Obfsproxy problem in ubuntu

Question

I have problem with Tor and obfsproxy for using bridges on ubuntu 14.04. Tor could not start obfsproxy and always return permission denied.

tail -f /var/log/tor/log

Aug 01 13:06:30.000 [notice] Tor 0.2.4.23 (git-05b81fcd2a655c5a) opening new log file.
Aug 01 13:06:30.000 [notice] Parsing GEOIP IPv4 file /usr/share/tor/geoip.
Aug 01 13:06:30.000 [notice] Parsing GEOIP IPv6 file /usr/share/tor/geoip6.
Aug 01 13:06:30.000 [warn] OpenSSL version from headers does not match the version we're running with. If you get weird crashes, that might be why. (Compiled with 1000105f:     OpenSSL 1.0.1e 11 Feb 2013; running with 1000106f: OpenSSL 1.0.1f 6 Jan 2014).
Aug 01 13:06:33.000 [warn] Could not launch managed proxy executable at '/usr/bin/obfsproxy' ('Permission denied').
Aug 01 13:06:34.000 [notice] Bootstrapped 5%: Connecting to directory server.
Aug 01 13:06:34.000 [warn] We were supposed to connect to bridge '192.36.27.216:55313' using pluggable transport 'obfs2', but we can't find a pluggable transport proxy supporting 'obfs2'. This can happen if you haven't provided a ClientTransportPlugin line, or if your pluggable transport proxy stopped running.

Answer 1

Premise
How to configure Tor and Obfsproxy:
- https://www.torproject.org/projects/obfsproxy-debian-instructions

According with this bug report:
https://trac.torproject.org/projects/tor/ticket/6996
... the obfsproxy permission error is triggered by the tor init script ( at least on debian/ubuntu ) because of tor apparmor wrong script (/etc/apparmor.d/system_tor)

so basically approuch is to stop the service and launch tor directly so a simple and straight:

sudo service tor stop && tor

this should work ( don't use sudo to launch tor or you will get a different error :(

Better solution
is to fix the apparmor tor profile so that the tor service start correctly

1. edit this file /etc/apparmor.d/system_tor
2. add this line /usr/bin/obfsproxy Ux,
3. restart apparmor service (sudo service apparmor restart )

So the profile should look something like this:

# vim:syntax=apparmor
#include <tunables/global>

profile system_tor {
  #include <abstractions/tor>

  owner /var/lib/tor/** rwk,
  owner /var/log/tor/* w,

  /usr/bin/obfsproxy  Ux,  ## this is the FIX

  /{,var/}run/tor/control w,
  /{,var/}run/tor/tor.pid w,
  /{,var/}run/tor/control.authcookie w,
  /{,var/}run/tor/control.authcookie.tmp rw,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/system_tor>
}

Answer 2

The log says that Tor tries to connect to a bridge with obfs2. This variant of obfs is deprecated and probably the bridge doesn't offer it anymore. You can try if this bridge uses obfs3 with two ways:

1. If you're using the Tor Browser Bundle, just click on the green onion and select the last entry (network settings). On the next menu click on the last button (my provider blocks connections). Normally obfs3 is pre-selected. So just click on OK.
2. You can also modify your torrc. Go to the file. It should contain an entry like Bridge obfs2 192.…. Now change obfs2 to obfs3 and restart Tor. It will now try obfs3 on that IP address. When this does not work, you should go to the Tor bridges page and receive some bridge addresses. Enter those and it should work again.