3

I have installed Tor on Ubuntu 14.04 according to instructions at https://www.torproject.org/docs/debian.html.en

I got the basic relay configured and working but I have file permission issues with file permissions of a hidden service private_key and hostname files. Tor is started as root, it will do some magic and then it drops itself to run as "debian-tor".

File permissions:

sudo ls -l /home/debian-tor /home/debian-tor/tor_keys =>
/home/debian-tor:
total 4
drwx------ 2 debian-tor debian-tor 4096 Jul 17 10:59 tor_keys

/home/debian-tor/tor_keys:
total 8
-rw------- 1 debian-tor debian-tor  23 Jul 17 10:59 hostname
-rw------- 1 debian-tor debian-tor 891 Jul 16 17:52 private_key

Starting as a service (does not work):

sudo service tor start =>
[notice] Tor 0.2.6.10 (git-71459b2fe953a1c0) opening new log file.
[warn] Could not open "/home/debian-tor/tor_keys/private_key": Permission denied
[warn] Error reading private key from "/home/debian-tor/tor_keys/private_key"
[err] Error loading private key.
[warn] Error loading rendezvous service keys
[err] set_options(): Bug: Acting on config options left us in a broken state. Dying.

Starting from command line (works!):

sudo tor =>
[notice] Tor 0.2.6.10 (git-71459b2fe953a1c0) opening log file.
[notice] Tor v0.2.6.10 (git-71459b2fe953a1c0) running on Linux with Libevent 2.0.21-stable, OpenSSL 1.0.1f and Zlib 1.2.8.
[notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
[notice] Read configuration file "/etc/tor/torrc".
[notice] Opening Control listener on 127.0.0.1:9052
[notice] Parsing GEOIP IPv4 file /usr/share/tor/geoip.
[notice] Parsing GEOIP IPv6 file /usr/share/tor/geoip6.
[notice] Bootstrapped 0%: Starting
...
[notice] Bootstrapped 100%: Done

Test to have an other user own the files (this shows that tor is really running as debian-tor):

sudo chown -R ubuntu_user:ubuntu_user /home/debian-tor
sudo service tor start =>
 * Checking if tor configuration is valid
Jul 17 12:23:06.811 [notice] Tor v0.2.6.10 (git-71459b2fe953a1c0) running on Linux with Libevent 2.0.21-stable, OpenSSL 1.0.1f and Zlib 1.2.8.
Jul 17 12:23:06.811 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Jul 17 12:23:06.811 [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc".
Jul 17 12:23:06.811 [notice] Read configuration file "/etc/tor/torrc".
Jul 17 12:23:06.814 [warn] /home/debian-tor/tor_keys is not owned by this user (debian-tor, 108) but by ubuntu_user (1000). Perhaps you are running Tor as the wrong user?
Jul 17 12:23:06.814 [warn] Failed to parse/validate config: Failed to configure rendezvous options. See logs for details.
Jul 17 12:23:06.814 [err] Reading config failed--see warnings above.

Trying to get Tor re-create keys:

sudo rm -r /home/debian-tor/tor_keys
sudo service tor start =>
[notice] Tor 0.2.6.10 (git-71459b2fe953a1c0) opening log file.
[warn] Error creating directory /home/debian-tor/tor_keys: Permission denied
[warn] Error loading rendezvous service keys
[err] set_options(): Bug: Acting on config options left us in a broken state. Dying.

Running sudo tor would create the folder and write hostname and private_key files there.

So my question is how could I get sudo service tor start working? It somehow does not have root nor debian-tor privileges to write there, or maybe I am missing something. Or should I just not use the /etc/init.d/tor script to manage it?

0

There is a simple answer - AppArmor. It limits resources for you services. You can find details here man apparmor or look here http://wiki.apparmor.net/index.php/QuickProfileLanguage

So you have to add rules to /etc/apparmor.d/local/system_tor

# Site-specific additions and overrides for system_tor.
# For more details, please see /etc/apparmor.d/local/README.

/home/debian-tor/tor_keys/* rwmk,

Then sudo service apparmor restart And it will work like a sharm.

sudo service tor restart

sudo service tor status

tail /var/log/tor/log

torify links my_abracadabra.onion

and so on...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.