4

Context

When I try to install tor without sudo, using apt install tor Ubuntu 20.04 returns:

E: Could not open lock file /var/lib/dpkg/lock-frontend - open (13: Permission denied)
E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), are you root?

When I install it with sudo apt install tor it works.

When I try to run it without sudo, using tor start, it returns:

[warn] Command-line option 'start' with no value. Failing.
[err] Reading config failed--see warnings above.

When I run it with sudo, using sudo tor start, it works and returns:

[warn] You are running Tor as root. You don't need to, and you probably shouldn't.

Question

How can I ensure I am able to run tor without sudo? I think I should add permissions of the user-account to some group for tor, but I did not yet exactly find out how.

Improve this question

2 Answers 2

Reset to default
1

It's a normal error: the dpkg needs to obtain a global and system-wide lock to be sure that no installation process will mess one another, so they will be done in a serial way being run one by one. It's also true for any mainstream package manager like yum, rpm et cetera. It's OK to do a sudo for install: the installation script will create a separate isolated user for Tor and the config will drop the privileges just to it, so it's not a security hole at all

Improve this answer
2
  • I do not quite understand what you mean with the config will drop the priviliges just to it. Your answer slightly confuses me because my observations imply that, given the sudo install, tor still requires the sudo privilege to run (without errors). That seems to suggest, to me, that the privileges have not been “dropped enough”. (I am talking about the privilege that is acquired by prepending sudo to command tor. (I assume that is some form of a privilege)).
    – a.t.
    Commented Jul 30, 2021 at 14:50
  • Tor has it's options for data directory and for a user to switch to. If you have not specified them - then yes, you will still need a sudo to start it. Otherwise you will need to sudo the systemctl start tor command to actually start the system-wide service. The tor itself will drop it's privileges to it's user - check the top command output
    – Alexey Vesnin ♦
    Commented Jul 31, 2021 at 7:20
0

An effective solution was found by running:

sudo touch /etc/tor/torrc
sudo chmod 777 /etc/tor/torrc

This allowed tor to be ran without sudo.

Hidden Services

To also allow hidden services whilst running tor without sudo priviliges, I had to include:

sudo chmod 700 -R /var/lib/tor/
sudo chown -R "$normal_username" /var/lib/tor/

where $normal_username is the name of the user from which you want to run tor, e.g. the output of $(whoami).

An example of such a hidden service can be an onion domain to allow one to ssh into the device, where the onion domain for ssh is located in /var/lib/tor/ssh/hostname.

After this, you should be able to run tor without it throwing an error (assuming sudo tor worked before).

Improve this answer
3
  • very bad idea: so everyone can modify your Tor config
    – Alexey Vesnin ♦
    Commented Dec 14, 2023 at 16:00
  • @AlexeyVesnin thank you for your feedback. Would you be able to specify everyone. I assume you mean anyone who has compromised my system and has gained (physical) read/write access to my system. Or do you mean anyone on connected to the internet, or do you mean anyone who has found a/my onion domain, or do you perhaps mean something else?
    – a.t.
    Commented Mar 23 at 9:11
  • literally everybody on your system - after this line chmod 777 /etc/tor/torrc you're enabling modifications for everyone. It can be a hacker, legitimate local user, an exploit or anything that happened to obtain a pid on your system somehow
    – Alexey Vesnin ♦
    Commented Mar 24 at 18:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .