21

Suppose I have a Linux machine (for example Debian) with more than one public IPs, sufficient bandwidth, memory and CPU resources.

How may I run more than one Tor relay instance in that single machine? Should there be different users that start every instance? How about the different torrc configuration files?

Finally are there any implications from running two or more relays in a single machine ?

12

Install Tor package:

# apt-get install -y tor

Create different data dirs:

# mkdir /usr/local/var/lib/tor{1,2,3}

Create as many as you want(have different IP Addresses) different configuration files:

For example 3:

1st

# cat > /usr/local/etc/torrc1 << EOF
SocksPort 9051
Log notice file /usr/local/var/log/tor/notices1.log
RunAsDaemon 1
DataDirectory /usr/local/var/lib/tor1
ControlPort 9061
ORPort 9001
ORListenAddress 1.1.1.1:9001
Nickname relay1
ContactInfo anonymous1 anonymous@mail.com
DirPort 9031
DirListenAddress 1.1.1.1:9031
ExitPolicy reject *:*
EOF

2nd

# cat > /usr/local/etc/torrc2 << EOF
SocksPort 9052
Log notice file /usr/local/var/log/tor/notices2.log
RunAsDaemon 1
DataDirectory /usr/local/var/lib/tor2
ControlPort 9062
ORPort 9002
ORListenAddress 2.2.2.2:9002
Nickname relay2
ContactInfo anonymous2 anonymous@mail.com
DirPort 9032
DirListenAddress 2.2.2.2:9032
ExitPolicy reject *:*
EOF

3rd

# cat > /usr/local/etc/torrc3 << EOF
SocksPort 9053
Log notice file /usr/local/var/log/tor/notices3.log
RunAsDaemon 1
DataDirectory /usr/local/var/lib/tor3
ControlPort 9063
ORPort 9003
ORListenAddress 3.3.3.3:9003
Nickname relay3
ContactInfo anonymous3 anonymous@mail.com
DirPort 9033
DirListenAddress 3.3.3.3:9033
ExitPolicy reject *:*
EOF

There after just start three instance of tor with this config files as arguments:

# /usr/sbin/tor -f /usr/local/etc/torrc1
# /usr/sbin/tor -f /usr/local/etc/torrc2
# /usr/sbin/tor -f /usr/local/etc/torrc3

Watch logs:

# tail -F /usr/local/var/log/tor/notices?.log

Don't forget to open on firewall six ports:

# for port in `seq 9001 9003` `seq 9031 9033`;do echo $i;done
iptables -I INPUT -p tcp --dport $port -m state --state NEW -s 0.0.0.0/0 -j ACCEPT
done

You can start Tor instance as different Users, don't forget to change permissions on DataDirectories and log files. Moreover, if you have fast bandwidth on even one of your network interfaces ( more than 50-100 mb/s ), you may try to wrap one tor client into another tor relay, read this doc, simply start inner instance as the transparently specific user.

  • please clarify "wrap one tor relay into another". Isn't Tor over Tor overkill in general, so especially for relays? – alaf Oct 5 '13 at 1:02
  • It is optional in my answer. You can to imagine this by your self, what is better: chain with 3 hops or chain with 6 hops? What is longer? etc... (And again, you need at least 50mb/s to do that) – perpetuity Oct 5 '13 at 2:01
8

There's no point to running multiple instances on a single machine. In fact, it's dangerous. If you fail to set family properly, and the IP's you've got are on different sub-nets (or the user has their torrc configured to allow multiple nodes on the same sub-net for some reason), it's possible (though not likely) that a user would build a circuit using two of your relays. Now anyone who gains access to your box controlls multiple hops. None of this is likely, but that doesn't mean you should do it.

Just set up a single node and make sure it's allowed to use all the bandwidth you want it to. You can make a single instance listen on multiple IP's by setting multiple SocksListenAddress'es in your torrc file.

  • 3
    One reason to have multiple Tor daemons running is if you run a hidden service and a relay. You may want to use AccountingMax on the relay but always have the hidden service available. – htoip Jul 31 '14 at 0:47
4

Multiple Tor instances are useful whenever a single one doesn't manage to fill the available bandwidth.

Try running one single instance first.

Multiple instances use separate torrc files by using the -f option. The preferred way to do this may depend on what distribution you are running.

Regarding Debian (for which I'm no expert), a cursory glance at /etc/init.d/tor reveals there is no specific support. I would copy this script to get tor1 ... torN (as many as instances) and edit them to specify different config files.

Note that you may use a custom defaults file for common configuration (e.g. family).

  • Modified question. Added Linux to be more specific and clear. – alaf Oct 4 '13 at 12:54
  • I wonder how widespread the requirement for running multiple tor instances is. I wouldn't be opposed to natively support that in the Debian packages if somebody could demonstrate that more users have that requirement and we could come with a nice way to do it. – weasel - Peter Palfrader Oct 4 '13 at 18:22
4

Current versions of Ubuntu (and probably other distros) use AppArmor, which can cause hard to debug error messages (e.g. Couldn't access/create private data directory despite permissions being set correctly). In order to be able to run a second Tor instance, I did:

  • edit /etc/apparmor.d/local/system_tor and add two rules (if you use other file names/paths below, you will have to adjust this!):
    owner /var/lib/tor2/** rwk,
    /{,var/}run/tor/tor2.pid w,

  • copy /etc/init.d/tor to /etc/init.d/tor2 and edit the following lines as follows:
    DESC="tor daemon legacy"
    TORPID=$TORPIDDIR/tor2.pid
    ARGS="-f /etc/tor/torrc2"

  • copy /etc/tor/torrc to torrc2 and edit it

    • adjust ports
    • adjust nick
    • adjust Log notice file (use same dir unless you want to write more AppArmor rules!)
    • adjust DataDirectory to point to /var/lib/tor2/
  • run /etc/init.d/apparmor reload

  • You might need to create /var/lib/tor2, adjust owner (chown debian-tor:debian-tor) and permissions (chmod 2700), but I think once AppArmor is configured Tor will do it itself. Feel free to populate the keys/ directory with appropriate keys.

  • Start your second instance with service tor2 start. If you want it to start automatically, you will likely have to run something like update-rc.d with correct parameters.

1

Yes you definitely can. You just have to install Privoxy to work with Tor as described by the answers in https://stackoverflow.com/questions/9887505/changing-tor-identity-inside-python-script. In case you don't want to configure anything, I wrote privoxyTor (Python, at https://github.com/anhldbk/privoxyTor/) to make the configuration process easier. Hope this will help!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.