lar.ven – this.ven's wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Relay ======

A [[https://support.torproject.org/glossary/relay|relay]] in the context of the [[./|Tor]] network is a [[wp>Routing|routing]] node registering itself at another special-purpose relay ([[https://support.torproject.org/glossary/directory-authority|directory authority]]) that maintains and publishes a list of currently-running relays called [[https://support.torproject.org/glossary/consensus|consensus]]. Relays can perform [[https://community.torproject.org/relay/types-of-relays|different roles]] in the Tor network.

I was running a [[https://support.torproject.org/glossary/bridge|bridge]] on a [[https://www.raspberrypi.org|Raspberry Pi]] single-board computer, but due to limited capabilities of the used internet connection I could barely comply with [[https://community.torproject.org/relay/relays-requirements|relay requirements]] and switched to a [[wp>WebRTC|WebRTC]] based solution via [[./Snowflake|Snowflake]]. Nevertheless, for documentation purposes the former setup is provided in the following.

===== Basic setup =====

[[https://voidlinux.org|{{https://voidlinux.org/assets/img/void_bg.png?64 |Void Linux}}]] Since hardware specifications of a [[https://docs.voidlinux.org/installation/guides/arm-devices/platforms.html|Raspberry Pi 3 A+]] are low [[https://voidlinux.org|Void Linux]] is used as [[wp>Operating_system|operating system]]. [[https://docs.voidlinux.org/installation/guides/fde.html|Full disk encryption]] method is not employed during installation as Tor is already not storing identifiable data tracks by design and thus, not leading to a leakage. After downloading and writing a [[https://docs.voidlinux.org/installation/guides/arm-devices/index.html#pre-built-images|pre-built image]] to a SD card, the system can be booted on the single-board computer. Login using [[https://docs.voidlinux.org/installation/guides/arm-devices/index.html#logging-in|default credentials]] and change the root password by entering a new one twice after invoking ''passwd''.

==== Networking ====

As there's no wired network interface in the chosen Raspberry Pi model, [[https://docs.voidlinux.org/config/network/#wireless|wireless]] networking is used. The [[https://docs.voidlinux.org/config/network/wpa_supplicant.html|wpa_supplicant]] packages is installed by default and provides tools to create and manage connections. To configure a typical WPA-PSK connection found in home networks use the following commands and adapt the values for [[wp>Service_set_(802.11_network)|SSID]] and [[wp>Pre-shared_key|PSK]] to match your network credentials:

<code bash>SSID="My network name"
PSK="Super secret key"
wpa_passphrase $SSID $PSK >> /etc/wpa_supplicant/wpa_supplicant.conf</code> 

Edit the file ''/etc/wpa_supplicant/wpa_supplicant.conf'' and add ''scan_ssid=1'' as well as ''key_mgmt=WPA-PSK'' to match the following:

<file text wpa_supplicant.conf># home network; allow all valid ciphers
network={
	ssid="$SSID"
	scan_ssid=1
	key_mgmt=WPA-PSK
        #psk="$PSK"
	psk="<wpa_passphrase output>"
}</file> 

> **Note:** The parameters //ssid// and //#psk// your network credentials. The latter can be safely removed for protecting the clear-text passphrase.

More examples can be found in the [[https://man.voidlinux.org/wpa_supplicant.conf.5#QUICK_EXAMPLES|man page]]. Afterwards enable and start the daemon:

<code bash>ln -s /etc/sv/wpa_supplicant /var/service/
sv up wpa_supplicant
</code>

IP addressing will be done by static DHCP via the router connecting the bridge to the internet. Thus, it needs to use [[https://docs.voidlinux.org/config/network/#dhcpcd|dhcpcd]] on all interfaces by enabling and starting its service:

<code bash>ln -s /etc/sv/dhcpcd /var/service/
sv up dhcpcd</code>

==== Time synchronization ====

In order to synchronize the system time to [[wp>Time_server|time server]]s the [[https://docs.voidlinux.org/config/date-time.html#timezone|timezone]] must be set and the [[https://docs.voidlinux.org/config/date-time.html#chrony|chrony]] service is installed, enabled and started after initial manual setting current date and time with [[https://man.voidlinux.org/date.1|date]] utility (adjust ''20221019 16:40'' to your current date and time):

<code bash>ln -sf /usr/share/zoneinfo/<timezone> /etc/localtime
date --set="20221019 16:40"
xbps-install -Sy chrony
ln -s /etc/sv/chronyd /var/service/
sv up chronyd</code>

==== Console privacy ====

To prevent eavesdropping from the display the screen can be blanked after 30 seconds of inactivity by appending [[https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html?highlight=consoleblank|consoleblank=30]] as kernel parameter in ''/boot/cmdline.txt''.

===== OBFSv4 bridge setup =====

General instructions on [[https://community.torproject.org/relay/setup/bridge/voidlinux|how to deploy an obfs4 bridge on Void Linux]] can be found in the technical setup guide for bridges. This section only covers some additional settings for ''/etc/tor/torrc'' that I found useful. Remember to restart the Tor service after editing the configuration:

<code bash>sv restart tor</code>

==== Torify XBPS ====

[[https://docs.voidlinux.org/xbps/repositories/mirrors/tor.html#using-xbps-with-tor|Using XBPS with Tor]] minimizes [[wp>Clearnet_(networking)|clearnet]] communication during updates and thus, supports keeping the relay anonymous. Permanent configuration is done by overriding default [[wp>Software_repository|repository]] mirrors with an onion service mirror in the ''/etc/xbps.d'' directory:

<code bash>mkdir -p /etc/xbps.d
cp /usr/share/xbps.d/*-repository-*.conf /etc/xbps.d/
sed -i 's|https://repo-default.voidlinux.org|http://lysator7eknrfl47rlyxvgeamrv7ucefgrrlhk7rouv3sna25asetwid.onion/pub/voidlinux|g' /etc/xbps.d/*-repository-*.conf</code>

Additionally, the ''SOCKS_PROXY'' environment variable must be set to avoid [[wp>DNS_leak|DNS leak]]s:

<code bash>cat - <<EOF > /etc/profile.d/socksproxy.sh
#!/bin/sh
export SOCKS_PROXY="socks5://127.0.0.1:9050"
EOF</code>

==== Port selection ====

When considering an ''ORPort'' and obfs4 port to be used in ''ServerTransportListenAddr'' a look at the [[wp>List_of_TCP_and_UDP_port_numbers|list of TCP and UDP port numbers]] might help to find candidates. As stated in the example configuration snippet best practice is to:

> Avoid port 9001 because it's commonly associated with Tor and censors may be scanning the Internet for this port.

Also, I had to setup [[https://support.torproject.org/relay-operators/behind-nat|port forwarding on my router]] to make the chosen ports reachable from the internet. The [[https://bridges.torproject.org/scan|reachability test]] can be used with the [[wp>IP_address#Public_address|public IP address]] (''<public-ip>'') to check each port (''<port>''):

[[https://bridges.torproject.org/scan/scan?address=<public-ip>&port=<port>]]

For more sophisticated checks, use the following [[https://nc110.sourceforge.io|netcat]] command:

<code bash>nc -zv <public-ip> <port></code>

==== Bandwidth limitation ====

Running a bridge on a home internet connection causes a lot of traffic. Thus, it's advisable to specify bandwidth limits in the ''/etc/tor/torc'' configuration file like as follows:

<code>RelayBandwidthRate 250 KBytes  # Throttle traffic to 250 kB/s (2 Mbps)
RelayBandwidthBurst 300 KBytes # But allow bursts up to 300 kB/s (2.4 Mbps)</code>

The values above depend on our internet speed. Use a [[https://bandspeed.de|speedtest]] to identify your connection speed and [[https://www.checkyourmath.com/convert/data_rates|calculate]] values that do not exceed more than half of your upload rate to [[https://support.torproject.org/relay-operators/bandwidth-shaping|maintain enough bandwidth]] for your other internet applications.

For example, a common [[wp>Asymmetric_digital_subscriber_line|asymmetric]] 50 [[wp>Data-rate_units#Megabit_per_second|Mbps]] home internet connection typically only has an upload rate of about 6 Mbps equal to 750 kBps (or //KBytes// as used in the torrc file). Allowing Tor bridge [[wp>Burst_transmission|burst]]s up to 40% of the bandwidth means 300 KBytes (= 2.4 Mbps) at max. and about one third on the average:

//6 Mbps * 125 = 750 kBps\\
750 kBps * 40% = 300 kBps\\
300 kBps / 125 = 2.4 Mbps\\
250 kBps / 125 = 2 Mbps\\
2 Mbps / 6 Mbps * 100 = 33.33%//

> **Note:** If you are using a metered connection to the internet, you'd probably want to [[https://support.torproject.org/relay-operators/limit-total-bandwidth|limit the total amount of bandwidth]].

==== Monitoring ====

For real-time information on the local Tor service [[https://nyx.torproject.org|nyx]] can be used for monitoring. Installation is done by:

<code bash>xbps-install -Sy nyx</code>

and for granting nyx access to the Tor service edit the ''/etc/tor/torrc'' configuration file to uncomment the following lines:

<code>#ControlPort 9051
#CookieAuthentication 1</code>

Restart Tor afterwards and start nyx:

<code bash>sv restart tor && nyx</code>

==== Node information ====

The Tor network maintains information about relays identified by a hashed fingerprint (''<hashed-fingerprint>''). The latter is written to the file ''/var/lib/tor/hashed-fingerprint'' and is needed for showing the bridge status and metrics:

[[https://bridges.torproject.org/status?id=<hashed-fingerprint>]]\\
[[https://metrics.torproject.org/rs.html#details/<hashed-fingerprint>]]

If you consider specifying ''ContactInfo'' in the configuration file ''/etc/tor/torrc'', you can not only use your name and email, but also a lot of other options. There is a [[https://nusenu.github.io/ContactInfo-Information-Sharing-Specification|specification]] and a [[https://torcontactinfogenerator.netlify.app|generator]] available. For example, I was using an URI with [[https://nusenu.github.io/ContactInfo-Information-Sharing-Specification/#uri-rsa|uri-rsa]] proof method to fetch Tor relay fingerprints from my website.

{{tag>bridge censorship relay surveillance tor }}

Category: [[./|Tor]]
lar.ven – this.ven's wiki

User Tools

Site Tools

Page Tools
