Actions

Difference between revisions of "Tor"

From Whonix

[checked revision][checked revision]
(capitalization)
 
(175 intermediate revisions by 3 users not shown)
Line 4: Line 4:
 
|image=https://www.whonix.org/w/images/3/32/Menger-702837640.jpg
 
|image=https://www.whonix.org/w/images/3/32/Menger-702837640.jpg
 
}}
 
}}
  +
[[File:Iconfinder_tor_386502.svg|Tor Icon|200px|thumb]]
  +
= Configuration =
  +
== Introduction ==
  +
<u>Essential Tor Configuration</u>:
   
  +
For enabling Tor, disabling Tor and using [[Bridges]] the user can use [[Anon Connection Wizard]]. <ref>
= Version Number =
 
  +
[[Anon Connection Wizard]] stores its configuration file file <code>/usr/local/etc/torrc.d/40_tor_control_panel.conf</code>.
To find out what Tor version you are running, run the following command inside Whonix-Gateway.
 
  +
</ref>
  +
  +
<u>Advanced Tor Configuration</u>:
   
  +
Tor configuration can also be modified by editing the Tor configuration file(s).
{{CodeSelect|code=
 
  +
anon-info
 
  +
{{mbox
  +
| type = notice
  +
| image = [[File:Ambox_notice.png|40px|alt=Info]]
  +
| text = It is recommended for simplicity for most users that <u>all</u> unique user Tor configurations should be stored in Tor configuration file <code>/usr/local/etc/torrc.d/50_user.conf</code> and nowhere else. <ref>
  +
<code>/usr/local/etc/torrc.d/40_tor_control_panel.conf</code> is auto generated. It can be examined but changes should only be made to <code>/usr/local/etc/torrc.d/50_user.conf</code>.
  +
</ref> Note that Whonix will <u>not</u> modify <code>/usr/local/etc/torrc.d/50_user.conf</code> once it is created, therefore the user is responsible for adding or removing specific configurations in this file.
 
}}
 
}}
   
  +
[[Configuration_Files#Configuration_Drop-In_Folders|Configuration Drop-In Folders]] <code>/etc/torrc.d/</code> and <code>/usr/local/etc/torrc.d/</code> are a {{Project name}} specific feature. ([[Dev/Tor#Tor_Config_Files|technical details]]) Advanced users and packages specifically supporting {{Project name}} are free to use these folders, however other distributions such as Debian do not support it at time of writing. <ref>
Should show something like this.
 
  +
Debian feature request: [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=866187 add torrc.d configuration directory]
  +
</ref>
   
  +
== Edit Tor Configuration ==
<pre>
 
  +
{{Open /usr/local/etc/torrc.d/50 user.conf}}
0.2.8.6-1~d80.jessie+1
 
</pre>
 
   
  +
== Configuration Check ==
= Permissions on directory /var/run/tor are too permissive Error =
 
  +
To discover if there are any Tor configuration syntax errors and to see which Tor configuration files are processed in which order, run the following command inside {{gateway_product_name}} ([[{{q project name short}}|{{q project name}}]]: <code>sys-whonix</code>).
To find out if you are affected by the {{Code2|Permissions on directory /var/run/tor are too permissive Error}}<ref>
 
https://trac.torproject.org/projects/tor/ticket/19824
 
</ref>, run the following command inside Whonix-Gateway. (In Qubes, in sys-whonix.)
 
   
  +
{{CodeSelect|code=
<pre>
 
  +
anon-verify
sudo cat /var/run/tor/log | grep -i permissive
 
  +
}}
</pre>
 
   
If you are affected, it would show something like the following.
+
The output should be similar to the following.
   
 
<pre>
 
<pre>
  +
/===================================================================\
Aug 03 17:36:33.000 [warn] Permissions on directory /var/run/tor are too permissive.
 
  +
| Report Summary |
  +
\===================================================================/
  +
No error detected in your Tor configuration.
  +
Tor verify exit code: 0
  +
/===================================================================\
  +
| Tor Full Report |
  +
\===================================================================/
  +
Aug 09 19:29:56.669 [notice] Tor 0.3.3.9 (git-ca1a436fa8e53a32) running on Linux with Libevent 2.0.21-stable, OpenSSL 1.1.0f, Zlib 1.2.8, Liblzma 5.2.2, and Libzstd 1.1.2.
  +
Aug 09 19:29:56.669 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
  +
Aug 09 19:29:56.669 [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc".
  +
Aug 09 19:29:56.669 [notice] Read configuration file "/etc/tor/torrc".
  +
Aug 09 19:29:56.672 [notice] You configured a non-loopback address '10.137.8.1:5300' for DNSPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted.
  +
Aug 09 19:29:56.672 [notice] You configured a non-loopback address '10.137.8.1:9040' for TransPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted.
  +
Configuration was valid
  +
/===================================================================\
  +
| Used Tor Configuration Files |
  +
\===================================================================/
  +
5 files are used as Tor configuration files:
  +
/usr/share/tor/tor-service-defaults-torrc /etc/tor/torrc /etc/torrc.d/95_whonix.conf /usr/local/etc/torrc.d/40_tor_control_panel.conf /usr/local/etc/torrc.d/50_user.conf
  +
=====================================================================
 
</pre>
 
</pre>
 
The only workaround (needs to be manually re-done after every reboot) for now.
 
 
{{CodeSelect|code=
 
sudo chmod --recursive 700 /var/run/tor
 
}}
 
   
 
= Log Analysis =
 
= Log Analysis =
 
== Introduction ==
 
== Introduction ==
Analysis of Tor's log can be useful in case of connectivity issues.
+
Analysis of Tor's (and [[vanguards|vanguards]]'s) log can be useful if connectivity issues emerge.
   
  +
Regarding log messages from vanguards, see also [[vanguards#Log_Analysis|vanguards, Log Analysis]].
== Open Tor Log ==
 
* /var/log/tor/log - persistent Tor log
 
* /var/run/tor/log - Tor log since last boot
 
 
{{open with root rights|filename=
 
/var/run/tor/log
 
}}
 
   
  +
== Dump Tor Log ==
 
<ref>
 
<ref>
  +
* <code>-b</code>: shortcut for <code>journalctl</code> <code>--boot</code> which shows only log entries from current boot. Not from previous boots.
{{Code2|/var/run/tor/log}} is a Whonix Tor configuration specific file. An alternative to {{Code2|/var/log/tor/log}}. The former only contains Tor's output since last boot of Whonix-Gateway. The latter is a permanent log that persists across reboots. The former has a small usability advantage. It is shorter. Should therefore contain more relevant information.
 
  +
* <code>--output cat</code>: Prevention of duplicate timestamp per log line. Prevent <code>journalctl</code> from adding a timestamp to the log output since this is unnecessary since Tor already adds its own timestamp to the log.
  +
* <code>--no-pager</code>: Dump log to stdout. No scrolling.
  +
* <code>tor</code>: multi-instance-master
  +
* <code>tor@default</code>: actual Tor process
  +
* <code>vanguards</code>: add-on, see [[vanguards|vanguards]]
 
</ref>
 
</ref>
  +
  +
{{CodeSelect|code=
  +
sudo journalctl -b --output cat --no-pager -u tor -u tor@default -u vanguards
  +
}}
   
 
== Watch Tor Log ==
 
== Watch Tor Log ==
You can also watch Tor's log as it's being written.
+
Users can also watch Tor's log as it is written.
   
 
{{CodeSelect|code=
 
{{CodeSelect|code=
  +
sudo journalctl -f -b --output cat --no-pager -u tor -u tor@default -u vanguards
sudo tail -f /var/run/tor/log
 
 
}}
 
}}
   
This is especially useful in combination with another terminal tab and [[#Reload Tor|reloading Tor]].
+
This command is especially useful when Tor is reloaded or restarted simultaneously in another terminal window.
  +
  +
To [[#Reload Tor|reload Tor]], run the following command.
   
 
{{CodeSelect|code=
 
{{CodeSelect|code=
Line 68: Line 100:
 
}}
 
}}
   
Or [[#Restart Tor|restarting Tor]].
+
To [[#Restart Tor|restart Tor]], run the following command.
   
 
{{CodeSelect|code=
 
{{CodeSelect|code=
Line 74: Line 106:
 
}}
 
}}
   
== Non-Issues ==
+
== anon-log ==
  +
Advanced users only. [https://gitlab.com/whonix/anon-gw-anonymizer-config/-/blob/master/usr/bin/anon-log <code>/usr/bin/anon-log</code>]. Only available in git master for now. Manual installation only for now. In next version of {{project name}}, <code>anon-log</code> will be installed and easily available for everyone.
{| class="wikitable" style="background-color: #fff;text-align: center"
 
   
  +
<code>anon-log</code> simplifies the manual [[#Dump Tor Log|dump Tor log]] command by only showing relevant log entries and no [[#Non-Issues|non-issues]].
! message / question
 
  +
! answer
 
  +
{{CodeSelect|code=
  +
anon-log
  +
}}
  +
  +
The output should be similar to the following.
  +
  +
<pre>
  +
tor.service:
  +
  +
Starting Anonymizing overlay network for TCP (multi-instance-master)...
  +
Started Anonymizing overlay network for TCP (multi-instance-master).
  +
  +
/run/tor/log:
  +
  +
Jan 20 11:50:47.733 [notice] Tor 0.4.4.6 running on Linux with Libevent 2.1.8-stable, OpenSSL 1.1.1d, Zlib 1.2.11, Liblzma 5.2.4, and Libzstd 1.3.8.
  +
Jan 20 11:50:47.733 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
  +
Jan 20 11:50:47.000 [notice] Bootstrapped 0% (starting): Starting
  +
Jan 20 11:50:48.000 [notice] Starting with guard context "default"
  +
Jan 20 11:50:48.000 [notice] Signaled readiness to systemd
  +
Jan 20 11:50:48.000 [notice] Received reload signal (hup). Reloading config and resetting internal state.
  +
Jan 20 11:50:48.000 [notice] Bootstrapped 5% (conn): Connecting to a relay
  +
Jan 20 11:50:48.000 [notice] Bootstrapped 10% (conn_done): Connected to a relay
  +
Jan 20 11:50:49.000 [notice] Bootstrapped 14% (handshake): Handshaking with a relay
  +
Jan 20 11:50:49.000 [notice] Bootstrapped 15% (handshake_done): Handshake with a relay done
  +
Jan 20 11:50:49.000 [notice] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits
  +
Jan 20 11:50:49.000 [notice] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits
  +
Jan 20 11:50:49.000 [notice] Bootstrapped 95% (circuit_create): Establishing a Tor circuit
  +
Jan 20 11:50:54.000 [notice] Bootstrapped 100% (done): Done
  +
  +
vanguards.service:
  +
  +
WARNING[Wed Jan 20 11:50:48 2021]: Tor daemon connection closed. Trying again...
  +
NOTICE[Wed Jan 20 11:50:49 2021]: Vanguards 0.3.1 connected to Tor 0.4.4.6 using stem 1.7.1
  +
</pre>
  +
  +
= Permissions Fix =
  +
If error messages like the following appear.
  +
  +
<pre>
  +
Oct 24 07:22:15.693 [warn] Directory /var/lib/tor/.tor cannot be read: Permission denied
  +
</pre>
  +
  +
<pre>
  +
Oct 25 12:35:07.460 [warn] Directory /var/lib/tor cannot be read: Permission denied
  +
</pre>
  +
  +
<pre>
  +
Oct 25 12:35:07.460 [warn] Failed to parse/validate config: Couldn't access private data directory "/var/lib/tor"
  +
</pre>
  +
  +
Then apply the following steps.
  +
{{Box|text=
  +
'''1.''' {{Open_a _product_gw_terminal}}
  +
  +
'''2.''' Apply a permissions fix for the Tor data folder.
  +
  +
{{CodeSelect|code=
  +
sudo chown --recursive debian-tor:debian-tor /var/lib/tor
  +
}}
  +
  +
'''3.''' {{Restart_Tor}}
  +
  +
Error messages should no longer appear after completing these steps. <ref>[https://phabricator.whonix.org/T855 whonixcheck check /var/lib/tor folder permission]</ref>
  +
}}
  +
  +
= Non-Issues =
  +
  +
{| class="wikitable" style="background-color: #fff;text-align: left"
  +
  +
! '''Message / Question'''
  +
! '''Answer'''
   
 
|-
 
|-
 
| <u>{{Code2|Am I compromised? Does Tor's log report leaks?}}
 
| <u>{{Code2|Am I compromised? Does Tor's log report leaks?}}
| Tor's output is conceptually not a tool to find out about serious issues such as compromise or leaks.</u>
+
| Tor's output is an ineffective tool for discovering serious issues such as a compromise or leaks.</u>
   
 
|-
 
|-
 
| {{Code2|[WARN] Socks version 71 not recognized. (Tor is not an http proxy.)}}
 
| {{Code2|[WARN] Socks version 71 not recognized. (Tor is not an http proxy.)}}
 
|
 
|
This is caused by [[whonixcheck]] (by function {{Code2|check_tor_socks_port_reachability}}). It checks if a Tor SocksPort is reachable by trying to fetch it using curl. <ref>
+
This warning is caused by [[whonixcheck]], specifically the function {{Code2|check_tor_socks_port_reachability}} which checks if a Tor SocksPort is reachable by trying to fetch it using curl. <ref>
 
{{CodeSelect|code=
 
{{CodeSelect|code=
 
{{Curl_Plain}} 10.152.152.10:9100
 
{{Curl_Plain}} 10.152.152.10:9100
 
}}
 
}}
  +
</ref> No warnings appear if the function works correctly.
</ref> It will not report anything if it worked, but would complain if it failed.
 
   
 
|-
 
|-
  +
| {{Code2|[warn] Socks version 71 not recognized. (This port is not an HTTP proxy; did you want to use HTTPTunnelPort?)}}
| {{Code2|[NOTICE] You configured a non-loopback address '10.152.152.10:9179' for SocksPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted. [1 duplicate hidden]}} (Or other port number or DnsPort or TransPort.)
 
  +
| Similar to above.
| This is not of concern. Tor really listens on that IP/port. It is Whonix-Gateway's network interface, that is only available to Whonix-Workstations, because it is an internal network with Whonix-Workstation and because Whonix-Gateway is firewalled (see ''{{WhonixFirewall}}'' or in Whonix source code).
 
   
 
|-
 
|-
  +
| {{Code2|[NOTICE] You configured a non-loopback address '10.152.152.10:9179' for SocksPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted. [1 duplicate hidden]}} This notice may reference other port numbers, or the DnsPort or TransPort.
| {{Code2|[NOTICE] New control connection opened. [2 duplicates hidden]}} (Or more duplicates.)
 
  +
| This notice is not a concern because Tor really listens on that IP/port - it is the internal network interface for {{gateway_product_name}} (<code>sys-whonix</code>) that is only available to {{workstation_product_name}} because {{gateway_product_name}} (<code>sys-whonix</code>) is firewalled. See ''{{W_Firewall}}'' or the {{project_name}} source code for further information.
| This is not of concern. This is caused by [[whonixcheck]]'s Tor Bootstrap Status Test, which uses Tor's ControlPort or [[Dev/CPFP|CPFP]].
 
  +
  +
|-
  +
| {{Code2|[NOTICE] New control connection opened. [2 duplicates hidden]}} A higher number of duplicate messages may also appear.
  +
| This notice is not a concern because it is caused by [[whonixcheck]]'s Tor Bootstrap Status Test, which uses Tor's ControlPort or [[Dev/CPFP|CPFP]].
   
 
|}
 
|}
   
= See Also =
+
= Version Number =
  +
To discover what Tor version is currently in use, run the following command inside {{gateway_product_name}} ([[{{q project name short}}|{{q project name}}]]: <code>sys-whonix</code>).
   
  +
{{CodeSelect|code=
* [[Why_does_Whonix_use_Tor| Why does Whonix use Tor?]]
 
  +
anon-info
* [[Why is Tor slow| Why is Tor slow?]]
 
  +
}}
* [[Bridges| Censorship Circumvention - Tor Bridge Mode, using (private) (obfuscated) bridges]]
 
* [[Hide Tor and Whonix from your ISP| Hide the fact that you are using Tor/Whonix]]
 
* [[Tor Controller| Controlling Tor]]
 
* [[Onion Services| Hosting Tor Onion Services, ANY, Hidden Webserver]]
 
* [[Comparison Of Tor Proxies CGI proxies Proxy Chains And VPN Services|Comparison of Tor, Proxies, CGI proxies, Proxy Chains and VPN Services]]
 
   
  +
The output should be similar to the following.
  +
  +
<pre>
  +
INFO: version of the 'tor' package: 0.4.2.7-1~d10.buster+1
  +
</pre>
  +
  +
See also [[Tor_Versioning|Newer Tor Versions]].
   
 
= Advanced Topics =
 
= Advanced Topics =
== Entry Guards ==
 
=== Introduction ===
 
   
  +
== Additional SocksPorts ==
{{Persistent Tor Entry Guards Introduction}}
 
   
  +
Adding additional Tor SocksPorts to ''/usr/local/etc/torrc.d/50_user.conf'' is non-intuitive. <ref>https://trac.torproject.org/projects/tor/ticket/15261</ref>
<ref>
 
As concluded in ticket [https://phabricator.whonix.org/T469 research non-persistent Tor directory guards], these are covered by the following instructions.
 
</ref>
 
   
  +
As noted in the Tor man page (<code>man tor</code>):
=== Manual Rotation of Tor Guards ===
 
  +
  +
<blockquote>
  +
By default, an option on the command line overrides an option found in the configuration file, and an option in a configuration file overrides one in the defaults file. <br />
  +
<br />
  +
This rule is simple for options that take a single value, but it can become complicated for options that are allowed to occur more than once: if you specify four SOCKSPorts in your configuration file, and one more SOCKSPort on the command line, the option on the command line will replace <u>all</u> of the SOCKSPorts in the configuration file. If this is not what you want, prefix the option name with a plus sign, and it will be appended to the previous set of options instead.
  +
</blockquote>
  +
  +
Nick Mathewson from The Tor Project has also noted: <ref>https://trac.torproject.org/projects/tor/ticket/15261#comment:1</ref>
  +
  +
<blockquote>
  +
So to make sure that the SocksPort in the torrc does what you want, write it as <code>+SocksPort</code>.
  +
</blockquote>
  +
  +
After adding custom ports, a user would also have to edit the {{project_name}} firewall unless they were lucky. For example, various custom ports for such use cases have already been added. Those are documented [[Stream_Isolation#How_to_mitigate_identity_correlation|here]].
  +
  +
== Blacklist Certain Onion Services from Connecting ==
   
 
{{mbox
 
{{mbox
  +
| type = notice
| image = [[File:Ambox_warning_pn.svg.png|40px]]
 
  +
| image = [[File:Ambox_notice.png|40px|alt=Info]]
| text = The decision to manually create and utilize a new Whonix-Gateway (sys-whonix) is risky and should not be taken undertaken lightly!
 
  +
| text = This procedure is experimental. Testers only.
 
}}
 
}}
   
  +
{{Open /usr/local/etc/torrc.d/50_user.conf}}
   
  +
The following is an example onion service that is added to {{Code2|/usr/local/etc/torrc.d/50_user.conf}}. Replace {{Code2|bbbbbb6qtmqg65g6.onion}} with the actual onion service that should be blacklisted.
On occasion, users may be tempted to create a new Whonix-Gateway ([[Qubes-Whonix]]: <code>sys-whonix</code>) because:
 
   
  +
{{CodeSelect|code=
* Bootstrapping is slow or regularly fails.
 
  +
MapAddress bbbbbb6qtmqg65g6.onion 127.0.0.1
* Tor logs show warnings suggesting evidence of route manipulation attacks or other oddities.
 
  +
}}
* Logs reveal attempted attacks on Whonix or Tor processes, for example in AppArmor logs.
 
* Current Tor performance is very slow or unreliable due to collapsing circuits or other factors.
 
* The user is concerned about the amount of Tor data that could be revealed if the Whonix-Gateway is infected, particularly after a long period of use.
 
   
  +
{{Reload_Tor}}
   
  +
== Entry Guards ==
Creating a new Whonix-Gateway or sys-whonix will ''likely'' lead to a new set of Tor entry guards, which is [https://blog.torproject.org/improving-tors-anonymity-changing-guard-parameters proven to degrade anonymity]. Voluntary guard rotation via a new Whonix-Gateway is more dangerous than allowing "natural churn" as chosen by the Tor application for several reasons:
 
  +
{{Anchor|Manual Rotation of Tor Guards}}
  +
{{Anchor|Security and Performance Related Issues}}
  +
{{Anchor|Mitigate the Threat of Guard Fingerprinting}}
  +
{{Anchor|Clone {{gateway_product_name}} (sys-whonix) with New Entry Guards}}
  +
{{Anchor|Regenerate the Tor State After Saving the Tor State Folder}}
  +
{{Anchor|Alternating Bridges}}
  +
{{Anchor|Copy Tor State Files to Another sys-whonix Instance}}
  +
{{Anchor|Fresh Tor Entry Guards by Regenerating the Tor State File}}
  +
{{Anchor|Notes}}
   
  +
This entry has been moved [[Tor_Entry_Guards|here]].
* It increases the likelihood of a compromised or malicious Tor guard being selected, leading to a corresponding rise in the chance of a successful [https://securityaffairs.co/wordpress/17489/intelligence/traf%EF%AC%81c-correlation-vs-anonymity-on-tor.html correlation attack] if the adversary runs Tor exit relays in the network. <ref>Even if the adversary cannot enumerate all websites visited by the user, it might reveal sites visited more regularly, such as whonix.org</ref>
 
* The user is more likely to traverse a [http://freehaven.net/anonbib/#feamster:wpes2004 given] [http://freehaven.net/anonbib/#DBLP:conf:ccs:EdmanS09 set] of [http://freehaven.net/anonbib/#ndss13-relay-selection Internet infrastructure links] that are under the adversary's control, such as Autonomous Systems (ASes) or Internet Exchange Points (IXPs).
 
* Every change of Tor guards acts like a fingerprinting mechanism, since other users are less likely to pick the same set. If the adversary is able to enumerate a user's Tor guards, and later observes someone with the same set, the chance is high the two observations stem from the same person. <ref>For example, the [https://trac.torproject.org/projects/tor/ticket/9273#comment:3 entropy associated with one, two or three guards] is 9, 17 and 25 bits, respectively.</ref>
 
   
  +
== Manual Bridge Configuration ==
  +
It is recommended to first read the main [[Bridges]] article.
   
  +
For the majority of users, the [[Anon_Connection_Wizard|Anon Connection Wizard]] GUI application is suitable for bridge configuration. The manual bridge configuration steps below are only recommended for advanced users.
For these reasons the Tor Project has changed its design and reduced the number of primary guard nodes to 3, and increased the set period for guard rotation. <ref>https://trac.torproject.org/projects/tor/ticket/8240</ref> The user should also contemplate the possibility their current poor Tor performance is an attempt by an advanced adversary to cause frustration, leading to a manual change in Tor guards: <ref>https://blog.torproject.org/improving-tors-anonymity-changing-guard-parameters</ref> <ref>For example if the current set of Tor guards is not under their control.</ref>
 
   
  +
=== Step 1: Access Tor Configuration to Add Bridges ===
<blockquote>We should also consider whether an adversary can *induce* congestion or resource exhaustion to cause a target user to switch away from her guard. Such an attack could work very nicely coupled with the guard enumeration attacks discussed above.</blockquote>
 
   
  +
{{Open_/usr/local/etc/torrc.d/50_user.conf}}
In one sense, users should ''welcome'' slow entry guards, since "honeypot" operators on the Tor network are unlikely to have constrained bandwidth which might chase away intended targets. This thinking aligns with intelligence disclosures which deem all Tor users to be persons of interest to state-level adversaries.
 
   
  +
=== Step 2: Edit Tor Configuration ===
{{mbox
 
| image = [[File:Ambox_warning_pn.svg.png|40px]]
 
| text = Users considering using disposable Whonix-Gateway ProxyVMs in Qubes R4 are [[Qubes/DisposableVM#Warning:_Avoid_Ephemeral_Whonix-Gateway_ProxyVMs_in_Qubes_R4|warned]] that this technique poses an even greater anonymity risk than described above; <b>new Tor guards are created during each distinct Whonix session.</b>
 
}}
 
   
  +
==== Use obfs4 Bridges ====
   
  +
<div class="toccolours mw-collapsible mw-collapsed">
Under certain circumstances, users will feel compelled to proceed despite the anonymity risks. In this instance, it may be safer to first try: <ref>This issue requires further research.</ref>
 
  +
<div class="mw-collapsible-content">
  +
{{Box|text=
  +
'''1.''' Open {{Code2|/usr/local/etc/torrc.d/50_user.conf}} in an editor.
   
  +
Copy and paste the following text to enable the use of {{Code2|obfs4}} bridges. <ref>obfs3 bridges have been deprecated.</ref> <ref>
* One of the fallback primary entry guards.
 
  +
{{CodeSelect|code=
* A configured [[Bridges|bridge]].
 
  +
ClientTransportPlugin fte exec /usr/bin/fteproxy --managed
* Possibly [[Tunnels/Introduction|combine tunnels with Tor]].
 
  +
}}
* Creating a fresh Whonix-Gateway (sys-whonix), and copying across the Tor state file.
 
  +
</ref>
   
  +
{{CodeSelect|code=
  +
UseBridges 1
  +
ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy
  +
}}
   
  +
'''2.''' Add the bridge IP addresses that were sourced in the [[Bridges#Finding_a_Bridge_and_Choosing_the_Right_Protocol|Finding a Bridge and Choosing the Right Protocol]] section.
The user can also persist with poor performance and wait for normal guard rotation. <ref>Note that if the problem relates to a dead entry guard(s), Tor is configured to eventually remove them.</ref> Users should note that [[tor#Fresh_Tor_Entry_Guards_by_regenerating_Tor_State_File|regenerating the Tor state file]] poses the same anonymity risks as outlined in this section.
 
   
  +
Copy and paste the IP addresses to the very bottom of {{Code2|/usr/local/etc/torrc.d/50_user.conf}}, <u>after the ClientTransportPlugin entries</u>. Users must ensure that "bridge" appears at the beginning of each line.
=== Alternating Bridges ===
 
If you are using [[bridges|bridges]] already, use different bridges for different locations. Or if you are not a bridge user, you could consider to sometimes use alternate bridges in different locations and entry guards in your main location or so.
 
   
  +
{{mbox
On your Whonix-Gateway.
 
  +
| type = notice
  +
| image = [[File:Ambox_notice.png|40px|alt=Info]]
  +
| text = In the <i>obfs4</i> example below: <br />
  +
* <u>Do not copy and paste this list of bridge entries to the {{Code2|50_user.conf}} file.</u> They will not work.
  +
* Retrieve [https://bridges.torproject.org/bridges?transport=obfs4 obfs4 bridges] from The Tor Project <u>before</u> editing this file.
  +
* <u>Capitalization in the {{Code2|50_user.conf}} file matters.</u> For example, bridges will not connect if users type "Bridge" instead of "bridge".
  +
}}
   
  +
{{Code2|Obfs4}} example text to add to {{Code2|/usr/local/etc/torrc.d/50_user.conf}}.
1. {{Disable_Tor}}
 
   
  +
{{CodeSelect|code=
2. Configure Tor to use bridges. Refer to the [[Bridges|Bridges]] documentation.
 
  +
bridge obfs4 192.235.207.85:42086 0EEB10BF4B4FAF56D46E cert=oue8sYYw5wi4n3mf2WDOg iat-mode=0
  +
bridge obfs4 34.218.26.20:43263 DD21A551767816A0C9495 cert=7qzS6KASquPvJU82Fm7qoJw iat-mode=0
  +
bridge obfs4 161.217.177.95:10703 B3B8009D01BB7E5FDFAEC cert=4RaIqGiOytEXm6Hw iat-mode=0
  +
}}
   
  +
The sample text for a complete {{Code2|obfs4}} torrc file is below. Check your file is similar, except for the specific bridge entries.
3. Enable Tor using whonixsetup / whonix-setup-wizard at your new location.
 
  +
<pre>
  +
# This file is part of Whonix
  +
# Copyright (C) 2012 - 2013 adrelanos
  +
# See the file COPYING for copying conditions.
   
  +
# Use this file for your user customizations.
4. Before you leave this location, disable Tor and add a different bridge address if going to a different place. To go back to your usual guard nodes at home, remove the torrc bridge settings before you enable the network or rollback to a vm snapshot you created there.
 
  +
# Please see /usr/local/etc/torrc.d/50_user.conf.examples for help, options, comments etc.
   
  +
# Anything here will override {{project name}} own Tor config customizations in /usr/share/tor/tor-service-defaults-torrc
=== Fresh Tor Entry Guards by Regenerating the Tor State File ===
 
Usually something to avoid unless you know what you are doing (see [[#Introduction|Introduction]]). This is a method you could use if you just once wanted to change your Tor entry guards, such as before you permanently relocate to a new location.
 
   
  +
# Enable Tor through whonixsetup or manually uncomment "DisableNetwork 0" by
On your Whonix-Gateway.
 
  +
# removing the # in front of it.
  +
DisableNetwork 0
  +
UseBridges 1
  +
ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy
   
  +
bridge obfs4 192.235.207.85:42086 0EEB10BF4B4FAF56D46E cert=oue8sYYw5wi4n3mf2WDOg iat-mode=0
1. {{Disable_Tor}}
 
  +
bridge obfs4 34.218.26.20:43263 DD21A551767816A0C9495 cert=7qzS6KASquPvJU82Fm7qoJw iat-mode=0
  +
bridge obfs4 161.217.177.95:10703 B3B8009D01BB7E5FDFAEC cert=4RaIqGiOytEXm6Hw iat-mode=0
  +
</pre>
   
  +
<ref>
2. Delete Tor's state file.
 
  +
{{Code2|fte}} example text to add to {{Code2|/usr/local/etc/torrc.d/50_user.conf}}.
   
  +
fte is supported in {{project_name}} 15, but further testing is required; see: https://phabricator.whonix.org/T520
 
{{CodeSelect|code=
 
{{CodeSelect|code=
  +
ClientTransportPlugin fte exec /usr/bin/fteproxy --managed
sudo rm /var/lib/tor/state
 
  +
bridge fte 10.200.100.60:95128 4352e58420e68f5e40bf7c74faddccd9d1349413
  +
bridge fte 300.100.300.80:23521 4352e58420e68f5e40bf7c74faddccd9d1349413
 
}}
 
}}
  +
</ref>
   
  +
'''3.''' After {{Code2|/usr/local/etc/torrc.d/50_user.conf}} editing is finished, save and exit.
3. Enable Tor using whonixsetup / whonix-setup-wizard at your new location.
 
   
  +
<pre>
=== Always Non-Persistent Entry Guards ===
 
  +
<Ctrl-X> --> press Y --> <Enter>
You could consider to always use non-persistent entry guards. In most cases, this is something to avoid because persistent entry guards is a security feature as explained in the [[#Introduction|introduction]]. A much more secure, but more time expensive approach would be [[#Alternating Bridges|Alternating Bridges]].
 
  +
</pre>
  +
}}
  +
</div>
  +
</div>
   
  +
==== Use meek_lite Bridges ====
<div class="toccolours mw-collapsible mw-collapsed" style="width:800px">
 
  +
If you would like to see more information anyway, please press on expand on the right.
 
  +
<div class="toccolours mw-collapsible mw-collapsed">
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
On your Whonix-Gateway.
 
   
  +
{{Code2|meek_lite}} bridges are available. To use them, simply add one more line to the {{Code2|/usr/local/etc/torrc.d/50_user.conf}} file. Take note the bridge type is called {{Code2|meek_lite}}, not {{Code2|meek}} which is used in Tor Browser Bundle. <ref>{{Code2|meek_lite}} actually uses a different implementation of {{Code2|obfs4proxy}}. Forum discussion: https://forums.whonix.org/t/censorship-circumvention-tor-pluggable-transports/2601/3</ref>
1. Adjust whonixcheck settings (applies until Whonix 12):
 
  +
{{Box|text=
  +
'''1.''' Open {{Code2|/usr/local/etc/torrc.d/50_user.conf}} in an editor.
   
  +
Copy and paste the following text to enable {{Code2|meek_lite}} bridges.
{{Open with root rights|filename=
 
  +
/etc/whonix.d/50_user.conf
 
  +
{{CodeSelect|code=
  +
UseBridges 1
  +
ClientTransportPlugin meek_lite exec /usr/bin/obfs4proxy
 
}}
 
}}
   
  +
'''2.''' Add a {{Code2|meek_lite}} bridge to the configuration file.
Add.
 
  +
  +
An example of {{Code2|meek_lite}} text that must be added to the {{Code2|/usr/local/etc/torrc.d/50_user.conf}} file is below. The bridge in this example is functional, so a search for other {{Code2|meek_lite}} bridges is unnecessary.
   
 
{{CodeSelect|code=
 
{{CodeSelect|code=
  +
bridge meek_lite 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2cly7j4zqgua7.cloudfront.net/ front=a0.awsstatic.com
whonixcheck_skip_functions+=" check_tor_pid "
 
 
}}
 
}}
   
  +
'''3.''' After {{Code2|/usr/local/etc/torrc.d/50_user.conf}} editing is finished, save and exit.
Save.
 
   
  +
<pre>
2. {{Disable_Tor}}
 
  +
<Ctrl-X> --> press Y --> <Enter>
  +
</pre>
  +
}}
  +
</div>
  +
</div>
   
3. Modify Tor settings.
+
=== Step 3: Enable Tor ===
   
  +
Follow this procedure if it has not been previously completed.
{{Open /etc/tor/torrc}}
 
   
  +
{{Enable_Tor}}
Add.
 
   
  +
=== Step 4: Have {{Code2|/usr/local/etc/torrc.d/50_user.conf}} Changes Take Effect ===
{{CodeSelect|code=
 
DataDirectory /var/run/tor
 
}}
 
   
  +
{{Reload_Tor}}
Save.
 
   
  +
== Tor Functions ==
4. Enable Tor using whonixsetup / whonix-setup-wizard at your new location.
 
   
  +
=== Disable Tor ===
5. Before you leave this location, disable Tor and repeat the above steps if going to a different place. To go back to your usual guard nodes at home, remove the torrc setting before you enable the network or rollback to a vm snapshot you created there.
 
  +
{{Disable Tor}}
</div>
 
</div>
 
   
=== Notes ===
+
=== Reload Tor ===
  +
{{Reload_Tor}}
   
  +
=== Restart Tor ===
* The proposed Tails solutions towards AdvGoalTracking have disadvantages<ref>https://tails.boum.org/blueprint/persistent_Tor_state/</ref><ref>https://blog.torproject.org/blog/tor-weekly-news-%E2%80%94-june-17th-2015#A_persistent_Tor_state_for_Tails</ref> and are not options for Whonix because we don't connect directly to a user's internet LAN anyway, so trying to remember a network based on its SSID will not work. Unlike wireless access points, wired networks (physical or virtual) lack SSIDs and cannot be "remembered" that way.
 
  +
{{Restart_Tor}}
   
  +
== vanguards ==
* Even if it were possible, it is best to avoid letting adversaries influence guard changes in any way. Spoofing MAC addresses or SSIDs would trigger use of the other entry guard recorded for another "location profile". Also global networks have generic characteristics that cannot be differentiated from the point of view of a connecting device leading to the same guards being used on different networks.
 
  +
See [[Vanguards]].
   
  +
== UDP ==
* Developers/Auditors-only: Development discussion related to this documentation chapter: [https://phabricator.whonix.org/T94 research non-persistent entry guards]
 
  +
{{Tor_UDP}}
   
  +
== ICMP ==
== Blacklist Certain Onion Services from Connecting ==
 
  +
Same as above.
'''Experimental'''
 
   
  +
= FAQ =
{{Open /etc/tor/torrc}}
 
   
  +
== {{project name}} is Preventing Tor from Bootstrapping! ==
Example. Add to {{Code2|/etc/tor/torrc}}. Replace {{Code2|bbbbbb6qtmqg65g6.onion}} with the actual onion service you want to blacklist.
 
   
  +
Refer to the related [[Why_is_Tor_slow#Whonix_.E2.84.A2_has_Slowed_Tor_Connections_Dramatically.21|{{project name}} has Slowed Tor Connections Dramatically!]] wiki entry. Bootstrapping problems can relate to nation state or ISP censorship of Tor, or relate to the Tor guard in operation. In the latter case, temporarily changing the Tor guard might resolve the issue.
{{CodeSelect|code=
 
  +
MapAddress bbbbbb6qtmqg65g6.onion 127.0.0.1
 
  +
If that is ineffective, users can also:
  +
  +
* Confirm [[System_Requirements|minimum system requirements]] have been met for {{project_name}}.
  +
* Confirm the accuracy of the VM clock with [[Sdwdate|sdwdate]].
  +
* Remove any changes that were made to the {{gateway_product_name}} (<code>sys-whonix</code>) torrc configuration, such as [[Bridges|bridges]], pluggable transports, [[{{gateway product name short}}_Security|seccomp, connection padding]] and so on.
  +
* Test Tor functionality on the host.
  +
* In [[Qubes|{{q_project_name}}]], [[Install_Tor_Browser_Outside_of_Whonix#Moderate:_{{q_project_name}}|test Tor functionality in a non-{{project_name}} AppVM]].
  +
* Increase the amount of RAM available to {{gateway_product_name}} (<code>sys-whonix</code>).
  +
* Follow other [[Troubleshooting]] advice.
  +
  +
== Can I Speed Up Tor or the {{gateway_product_name}}? ==
  +
  +
''Is there a way to configure the number of nodes in a circuit and to allow selection according to their speeds?''
  +
  +
{{mbox
  +
| type = notice
  +
| image = [[File:Ambox_notice.png|40px|alt=Info]]
  +
| text = '''Reminder:''' [[Free Support Principle|{{project_name}} Reliance on Debian (and Tor)]] - ''"{{project_name}} is not a stripped down version of Debian; anything possible in "vanilla" Debian GNU/Linux can be replicated in {{project_name}}."'' Tor configurations are not limited by using {{project_name}}.
 
}}
 
}}
   
  +
Those who already know how to configure Tor in this way on the command line in vanilla Debian can follow the same procedure in {{gateway_product_name}}. This is not an endorsement for making these manual Tor changes because it is not recommended by Tor developers and thus the {{project name}} team. <ref>Deferring to their expertise on the possible adverse anonymity effects.</ref> This is also the reason there are no instructions in the {{project name}} documentation to manipulate Tor nodes in this way.
{{Reload_Tor}}
 
   
  +
That said, if general instructions were found describing how to achieve this on the host, then the same procedure could simply be repeated in {{gateway_product_name}}.
== Additional SocksPorts ==
 
Adding additional Tor SocksPorts to /etc/tor/torrc is kinda non-intuitive. <ref>https://trac.torproject.org/projects/tor/ticket/15261</ref>
 
   
  +
== Does {{project name}} Modify Tor? ==
Quote Tor man page.
 
<blockquote>
 
By default, an option on the command line overrides an option found in the configuration file, and an option in a configuration file overrides one in the defaults file.
 
</blockquote>
 
   
  +
{{mbox
<blockquote>
 
  +
| type = notice
This rule is simple for options that take a single value, but it can become complicated for options that are allowed to occur more than once: if you specify four SOCKSPorts in your configuration file, and one more SOCKSPort on the command line, the option on the command line will replace __all__ of the SOCKSPorts in the configuration file. If this is not what you want, prefix the option name with a plus sign, and it will be appended to the previous set of options instead.
 
  +
| image = [[File:Ambox_notice.png|40px|alt=Info]]
</blockquote>
 
  +
| text = [https://support.torproject.org/about/what-is-tor/ Tor] is an anonymizer developed by The Tor Project. [[Tor Browser]] is a web browser [https://www.torproject.org/ developed by the Tor Project] which is optimized for privacy. Please do not confuse {{Code2|Tor}} with {{Code2|Tor Browser}} when conversing about {{project_name}} topics.
  +
  +
For differences of Tor Browser by Tor Project compared to Tor Browser in {{project_name}} see [[Tor_Browser#Whonix_.E2.84.A2_Tor_Browser_Differences|Whonix ™ Tor Browser Differences]].
  +
}}
  +
  +
{{mbox
  +
| type = notice
  +
| image = [[File:Ambox_notice.png|40px|alt=Info]]
  +
| text = {{project name}} does <u>not </u> modify the Tor package itself.
  +
}}
  +
  +
Although {{project name}} does not modify Tor, the Tor configuration file ''has'' been adapted for {{project_name}}. To inspect the relevant files, check the following on {{gateway_product_name}}: <ref>Changes to the configuration file are made by the [https://github.com/{{project_name_short}}/anon-gw-anonymizer-config anon-gw-anonymizer-config] package.</ref>
  +
  +
* <code>/etc/tor/torrc</code> file.
  +
* <code>/etc/torrc.d</code> folder.
  +
* <code>/usr/local/etc/torrc.d/</code> folder.
  +
* <code>/usr/share/tor/tor-service-defaults-torrc</code> file.
  +
  +
Tor is not patched and the normal Tor deb package is used in {{project name}} [[Dev/Tor#Tor_Version|from deb.torproject.org]].
  +
  +
Any changes to the Tor routing algorithm should be proposed, discussed and eventually implemented upstream in Tor on torproject.org. <ref>This means changes occur for all Tor users and not a subset relying on a particular distribution.</ref> If proposed changes are not adopted by The Tor Project, then the option to create a Tor fork <ref name=fork>https://en.wikipedia.org/wiki/Fork_(software_development)</ref> is available. Tor has already been forked at least once.
  +
  +
A general {{project name}} design principle is to keep the Tor process as uniform as possible, in order to simplify any security audits. Diverging from this practice would introduce unnecessary complexity, possibly worsen fingerprinting or degrade anonymity, and limit {{project name}} discussions to the security impacts of the modified routing algorithm. For these reasons, the {{project name}} team is strongly disinclined to make any direct changes to the Tor package.
  +
  +
== Can {{project name}} Improve Tor? ==
  +
  +
As outlined in the [[#Does {{project name}} modify Tor?|previous section]], {{project name}} will not implement any changes to Tor directly and any suggested improvements or bug fixes are proposed upstream on torproject.org. This has already [[Dev/Threat Model#Design Document, innovations and research|happened]] on occasion. Creating {{project name}} is a difficult and time consuming endeavor, so Tor improvements are better left to dedicated, skilled developers who are more knowledgeable in this area.
  +
  +
Skilled coders can always provide upstream patches to Tor, or as a last resort, fork <ref name=fork /> it. Hypothetically, if a fork <ref name=fork /> developed a greater following than the original project due to proven security / anonymity benefits, then {{project name}} would seriously consider making a switch.
  +
  +
== Tor Routing Algorithm ==
  +
Quote Tor Project FAQ [https://2019.www.torproject.org/docs/faq.html.en#ChooseEntryExit Can I control which nodes (or country) are used for entry/exit?] (bold and underline added)
   
Quote Nick Mathewson <ref>https://trac.torproject.org/projects/tor/ticket/15261#comment:1</ref>:
 
 
<blockquote>
 
<blockquote>
  +
Yes. You can set preferred entry and exit nodes as well as inform Tor which nodes you do not want to use. The following options can be added to your config file torrc or specified on the command line:
So to make sure that the SocksPort in the torrc does what you want, write it as <code>+SocksPort</code>.
 
  +
  +
[...]
  +
  +
'''We recommend you do <u>not</u> use these''' — they are intended for testing and may disappear in future versions. '''You get the best security that Tor can provide when you leave the route selection to Tor'''; overriding the entry / exit nodes can mess up your anonymity in ways we don't understand.
 
</blockquote>
 
</blockquote>
   
  +
To make changes to the Tor routing algorithm which benefit anonymity and not actually worsen anonymity it is required to be more clever than the Tor developers. Many questions, suggestions and discussions online only scratch the surface and are unaware of the informational resources:
After adding custom ports, you would also have to edit Whonix's firewall. But you are lucky, you don't need to do that. Various custom ports for such use cases have already been added.
 
   
  +
* [https://www.freehaven.net/anonbib/ Anonymity Bibliography - Collection Anonymity Research]
Those are documented here:<br />
 
  +
* Read the [https://blog.torproject.org Tor blog] as there are often blog posts discussing anonymity research such as blog post [https://blog.torproject.org/new-low-cost-traffic-analysis-attacks-mitigations new low cost traffic analysis attacks and mitigations].
[[Stream_Isolation#How_to_mitigate_identity_correlation]]
 
   
  +
The following resources describe the organizational structure of the {{Project name}} project in relation to The Tor Project, Debian and other upstream sources.
= UDP =
 
{{Tor_UDP}}
 
   
  +
* [[Dev/Relationship_With_Upstream|{{Project name}} Relationship With Upstream]]
= Reload Tor =
 
  +
* [[Why_does_{{project_name_short}}_use_Tor|Why does {{project_name}} use Tor?]]
{{Reload_Tor}}
 
  +
* [[Trust|Placing Trust in {{project_name}}]]
  +
* [[Free Support Principle]]
  +
* [[Linux User Experience versus Commercial Operating Systems]]
   
  +
See also:
= Restart Tor =
 
{{Restart_Tor}}
 
   
  +
* [[#Does Whonix ™ Modify Tor?|Does Whonix ™ Modify Tor?]]
= Disable Tor =
 
  +
* [[#Can Whonix ™ Improve Tor?|Can Whonix ™ Improve Tor?]]
{{Disable_Tor}}
 
  +
  +
== How do I Change Other Tor Settings? ==
  +
  +
Questions are often raised in forums about how other Tor-specific changes can be made in {{project_name}}, such as excluding specific exit nodes. <ref>
  +
http://forums.whonix.org/t/how-to-set-an-exit-node-in-wonix-of-qubesos/9070
  +
</ref>
  +
  +
In many cases, making such changes is already documented {{project_name}} [[Documentation]]. In other cases such changes are discouraged.
  +
  +
In all instances:
  +
  +
# Changes must be made to the Tor configuration file as per [[#Edit Tor Configuration|Edit Tor Configuration]].
  +
# Refer to the [https://2019.www.torproject.org/docs/tor-manual.html.en Tor Project Manual] for specific configuration details.
  +
  +
For example, to exclude exit nodes from the Five Eyes countries the Tor configuration would include the following lines:
  +
  +
[[#Tor Routing Algorithm|Discouraged!]]
  +
  +
<pre>
  +
ExcludeExitNodes {us},{au},{ca},{nz},{gb}
  +
StrictNodes 1
  +
</pre>
  +
  +
A [[#Configuration Check|Configuration Check]] should be run afterwards inside {{gateway_product_name}} ([[{{q project name short}}|{{q project name}}]]: <code>sys-whonix</code>) to confirm there are no Tor configuration syntax errors. As these configurations are specific to Tor (and not {{project_name}}), the [[Free_Support_Principle|Free Support Principle]] applies.
  +
  +
== How do I Install the Latest Tor Version? ==
  +
  +
Follow the instructions [[Tor_Versioning|here]] to install later Tor versions from either:
  +
  +
* the {{project_name}} repository; or
  +
* Tor Project APT repositories; or
  +
* Tor Project source code.
  +
  +
= Troubleshooting =
  +
The following helper tools and documentation chapters might be of assistance.
  +
  +
* <code>anon-info</code> &rarr; [[#Version Number|Show Tor Version Number]]
  +
* <code>anon-verify</code> &rarr; [[#Configuration Check|Tor Configuration Check]]
  +
* <code>anon-log</code> (coming soon) &rarr; [[#anon-log|Tor Log Analysis]]
  +
  +
See also:
  +
  +
* [[Network Obstacle]]
  +
* [[Bridges|Censorship Circumvention - Configure (Private) (Obfuscated) Tor Bridges]]
  +
  +
= Further Reading =
  +
<div style="column-count:2;-moz-column-count:2;-webkit-column-count:2">
  +
* [[Why_does_{{project_name_short}}_use_Tor|Why does {{project_name}} use Tor?]]
  +
* [[Why is Tor slow|Why is Tor slow?]]
  +
* [[Bridges|Censorship Circumvention - Configure (Private) (Obfuscated) Tor Bridges]]
  +
* [[Anon_Connection_Wizard|Anon Connection Wizard]]
  +
* [[Network Obstacle]]
  +
* [[Hide_Tor_and_{{project_name_short}}_from_your_ISP|Hide Tor and {{project name}} use from the ISP]]
  +
* [[Tor Controller|Control and Monitor Tor]]
  +
* [[Onion Services|Hosting Tor Onion Services (<u>any</u> Hidden Webserver)]]
  +
* [[Comparison Of Tor Proxies CGI proxies Proxy Chains And VPN Services|Comparison of Tor with CGI Proxies, Proxy Chains and VPN Services]]
  +
* [[Tor_Versioning|Newer Tor Versions]]
  +
</div>
   
 
= Footnotes / References =
 
= Footnotes / References =
  +
{{reflist|close=1}}
<references />
 
   
 
{{Footer}}
 
{{Footer}}

Latest revision as of 13:00, 20 January 2021


Tor Icon

Configuration[edit]

Introduction[edit]

Essential Tor Configuration:

For enabling Tor, disabling Tor and using Bridges the user can use Anon Connection Wizard. [1]

Advanced Tor Configuration:

Tor configuration can also be modified by editing the Tor configuration file(s).

Info It is recommended for simplicity for most users that all unique user Tor configurations should be stored in Tor configuration file /usr/local/etc/torrc.d/50_user.conf and nowhere else. [2] Note that Whonix will not modify /usr/local/etc/torrc.d/50_user.conf once it is created, therefore the user is responsible for adding or removing specific configurations in this file.

Configuration Drop-In Folders /etc/torrc.d/ and /usr/local/etc/torrc.d/ are a Whonix ™ specific feature. (technical details) Advanced users and packages specifically supporting Whonix ™ are free to use these folders, however other distributions such as Debian do not support it at time of writing. [3]

Edit Tor Configuration[edit]

Open /usr/local/etc/torrc.d/50_user.conf.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q")Whonix-Gateway ™ ProxyVM (commonly named sys-whonix)Tor User Config (Torrc)

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start MenuApplicationsSettings/usr/local/etc/torrc.d/50_user.conf

If you are using a terminal-only Whonix-Gateway ™, complete the following steps.

sudo nano /usr/local/etc/torrc.d/50_user.conf

Configuration Check[edit]

To discover if there are any Tor configuration syntax errors and to see which Tor configuration files are processed in which order, run the following command inside Whonix-Gateway ™ (Qubes-Whonix ™: sys-whonix).

anon-verify

The output should be similar to the following.

/===================================================================\
|                      Report Summary                               |
\===================================================================/
No error detected in your Tor configuration.
Tor verify exit code: 0
/===================================================================\
|                      Tor Full Report                              |
\===================================================================/
Aug 09 19:29:56.669 [notice] Tor 0.3.3.9 (git-ca1a436fa8e53a32) running on Linux with Libevent 2.0.21-stable, OpenSSL 1.1.0f, Zlib 1.2.8, Liblzma 5.2.2, and Libzstd 1.1.2.
Aug 09 19:29:56.669 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Aug 09 19:29:56.669 [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc".
Aug 09 19:29:56.669 [notice] Read configuration file "/etc/tor/torrc".
Aug 09 19:29:56.672 [notice] You configured a non-loopback address '10.137.8.1:5300' for DNSPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted.
Aug 09 19:29:56.672 [notice] You configured a non-loopback address '10.137.8.1:9040' for TransPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted.
Configuration was valid
/===================================================================\
|                 Used Tor Configuration Files                      |
\===================================================================/
5 files are used as Tor configuration files: 
/usr/share/tor/tor-service-defaults-torrc /etc/tor/torrc /etc/torrc.d/95_whonix.conf /usr/local/etc/torrc.d/40_tor_control_panel.conf /usr/local/etc/torrc.d/50_user.conf
=====================================================================

Log Analysis[edit]

Introduction[edit]

Analysis of Tor's (and vanguards's) log can be useful if connectivity issues emerge.

Regarding log messages from vanguards, see also vanguards, Log Analysis.

Dump Tor Log[edit]

[4]

sudo journalctl -b --output cat --no-pager -u tor -u tor@default -u vanguards

Watch Tor Log[edit]

Users can also watch Tor's log as it is written.

sudo journalctl -f -b --output cat --no-pager -u tor -u tor@default -u vanguards

This command is especially useful when Tor is reloaded or restarted simultaneously in another terminal window.

To reload Tor, run the following command.

sudo service tor@default reload

To restart Tor, run the following command.

sudo service tor@default restart

anon-log[edit]

Advanced users only. /usr/bin/anon-log [archive]. Only available in git master for now. Manual installation only for now. In next version of Whonix ™, anon-log will be installed and easily available for everyone.

anon-log simplifies the manual dump Tor log command by only showing relevant log entries and no non-issues.

anon-log

The output should be similar to the following.

tor.service:

Starting Anonymizing overlay network for TCP (multi-instance-master)...
Started Anonymizing overlay network for TCP (multi-instance-master).

/run/tor/log:

Jan 20 11:50:47.733 [notice] Tor 0.4.4.6 running on Linux with Libevent 2.1.8-stable, OpenSSL 1.1.1d, Zlib 1.2.11, Liblzma 5.2.4, and Libzstd 1.3.8.
Jan 20 11:50:47.733 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Jan 20 11:50:47.000 [notice] Bootstrapped 0% (starting): Starting
Jan 20 11:50:48.000 [notice] Starting with guard context "default"
Jan 20 11:50:48.000 [notice] Signaled readiness to systemd
Jan 20 11:50:48.000 [notice] Received reload signal (hup). Reloading config and resetting internal state.
Jan 20 11:50:48.000 [notice] Bootstrapped 5% (conn): Connecting to a relay
Jan 20 11:50:48.000 [notice] Bootstrapped 10% (conn_done): Connected to a relay
Jan 20 11:50:49.000 [notice] Bootstrapped 14% (handshake): Handshaking with a relay
Jan 20 11:50:49.000 [notice] Bootstrapped 15% (handshake_done): Handshake with a relay done
Jan 20 11:50:49.000 [notice] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits
Jan 20 11:50:49.000 [notice] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits
Jan 20 11:50:49.000 [notice] Bootstrapped 95% (circuit_create): Establishing a Tor circuit
Jan 20 11:50:54.000 [notice] Bootstrapped 100% (done): Done

vanguards.service:

WARNING[Wed Jan 20 11:50:48 2021]: Tor daemon connection closed. Trying again...
NOTICE[Wed Jan 20 11:50:49 2021]: Vanguards 0.3.1 connected to Tor 0.4.4.6 using stem 1.7.1

Permissions Fix[edit]

If error messages like the following appear.

Oct 24 07:22:15.693 [warn] Directory /var/lib/tor/.tor cannot be read: Permission denied
Oct 25 12:35:07.460 [warn] Directory /var/lib/tor cannot be read: Permission denied
Oct 25 12:35:07.460 [warn] Failed to parse/validate config: Couldn't access private data directory "/var/lib/tor"

Then apply the following steps.

1. Open a terminal.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q")Whonix-Gateway ™ ProxyVM (commonly named sys-whonix)Xfce Terminal

If you are using a graphical Whonix with XFCE, run.

Start MenuXfce Terminal

2. Apply a permissions fix for the Tor data folder.

sudo chown --recursive debian-tor:debian-tor /var/lib/tor

3. Restart Tor.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q")Whonix-Gateway ™ ProxyVM (commonly named 'sys-whonix')Restart Tor

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start MenuApplicationsSettingsRestart Tor

If you are using a terminal-only Whonix-Gateway ™, press on Expand on the right.

Complete the following steps.

Restart Tor.

sudo service tor@default Restart

Check Tor's daemon status.

sudo service tor@default status

It should include a a message saying.

Active: active (running) since ...

In case of issues, try the following debugging steps.

Check Tor's config.

anon-verify

The output should be similar to the following.

/===================================================================\
|                      Report Summary                               |
\===================================================================/
No error detected in your Tor configuration.

Error messages should no longer appear after completing these steps. [5]

Non-Issues[edit]

Message / Question Answer
Am I compromised? Does Tor's log report leaks? Tor's output is an ineffective tool for discovering serious issues such as a compromise or leaks.
[WARN] Socks version 71 not recognized. (Tor is not an http proxy.)

This warning is caused by whonixcheck, specifically the function check_tor_socks_port_reachability which checks if a Tor SocksPort is reachable by trying to fetch it using curl. [6] No warnings appear if the function works correctly.

[warn] Socks version 71 not recognized. (This port is not an HTTP proxy; did you want to use HTTPTunnelPort?) Similar to above.
[NOTICE] You configured a non-loopback address '10.152.152.10:9179' for SocksPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted. [1 duplicate hidden] This notice may reference other port numbers, or the DnsPort or TransPort. This notice is not a concern because Tor really listens on that IP/port - it is the internal network interface for Whonix-Gateway ™ (sys-whonix) that is only available to Whonix-Workstation ™ because Whonix-Gateway ™ (sys-whonix) is firewalled. See /usr/bin/whonix_firewall or the Whonix ™ source code for further information.
[NOTICE] New control connection opened. [2 duplicates hidden] A higher number of duplicate messages may also appear. This notice is not a concern because it is caused by whonixcheck's Tor Bootstrap Status Test, which uses Tor's ControlPort or CPFP.

Version Number[edit]

To discover what Tor version is currently in use, run the following command inside Whonix-Gateway ™ (Qubes-Whonix ™: sys-whonix).

anon-info

The output should be similar to the following.

INFO: version of the 'tor' package: 0.4.2.7-1~d10.buster+1

See also Newer Tor Versions.

Advanced Topics[edit]

Additional SocksPorts[edit]

Adding additional Tor SocksPorts to /usr/local/etc/torrc.d/50_user.conf is non-intuitive. [7]

As noted in the Tor man page (man tor):

By default, an option on the command line overrides an option found in the configuration file, and an option in a configuration file overrides one in the defaults file.

This rule is simple for options that take a single value, but it can become complicated for options that are allowed to occur more than once: if you specify four SOCKSPorts in your configuration file, and one more SOCKSPort on the command line, the option on the command line will replace all of the SOCKSPorts in the configuration file. If this is not what you want, prefix the option name with a plus sign, and it will be appended to the previous set of options instead.

Nick Mathewson from The Tor Project has also noted: [8]

So to make sure that the SocksPort in the torrc does what you want, write it as +SocksPort.

After adding custom ports, a user would also have to edit the Whonix ™ firewall unless they were lucky. For example, various custom ports for such use cases have already been added. Those are documented here.

Blacklist Certain Onion Services from Connecting[edit]

Info This procedure is experimental. Testers only.

Open /usr/local/etc/torrc.d/50_user.conf.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q")Whonix-Gateway ™ ProxyVM (commonly named sys-whonix)Tor User Config (Torrc)

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start MenuApplicationsSettings/usr/local/etc/torrc.d/50_user.conf

If you are using a terminal-only Whonix-Gateway ™, complete the following steps.

sudo nano /usr/local/etc/torrc.d/50_user.conf

The following is an example onion service that is added to /usr/local/etc/torrc.d/50_user.conf. Replace bbbbbb6qtmqg65g6.onion with the actual onion service that should be blacklisted.

MapAddress bbbbbb6qtmqg65g6.onion 127.0.0.1

Reload Tor.

After editing /usr/local/etc/torrc.d/50_user.conf, Tor must be reloaded for changes to take effect.

Note: If Tor does not connect after completing all these steps, then a user mistake is the most likely explanation. Recheck /usr/local/etc/torrc.d/50_user.conf and repeat the steps outlined in the sections above. If Tor then connects successfully, all the necessary changes have been made.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q")Whonix-Gateway ™ ProxyVM (commonly named 'sys-whonix')Reload Tor

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start MenuApplicationsSettingsReload Tor

If you are using a terminal-only Whonix-Gateway ™, click HERE for instructions.

Complete the following steps.

Reload Tor.

sudo service tor@default reload

Check Tor's daemon status.

sudo service tor@default status

It should include a a message saying.

Active: active (running) since ...

In case of issues, try the following debugging steps.

Check Tor's config.

sudo -u debian-tor tor --verify-config

The output should be similar to the following.

Sep 17 17:40:41.416 [notice] Read configuration file "/usr/local/etc/torrc.d/50_user.conf".
Configuration was valid

Entry Guards[edit]

This entry has been moved here.

Manual Bridge Configuration[edit]

It is recommended to first read the main Bridges article.

For the majority of users, the Anon Connection Wizard GUI application is suitable for bridge configuration. The manual bridge configuration steps below are only recommended for advanced users.

Step 1: Access Tor Configuration to Add Bridges[edit]

Open /usr/local/etc/torrc.d/50_user.conf.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q")Whonix-Gateway ™ ProxyVM (commonly named sys-whonix)Tor User Config (Torrc)

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start MenuApplicationsSettings/usr/local/etc/torrc.d/50_user.conf

If you are using a terminal-only Whonix-Gateway ™, complete the following steps.

sudo nano /usr/local/etc/torrc.d/50_user.conf

Step 2: Edit Tor Configuration[edit]

Use obfs4 Bridges[edit]

1. Open /usr/local/etc/torrc.d/50_user.conf in an editor.

Copy and paste the following text to enable the use of obfs4 bridges. [9] [10]

UseBridges 1
ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy

2. Add the bridge IP addresses that were sourced in the Finding a Bridge and Choosing the Right Protocol section.

Copy and paste the IP addresses to the very bottom of /usr/local/etc/torrc.d/50_user.conf, after the ClientTransportPlugin entries. Users must ensure that "bridge" appears at the beginning of each line.

Info In the obfs4 example below:

  • Do not copy and paste this list of bridge entries to the 50_user.conf file. They will not work.
  • Retrieve obfs4 bridges [archive] from The Tor Project before editing this file.
  • Capitalization in the 50_user.conf file matters. For example, bridges will not connect if users type "Bridge" instead of "bridge".

Obfs4 example text to add to /usr/local/etc/torrc.d/50_user.conf.

bridge obfs4 192.235.207.85:42086 0EEB10BF4B4FAF56D46E cert=oue8sYYw5wi4n3mf2WDOg iat-mode=0
bridge obfs4 34.218.26.20:43263 DD21A551767816A0C9495 cert=7qzS6KASquPvJU82Fm7qoJw iat-mode=0
bridge obfs4 161.217.177.95:10703 B3B8009D01BB7E5FDFAEC cert=4RaIqGiOytEXm6Hw iat-mode=0

The sample text for a complete obfs4 torrc file is below. Check your file is similar, except for the specific bridge entries.

# This file is part of Whonix
# Copyright (C) 2012 - 2013 adrelanos
# See the file COPYING for copying conditions.

# Use this file for your user customizations.
# Please see /usr/local/etc/torrc.d/50_user.conf.examples for help, options, comments etc.

# Anything here will override {{project name}} own Tor config customizations in /usr/share/tor/tor-service-defaults-torrc

# Enable Tor through whonixsetup or manually uncomment "DisableNetwork 0" by
# removing the # in front of it.
DisableNetwork 0
UseBridges 1
ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy

bridge obfs4 192.235.207.85:42086 0EEB10BF4B4FAF56D46E cert=oue8sYYw5wi4n3mf2WDOg iat-mode=0
bridge obfs4 34.218.26.20:43263 DD21A551767816A0C9495 cert=7qzS6KASquPvJU82Fm7qoJw iat-mode=0
bridge obfs4 161.217.177.95:10703 B3B8009D01BB7E5FDFAEC cert=4RaIqGiOytEXm6Hw iat-mode=0

[11]

3. After /usr/local/etc/torrc.d/50_user.conf editing is finished, save and exit.

<Ctrl-X> --> press Y --> <Enter>

Use meek_lite Bridges[edit]

meek_lite bridges are available. To use them, simply add one more line to the /usr/local/etc/torrc.d/50_user.conf file. Take note the bridge type is called meek_lite, not meek which is used in Tor Browser Bundle. [12]

1. Open /usr/local/etc/torrc.d/50_user.conf in an editor.

Copy and paste the following text to enable meek_lite bridges.

UseBridges 1
ClientTransportPlugin meek_lite exec /usr/bin/obfs4proxy

2. Add a meek_lite bridge to the configuration file.

An example of meek_lite text that must be added to the /usr/local/etc/torrc.d/50_user.conf file is below. The bridge in this example is functional, so a search for other meek_lite bridges is unnecessary.

bridge meek_lite 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2cly7j4zqgua7.cloudfront.net/ front=a0.awsstatic.com

3. After /usr/local/etc/torrc.d/50_user.conf editing is finished, save and exit.

<Ctrl-X> --> press Y --> <Enter>

Step 3: Enable Tor[edit]

Follow this procedure if it has not been previously completed.

Enable Tor using Anon Connection Wizard (easiest option).

Start Anon Connection Wizard.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q")Whonix-Gateway ™ ProxyVM (commonly named sys-whonix)Anon Connection Wizard

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start MenuApplicationsSystemAnon Connection Wizard

If you are using a terminal Whonix-Gateway ™, type.

lxsudo anon-connection-wizard

Choose the Enable Tor option. Press next.

Step 4: Have /usr/local/etc/torrc.d/50_user.conf Changes Take Effect[edit]

Reload Tor.

After editing /usr/local/etc/torrc.d/50_user.conf, Tor must be reloaded for changes to take effect.

Note: If Tor does not connect after completing all these steps, then a user mistake is the most likely explanation. Recheck /usr/local/etc/torrc.d/50_user.conf and repeat the steps outlined in the sections above. If Tor then connects successfully, all the necessary changes have been made.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q")Whonix-Gateway ™ ProxyVM (commonly named 'sys-whonix')Reload Tor

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start MenuApplicationsSettingsReload Tor

If you are using a terminal-only Whonix-Gateway ™, click HERE for instructions.

Complete the following steps.

Reload Tor.

sudo service tor@default reload

Check Tor's daemon status.

sudo service tor@default status

It should include a a message saying.

Active: active (running) since ...

In case of issues, try the following debugging steps.

Check Tor's config.

sudo -u debian-tor tor --verify-config

The output should be similar to the following.

Sep 17 17:40:41.416 [notice] Read configuration file "/usr/local/etc/torrc.d/50_user.conf".
Configuration was valid

Tor Functions[edit]

Disable Tor[edit]

Disable Tor using Anon Connection Wizard (safest option).

Start Anon Connection Wizard.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q")Whonix-Gateway ™ ProxyVM (commonly named sys-whonix)Anon Connection Wizard

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start MenuApplicationsSystemAnon Connection Wizard

If you are using a terminal Whonix-Gateway ™, type.

lxsudo anon-connection-wizard

Choose the Disable Tor option. Press next.

Reload Tor[edit]

Reload Tor.

After editing /usr/local/etc/torrc.d/50_user.conf, Tor must be reloaded for changes to take effect.

Note: If Tor does not connect after completing all these steps, then a user mistake is the most likely explanation. Recheck /usr/local/etc/torrc.d/50_user.conf and repeat the steps outlined in the sections above. If Tor then connects successfully, all the necessary changes have been made.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q")Whonix-Gateway ™ ProxyVM (commonly named 'sys-whonix')Reload Tor

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start MenuApplicationsSettingsReload Tor

If you are using a terminal-only Whonix-Gateway ™, click HERE for instructions.

Complete the following steps.

Reload Tor.

sudo service tor@default reload

Check Tor's daemon status.

sudo service tor@default status

It should include a a message saying.

Active: active (running) since ...

In case of issues, try the following debugging steps.

Check Tor's config.

sudo -u debian-tor tor --verify-config

The output should be similar to the following.

Sep 17 17:40:41.416 [notice] Read configuration file "/usr/local/etc/torrc.d/50_user.conf".
Configuration was valid

Restart Tor[edit]

Restart Tor.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q")Whonix-Gateway ™ ProxyVM (commonly named 'sys-whonix')Restart Tor

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start MenuApplicationsSettingsRestart Tor

If you are using a terminal-only Whonix-Gateway ™, press on Expand on the right.

Complete the following steps.

Restart Tor.

sudo service tor@default Restart

Check Tor's daemon status.

sudo service tor@default status

It should include a a message saying.

Active: active (running) since ...

In case of issues, try the following debugging steps.

Check Tor's config.

anon-verify

The output should be similar to the following.

/===================================================================\
|                      Report Summary                               |
\===================================================================/
No error detected in your Tor configuration.

vanguards[edit]

See Vanguards.

UDP[edit]

Ambox notice.png The Tor software does not yet support UDP, [13] although Tor provides a DnsPort.

If UDP is urgently required in Whonix ™, a limited workaround is provided. For the most secure method, see Tunnel UDP over Tor.

ICMP[edit]

Same as above.

FAQ[edit]

Whonix ™ is Preventing Tor from Bootstrapping![edit]

Refer to the related Whonix ™ has Slowed Tor Connections Dramatically! wiki entry. Bootstrapping problems can relate to nation state or ISP censorship of Tor, or relate to the Tor guard in operation. In the latter case, temporarily changing the Tor guard might resolve the issue.

If that is ineffective, users can also:

Can I Speed Up Tor or the Whonix-Gateway ™?[edit]

Is there a way to configure the number of nodes in a circuit and to allow selection according to their speeds?

Info Reminder: Whonix ™ Reliance on Debian (and Tor) - "Whonix ™ is not a stripped down version of Debian; anything possible in "vanilla" Debian GNU/Linux can be replicated in Whonix ™." Tor configurations are not limited by using Whonix ™.

Those who already know how to configure Tor in this way on the command line in vanilla Debian can follow the same procedure in Whonix-Gateway ™. This is not an endorsement for making these manual Tor changes because it is not recommended by Tor developers and thus the Whonix ™ team. [14] This is also the reason there are no instructions in the Whonix ™ documentation to manipulate Tor nodes in this way.

That said, if general instructions were found describing how to achieve this on the host, then the same procedure could simply be repeated in Whonix-Gateway ™.

Does Whonix ™ Modify Tor?[edit]

Info Tor [archive] is an anonymizer developed by The Tor Project. Tor Browser is a web browser developed by the Tor Project [archive] which is optimized for privacy. Please do not confuse Tor with Tor Browser when conversing about Whonix ™ topics.

For differences of Tor Browser by Tor Project compared to Tor Browser in Whonix ™ see Whonix ™ Tor Browser Differences.

Info Whonix ™ does not modify the Tor package itself.

Although Whonix ™ does not modify Tor, the Tor configuration file has been adapted for Whonix ™. To inspect the relevant files, check the following on Whonix-Gateway ™: [15]

  • /etc/tor/torrc file.
  • /etc/torrc.d folder.
  • /usr/local/etc/torrc.d/ folder.
  • /usr/share/tor/tor-service-defaults-torrc file.

Tor is not patched and the normal Tor deb package is used in Whonix ™ from deb.torproject.org.

Any changes to the Tor routing algorithm should be proposed, discussed and eventually implemented upstream in Tor on torproject.org. [16] If proposed changes are not adopted by The Tor Project, then the option to create a Tor fork [17] is available. Tor has already been forked at least once.

A general Whonix ™ design principle is to keep the Tor process as uniform as possible, in order to simplify any security audits. Diverging from this practice would introduce unnecessary complexity, possibly worsen fingerprinting or degrade anonymity, and limit Whonix ™ discussions to the security impacts of the modified routing algorithm. For these reasons, the Whonix ™ team is strongly disinclined to make any direct changes to the Tor package.

Can Whonix ™ Improve Tor?[edit]

As outlined in the previous section, Whonix ™ will not implement any changes to Tor directly and any suggested improvements or bug fixes are proposed upstream on torproject.org. This has already happened on occasion. Creating Whonix ™ is a difficult and time consuming endeavor, so Tor improvements are better left to dedicated, skilled developers who are more knowledgeable in this area.

Skilled coders can always provide upstream patches to Tor, or as a last resort, fork [17] it. Hypothetically, if a fork [17] developed a greater following than the original project due to proven security / anonymity benefits, then Whonix ™ would seriously consider making a switch.

Tor Routing Algorithm[edit]

Quote Tor Project FAQ Can I control which nodes (or country) are used for entry/exit? [archive] (bold and underline added)

Yes. You can set preferred entry and exit nodes as well as inform Tor which nodes you do not want to use. The following options can be added to your config file torrc or specified on the command line:

[...]

We recommend you do not use these — they are intended for testing and may disappear in future versions. You get the best security that Tor can provide when you leave the route selection to Tor; overriding the entry / exit nodes can mess up your anonymity in ways we don't understand.

To make changes to the Tor routing algorithm which benefit anonymity and not actually worsen anonymity it is required to be more clever than the Tor developers. Many questions, suggestions and discussions online only scratch the surface and are unaware of the informational resources:

The following resources describe the organizational structure of the Whonix ™ project in relation to The Tor Project, Debian and other upstream sources.

See also:

How do I Change Other Tor Settings?[edit]

Questions are often raised in forums about how other Tor-specific changes can be made in Whonix ™, such as excluding specific exit nodes. [18]

In many cases, making such changes is already documented Whonix ™ Documentation. In other cases such changes are discouraged.

In all instances:

  1. Changes must be made to the Tor configuration file as per Edit Tor Configuration.
  2. Refer to the Tor Project Manual [archive] for specific configuration details.

For example, to exclude exit nodes from the Five Eyes countries the Tor configuration would include the following lines:

Discouraged!

ExcludeExitNodes {us},{au},{ca},{nz},{gb}
StrictNodes 1

A Configuration Check should be run afterwards inside Whonix-Gateway ™ (Qubes-Whonix ™: sys-whonix) to confirm there are no Tor configuration syntax errors. As these configurations are specific to Tor (and not Whonix ™), the Free Support Principle applies.

How do I Install the Latest Tor Version?[edit]

Follow the instructions here to install later Tor versions from either:

  • the Whonix ™ repository; or
  • Tor Project APT repositories; or
  • Tor Project source code.

Troubleshooting[edit]

The following helper tools and documentation chapters might be of assistance.

See also:

Further Reading[edit]

Footnotes / References[edit]

  1. Anon Connection Wizard stores its configuration file file /usr/local/etc/torrc.d/40_tor_control_panel.conf.
  2. /usr/local/etc/torrc.d/40_tor_control_panel.conf is auto generated. It can be examined but changes should only be made to /usr/local/etc/torrc.d/50_user.conf.
  3. Debian feature request: add torrc.d configuration directory [archive]
    • -b: shortcut for journalctl --boot which shows only log entries from current boot. Not from previous boots.
    • --output cat: Prevention of duplicate timestamp per log line. Prevent journalctl from adding a timestamp to the log output since this is unnecessary since Tor already adds its own timestamp to the log.
    • --no-pager: Dump log to stdout. No scrolling.
    • tor: multi-instance-master
    • tor@default: actual Tor process
    • vanguards: add-on, see vanguards
  4. whonixcheck check /var/lib/tor folder permission [archive]
  5. UWT_DEV_PASSTHROUGH=1 curl 10.152.152.10:9100

  6. https://trac.torproject.org/projects/tor/ticket/15261 [archive]
  7. https://trac.torproject.org/projects/tor/ticket/15261#comment:1 [archive]
  8. obfs3 bridges have been deprecated.
  9. ClientTransportPlugin fte exec /usr/bin/fteproxy --managed

  10. fte example text to add to /usr/local/etc/torrc.d/50_user.conf. fte is supported in Whonix ™ 15, but further testing is required; see: https://phabricator.whonix.org/T520 [archive]
    ClientTransportPlugin fte exec /usr/bin/fteproxy --managed
    bridge fte 10.200.100.60:95128 4352e58420e68f5e40bf7c74faddccd9d1349413
    bridge fte 300.100.300.80:23521 4352e58420e68f5e40bf7c74faddccd9d1349413

  11. meek_lite actually uses a different implementation of obfs4proxy. Forum discussion: https://forums.whonix.org/t/censorship-circumvention-tor-pluggable-transports/2601/3 [archive]
  12. https://trac.torproject.org/projects/tor/ticket/7830 [archive]
  13. Deferring to their expertise on the possible adverse anonymity effects.
  14. Changes to the configuration file are made by the anon-gw-anonymizer-config [archive] package.
  15. This means changes occur for all Tor users and not a subset relying on a particular distribution.
  16. 17.0 17.1 17.2 https://en.wikipedia.org/wiki/Fork_(software_development) [archive]
  17. http://forums.whonix.org/t/how-to-set-an-exit-node-in-wonix-of-qubesos/9070 [archive]


text=Jobs in USA
Jobs in USA


Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki


Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: 1024px-Telegram 2019 Logo.svg.png Discourse logo.png Matrix logo.svg.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Share: Twitter | Facebook

Have you read our Documentation, Design and Developer Portal links yet?

https link onion link

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.

Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].

Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.