Tor

1 tor

Documenting this here because all the repository based methods of installing tor that are everywhere documented don’t work and are apt to screw up your system.

1.1 enabling tor services

This is needed by programs that use tor, such as cln (core lightning) but not needed by the tor browser

install tor
systemctl enable --now tor
nano /etc/tor/torrc:

In ’etc/tor/torrc`uncomment or add

ExitPolicy reject *:* # no exits allowed

ControlPort 9051
CookieAuthentication 1
CookieAuthFile /var/lib/tor/control_auth_cookie
CookieAuthFileGroupReadable 1

DirPort 0
ORPort 0

ControlPort should be closed, so that only applications running on your computer can get to it.

DirPort and ORPort, if set, should be open – whereupon you are running as a bridge. Which you probably do not want, but are good for obfuscation traffic.

Because the cookie file is group readable, applications running on your computer can read it to control tor through the control port. It is a good idea to firewall this port so that it is externally closed, so that nothing outside the computer can control tor.

DirPort and ORPort tell tor to advertise that these ports are open. Don’t open or advertise them (set to zero), because then you are running as a bridge.

If you want to run as a bridge to create obfuscation:

DirPort «your external ip address»:9030
ORPort «your external ip address»:9001

1.2 installing tor browser

Torproject on Github provides information that actually works.

Download the tar file to your home directory, extract it, and execute the command as an ordinary user, no sudo, no root, no mucking around with `apt``

tar -xf tor-browser-linux-x86_64-13.0.8.tar.xz
cd tor-browser
./start-tor-browser.desktop --register-app

The next time you do a graphical login, tor will just be there and will just work, with no fuss or drama. And it will itself check for updates and nag you for them when needed.