I am trying to build a private tor network using raspberry pis. As a start, I am trying to emulate the basic-min network configuration (4 Authorities(also works as non-exit relays), 1 Exit, 1 Client) provided in chutney. Following are the steps I followed to set up an Directory Authority.
I installed tor to a raspberry pi and successfully created a tor relay which was connected to the Internet. The torrc file looked as follows.
SocksPort 0
Log notice file /var/log/tor/notices.log
RunAsDaemon 1
DataDirectory /var/lib/tor
ControlPort 9051
CookieAuthentication 1
ORPort 443
DirPort 80
ExitPolicy reject *:*
Nickname TorRelay1
DisableDebuggerAttachment 0
Then I downloaded and configured chutney and tested the basic-min network configuration. This generated 6 torrc files - 1 for each node in the basic-min configurations.
Then I replaced the torrc file in one of the raspberry pis with a torrc file generated from chutney for a directory authority.
PathsNeededToBuildCircuits 0.67
#TestingDirAuthVoteExit *
#TestingDirAuthVoteHSDir *
#V3AuthNIntervalsValid 2
#TestingDirAuthVoteGuard *
#TestingMinExitFlagThreshold 0
DataDirectory /var/lib/tor
RunAsDaemon 1
ConnLimit 60
Nickname test000a
ShutdownWaitLength 2
DisableDebuggerAttachment 0
ControlPort 9051
CookieAuthentication 1
#PidFile /home/ishan/tor/chutney/net/nodes.1610932415/000a/pid
Log notice file /var/log/tor/notices.log
#Log info file /home/ishan/tor/chutney/net/nodes.1610932415/000a/info.log
ProtocolWarnings 1
SafeLogging 0
LogTimeGranularity 1
#Sandbox 1
#__OwningControllerProcess 2974
DirAuthority test000a orport=443 no-v2 v3ident=55722D7810A204362B451EDFD6EAFF0BB8933673 192.168.0.8:80 0BD0033D651C260F62017885A74CF68BF438D68C
DirAuthority test001a orport=443 no-v2 v3ident=FFE37317EBD25F02E77215CD353D8AB450BE4E79 192.168.0.10:80 66FCEEE7E25AB8A60FBD7BF85491400ACD8F63A9
DirAuthority test002a orport=443 no-v2 v3ident=1561A5D60B1D2C729B91E8B5EA2F56D012E39043 192.168.0.2:80 EC6780819230C3F7457FC3BF4A68762297115A29
DirAuthority test003a orport=443 no-v2 v3ident=BC17E2D0DED9835D97B892C5F5A1A08CF8B9A08A 192.168.0.15:80 4E7E942815916E52366B55D756AB1E57D0A4EEE7
SocksPort 0
OrPort 443
Address 192.168.0.2
ExitRelay 0
ServerDNSDetectHijacking 0
ServerDNSTestAddresses
ServerDNSResolvConfFile /dev/null
DirPort 80
AuthoritativeDirectory 1
V3AuthoritativeDirectory 1
#ContactInfo auth0@test.test
AssumeReachable 1
#TestingV3AuthInitialVotingInterval 20
#TestingV3AuthInitialVoteDelay 4
#TestingV3AuthInitialDistDelay 4
#V3AuthVotingInterval 20
#V3AuthVoteDelay 4
#V3AuthDistDelay 4
Please note that I have set static IP's to all the raspberry pi's which are connected via a switch and which I have added to the torrc file. I have commented some lines that I thought was not useful in my work. Also, I removed the comments included in the original chutney generated file to reduce the length of the question.
My questions are as follows.
Tor does not start properly with the above torrc file. When I comment
AuthoritativeDirectory 1
andV3AuthoritativeDirectory 1
it does start. However, I need my pi to act as a relay + DirAuthority. What am I doing wrong here? And how to resolve the issue?I do not understand the impact of DirAuthority fingerprint (0BD0033D651C260F62017885A74CF68BF438D68C) and V3ident(55722D7810A204362B451EDFD6EAFF0BB8933673). Do I need to add some files with these keys to a specific location? (May be the DataDirectory?)
Thank you.
Update : When I use AuthoritativeDirectory 1
and
V3AuthoritativeDirectory 1
, and start tor service using "sudo /etc/init.d/tor restart", I get the following when I run "systemctl | gerp tor".
tor@default.service loaded active exited
When a remove the above config parameters, I get,
tor@default.service loaded active running
Furthermore, the nyx command also gives "Unable to connect to tor. Are you sure it's running?" error at the problem scenario.
Additionally, I started all six raspberry pis with relevant torrc files (without the two parameters I have mentioned above). I get the following warnings in nyx.
- Consensus is too old and won't serve to clients when fetching a consensus from another DirAuthority.
- Consensus is not found when fetching from another Directory Authority.
- Non authoritative directory does not accept posted server descriptors. please correct.
Update 2 -
I could fix the issue mentioned above by adding the authority certificates, other keys and fingerprints to the DataDirectory location. I am keeping the issue open just in case someone else may find it useful. However, this led to another issue which I have posted under a different question. Private Tor network connection issue due to error in TLS handshake