Skip to main content

Tor Relay Install Guide

With the whole world shutting down brick and mortar locations and trying to social distance I'm wondering what hits individual privacy will take...

 I have a raspberry pi collecting dust so I figured I could put it to use as a Tor relay.

 

*Note - this build is in progress and not complete *


What is Tor?

If you are not familiar with Tor, it is an online privacy service that routes traffic through multiple servers and encrypts it each step of the way.  To take advantage of this all users need to do is use a Tor enabled browser like the one offered by the Tor Project, Firefox, Brave, etc.  

In their own words, the folks at the Tor project "fight every day for everyone to have private access to an uncensored internet, and Tor has become the world's strongest tool for privacy and freedom online." (source)

The short version of how this works is that your Tor browser will navigate a course to the internet sites you visit by passing the data through 3 Tor relay nodes.  Traffic between the browser and each of the 3 nodes is encrypted so that neither has all the details of who you are and where you are going.  For more details check out the Tor Project

Tor circuit step two



What are the Relay Requirements?

Host:
    • A <40 Mbit/s non-exit relay should have at least 512 MB of RAM available.
    • less than 200 MB for Tor related data
    • Any modern CPU should be fine.
My pi should get the job done with its 512MB RAM even if its not going to win any awards.

Networking:
    • at least 7000 concurrent connections 
    • and minimum of 10 Mbit/s (Mbps) or at least 1 Mbit/s for a bridge with obfs4 support.
    • They say to expect a minimum of ~3GB of I/O / day
My little local firewall definitely isn't enterprise grade, but I think it can manage this.


What OS should we load on the pi?

Any OS can be used, but the documentation (here and here) seems to imply that BSD is needed for variety.  As BSD is supposed to be great for security and networking it seems like a good choice for this use case.  Both FreeBSD and OpenBSD support the pi, but only FreeBSD supports older model I have available.

Flashing FreeBSD is pretty much the same as rasbian or any other OS for the pi, but if there is any doubt FreeBSD foundation has a pretty good write up

How do I install the Relay software?

Once the pi is up and running the Tor project has all the info we need to get the relay configured, but first we need to decide what type of relay. there are 4 options:
  1. Guard - This is the first place a Tor browser will go. It will know your IP.
  2. Middle - This is (as name implies) the relay that sits in between the guard and the exit..
  3. Exit - This is what the websites you visit see.  These relays are most likely to get blamed for any bad behavior of the Tor users.
  4. Bridge - An incognito relay that is not publicly listed.  Its meant to support users / regions in areas that are trying to suppress Tor usage.
I chose a Tor Bridge Relay setup as it seems to need the least juice.  If it goes well I may try a middle guard relay later, but not likely an Exit Relay.

The Bridge Relay installation instructions provided by Tor Project looked straight forward, but apparently obfs4proxy is not packaged in FreeBSD for pi builds.  To get around this I followed the ports installation procedure from the FreeBSD handbook to go get that package and its dependencies. (as opposed to pkg install as stated in instructions linked above).

Here are the cliff notes...

# pkg install subversion
# svn checkout https://svn.FreeBSD.org/ports/head/security/obfs4proxy-tor /usr/ports/security/obfs4proxy-tor
# svn checkout https://svn.FreeBSD.org/ports/head/Mk /usr/ports/Mk

# svn checkout https://svn.FreeBSD.org/ports/head/lang/go /usr/ports/lang/go


# cd /usr/ports/security/obfs4proxy-tor

# make install clean

# pkg delete subversion


I'm not a big BSD user so I followed instructions from FreeBSD site and removed subversion when I was done.  That said, I'm pretty sure this could have been done a bit quicker by simply downloading the obfs4 port from the direct link and running `make install`.

In any case, this method I used was successful even if it was a bit slow as it downloaded the entire svn head dir...






https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers


Links:
https://trac.torproject.org/projects/tor/wiki/TorRelayGuide


https://community.torproject.org/relay/setup/guard/freebsd/

https://community.torproject.org/relay/setup/bridge/freebsd/
https://community.torproject.org/relay/setup/bridge/post-install/


https://2019.www.torproject.org/docs/faq.html

https://blog.torproject.org/remote-work-personal-safety



    Labels:

    Comments

    Post a Comment

    Popular posts from this blog

    Installing Kali NetHunter on OnePlus One

    I found this in my notes from when I loaded NetHunter on my old OnePlus one a while back.  Thought someone might find it useful so enjoy.. (apologies for the formatting, copy/paste from google docs broke some things..) 1) Backup The first thing to do is backup your OnePlus One! This can be done many ways but i found the following commands useful:  Adb pull /storage/ /local/path/to/stuff/storage  Adb pull /sdcard/ /local/path/to/stuff/sdcard Once your data is backed up verify that you have what you need before moving on. The later steps will ERASE ALL YOUR DATA! 2) Install stock CyanogenMod Once all important data is backed up, we are ready to install CyanogenMod 2.1) Download The first (and hardest) part of this install is finding the binaries. Unfortunately, CyanogenMod has moved on and is no longer supported. This means official links are no longer available. Cyanogenmod.org looks dead, and cyngn.com domain now belongs to an autonomous vehicle com
    Post a Comment
    Read more

    VirtualBox Guest Additions

    I always forget how to setup VirtualBox Guest Additions so decided to actually take some notes to simplify the process next time. The docs on their site are great, but there are too many links so I needed something a little more direct.  I needed the "for dummie's" version.. So, here it is.. Why Guest Additions? For me the shared clipboard and seamless mode make working in the VM less of a hassle so they are essential.  There are also some other usefull features you can read about in the manual . Installing Guest Additions on Ubuntu Guest Update the system... # sudo apt update && sudo apt upgrade -y Prepare the system with kernel modules   # sudo apt install kbuild linux-headers-$(uname -r) Insert the Guest Additions iso Mount the Guest Additions iso # sudo mkdir -p /mnt/cdrom # sudo mount /dev/cdrom /mnt/cdrom # sudo /mnt/cdrom/VBoxLinuxAdditions.run Enable shared clipboard Reboot the system # sudo reboot now And th
    Post a Comment
    Read more