3

I've set up Tor on my system with torsocks by adding 127.0.0.1:9050 to Ubuntu's network proxy settings (set to manual). I can confirm this works as intended by comparing IP addresses and using https://check.torproject.org/

However, while I wish to use a system-wide Tor connection at certain times, I also want to be able to run a normal connection for when security and privacy are not crucial.

In the Android variant (OrBot), you are able to connect to the Tor network, and maintain that connection, but you also have a "VPN Mode" toggle, which is what determines whether a standard or a Tor connection is being made.

This is essentially the functionality I am looking for; a way to quickly and conveniently toggle between Tor and standard connections with a single click or by setting a hotkey.

  • 3
    Possible duplicate of Is there a way to use Tor system-wide? – tu-Reinstate Monica-dor duh Oct 14 '18 at 23:42
  • 1
    That link is how I set things up in the first place. However, it does not explain how to do what I'm trying to do in my question. – hiigaran Oct 15 '18 at 0:05
  • Ah. I misread. My bad. You're wanting a Tor plugin switch in the status bar or some such, like VPNs and WFi does. – tu-Reinstate Monica-dor duh Oct 15 '18 at 0:09
  • That's correct. It's not a huge problem if one doesn't exist. This is solely to make things a little more convenient. – hiigaran Oct 15 '18 at 0:43
  • Yeah, there doesn't seem to be a Gnome Shell Extension for it, but it wouldn't be that hard to write. – tu-Reinstate Monica-dor duh Oct 15 '18 at 1:16
2

Digging around, I've found one possible solution. This involves setting two hotkeys, and the usage of gsettings.

After configuring your proxy settings, you will need to go to Settings > Devices > Keyboard and create one custom hotkey that initiates the following command:

gsettings set org.gnome.system.proxy mode manual

Then create a second one for:

gsettings set org.gnome.system.proxy mode none

As the proxy settings remain saved whether enabled or not, you can then assign an 'enable' key for the first command, and a 'disable' key for the second.

Confirm the change by pressing your first hotkey and navigating to Settings > Network, then navigating away, pressing your second hotkey, and returning to the network settings. Assuming Tor is set up correctly, and passes https://check.torproject.org, this should be all that's needed.

Perhaps not the most ideal solution, but it will do for now, unless someone comes up with a toggle on the activity bar or something.

EDIT:

A slight improvement on the above, is to use one hotkey that checks the current state of the proxy mode, then sets it to the opposite. Grab your text editor and create a new file with the following contents:

case "$(gsettings get org.gnome.system.proxy mode)" in
"'none'") gsettings set org.gnome.system.proxy mode "'manual'" 
notify-send "Tor Enabled";;
"'manual'") gsettings set org.gnome.system.proxy mode  "'none'"
notify-send "Tor Disabled" ;;
esac

This will also display a message showing the current state of your proxy settings.

Save the script somewhere, then reference the file location when creating a custom hotkey.

1

You want to look into "transparent" vs. "isolating" proxies. Transparent proxies, like what you are trying to do, are strenuously discouraged as they leak packets. The Tor project has some discussion of the dangers, which include "Identity correlation through circuit sharing;" issues with the clipboard, particularly download managers and antivirus software; and perhaps other issues with software you are running.

There are ways to do it, if you insist. See that first link, which involves extensive use of iptables, and/or look into redsocks, transocks, or lcat (redsocks is probably the best - see the discussion at the lcat link). The correct approach is an isolating proxy, eg. Whonix, which uses a pair of virtual machines as a means of isolation. One machine is the virtual OS, the other is a virtual router. The Qubes OS is built around this approach. Isolation can be engineered to insure there are no packet leaks, and so is much more secure. Instead of toggling the proxy on one OS, you switch between virtual OS's, or your host and a virtual OS. An alternative to Whonix is Subgraph OS, which locks down the network so all packets go through Tor. You could run that in a virtual machine, keeping your host machine as is. (But be aware that Subgraph is still alpha.)

Another transparent proxy, by the way, which is in addition obfuscating, is shadowsocks. This is extensively used in China, much like VPN's are used. Rather than connecting to Tor, you need a server on the other end - shadwosocks provides both client and server software - but you don't need superuser status there, so it's easy to get a cheap shell account and set it up. You could also use redsocks for this approach, though it wouldn't be obfuscated. The best server software to go with it is dante-server, though that does need superuser status to install. (dante-server is an apt package in Ubuntu. There is a dante-client, but that's not transparent, so you would want redsocks.). One advantage of shadowsocks or dante/redsocks is that they will proxy UDP, while Tor is only TCP. But that's perhaps off topic.

  • According to your first link, it mentions that you need applications that are configured to route traffic through SOCKS. If the most I'm using on this system is a browser, IRC client, and a few terminal functions prefixed with torsocks, are there any other potential sources for leaks? – hiigaran Oct 16 '18 at 0:29
  • 1
    Yes. There's all kinds of stuff that your OS is doing. Your clock, for example, is sending out UDP packets. Your update manager may be checking for security updates in the background. And how 'bout that Amazon search cr-p that Ubuntu includes? (I hope you've removed it.) I'm sure we could come up with others. – Diagon Oct 16 '18 at 0:34
  • Makes sense. However, can you be tied to activity taking place over a Tor connection? Say my IRC is configured correctly, and I send a message that my country of residence would not agree with. What are the implications of that action if, for instance, my clock does send out one of those UDP packets, assuming the content of my message does not identify me or my location? – hiigaran Oct 16 '18 at 0:47
  • 1
    While I'm not up on all the ways to break Tor, I am aware that there is a reason that we have a Tor browser bundle. Firefox had to be locked down so as not to leak information that could reveal the location of the source. AFAIK, that has not been done with any IRC clients. Re terminals, that would clearly depend on what you type into them. Whether other OS leaks can be used for correlation attacks or others means of deanonymization, I don't know. I do assume there are good reasons they highly discourage a piecemeal approach. If you want more, I would suggest #tor on OFTC. – Diagon Oct 16 '18 at 1:03
  • @hiigaran - I actually found more here. Look at the beginning & end of that link. I'll add it to my answer. – Diagon Oct 16 '18 at 2:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.