache_valid      200  5m;
       proxy_cache_use_stale  error timeout invalid_header updating
                              http_500 http_502 http_503 http_504;
     }
}

2. Edit /etc/nginx/nginx.conf

http {

    ## 2021-01-01
    proxy_cache_path  /opt/nginx/cache  levels=1:2
    keys_zone=STATIC:10m inactive=24h  max_size=1g;

3. Run:

sudo mkdir -p /opt/nginx/

4. Start nginx in torifyed mode:

sudo torsocks nginx

5. Now you can use regular local HTTP connections, e.g.:

curl 127.0.0.1:1234

To stop, use regular kill because systemctl will not work:

ps axf | grep -v grep | grep nginx  # lookup PID

kill PID_GOES_HERE

Let nginx restart automatically (systemd)

Now instead of starting and stopping ngingx manually, edit systemd script so it does it automatically every time the process crashes or the system reboots.

Edit /lib/systemd/system/nginx.service

• Simply add /usr/bin/torsocks in front of every Exec command
• So Exec commands should looks similar to this:

ExecStart=/usr/bin/torsocks /usr/sbin/nginx -g 'daemon on; master_process on;'
ExecReload=/usr/bin/torsocks /usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
ExecStop=/usr/bin/torsocks /sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid

1. Make script changes effective: sudo systemctl daemon-reload
2. Manually kill your current nginx
3. sudo systemctl restart nginx

Historical details

• "Connection timed out" in /var/log/nginx/error.log and all connections to the onion address stop working. Restarting tor for the client mitigates the issue temporarily. To to prevent the issue I increased the connection timeout and added caching for 5 minutes.