2

I'm looking at using the Tor browser bundle, and the instructions have one run the bundle as a normal user (in my case, on Debian Jessie). This would seem to expose the Tor files to tampering in a way that is not the case with iceweasel.

Q1: are my concerns misplaced?

I've tried to run Tor inside of /opt with a softlink to /usr/local/bin/start-tor-browser, but unless I assign "my user:my user" to the entire "/opt/torfolder" I get a permission error. There is code to stop Tor running as root which I'd prefer not to comment out, but regardless I don't think that is the main problem at the moment.

Q: is there a "best practice" for running Tor as a normal user, but for protecting the Tor files from user tampering with permissions?

Q: What are the benefits/downsides of using visudo?

Thanks!

migrated from serverfault.com Nov 14 '15 at 21:57

This question came from our site for system and network administrators.

  • 1
    In what ways are the Tor files exposed to tampering if running as a non-root user? (And how does Iceweasel prevent this?) – Richard Horrocks Nov 15 '15 at 18:05
  • Hi Richard, thanks for the question. My sense is installed linux apps like iceweasel files are stored in folders with root:root permissions, and libraries/application files have root:root permissions. The Tor Browser Bundle is meant to run in a user account, with regular user permissions, so my assumption is that it is easier for those files to be vulnerable to malware/user mistakes. If so, am looking for a way to set up Tor like iceweasel where Tor folders/files have root:root but can be run by regular users. Not sure TBB allows this easily given how it is configured to work. – Senrabdet Nov 17 '15 at 11:57
1

So - here are your answers, step by step:

  • Q1 Tor has no folder-hardcode in it's entire source, and if you're about to use /opt/tordir or anything else that is physically reachable in your FileSystem API - it's totally OK. Just make sure that you will make it actually reachable by issuing chown -R tor-user:tor-user-primary-group /path/to/your/tordir and making it referenced as DataDirectory /full/path/to/your/tordir/from/the/very/top and corresponding values with full path too: GeoIPFile,GeoIPv6File,PidFile. And the magic goes on! Use User tor-user as the very last line in your torrc. That's it - I'm running Tor from it's dedicated and non-standart folder too.
  • Q2 Make a separate directory for Tor(look Q1 answer), use /etc/torrc owned by root only and run it as a regular dedicated user. Additional file security is - actually - not required strictly, but of course a UMASK 077 is in order system-wide, or don't speak about a filesystem security on that host at all. Extra level of defense - above umask 077 - if you will need it - I'd recommend you AppArmor, used it in Ubuntu and in Debian. Really simple and powerful tool if you need some additional hardening.
  • Q3 it's a native part of sudo toolset, so it's totally fine to use it: because only root is able to use it and even read a sudoers file. But as in any case of include-configs, do check that not a byte is included from either directories or files: all the sudo permissions must reside on one single file. And if you'll have a root account breached - your server is lost regardless of OS you're using(except MS-DOS, pehaps)

Feel free to ask more questions - I'll be glad to help!

1

In complement of Alexey's detailed answer, let me add the following. As indicated, for instance, here, the simpler way to install tor browser in /opt on Linux is probably the following:

  1. Download a bundle at https://www.torproject.org/projects/torbrowser.html.en#downloads
  2. (optional, but recommended) Check the signature (https://www.torproject.org/docs/verifying-signatures.html.en)
  3. Extract the file, for instance with

    tar -xvfJ tor-browser-linux64-7.0.4_en-US.tar.xz
    
  4. As root, move the files to /opt, using for instance

    mv tor-browser_en-US /opt
    
  5. Finally, as a normal user, run the program with

        cd /opt/tor-browser_en-US/
        ./start-tor-browser.desktop
    

and you can even add to that latter command --register-app at the end, to be able to run the program from anywhere (i.e., to add it to the applications in your menu, for instance).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.