For the life of me, I cannot get my tor bridge relay working with obfsproxy, or obfs4proxy. I am running Ubuntu 15.10 with tor v0.2.7.6 (git-605ae665009853bd). Tor starts and bootstraps fine and is accessible to the outside world, but the managed proxy fails to start:

Jan 22 12:59:38.000 [notice] Bootstrapped 0%: Starting
Jan 22 12:59:39.000 [notice] Bootstrapped 80%: Connecting to the Tor network
Jan 22 12:59:39.000 [notice] Signaled readiness to systemd

Jan 22 12:59:40.000 [warn] Could not launch managed proxy executable at '/usr/bin/obfs4proxy' ('Operation not permitted').

Jan 22 12:59:40.000 [notice] Bootstrapped 85%: Finishing handshake with first hop
Jan 22 12:59:40.000 [notice] Bootstrapped 90%: Establishing a Tor circuit
Jan 22 12:59:41.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working.
Jan 22 12:59:41.000 [notice] Bootstrapped 100%: Done
Jan 22 12:59:41.000 [notice] Now checking whether ORPort xxx.xxx.xxx.xxx:xxx is reachable... (this may take up to 20 minutes -- look for log messages indicating success)
Jan 22 12:59:42.000 [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.
Jan 22 12:59:46.000 [notice] Performing bandwidth self-test...done.

I have tried changing the ownership for obfs4proxy/obfsproxy to the debian-tor account, to no avail.

-rwxr-xr-x 1 debian-tor debian-tor 5.0M Jun 28  2015 /usr/bin/obfs4proxy

I have also tried the apparmor patch from Debian:


But that also didn't allow the proxy to start. Any suggestions on what I can do to get this working? Or maybe there is an apparmor or tor bug here?

Here is my torrc:

#Log debug file /var/log/tor/debug.log
SocksPort 0 # Default: Bind to localhost:9050 for local connections.
ExtORPort auto
ORPort xxx
Nickname xxxxxxxxxx
RelayBandwidthRate 200 KBytes  # Throttle traffic to 100KB/s (800Kbps)
RelayBandwidthBurst 250 KBytes # But allow bursts up to 200KB (1600Kb)
AccountingMax 100 GBytes
AccountingStart day 00:00
ContactInfo xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
BridgeRelay 1
ExitPolicy reject *:*
ServerTransportPlugin obfs3,obfs4 exec /usr/bin/obfs4proxy

Here is debug logging from when tor tried to start obfs4proxy:

Jan 22 13:12:07.000 [info] handle_proxy_line(): Got a line from managed proxy '/usr/bin/obfs4proxy': (ERR: Failed to spawn background process - code 9/1)
Jan 22 13:12:07.000 [warn] Could not launch managed proxy executable at '/usr/bin/obfs4proxy' ('Operation not permitted').


lost@shithead:~$ obfs4proxy 
2016/01/24 19:23:06 [ERROR]: obfs4proxy - must be run as a managed transport
lost@shithead:~$ obfs4proxy --managed
flag provided but not defined: -managed
Usage of obfs4proxy:
  -enableLogging=false: Log to TOR_PT_STATE_LOCATION/obfs4proxy.log
  -logLevel="ERROR": Log level (ERROR/WARN/INFO/DEBUG)
  -obfs4-distBias=false: Enable obfs4 using ScrambleSuit style table generation
  -unsafeLogging=false: Disable the address scrubber
  -version=false: Print version and exit
lost@shithead:~$ obfsproxy 
usage: obfsproxy [-h] [-v] [--log-file LOG_FILE]
                 [--log-min-severity {error,warning,info,debug}] [--no-log]
                 [--no-safe-logging] [--data-dir DATA_DIR] [--proxy PROXY]
                 {managed,obfs2,dummy,obfs3,scramblesuit,b64} ...
obfsproxy: error: too few arguments
lost@shithead:~$ obfsproxy --managed
Traceback (most recent call last):
  File "/usr/local/bin/obfsproxy", line 9, in <module>
    load_entry_point('obfsproxy==0.2.13', 'console_scripts', 'obfsproxy')()
  File "/usr/local/lib/python2.7/dist-packages/obfsproxy/pyobfsproxy.py", line 205, in run
  File "/usr/local/lib/python2.7/dist-packages/obfsproxy/pyobfsproxy.py", line 175, in pyobfsproxy
  File "/usr/local/lib/python2.7/dist-packages/obfsproxy/pyobfsproxy.py", line 76, in do_managed_mode
    if checkClientMode():
  File "/usr/local/lib/python2.7/dist-packages/pyptlib/config.py", line 121, in checkClientMode
    raise EnvError('neither TOR_PT_{SERVER,CLIENT}_TRANSPORTS set')
pyptlib.config.EnvError: neither TOR_PT_{SERVER,CLIENT}_TRANSPORTS set
  • Possible duplicate of Obfsproxy problem in ubuntu
    – Ron
    Jan 23 '16 at 8:30
  • can you launch the executable of obfs4proxy by hand? In my case OBFS proxy is called just obfsproxy, not obfs4proxy btw
    – Alexey Vesnin
    Jan 23 '16 at 16:00
  • @AlexeyVesnin updated question with output
    – Bscherer
    Jan 25 '16 at 1:23
  • @Ron I looked at that, but that fix didn't work. My error is "Operation not permitted" not "Permission Denied"
    – Bscherer
    Jan 25 '16 at 1:26
  • @Bscherer try to make a Git compilation from official sources - and post an update here
    – Alexey Vesnin
    Jan 25 '16 at 3:38

I have finally found a solution to this problem. For me, the offender was the /lib/systemd/system/tor@default.service file. I was directed by Tor ops to modify this file to include only the following after the "Hardening" comment:

# Hardening

Comment out or delete everything else and you will no longer get the "Operation not permitted" error when launching obfs4proxy.


I modified apparmor profile /etc/apparmor.d/system_tor, just added three lines in it:

/usr/bin/obfsproxy PUx,
profile /etc/apparmor.d/usr.bin.obfsproxy {

Whole file sample:

# vim:syntax=apparmor
#include <tunables/global>

profile system_tor flags=(attach_disconnected) {
  #include <abstractions/tor>

  /usr/bin/obfsproxy PUx,

  profile /etc/apparmor.d/usr.bin.obfsproxy {

  owner /var/lib/tor/** rwk,
  owner /var/lib/tor/ r,
  owner /var/log/tor/* w,

  # During startup, tor (as root) tries to open various things such as
  # directories via check_private_dir().  Let it.
  /var/lib/tor/** r,

  /{,var/}run/tor/ r,
  /{,var/}run/tor/control w,
  /{,var/}run/tor/socks w,
  /{,var/}run/tor/tor.pid w,
  /{,var/}run/tor/control.authcookie w,
  /{,var/}run/tor/control.authcookie.tmp rw,
  /{,var/}run/systemd/notify w,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/system_tor>
  • 1
    Could you add a description what your changes do and why you made them?
    – Jens Kubieziel
    Jun 16 '17 at 21:58

I used this method..have to change the NoNewPrivileges=yes to NoNewPrivileges=no


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.