September 2019 - tor-commits - lists.torproject.org

[community/master] Added Fedora Instructions
by phw＠torproject.org 04 Sep '19

04 Sep '19

commit ea704abd8de6908876106b4881844f3299a6ae34 Author: Christopher King <bunnyapocalypse(a)protonmail.com> Date: Fri Aug 30 23:55:39 2019 +0000 Added Fedora Instructions So this is what I needed to do in order to get my fedora server up and running as a bridge, and I've added these instructions as if these problems only affect Fedora users, but I would be surprised if that's the case, because the alternative ports that are encouraged in this guide for ORPort and ServerTransportListenAddr are exactly what selinux is supposed to stop. Because of that, I'd imagine that this would function the same on CentOS SUSE and RHEL. As for why the fedora instructions install the executable into normal bin, that's because you run into selinux problems there too when it's in /usr/local/bin , but problems that were more complicated than my tiny selinux knowledge can deal with. policycoreutils-python-utils is needed for semanage. --- .../bridge/centos-rhel-opensuse/contents.lr | 56 ++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr b/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr index 16e12e5..0ecdfc5 100644 --- a/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr +++ b/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr @@ -21,6 +21,12 @@ yum install git golang tor zypper install tor go git ``` +* Fedora: + +``` +dnf install git golang tor policycoreutils-python-utils +``` + ### 2. Build obfs4proxy and move it into place. Heavily outdated versions of git can make `go get` fail, so try upgrading to a more recent git version if you're running into this problem. @@ -42,8 +48,18 @@ go get gitlab.com/yawning/obfs4.git/obfs4proxy sudo cp $GOPATH/bin/obfs4proxy /usr/local/bin/ ``` +* Fedora: + +``` +export GOPATH=`mktemp -d` +go get gitlab.com/yawning/obfs4.git/obfs4proxy +sudo cp $GOPATH/bin/obfs4proxy /usr/bin/ +``` + ### 3. Edit your Tor config file, usually located at `/etc/tor/torrc` and replace its content with: +* CentOS / RHEL / OpenSUSE: + ``` RunAsDaemon 1 BridgeRelay 1 @@ -72,6 +88,36 @@ ContactInfo <address(a)email.com> # Pick a nickname that you like for your bridge. This is optional. Nickname PickANickname ``` +* Fedora: + +``` +RunAsDaemon 1 +BridgeRelay 1 + +# Replace "TODO" with a Tor port of your choice. This port must be externally +# reachable. Avoid port 9001 because it's commonly associated with Tor and +# censors may be scanning the Internet for this port. +ORPort TODO + +ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy + +# Replace "TODO" with an obfs4 port of your choice. This port must be +# externally reachable. Avoid port 9001 because it's commonly associated with +# Tor and censors may be scanning the Internet for this port. +ServerTransportListenAddr obfs4 0.0.0.0:TODO + +# Local communication port between Tor and obfs4. Always set this to "auto". +# "Ext" means "extended", not "external". Don't try to set a specific port +# number, nor listen on 0.0.0.0. +ExtORPort auto + +# Replace "<address(a)email.com>" with your email address so we can contact you if +# there are problems with your bridge. This is optional but encouraged. +ContactInfo <address(a)email.com> + +# Pick a nickname that you like for your bridge. This is optional. +Nickname PickANickname +``` Don't forget to change the `ORPort`, `ServerTransportListenAddr`, `ContactInfo`, and `Nickname` options. @@ -79,8 +125,18 @@ Nickname PickANickname ### 4. Restart tor +* CentOS / RHEL / OpenSUSE: + `systemctl restart tor` +* Fedora: + +``` +sudo semanage port -a -t tor_port_t -p tcp [desired ORPort number set earlier] +sudo semanage port -a -t tor_port_t -p tcp [desired ServerTransportListenAddr port number set earlier] +systemctl restart tor +``` + ### 5. Monitor your logs (usually in your syslog) To confirm your bridge is running with no issues, you should see something like this:

1 0

[community/master] Make comment consistent with Fedora instructions.
by phw＠torproject.org 04 Sep '19

04 Sep '19

commit 59b8c7268ff5c50150ec45832f44798a677e7a0c Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Sep 4 12:06:43 2019 -0700 Make comment consistent with Fedora instructions. --- .../technical-setup/bridge/centos-rhel-opensuse/contents.lr | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr b/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr index 13b3119..949ab1a 100644 --- a/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr +++ b/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr @@ -85,8 +85,8 @@ Nickname PickANickname * CentOS / RHEL: ``` -sudo semanage port -a -t tor_port_t -p tcp [desired ORPort number set earlier] -sudo semanage port -a -t tor_port_t -p tcp [desired ServerTransportListenAddr port number set earlier] +sudo semanage port -a -t tor_port_t -p tcp [OR port set earlier, in TODO1] +sudo semanage port -a -t tor_port_t -p tcp [obfs4 port set earlier, in TODO2] ``` * CentOS / RHEL / OpenSUSE:

1 0

[community/master] Swap order for consistency.
by phw＠torproject.org 04 Sep '19

04 Sep '19

commit ded0deb18c6f8e06e0e008578237ab644d799f79 Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Sep 4 12:05:31 2019 -0700 Swap order for consistency. --- .../technical-setup/bridge/centos-rhel-opensuse/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr b/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr index 04b7b77..13b3119 100644 --- a/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr +++ b/content/relay-operations/technical-setup/bridge/centos-rhel-opensuse/contents.lr @@ -82,7 +82,7 @@ Nickname PickANickname ### 4. Restart tor -* RHEL / CentOS: +* CentOS / RHEL: ``` sudo semanage port -a -t tor_port_t -p tcp [desired ORPort number set earlier]

1 0

[community/master] Update contents.lr
by phw＠torproject.org 04 Sep '19

04 Sep '19

commit 58c72a4ea76a22481b46f7bc5f98a1b20909fdbb Author: Christopher King <bunnyapocalypse(a)protonmail.com> Date: Tue Sep 3 16:46:44 2019 +0000 Update contents.lr --- .../relay-operations/technical-setup/bridge/fedora/contents.lr | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/content/relay-operations/technical-setup/bridge/fedora/contents.lr b/content/relay-operations/technical-setup/bridge/fedora/contents.lr index a1584b0..40ad6a9 100644 --- a/content/relay-operations/technical-setup/bridge/fedora/contents.lr +++ b/content/relay-operations/technical-setup/bridge/fedora/contents.lr @@ -17,7 +17,11 @@ dnf install git golang tor policycoreutils-python-utils ``` export GOPATH=`mktemp -d` go get gitlab.com/yawning/obfs4.git/obfs4proxy -sudo cp $GOPATH/bin/obfs4proxy /usr/bin/ +sudo cp $GOPATH/bin/obfs4proxy /usr/local/bin/ +``` +And tell selinux to allow Tor to use obfs4proxy: +``` +/sbin/restorecon -v /usr/local/bin/obfs4proxy ``` ### 3. Edit your Tor config file, usually located at `/etc/tor/torrc` and replace its content with: @@ -31,7 +35,7 @@ BridgeRelay 1 # censors may be scanning the Internet for this port. ORPort TODO -ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy +ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy # Replace "TODO" with an obfs4 port of your choice. This port must be # externally reachable. Avoid port 9001 because it's commonly associated with

1 0

[community/master] Merge branch 'fedora-guide' of github.com:BunnyApocalypse/community into fedora-guide
by phw＠torproject.org 04 Sep '19

04 Sep '19

commit ba29705a7f40bdde753895190d0706333d515ab9 Merge: 31fda16 58c72a4 Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Sep 4 09:26:44 2019 -0700 Merge branch 'fedora-guide' of github.com:BunnyApocalypse/community into fedora-guide .../technical-setup/bridge/fedora/contents.lr | 106 +++++++++++++++++++++ 1 file changed, 106 insertions(+)

1 0

[community/master] Harmonise instructions with other guides.
by phw＠torproject.org 04 Sep '19

04 Sep '19

commit e2b8aa6cbebe15f24e38b58ca3f27403b1746f36 Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Sep 4 09:44:59 2019 -0700 Harmonise instructions with other guides. In particular: * Use "TODO1" and "TODO2" to make it clear that the OR and the obfs4 port are separate ports. * Slightly rephrase comments for selinux commands. * Fix link to help section. * Fix subtitle. --- .../technical-setup/bridge/fedora/contents.lr | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/content/relay-operations/technical-setup/bridge/fedora/contents.lr b/content/relay-operations/technical-setup/bridge/fedora/contents.lr index 40ad6a9..d4c2734 100644 --- a/content/relay-operations/technical-setup/bridge/fedora/contents.lr +++ b/content/relay-operations/technical-setup/bridge/fedora/contents.lr @@ -30,17 +30,18 @@ And tell selinux to allow Tor to use obfs4proxy: RunAsDaemon 1 BridgeRelay 1 -# Replace "TODO" with a Tor port of your choice. This port must be externally +# Replace "TODO1" with a Tor port of your choice. This port must be externally # reachable. Avoid port 9001 because it's commonly associated with Tor and # censors may be scanning the Internet for this port. -ORPort TODO +ORPort TODO1 ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy -# Replace "TODO" with an obfs4 port of your choice. This port must be -# externally reachable. Avoid port 9001 because it's commonly associated with +# Replace "TODO2" with an obfs4 port of your choice. This port must be +# externally reachable and must be different from the one specified for ORPort. +# Avoid port 9001 because it's commonly associated with # Tor and censors may be scanning the Internet for this port. -ServerTransportListenAddr obfs4 0.0.0.0:TODO +ServerTransportListenAddr obfs4 0.0.0.0:TODO2 # Local communication port between Tor and obfs4. Always set this to "auto". # "Ext" means "extended", not "external". Don't try to set a specific port @@ -62,8 +63,8 @@ Nickname PickANickname ### 4. Restart tor ``` -sudo semanage port -a -t tor_port_t -p tcp [desired ORPort number set earlier] -sudo semanage port -a -t tor_port_t -p tcp [desired ServerTransportListenAddr port number set earlier] +sudo semanage port -a -t tor_port_t -p tcp [OR port set earlier, in TODO1] +sudo semanage port -a -t tor_port_t -p tcp [obfs4 port set earlier, in TODO2] systemctl restart tor ``` @@ -84,7 +85,7 @@ To confirm your bridge is running with no issues, you should see something like ### 6. Final notes If you are having troubles setting up your bridge, have a look at [our help -section](https://community.torproject.org/relay/setup/bridge/getting-help/). If +section](https://community.torproject.org/relay/getting-help/). If your bridge is now running, check out the [post-install notes](https://community.torproject.org/relay/setup/bridge/post-install/). @@ -97,7 +98,7 @@ key: --- color: primary --- -subtitle: How to deploy an obfs4 bridge on CentOS / RHEL / OpenSUSE +subtitle: How to deploy an obfs4 bridge on Fedora --- _template: layout.html ---

1 0

[community/master] Added Fedora Guide
by phw＠torproject.org 04 Sep '19

04 Sep '19

commit 00e385fc1fbf6469a240ab6e2c84eff12487ee81 Author: Chris King <bunnyapocalypse(a)protonmail.com> Date: Tue Sep 3 11:26:27 2019 -0500 Added Fedora Guide --- .../technical-setup/bridge/fedora/contents.lr | 102 +++++++++++++++++++++ 1 file changed, 102 insertions(+) diff --git a/content/relay-operations/technical-setup/bridge/fedora/contents.lr b/content/relay-operations/technical-setup/bridge/fedora/contents.lr new file mode 100644 index 0000000..a1584b0 --- /dev/null +++ b/content/relay-operations/technical-setup/bridge/fedora/contents.lr @@ -0,0 +1,102 @@ +_model: page +--- +color: primary +--- +title: Fedora +--- +body: + +### 1. Install tor and dependencies + +``` +dnf install git golang tor policycoreutils-python-utils +``` + +### 2. Build obfs4proxy and move it into place. + +``` +export GOPATH=`mktemp -d` +go get gitlab.com/yawning/obfs4.git/obfs4proxy +sudo cp $GOPATH/bin/obfs4proxy /usr/bin/ +``` + +### 3. Edit your Tor config file, usually located at `/etc/tor/torrc` and replace its content with: + +``` +RunAsDaemon 1 +BridgeRelay 1 + +# Replace "TODO" with a Tor port of your choice. This port must be externally +# reachable. Avoid port 9001 because it's commonly associated with Tor and +# censors may be scanning the Internet for this port. +ORPort TODO + +ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy + +# Replace "TODO" with an obfs4 port of your choice. This port must be +# externally reachable. Avoid port 9001 because it's commonly associated with +# Tor and censors may be scanning the Internet for this port. +ServerTransportListenAddr obfs4 0.0.0.0:TODO + +# Local communication port between Tor and obfs4. Always set this to "auto". +# "Ext" means "extended", not "external". Don't try to set a specific port +# number, nor listen on 0.0.0.0. +ExtORPort auto + +# Replace "<address(a)email.com>" with your email address so we can contact you if +# there are problems with your bridge. This is optional but encouraged. +ContactInfo <address(a)email.com> + +# Pick a nickname that you like for your bridge. This is optional. +Nickname PickANickname +``` + + Don't forget to change the `ORPort`, `ServerTransportListenAddr`, `ContactInfo`, and `Nickname` options. + +* Note that both Tor's OR port and its obfs4 port must be reachable. If your bridge is behind a firewall or NAT, make sure to open both ports. You can use [our reachability test](https://bridges.torproject.org/scan/) to see if your obfs4 port is reachable from the Internet. + +### 4. Restart tor + +``` +sudo semanage port -a -t tor_port_t -p tcp [desired ORPort number set earlier] +sudo semanage port -a -t tor_port_t -p tcp [desired ServerTransportListenAddr port number set earlier] +systemctl restart tor +``` + +### 5. Monitor your logs (usually in your syslog) + +To confirm your bridge is running with no issues, you should see something like this: + +``` +[notice] Your Tor server's identity key fingerprint is '<NICKNAME> <FINGERPRINT>' +[notice] Your Tor bridge's hashed identity key fingerprint is '<NICKNAME> <HASHED FINGERPRINT>' +[notice] Registered server transport 'obfs4' at '[::]:46396' +[notice] Tor has successfully opened a circuit. Looks like client functionality is working. +[notice] Bootstrapped 100%: Done +[notice] Now checking whether ORPort <redacted>:3818 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) +[notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. +``` + +### 6. Final notes + +If you are having troubles setting up your bridge, have a look at [our help +section](https://community.torproject.org/relay/setup/bridge/getting-help/). If +your bridge is now running, check out the [post-install +notes](https://community.torproject.org/relay/setup/bridge/post-install/). + +--- +html: two-columns-page.html +--- +key: + +2 +--- +color: primary +--- +subtitle: How to deploy an obfs4 bridge on CentOS / RHEL / OpenSUSE +--- +_template: layout.html +--- +section: bridge +--- +section_id: bridge

1 0

[translation/torbutton-abouttbupdatedtd_completed] https://gitweb.torproject.org/translation.git/commit/?h=torbutton-abouttbupdatedtd_completed
by translation＠torproject.org 04 Sep '19

04 Sep '19

commit 2418bac4a63b68727e2c45654b665f56abb444c9 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Sep 4 16:22:21 2019 +0000 https://gitweb.torproject.org/translation.git/commit/?h=torbutton-abouttbup… --- it/abouttbupdate.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/it/abouttbupdate.dtd b/it/abouttbupdate.dtd index e40ec576f..d179811ba 100644 --- a/it/abouttbupdate.dtd +++ b/it/abouttbupdate.dtd @@ -1,5 +1,5 @@ <!ENTITY aboutTBUpdate.changelogTitle "Cronologia Tor Browser"> -<!ENTITY aboutTBUpdate.updated "Il Browser TOR è stato aggiornato."> +<!ENTITY aboutTBUpdate.updated "Il Tor Browser è stato aggiornato."> <!ENTITY aboutTBUpdate.linkPrefix "Per maggiori informazioni su questa versione,"> <!ENTITY aboutTBUpdate.linkLabel "visita il nostro sito web"> <!ENTITY aboutTBUpdate.linkSuffix ".">

1 0

[translation/torbutton-abouttbupdatedtd] https://gitweb.torproject.org/translation.git/commit/?h=torbutton-abouttbupdatedtd
by translation＠torproject.org 04 Sep '19

04 Sep '19

commit 44712497857c87d740af919e77221cf7b431f103 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Sep 4 16:22:15 2019 +0000 https://gitweb.torproject.org/translation.git/commit/?h=torbutton-abouttbup… --- it/abouttbupdate.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/it/abouttbupdate.dtd b/it/abouttbupdate.dtd index e40ec576f..d179811ba 100644 --- a/it/abouttbupdate.dtd +++ b/it/abouttbupdate.dtd @@ -1,5 +1,5 @@ <!ENTITY aboutTBUpdate.changelogTitle "Cronologia Tor Browser"> -<!ENTITY aboutTBUpdate.updated "Il Browser TOR è stato aggiornato."> +<!ENTITY aboutTBUpdate.updated "Il Tor Browser è stato aggiornato."> <!ENTITY aboutTBUpdate.linkPrefix "Per maggiori informazioni su questa versione,"> <!ENTITY aboutTBUpdate.linkLabel "visita il nostro sito web"> <!ENTITY aboutTBUpdate.linkSuffix ".">

1 0

[community/master] Fix broken installation path.
by phw＠torproject.org 04 Sep '19

04 Sep '19

commit 31fda162a25a06f979c49b85c788ee268664cb19 Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Sep 4 09:04:56 2019 -0700 Fix broken installation path. Thanks to Wolfgang for pointing out this issue and to egypcio for confirming that it was indeed an issue. --- content/relay-operations/technical-setup/bridge/freebsd/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/technical-setup/bridge/freebsd/contents.lr b/content/relay-operations/technical-setup/bridge/freebsd/contents.lr index 951ef31..93f7aec 100644 --- a/content/relay-operations/technical-setup/bridge/freebsd/contents.lr +++ b/content/relay-operations/technical-setup/bridge/freebsd/contents.lr @@ -27,7 +27,7 @@ BridgeRelay 1 # censors may be scanning the Internet for this port. ORPort TODO1 -ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy +ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy # Replace "TODO2" with an obfs4 port of your choice. This port must be # externally reachable and must be different from the one specified for ORPort.

1 0