2

I've been trying for hours to get a munin monitoring plugin to hook into the Tor control port without success. The problem is that it's unable to access the Tor authcookie in /var/run/tor with the error permission denied. I've tried everything: Running the script as root, adding both root and www-data (it's a php script) into the debain-tor usergroup, changing permissions on /var/run/tor and /var/run/tor/control.authcokie (which works, but then prevents Tor from starting up throwing an error saying that the permissions aren't tight enough >.>), even changing the location of where Tor saves the cookie file all without success.

I've set the setting CookieAuthFileGroupReadable 1 in torrc and restarted Tor and the monitoring tool more times than I can count, all without luck. Is there some way to allow programs to access the cookie file while still maintaining strict enough permissions to allow Tor to start and run successfully?

Improve this question
1
  • I had to join the debian-tor group and it worked.
    – user7464
    May 20, 2015 at 5:18

1 Answer 1

Reset to default
1

Off the top of my head (I haven't thought about the security implications in any detail) I would:

  • Set CookieAuthFileGroupReadable 1
  • Start Tor
  • Figure out exactly what group Tor's process is running with (I'm not sure on Ubuntu) by running ps -aeo "%U %G %c" | grep tor (group is in the second column)
  • Unless group is root (in which case I wouldn't follow this advice), have your munin plugin run with said group by following these instructions, designed for exactly this purpose.

Done.

Improve this answer
3
  • The ps command gave this: debian-+ debian-+ tor I tried debain, debian-, and debian-+ and all gave a group doesn't exist error for munin. Perhaps I'm doing something wrong?
    – Ameo
    Aug 31, 2014 at 4:20
  • Without more information it's hard to say. Have you considered using password auth on the control port?
    – SLD
    Aug 31, 2014 at 10:59
  • Yeah I think that may be the best option at this point. The only problem is that the plugin was written without making changes to the code myself. But hey - it may be a fun challenge! EDIT: Thanks so much for your help; can't thank you enough!
    – Ameo
    Aug 31, 2014 at 16:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .