14
Short Answer:
There is no advantage to using TBB as root, but there are significant risks.
Longer Answer:
It is a generally accepted practice that userland applications (ie: application that are not system services) should not be run using a privileged account. This is to help ensure integrity and isolation of potentially harmful applications from core ...
12
Actually, we're very happy with our Debian packager. He works hard to make sure the version of Tor shipped in various Debians is safe and stable.
But Ubuntu has indeed been a source of frustration over the years. Read the Ubuntu bug ticket for some of the sordid details -- especially the parts where I start repeating the phrase "remote root vulnerability" ...
12
Normally the Tor service should be started/stopped with either:
sudo systemctl start/stop tor.service
Or:
sudo service tor start/stop
Personally I've always used the service command because it is simpler. I'm guessing things get a little more complicated when you run multiple Tor instances, but I have no experience with that.
Running Tor in a terminal runs ...
7
Tor checks the ownership of several files and directories at startup. One of those directories is the HiddenServiceDir. This should belong to the user who started the Tor process. Otherwise you will get the warning:
Oct 06 12:34:56.000 [warn] /foo/bar is not owned by this user (johndoe, 1011)
but by root (0). Perhaps you are running Tor as the wrong ...
6
Use the text editor and open the start-tor-browser script file. Search for the word root, you will see these lines:
if [ "`id -u`" -eq 0 ]; then
complain "The Tor Browser Bundle should not be run as root. Exiting."
exit 1
fi
Remove or comment out the exit 1 command.
6
From the Arch Linux Wiki:
chromium --proxy-server="socks5://127.0.0.1:9050" --host-resolver-rules="MAP * 0.0.0.0 , EXCLUDE myproxy"
However as the wiki explicitly warns: this will be used for fetching http and https only, a great deal of work was put into ensuring "Proxy Obedience" in Tor Browser.
Forcing Chromium to fetch content outside of the Tor proxy ...
6
You should prefer torsocks over proxychains, since torsocks is intended to block potential leaks.
Especially in cases with tools like youtube-dl which might try to pass over execution to programs that can make network connections of their own in unexpected or attacker controlled ways.
Specifically with proxychains, if anything wrapped in proxychains tries ...
5
As far as I see it, the package file brings its own version of the Tor Browser Bundle. So if you want to make sure that someone didn't change anything you'd have to check the integrity for yourself. If you don't do this the maintainer can inject arbitrary code into his TBB version.
A better way would be to download the TBB archive directly from torproject....
5
Tor should control the hidden service private key, it has nothing at all to do with the httpd so you shouldn't be putting the private key or setting the hidden service directory anywhere related to the httpd, e.g. inside /var/www
Instead use a folder like /var/lib/tor/hidden_service. This is inside a folder that tor already controls and can set the ...
5
From the obfs4proxy README:
The autogenerated obfs4 bridge parameters are placed in
DataDir/pt_state/obfs4_state.json. To ease deployment, the client side
bridge line is written to DataDir/pt_state/obfs4_bridgeline.txt.
So /var/lib/tor/pt_state/obfs4_bridgeline.txt.
5
The default systemd/upstart script should handle a shutdown properly.
The only thing that special about a relay shutdown is that there is a grace period of 30 secs to avoid tearing down short-lived connections.
From tor's the manpage:
ShutdownWaitLength NUM
When we get a SIGINT and we’re a server, we begin shutting down: we close listeners and ...
4
Premise
How to configure Tor and Obfsproxy:
- https://www.torproject.org/projects/obfsproxy-debian-instructions
According with this bug report:
https://trac.torproject.org/projects/tor/ticket/6996
... the obfsproxy permission error is triggered by the tor init script ( at least on debian/ubuntu ) because of tor apparmor wrong script (/etc/apparmor.d/...
4
At the moment the meek packages are landing in debian so we can expect them to arrive in ubuntu too.
UPDATE
Previous info are not working fine anymore, it looks there is now a repository for debian unstable ... so I changed my previous answer with this one:
1 Add Repository
Repository (info on the repository page).
2. Install meek-client package
sudo ...
4
If you follow these steps below and done everything correctly,
then this will work like a charm!
This might also work on other versions of Ubuntu & TBB.
Download the latest (Tor Browser Bundle) from https://www.torproject.org/ and save it into the Home (Downloads) directory.
Create a new folder somewhere in the Home directory. Example: Documents and ...
4
If you only used signed repositories for your software, then you should be fine. Both Debian and Ubuntu sign their archives by default, and apt complains as soon as you add an insecure source to its list. Thus, it should not matter how you download the packages - their integrity gets verified by the system before installing and everything should be secure.
...
answered Nov 23 '13 at 8:30
weasel - Peter Palfrader
5,1281 gold badge20 silver badges37 bronze badges
4
Building Tor statically is problematic, at best, and not really (well) supported.
I got configure to run with this minor patch:
--- a/configure.ac
+++ b/configure.ac
@@ -542,7 +542,7 @@ AC_ARG_WITH(ssl-dir,
fi
])
-TOR_SEARCH_LIBRARY(openssl, $tryssldir, [-lssl -lcrypto $TOR_LIB_GDI],
+TOR_SEARCH_LIBRARY(openssl, $tryssldir, [-lssl -lcrypto -lz -...
answered Nov 2 '13 at 22:07
weasel - Peter Palfrader
5,1281 gold badge20 silver badges37 bronze badges
3
I just solved what I believe may be your problem as well.
Try leaving the 'HiddenServiceDir' alone or back to it's normal value which I believe is
HiddenServiceDir /var/lib/tor/hidden_service/
Restart Yor with these
sudo service tor stop
sudo service tor start
You won't have access to /var/lib/tor so to access the .onion address from /var/lib/tor/...
3
You can run any command as a different user using sudo:
sudo -u my_user tor-browser-en
If you need to use multiple commands you can do this:
sudo -u my_user sh -c "first && second"
If you want to background the application, you should not do this (it will only work as expected if you're already authenticated with sudo):
sudo -u my_user tor-...
3
Also add StrictNodes 1 to your torrc.
3
The desktop file doesn't work in any case. However Tor comes with a shell script. You can execute it and Tor Browser will start. It is located in the Browser/ subdirectory:
tor-browser_en-US/Browser/start-tor-browser
3
If you want to run a tor hidden service, you should use tor, not tor browser. You can run tor as a daemon.
sudo apt-get install tor
tor
Make sure you properly set up your hidden service too.
3
From the README:
The getxbook program downloads books anonymously. Using it will still
result in your IP address being logged (use
torify to stop this)...
torify is tool that attempts to wrap your terminal command in a Tor session. There's a good tutorial on what you need to do, here. Then it's just a case of running:
torify <your_command>
3
This isn't really possible, and officially advised against.
The whole reason the Tor Browser was created was because of the difficulties in trying to make other browsers "safe".
Have a look at the Tor Browser Design Document, specifically the section on Design Requirements and Philosophy to understand the problems that have to be overcome when creating a ...
3
The NAT punching properties described in the video, are those of onion services. These are a default property of onion services.
Normally if you've providing a service that you want to be accessible behind some NAT, you have to setup some kind of exception on the NAT device (e.g. a home router) to allow incoming connections to a certain port be forwarded to ...
3
Your version of Tor has bug which causes this messages (see #21056). Version 0.3.0.6 has a partial fix. If you install this version there are high chances that the messages will go away. Currently the developers are working on a full fix (see #17242).
So I would recommend to install a newer version. Please follow the advise at the instruction page for ...
3
This won't work, given that Tor Browser ships with a specific default profile which it uses, and needs to use to operate properly, creating and utilising different profiles will cause issues.
Instead, have multiple installations of Tor Browser (each extracted to a distinct folder) which will provide superior isolation between identities and profiles for ...
2
In general you do the following steps:
Check the source code from Tor's git repository or from the download page.
Apply your changes
Compile the code (./configure && make)
You can install the binary (make install) or run it directly from the directory (src/or/tor)
As long as you do the changes you mentioned there is no need to exclude you from the ...
2
Perhaps this would help:
How to use Arm with Tor Browser Bundle
2
This bug has been confirmed. Some workarounds have been communicated, but no final solution / bugfix.
See launchpad: Bug #680192 “Vidalia was unable to start Tor. Check your setting...” and try to disable the usr.bin.vidalia AppArmor profile.
Hope this helps!
2
You can 'torify' your ubuntu machine, and route all traffic through tor,
see the wiki here for guides for that:
https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy
Or you can set up a 'Whonix' gateway, and put your windows virtual machine behind that.
There is a guide for that here:
https://www.whonix.org/wiki/Other_Operating_Systems#...
Only top voted, non community-wiki answers of a minimum length are eligible