22

Suppose I have a Linux machine (for example Debian) with more than one public IPs, sufficient bandwidth, memory and CPU resources.

How may I run more than one Tor relay instance in that single machine? Should there be different users that start every instance? How about the different torrc configuration files?

Finally are there any implications from running two or more relays in a single machine ?

Improve this question
2
  • If you run more than on relay, you should definitely set the <code>MyFamily</code> option in the torrc of each of them, see https://www.torproject.org/docs/faq.html.en#MultipleRelays.
    – user823
    Commented Dec 26, 2013 at 11:07
  • Today you can also run Tor simply in a container (e. g. a docker-container). Then nothing prevents you from running several of this containers (everyone with different ports).
    – anion
    Commented Jul 18, 2021 at 22:36

8 Answers 8

Reset to default
13

Install Tor package:

# apt-get install -y tor

Create different data dirs:

# mkdir /usr/local/var/lib/tor{1,2,3}

Create as many as you want(have different IP Addresses) different configuration files:

For example 3:

1st

# cat > /usr/local/etc/torrc1 << EOF
SocksPort 9051
Log notice file /usr/local/var/log/tor/notices1.log
RunAsDaemon 1
DataDirectory /usr/local/var/lib/tor1
ControlPort 9061
ORPort 9001
ORListenAddress 1.1.1.1:9001
Nickname relay1
ContactInfo anonymous1 [email protected]
DirPort 9031
DirListenAddress 1.1.1.1:9031
ExitPolicy reject *:*
EOF

2nd

# cat > /usr/local/etc/torrc2 << EOF
SocksPort 9052
Log notice file /usr/local/var/log/tor/notices2.log
RunAsDaemon 1
DataDirectory /usr/local/var/lib/tor2
ControlPort 9062
ORPort 9002
ORListenAddress 2.2.2.2:9002
Nickname relay2
ContactInfo anonymous2 [email protected]
DirPort 9032
DirListenAddress 2.2.2.2:9032
ExitPolicy reject *:*
EOF

3rd

# cat > /usr/local/etc/torrc3 << EOF
SocksPort 9053
Log notice file /usr/local/var/log/tor/notices3.log
RunAsDaemon 1
DataDirectory /usr/local/var/lib/tor3
ControlPort 9063
ORPort 9003
ORListenAddress 3.3.3.3:9003
Nickname relay3
ContactInfo anonymous3 [email protected]
DirPort 9033
DirListenAddress 3.3.3.3:9033
ExitPolicy reject *:*
EOF

There after just start three instance of tor with this config files as arguments:

# /usr/sbin/tor -f /usr/local/etc/torrc1
# /usr/sbin/tor -f /usr/local/etc/torrc2
# /usr/sbin/tor -f /usr/local/etc/torrc3

Watch logs:

# tail -F /usr/local/var/log/tor/notices?.log

Don't forget to open on firewall six ports:

# for port in `seq 9001 9003` `seq 9031 9033` ; do iptables -I INPUT -p tcp --dport $port -m state --state NEW -s 0.0.0.0/0 -j ACCEPT ; done

You can start Tor instance as different Users, don't forget to change permissions on DataDirectories and log files. Moreover, if you have fast bandwidth on even one of your network interfaces ( more than 50-100 mb/s ), you may try to wrap one tor client into another tor relay, read this doc, simply start inner instance as the transparently specific user.

Improve this answer
4
  • please clarify "wrap one tor relay into another". Isn't Tor over Tor overkill in general, so especially for relays?
    – alaf
    Commented Oct 5, 2013 at 1:02
  • It is optional in my answer. You can to imagine this by your self, what is better: chain with 3 hops or chain with 6 hops? What is longer? etc... (And again, you need at least 50mb/s to do that)
    – perpetuity
    Commented Oct 5, 2013 at 2:01
  • @perpetuity, thank you. How can I get control over these daemons? How can I stop and restart them?
    – Yevgen
    Commented May 4, 2019 at 10:14
  • it's better to use systemd logs and services - it works a way better!
    – Alexey Vesnin ♦
    Commented Jul 19, 2021 at 21:34
7

Multiple Tor instances are useful whenever a single one doesn't manage to fill the available bandwidth.

Try running one single instance first.

Multiple instances use separate torrc files by using the -f option. The preferred way to do this may depend on what distribution you are running.

Regarding Debian (for which I'm no expert), a cursory glance at /etc/init.d/tor reveals there is no specific support. I would copy this script to get tor1 ... torN (as many as instances) and edit them to specify different config files.

Note that you may use a custom defaults file for common configuration (e.g. family).

Improve this answer
2
  • Modified question. Added Linux to be more specific and clear.
    – alaf
    Commented Oct 4, 2013 at 12:54
  • I wonder how widespread the requirement for running multiple tor instances is. I wouldn't be opposed to natively support that in the Debian packages if somebody could demonstrate that more users have that requirement and we could come with a nice way to do it.
    – weasel - Peter Palfrader
    Commented Oct 4, 2013 at 18:22
6

There's no point to running multiple instances on a single machine. In fact, it's dangerous. If you fail to set family properly, and the IP's you've got are on different sub-nets (or the user has their torrc configured to allow multiple nodes on the same sub-net for some reason), it's possible (though not likely) that a user would build a circuit using two of your relays. Now anyone who gains access to your box controlls multiple hops. None of this is likely, but that doesn't mean you should do it.

Just set up a single node and make sure it's allowed to use all the bandwidth you want it to. You can make a single instance listen on multiple IP's by setting multiple SocksListenAddress'es in your torrc file.

Improve this answer
1
  • 4
    One reason to have multiple Tor daemons running is if you run a hidden service and a relay. You may want to use AccountingMax on the relay but always have the hidden service available.
    – htoip
    Commented Jul 31, 2014 at 0:47
4

Current versions of Ubuntu (and probably other distros) use AppArmor, which can cause hard to debug error messages (e.g. Couldn't access/create private data directory despite permissions being set correctly). In order to be able to run a second Tor instance, I did:

  • edit /etc/apparmor.d/local/system_tor and add two rules (if you use other file names/paths below, you will have to adjust this!):
    owner /var/lib/tor2/** rwk,
    /{,var/}run/tor/tor2.pid w,

  • copy /etc/init.d/tor to /etc/init.d/tor2 and edit the following lines as follows:
    DESC="tor daemon legacy"
    TORPID=$TORPIDDIR/tor2.pid
    ARGS="-f /etc/tor/torrc2"

  • copy /etc/tor/torrc to torrc2 and edit it

    • adjust ports
    • adjust nick
    • adjust Log notice file (use same dir unless you want to write more AppArmor rules!)
    • adjust DataDirectory to point to /var/lib/tor2/

  • run /etc/init.d/apparmor reload

  • You might need to create /var/lib/tor2, adjust owner (chown debian-tor:debian-tor) and permissions (chmod 2700), but I think once AppArmor is configured Tor will do it itself. Feel free to populate the keys/ directory with appropriate keys.

  • Start your second instance with service tor2 start. If you want it to start automatically, you will likely have to run something like update-rc.d with correct parameters.

Improve this answer
1

Yes you definitely can. You just have to install Privoxy to work with Tor as described by the answers in https://stackoverflow.com/questions/9887505/changing-tor-identity-inside-python-script. In case you don't want to configure anything, I wrote privoxyTor (Python, at https://github.com/anhldbk/privoxyTor/) to make the configuration process easier. Hope this will help!

Improve this answer
0

One more way are possible:

You can also run several VMs with your preferred operating system and one Tor browser on one host system.

Improve this answer
0

I just want to share How to change tor ip without restart the tor service. For some reason i want change the tor IP for every second instead create multiple tor to get multiple IP.

sudo apt update
sudo apt install tor
echo 'ExitNodes {RU}' | sudo tee --append /etc/tor/torrc
echo 'ControlPort 9051' | sudo tee --append /etc/tor/torrc
echo "HashedControlPassword 16:515F363FA030C6E160D21668FAD542DBE6BCA91B4442B2C30EC847B2F6" | sudo tee --append /etc/tor/torrc
sudo service tor start

Try the tor connection :

sudo apt install proxychains4
proxychains -q curl https://ipinfo.io/ip

Generate new IP :

echo -e "AUTHENTICATE \"safe_password\"\r\nSIGNAL NEWNYM\r\nQUIT\r\n" | nc 127.0.0.1 9051

Check new IP :

proxychains -q curl https://ipinfo.io/ip
Improve this answer
0

The Debian package (possibly also Ubuntu) contains a script named tor-instance-create. If you call this, you get a new configuration using a new user and group.

tor-instance-create nameofinstance
vi /etc/tor/instances/nameofinstance/torrc
systemctl enable tor@nameofinstance
systemctl start tor@nameofinstance

Also have a look at /var/lib/tor-instances/ and /usr/share/tor/tor-service-defaults-torrc-instances.

One good reason to have multiple instances is to spread the CPU load, which might be necessary for nodes providing lots of bandwidth.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .