3
Personally, I think the wiki stuff is outdated and needs some kinda purge with fire.
Here's how Tails does it:
#!/bin/sh
unset http_proxy
unset HTTP_PROXY
unset https_proxy
unset HTTPS_PROXY
exec torsocks /usr/lib/wget/wget --passive-ftp "$@"
This script is set as the default wget (through dpkg-divert, so that non-torified wget would be hard to ...
3
torsocks intercepts calls to the libc syscall() function (and various other libc calls) by hooking into them through the dynamic linkers LD_PRELOAD environment variable.
It creates a "shim" function around the calls that it knows it can properly torify, and runs a torified version of the function. Those that it cannot properly torify or does not know can be ...
2
Torsocks sets the LD_PRELOAD environment variable to intercept a few system calls.
It does not matter if you use it recursively:
# at first $LD_PRELOAD is unset
$ echo $LD_PRELOAD
# when we start a torsocks shell is $LD_PRELOAD is set
$ torsocks --shell
/usr/bin/torsocks: New torified shell coming right up...
$ echo $LD_PRELOAD
/usr/lib/torsocks/...
2
Most of the links you posted state the differences.
You should use torsocks.
tsocks: Allows non-SOCKS aware applications to use a SOCKS proxy. No longer maintained.
tsocks' role is to allow these non SOCKS aware applications (e.g telnet, ssh, ftp etc) to use SOCKS without any modification.
torsocks: Similar to tsocks but designed for Tor specifically.
...
1
For just a cURL - no, but a web browser or other application can launch another one that will make unproxified request and that's how the data leaks, so be careful in what you're doing!
1
Just tried your example, it doesn't see my real ip. There maybe some clever way to bypass torsocks, but usually applications access regular API's and curl definitely doesn't leak IP's on regular requests. Also, curl doesn't leak dns in this case, only using tor with --socks5 and not --socks5-hostname does.
1
You should use your system's default for all tcp timeouts, which is likely 60-90 seconds.
A quick diff of the about:config settings matching network.http*timeout in the following two browsers:
Mozilla Firefox 78.6.1esr and
Tor Browser 8.5.5 (based on Mozilla Firefox 60.9.0esr)
...shows two differences
network.http.connection-retry-timeout and
network.http....
1
If the hidden service is HTTP AND your client for some reason does not support torsocks, then you may benefit from a nginx revers proxy listening on local ports
WARNINGS:
This nginx process will not be listen on 0.0.0.0 because it's torified. It will only listen to localhost (127.0.0.1). This is good because on 0.0.0.0 you may be reachable on a public port ...
1
The torsocks program (the actual name of the torify alias) can connect to hidden services fine. For example:
torsocks curl https://3g2upl4pq6kufc4m.onion
1
No, Tor Browser isolates it's circuits by the first party domain.
e.g. foo.com, bar.foo.com and qux.bar.foo.com will all be isolated on their own circuit for foo.com. While example.com, bar.example.com and qux.bar.example.com will all use their own isolated circuit for example.com.
Anything under torify won't use the same SOCKS5 credentials and so won't ...
1
Generally speaking, if it works with torsocks wrapping it, it should be fine.
torsocks can cause some features to break but it shouldn't result in any leaks under normal circumstances.
It's hard to tell without thorough review if any program is 100% safe, but outside of a few common situations where it may leak most applications should be fine.
1
Tor's default SOCKS port is 9050 as far as I remember, so try to use it With remote DNS option.
1
You can send any command over Tor with torify or torsocks.
Example:
torsocks wget https://path/to/file
or
torify apt-get update
or
torsocks git clone https://path/to/git
or even ssh, scp or sftp over Tor
torsocks ssh user@host
1
Assuming you want to do this using apt-get, rather than building from source, you can use torify in the following way:
# torify apt-get update
# torify apt-get install <jdk_packages>
[A similar solution was offered here: https://tor.stackexchange.com/a/839/1730]
Only top voted, non community-wiki answers of a minimum length are eligible