I am trying to build a private tor network using raspberry pis. As a start, I am trying to emulate the basic-min network configuration (4 Authorities(also works as non-exit relays), 1 Exit, 1 Client) provided in chutney. Following are the steps I followed to set up an Directory Authority.
I installed tor to a raspberry pi and successfully created a tor relay which was connected to the Internet. The torrc file looked as follows.
SocksPort 0 Log notice file /var/log/tor/notices.log RunAsDaemon 1 DataDirectory /var/lib/tor ControlPort 9051 CookieAuthentication 1 ORPort 443 DirPort 80 ExitPolicy reject *:* Nickname TorRelay1 DisableDebuggerAttachment 0
Then I downloaded and configured chutney and tested the basic-min network configuration. This generated 6 torrc files - 1 for each node in the basic-min configurations.
Then I replaced the torrc file in one of the raspberry pis with a torrc file generated from chutney for a directory authority.
PathsNeededToBuildCircuits 0.67 #TestingDirAuthVoteExit * #TestingDirAuthVoteHSDir * #V3AuthNIntervalsValid 2 #TestingDirAuthVoteGuard * #TestingMinExitFlagThreshold 0 DataDirectory /var/lib/tor RunAsDaemon 1 ConnLimit 60 Nickname test000a ShutdownWaitLength 2 DisableDebuggerAttachment 0 ControlPort 9051 CookieAuthentication 1 #PidFile /home/ishan/tor/chutney/net/nodes.1610932415/000a/pid Log notice file /var/log/tor/notices.log #Log info file /home/ishan/tor/chutney/net/nodes.1610932415/000a/info.log ProtocolWarnings 1 SafeLogging 0 LogTimeGranularity 1 #Sandbox 1 #__OwningControllerProcess 2974 DirAuthority test000a orport=443 no-v2 v3ident=55722D7810A204362B451EDFD6EAFF0BB8933673 192.168.0.8:80 0BD0033D651C260F62017885A74CF68BF438D68C DirAuthority test001a orport=443 no-v2 v3ident=FFE37317EBD25F02E77215CD353D8AB450BE4E79 192.168.0.10:80 66FCEEE7E25AB8A60FBD7BF85491400ACD8F63A9 DirAuthority test002a orport=443 no-v2 v3ident=1561A5D60B1D2C729B91E8B5EA2F56D012E39043 192.168.0.2:80 EC6780819230C3F7457FC3BF4A68762297115A29 DirAuthority test003a orport=443 no-v2 v3ident=BC17E2D0DED9835D97B892C5F5A1A08CF8B9A08A 192.168.0.15:80 4E7E942815916E52366B55D756AB1E57D0A4EEE7 SocksPort 0 OrPort 443 Address 192.168.0.2 ExitRelay 0 ServerDNSDetectHijacking 0 ServerDNSTestAddresses ServerDNSResolvConfFile /dev/null DirPort 80 AuthoritativeDirectory 1 V3AuthoritativeDirectory 1 #ContactInfo firstname.lastname@example.org AssumeReachable 1 #TestingV3AuthInitialVotingInterval 20 #TestingV3AuthInitialVoteDelay 4 #TestingV3AuthInitialDistDelay 4 #V3AuthVotingInterval 20 #V3AuthVoteDelay 4 #V3AuthDistDelay 4
Please note that I have set static IP's to all the raspberry pi's which are connected via a switch and which I have added to the torrc file. I have commented some lines that I thought was not useful in my work. Also, I removed the comments included in the original chutney generated file to reduce the length of the question.
My questions are as follows.
Tor does not start properly with the above torrc file. When I comment
V3AuthoritativeDirectory 1it does start. However, I need my pi to act as a relay + DirAuthority. What am I doing wrong here? And how to resolve the issue?
I do not understand the impact of DirAuthority fingerprint (0BD0033D651C260F62017885A74CF68BF438D68C) and V3ident(55722D7810A204362B451EDFD6EAFF0BB8933673). Do I need to add some files with these keys to a specific location? (May be the DataDirectory?)
Update : When I use
AuthoritativeDirectory 1 and
V3AuthoritativeDirectory 1, and start tor service using "sudo /etc/init.d/tor restart", I get the following when I run "systemctl | gerp tor".
email@example.com loaded active exited
When a remove the above config parameters, I get,
firstname.lastname@example.org loaded active running
Furthermore, the nyx command also gives "Unable to connect to tor. Are you sure it's running?" error at the problem scenario.
Additionally, I started all six raspberry pis with relevant torrc files (without the two parameters I have mentioned above). I get the following warnings in nyx.
- Consensus is too old and won't serve to clients when fetching a consensus from another DirAuthority.
- Consensus is not found when fetching from another Directory Authority.
- Non authoritative directory does not accept posted server descriptors. please correct.
Update 2 -
I could fix the issue mentioned above by adding the authority certificates, other keys and fingerprints to the DataDirectory location. I am keeping the issue open just in case someone else may find it useful. However, this led to another issue which I have posted under a different question. Private Tor network connection issue due to error in TLS handshake