Tor "stem.connection.UnreadableCookieFile" error on scheduling python script on Airflow

Question

I am using Apache Airflow to schedule my script. If I try to run the script from the terminal. stem is able to pickup the cookie file easily but If I try to run it via Airflow, it throws this error. stem.connection.UnreadableCookieFile.

I tried making control_auth_cookie readable in /root/.tor/ by using chmod ugo+r and while the permissions are set, airflow still can't read the cookie file.

How should I fix this?

I have the following options uncommented in torrc:

RunAsDaemon 1
ControlPort 9051
CookieAuthentication 1
CookieAuthFileGroupReadable 1

Note: CookieAuthFileGroupReadable 1 was not present initially. I added it manually following other threads.

Answer 1

(Not a sure answer, but I can't post comments.)

UnreadableCookieFile can be raised for two simple reasons:

• os.path.exists(cookie_path) returns False
• open(cookie_path) raises IOError

I'm guessing you're still having permission issues.

You need to set DataDirectoryGroupReadable, possibly also CacheDirectoryGroupReadable, to make your /root/.tor directory readable. I'm assuming that's tor's data directory on your system because one of the defaults is ~/.tor.

Then run the script from terminal with whatever user and group ID Airflow is trying to run it.

Ideally you'd be running tor as a separate user and group (e.g. like debian-tor on debian-based systems), then you could add only selected users to the same group. This doesn't give full access, it just allows members of the group to interact with tor via controller.

Answer 2

using a cookie file on a host grants no additional security, only the unix socket for a control protocol increases the security on the same host. So the problem you're encountering is just one of the many. Here is what you should do to make it run secure and OK:

• Set up the hashed password in your torrc config file and make sure that only tor dedicated user AND group can read it. No one else must not be able to even list a tor's directory and/or read the config file
• Use unix filesystem socket for the ControlPort directive just like the manual instructs you with WorldWritable flag.
• Set up your app/script to be running from it's own dedicated user and group, so no other user and group can read the script's/app config with the control password specified.

After that no tcpdump is working on your unix socket and no access to the config's that are containing the password or it's hash. All the data can be retrieved through the control protocol securely and without a parasite overload to the network stack and a firewall.