March 2021 - tor-commits - lists.torproject.org

[community/staging] Add section FAQ for trainers
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit dfa4602b6472791db6b23e33fbc7161396ff3723 Author: gus <gus(a)torproject.org> Date: Wed Oct 2 15:12:14 2019 -0400 Add section FAQ for trainers --- content/training/faq/contents.lr | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/content/training/faq/contents.lr b/content/training/faq/contents.lr new file mode 100644 index 0000000..f305b85 --- /dev/null +++ b/content/training/faq/contents.lr @@ -0,0 +1,37 @@ +_model: page +--- +title: Tor Training FAQ +--- +body: + +After running a couple of Tor training, you will find out that first time users have some similar questions about Tor. Here we aggregate the most frequent questions that we listened during our training sessions and you must be aware before running your training. For an extensive resource check [Support portal](https://support.torproject.org). + + * [Why is it called Tor?](https://support.torproject.org/about/why-is-it-called-tor/) + * [Does using Tor Browser protect other applications on my computer?](https://support.torproject.org/tbb/tbb-13/) + * [Using Tor with a VPN is more secure?](https://support.torproject.org/faq/faq-5/) + * [Can I browse normal HTTPS sites with Tor?](https://support.torproject.org/https/https-2/) + * [Is it possible to find out the path that a client is taking on the Tor Network?](https://support.torproject.org/misc/misc-1/) + * [Why don't you prevent bad people from doing bad things when using Tor?](https://support.torproject.org/misc/misc-2/) + * [When I use Tor Browser, will anyone be able to tell which websites I visit?](https://support.torproject.org/tbb/tbb-3/) + * [Why did my search engine switch to DuckDuckGo? Or what is DuckDuckGo?](https://support.torproject.org/tbb/tbb-41/) + * [What is a bridge?](https://support.torproject.org/censorship/censorship-7/) + * [Tor Browser won't connect, but it doesn’t seem to be an issue with censorship.](https://support.torproject.org/tbb/tbb-20/) + * [What is the difference between using Tor Browser and 'Incognito mode' or private tabs? ](https://support.torproject.org/tbb/tbb-and-incognito-mode/) + * [Does running Tor Browser make me a relay?](https://support.torproject.org/tbb/tbb-33/) + * [Who funds Tor](https://support.torproject.org/misc/misc-3/) + * [Is there a backdoor in Tor?](https://support.torproject.org/about/backdoor/) + +--- +color: primary +--- +html: two-columns-page.html +--- +key: 5 +--- +section: Training +--- +section_id: training +--- +subtitle: + +You probably should know these answers before teaching about Tor

1 0

[community/staging] Change how to contact community team
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 626a02bb52a3ecca99cc5bd7e68e1ba1c2e30913 Author: gus <gus(a)torproject.org> Date: Wed Oct 2 10:56:36 2019 -0400 Change how to contact community team --- content/training/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/training/contents.lr b/content/training/contents.lr index 9024fb8..2d7693c 100644 --- a/content/training/contents.lr +++ b/content/training/contents.lr @@ -23,4 +23,4 @@ body: Are you a Tor trainer or interested in becoming one? Looking for resources to help your community learn the most about Tor? We've got you covered. For some users with serious threat models, teaching Tor and other privacy tools can be risky if not done with care. -If this describes your community, or if you're not sure, please [contact our community team](https://trac.torproject.org/projects/tor/wiki/org/teams/CommunityTeam… for more help. +If this describes your community, or if you're not sure, please [contact our Community Team](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-community-t… for more help.

1 0

[community/staging] Removed extra CoC link
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit b2a4dd4d74ab6558a46b525d0829461b53a9e47f Author: gus <gus(a)torproject.org> Date: Wed Oct 2 12:08:49 2019 -0400 Removed extra CoC link --- content/training/code-of-conduct/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/training/code-of-conduct/contents.lr b/content/training/code-of-conduct/contents.lr index 6d39f0d..03dc97a 100644 --- a/content/training/code-of-conduct/contents.lr +++ b/content/training/code-of-conduct/contents.lr @@ -22,4 +22,4 @@ body: ## Code of Conduct for Trainers -The Tor Project is committed to fostering an inclusive environment and community. Tor is a place where people should feel safe to engage, share their point of view, and participate. You can find our code of conduct [here](https://gitweb.torproject.org/community/policies.git/tree/code_of_con… +The Tor Project is committed to fostering an inclusive environment and community. Tor is a place where people should feel safe to engage, share their point of view, and participate.

1 0

[community/staging] add OpenBSD setup for middle/guard relays (@)<
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit db2e96faa6e7c70388ffaf898e5e4752d1730538 Author: Vinicius Zavam <egypcio(a)googlemail.com> Date: Thu Oct 3 18:02:58 2019 +0000 add OpenBSD setup for middle/guard relays (@)< - recommend using more recent package, from M:Tier; - cover the use of 'openup' to update packages; - tune system's limits to operate a fine relay (fix trac ticket 27489 [0]). [0] https://trac.torproject.org/projects/tor/ticket/27489 --- .../technical-setup/guard/openbsd/contents.lr | 94 ++++++++++++++++++++++ 1 file changed, 94 insertions(+) diff --git a/content/relay-operations/technical-setup/guard/openbsd/contents.lr b/content/relay-operations/technical-setup/guard/openbsd/contents.lr new file mode 100644 index 0000000..24a5dd7 --- /dev/null +++ b/content/relay-operations/technical-setup/guard/openbsd/contents.lr @@ -0,0 +1,94 @@ +_model: page +--- +color: primary +--- +title: OpenBSD +--- +body: + +# 1. Install `tor` OpenBSD's Package + +Recent OpenBSD systems, like 6.5/amd64, already have the repository configured on `/etc/installurl` so we do not need to bother changing it. + +Should that's not your case, please adjust the `installurl` configuration file like this: + +``` +echo "https://cdn.openbsd.org/pub/OpenBSD" > /etc/installurl +``` + +Proceed with `pkg_add` to install the package: + +``` +pkg_add tor +``` + +### 2.1. Recommended Steps to Install `tor` on OpenBSD + +If you want to install a newer version of the `tor` OpenBSD's package, you can use M:Tier's binary packages: + +``` +ftp https://stable.mtier.org/openup +``` + +Right after fetching `openup` you can run it to sync M:Tier's repository and update your packages; it's an alternative to `pkg_add -u`. + +Here is how you proceed with these steps: + +``` +openup +``` + +# 3. Configure `/etc/tor/torrc` + +This is a very simple version of the `torrc` configuration file in order to run a Middle/Guard relay on the Tor network: + +``` +Nickname myBSDRelay # Change your relay's nickname to something you like +ContactInfo your@email # Please write your email address and be aware that it will be published +ORPort 443 # You might want to use/try a different port, should you want to +ExitRelay 0 +SocksPort 0 +Log notice syslog +User _tor +``` + +# 4. Change `openfiles-max` and `maxfiles` Tweaks + +By default, OpenBSD maintains a rather low limit on the maximum number of open files for a process. For a daemon such as Tor's, that opens a connection to each and every other relay (currently around 7000 relays), these limits should be raised. + +Append the following section to `/etc/login.conf`: + +``` +tor:\ + :openfiles-max=13500:\ + :tc=daemon: +``` + +OpenBSD also stores a kernel-level file descriptor limit in the sysctl variable `kern.maxfiles`. + +Increase it from the default of 7030 to 16000: + +``` +echo "kern.maxfiles=16000" >> /etc/sysctl.conf +sysctl kern.maxfiles=16000 +``` + +# 6. Start `tor`: + +Here we set `tor` to start during boot and call it for the first time: + +``` +rcctl enable tor +rcctl start tor +``` + +--- +html: two-columns-page.html +--- +key: 2 +--- +section: Middle/Guard relay +--- +section_id: relay-operations +--- +subtitle: How to deploy a Middle/Guard relay on OpenBSD

1 0

[community/staging] present NetBSD to awesome people willing to support Tor :)
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit d01fcd5fe64822fc1fd50fa3b9e778ac5295b207 Author: Vinicius Zavam <egypcio(a)googlemail.com> Date: Thu Oct 3 18:14:35 2019 +0000 present NetBSD to awesome people willing to support Tor :) - this commit kinda mirrors the up to date wiki page to the new community portal; - all fine from 'wiki/TorRelayGuide/NetBSD'; - keeping the standards for all *BSD guides, working out of the box for vanilla systems. --- .../technical-setup/guard/netbsd/contents.lr | 51 ++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/content/relay-operations/technical-setup/guard/netbsd/contents.lr b/content/relay-operations/technical-setup/guard/netbsd/contents.lr new file mode 100644 index 0000000..688cbce --- /dev/null +++ b/content/relay-operations/technical-setup/guard/netbsd/contents.lr @@ -0,0 +1,51 @@ +_model: page +--- +color: primary +--- +title: NetBSD +--- +body: + +# 1. Setup `pkg_add` + +``` +echo "PKG_PATH=http://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/$(uname -m)/$(uname -r)/All" > /etc/pkg_install.conf +``` + +# 2. Install `tor` NetBSD's package + +``` +pkg_add tor +``` + +# 3. Configure `/usr/pkg/etc/tor/torrc` + +``` +Nickname myBSDRelay # Change your relay's nickname to something you like +ContactInfo your@email # Please write your email address and be aware that it will be published +ORPort 443 # You might want to use/try a different port, should you want to +ExitRelay 0 +SocksPort 0 +Log notice syslog +``` + +# 6. Start `tor`: + +Here we set `tor` to start during boot and call it for the first time: + +``` +ln -sf /usr/pkg/share/examples/rc.d/tor /etc/rc.d/tor +echo "tor=YES" >> /etc/rc.conf +/etc/rc.d/tor start +``` + +--- +html: two-columns-page.html +--- +key: 2 +--- +section: Middle/Guard relay +--- +section_id: relay-operations +--- +subtitle: How to deploy a Middle/Guard relay on NetBSD

1 0

[community/staging] Merge branch 'patch-5'
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 74e3edb5fcc12d7830749dc21b3aae303e3df3e6 Merge: 6910083 4cbe0a2 Author: gus <gus(a)torproject.org> Date: Thu Oct 3 17:11:15 2019 -0400 Merge branch 'patch-5' .../relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[community/staging] Redirect users to get-in-touch IRC help
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 2cd3dbef03beeec1b7fdf972a1a9e8b5a89feb66 Author: Gustavo Gus <gusgustavo(a)users.noreply.github.com> Date: Thu Oct 3 21:54:14 2019 +0000 Redirect users to get-in-touch IRC help --- content/relay-operations/getting-help/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/getting-help/contents.lr b/content/relay-operations/getting-help/contents.lr index cb72875..1ef463b 100644 --- a/content/relay-operations/getting-help/contents.lr +++ b/content/relay-operations/getting-help/contents.lr @@ -8,7 +8,7 @@ body: If you run into problems while setting up your relay, you can ask your questions on the public [tor-relays mailing list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays). The list is a great resource for asking (and answering) questions, and for getting to know other relay operators. Make sure to check out the archives! -You can also get help by joining the IRC channel #tor-relays in the network [irc.oftc.net](https://www.oftc.net). +You can also get help by joining the IRC channel #tor-relays in the network [irc.oftc.net](https://support.torproject.org/get-in-touch/#irc-help). --- html: two-columns-page.html

1 0

[community/staging] better strings for l10n, layout, trailing spaces
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 5b7a3f1509fc331fe7a444eb7f2ac63c9bbb7ad6 Author: gus <gus(a)torproject.org> Date: Tue Sep 3 12:00:52 2019 -0400 better strings for l10n, layout, trailing spaces --- content/outreach/contents.lr | 3 ++- content/training/faq/contents.lr | 8 +++++--- content/training/risks/contents.lr | 22 +++++++++++++++------- content/user-testing/current/contents.lr | 4 ++-- 4 files changed, 24 insertions(+), 13 deletions(-) diff --git a/content/outreach/contents.lr b/content/outreach/contents.lr index e6d65ef..8e7206a 100644 --- a/content/outreach/contents.lr +++ b/content/outreach/contents.lr @@ -20,4 +20,5 @@ body: ##Tell the world about Tor -We love it when people bring information about Tor to their community events, conferences, and meetups. We've curated some beautiful materials for sharing in-person and on social media we welcome you to use. \ No newline at end of file +We love it when people bring information about Tor to their community events, conferences, and meetups. +We've curated some beautiful materials for sharing in-person and on social media we welcome you to use. diff --git a/content/training/faq/contents.lr b/content/training/faq/contents.lr index f305b85..69a2d72 100644 --- a/content/training/faq/contents.lr +++ b/content/training/faq/contents.lr @@ -4,10 +4,12 @@ title: Tor Training FAQ --- body: -After running a couple of Tor training, you will find out that first time users have some similar questions about Tor. Here we aggregate the most frequent questions that we listened during our training sessions and you must be aware before running your training. For an extensive resource check [Support portal](https://support.torproject.org). +After running a couple of Tor training, you will find out that first time users have some similar questions about Tor. +Here we aggregate the most frequent questions that we listened during our training sessions and you must be aware before running your training. +For an extensive resource check [Support portal](https://support.torproject.org). * [Why is it called Tor?](https://support.torproject.org/about/why-is-it-called-tor/) - * [Does using Tor Browser protect other applications on my computer?](https://support.torproject.org/tbb/tbb-13/) + * [Does using Tor Browser protect other applications on my computer?](https://support.torproject.org/tbb/tbb-13/) * [Using Tor with a VPN is more secure?](https://support.torproject.org/faq/faq-5/) * [Can I browse normal HTTPS sites with Tor?](https://support.torproject.org/https/https-2/) * [Is it possible to find out the path that a client is taking on the Tor Network?](https://support.torproject.org/misc/misc-1/) @@ -34,4 +36,4 @@ section_id: training --- subtitle: -You probably should know these answers before teaching about Tor +You probably should know these answers before teaching about Tor diff --git a/content/training/risks/contents.lr b/content/training/risks/contents.lr index 6da1774..c1fea57 100644 --- a/content/training/risks/contents.lr +++ b/content/training/risks/contents.lr @@ -4,17 +4,22 @@ title: Risks --- body: -To our knowledge, no Tor trainer has ever faced consequences as a result of training others or speaking about Tor. However, in some countries and in certain circumstances, it's possible that a simply gathering of human rights defenders could be very risky, illegal or even subject of imprisonment, physical assaults, large fines, threats, placement on government watch lists and targeting for surveillance. +To our knowledge, no Tor trainer has ever faced consequences as a result of training others or speaking about Tor. +However, in some countries and in certain circumstances, it's possible that a simply gathering of human rights defenders could be very risky, illegal or even subject of imprisonment, physical assaults, large fines, threats, placement on government watch lists and targeting for surveillance. If you want to run a Tor training for the first time and you don't know how to assess the political and social environment, we strongly encourage you read this document and, in case of doubt, to reach out Tor Community Team privately. -Some of potential risks of running a digital security training are only valid in specific contexts. Therefore the potential risks associated to running a Tor training depend on: +Some of potential risks of running a digital security training are only valid in specific contexts. +Therefore the potential risks associated to running a Tor training depend on: 1. **Your threat model.** A high-profile activist already under a lot of surveillance, for example, might attract more attention when reaching out other activists to run a digital security training. 2. **The laws and regulations in the country.** Best to consult with local lawyers and local freedom of expression organizations, and learn whether your country has a record in prosecuting individuals engaging in similar types of activities. -3. **The types of training.** Not all trainings carry the same weight in terms of potential risk. For example, talking about privacy on digital age might be appreciable, but teaching how to circumvent government censorship could be a serious felony. +3. **The types of training.** Not all trainings carry the same weight in terms of potential risk. + For example, talking about privacy on digital age might be appreciable, but teaching how to circumvent government censorship could be a serious felony. 4. **The audience.** Gathering university students might not attract attention, but in case of a group of journalists working on leaked documents about government corruption, you might need to be extra careful on how to reach out them in a private way. -5. **The training venue.** Running a Tor training in some spaces could expose your participants identity. Ideally, you should use a private space that you can control the participants entrance. Check before the training if participants are comfortable on revealing their identity to a third party, if it's the case. +5. **The training venue.** Running a Tor training in some spaces could expose your participants identity. + Ideally, you should use a private space that you can control the participants entrance. + Check before the training if participants are comfortable on revealing their identity to a third party, if it's the case. ## Evaluating risks @@ -29,12 +34,15 @@ Some questions you may want to answer before running a digital security training Note, this is not an exhaustive list of questions. -Additionally, while many countries do not have laws specifically prohibiting the activity of running digital security training, the use of digital security tools may still be criminalized in certain countries under other, broader laws. For example, using Tor Browser may be viewed as illegal or anti-government activity. +Additionally, while many countries do not have laws specifically prohibiting the activity of running digital security training, the use of digital security tools may still be criminalized in certain countries under other, broader laws. +For example, using Tor Browser may be viewed as illegal or anti-government activity. -Please note that we are not lawyers, and any information we give you does not constitute legal advice. Additionally, your communication with us is not protected by any legal privilege so law enforcement may subpoena and obtain any information you give us. However, we may be able to put you in touch with lawyers who are capable of addressing your questions and/or concerns. +Please note that we are not lawyers, and any information we give you does not constitute legal advice. +Additionally, your communication with us is not protected by any legal privilege so law enforcement may subpoena and obtain any information you give us. +However, we may be able to put you in touch with lawyers who are capable of addressing your questions and/or concerns. Some relevant resources include: - + * [EFF Know your rights](https://www.eff.org/issues/know-your-rights) * [EFF Tor legal FAQ](https://community.torproject.org/relay/community-resources/eff-tor-leg… * [OONI disclaimer](https://ooni.io/about/risks/) diff --git a/content/user-testing/current/contents.lr b/content/user-testing/current/contents.lr index 1d10937..d71015f 100644 --- a/content/user-testing/current/contents.lr +++ b/content/user-testing/current/contents.lr @@ -8,9 +8,9 @@ image: clipboard --- _template: layout.html --- -title: Currently Testing Stuffs +title: Currently Testing Stuffs[FIXME] --- -subtitle: Link to somewhere we csan update more than this webpage, even banners will be tedious if we do testing all the time. We can even oput some thing puilled from there and have it populated here. +subtitle: Link to somewhere we can update more than this webpage, even banners will be tedious if we do testing all the time. We can even output some thing pulled from there and have it populated here.[FIXME] --- key: 1 ---

1 0

[community/staging] update FreeBSD setup guide for middle/guard relays;
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 6910083da66d719b880069e6a3a21c3ef00677a1 Author: Vinicius Zavam <egypcio(a)googlemail.com> Date: Thu Oct 3 17:49:49 2019 +0000 update FreeBSD setup guide for middle/guard relays; - ensure we cover also pkg's bootstrap (for vanila systems w/o any available package); - track the 'latest' branch used by pkg to get more frequent packages updates; - use HTTPS:// on the repository url (needs extra package, ca_root_nss); - cover starting our daemon on port 443, but still as '_tor' non-root user. --- .../technical-setup/guard/freebsd/contents.lr | 104 ++++++++++++++------- 1 file changed, 69 insertions(+), 35 deletions(-) diff --git a/content/relay-operations/technical-setup/guard/freebsd/contents.lr b/content/relay-operations/technical-setup/guard/freebsd/contents.lr index b442ca8..8744d31 100644 --- a/content/relay-operations/technical-setup/guard/freebsd/contents.lr +++ b/content/relay-operations/technical-setup/guard/freebsd/contents.lr @@ -6,68 +6,102 @@ title: FreeBSD --- body: -# 1. Enable Automatic Software Updates +# 1. Enable Automatic Updates for Packages One of the most imported things to keeps your relay secure is to install security updates timely and ideally automatically so you can not forget about it. Follow the instructions to enable [automatic software updates](updates) for your operating system. -# 2. Install the tor package +# 2. Bootstrap `pkg` -`pkg install tor ca_root_nss` +This article considers we have already a base installation of FreeBSD running, and only the base system (here, we are running 12.0-RELEASE). That means we do not have any packages installed neither the `pkg` packages manager itself (there's no `sudo` available - we are running commands as root). -or for alpha releases: +To bootstrap and install `pkg` we should run the following command: -`pkg install tor-devel ca_root_nss` +``` +pkg bootstrap +pkg update -f +``` + +### 2.1. Recommended Steps to Setup `pkg` + +To follow upstream updates in a "faster way" we recommend changing the 'quarterly' branch used by `pkg` to its 'latest' branch. + +One additional step is to prefer using HTTPS to fetch our packages, and updates - so here we also need an extra package to help us out (ca_root_nss). -# 3. Put the configuration file `/usr/local/etc/tor/torrc` in place +Installing the `ca_root_nss` package: ``` -#change the nickname "myNiceRelay" to a name that you like -Nickname myNiceRelay -ORPort 9001 -ExitRelay 0 -SocksPort 0 -# Change the email address bellow and be aware that it will be published -ContactInfo tor-operator@your-emailaddress-domain -Log notice syslog +pkg install ca_root_nss ``` -# 4. Ensure that the `random_id` sysctl setting is enabled: +We are keeping the original setting used by `pkg` but setting a new one that will override it, so we set up a new directory and than create a configuration file to override what we need. This configuration file will be `/usr/local/etc/pkg/repos/FreeBSD.conf`. + +Creating the new directory: ``` -echo "net.inet.ip.random_id=1" >> /etc/sysctl.conf -sysctl net.inet.ip.random_id=1 +mkdir -p /usr/local/etc/pkg/repos ``` -# 5. Start the tor daemon and make sure it starts at boot: +This is how the new configuration file `/usr/local/etc/pkg/repos/FreeBSD.conf` must look like: ``` -sysrc tor_enable=YES -service tor start +FreeBSD: { + url: pkg+https://pkg.freebsd.org/${ABI}/latest +} ``` -### Optional but recommended +After applying all these changes, we update the packages list again and try to check if there's already a new update to apply: -To get package updates faster after they have been build it is best to switch from the "quarterly" with "latest" repository. +``` +pkg update -f +pkg upgrade -y -f +``` -Create the following folder: +# 3. Install `tor` FreeBSD's Package -`mkdir -p /usr/local/etc/pkg/repos` +Here we can choose to install the latest stable version, like: -and create the file `/usr/local/etc/pkg/repos/FreeBSD.conf` with the following content: +``` +pkg install tor +``` + + ... or install an alpha release: + +``` +pkg install tor-devel ``` -FreeBSD: { enabled: no } -FreeBSDlatest: { - url: "pkg+https://pkg.FreeBSD.org/${ABI}/latest", - mirror_type: "srv", - signature_type: "fingerprints", - fingerprints: "/usr/share/keys/pkg", - enabled: yes -} +# 4. Configure `/usr/local/etc/tor/torrc` + +This is a very simple version of the `torrc` configuration file in order to run a Middle/Guard relay on the Tor network: + +``` +Nickname myBSDRelay # Change your relay's nickname to something you like +ContactInfo your@email # Please write your email address and be aware that it will be published +ORPort 443 # You might want to use/try a different port, should you want to +ExitRelay 0 +SocksPort 0 +Log notice syslog +``` + +# 5. Ensure `net.inet.ip.random_id` is enabled: + +``` +echo "net.inet.ip.random_id=1" >> /etc/sysctl.conf +sysctl net.inet.ip.random_id=1 +``` + +# 6. Start `tor`: + +Here we set `tor` to start at boot time and use the setuid feature, in order to bind to lower ports like 443 (the daemon itself will still run as a regular non-privileged user). + +``` +sysrc tor_setuid=YES +sysrc tor_enable=YES +service tor start ``` -# 6. Final notes +# 7. Final Notes If you are having troubles setting up your relay, have a look at our [help section](/relay/getting-help/). If your relay is now running, check out the [post-install](/relay/setup/post-install/) notes. --- @@ -79,4 +113,4 @@ section: Middle/Guard relay --- section_id: relay-operations --- -subtitle: How to deploy a middle/Guard relay on FreeBSD +subtitle: How to deploy a Middle/Guard relay on FreeBSD

1 0

[community/staging] bring DragonflyBSD to build bridges with us;
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 3c5efc632f2e3d1eab05133c83d832a95b868b51 Author: Vinicius Zavam <egypcio(a)googlemail.com> Date: Fri Oct 4 19:16:47 2019 +0000 bring DragonflyBSD to build bridges with us; - dfbsd is based on FreeBSD, and still keeps its default settings/paths; - packages names and most configurations are just the same as fbsd; - obfs4 is available! we can have more diverse bridges running :) --- .../bridge/dragonflybsd/contents.lr | 140 +++++++++++++++++++++ 1 file changed, 140 insertions(+) diff --git a/content/relay-operations/technical-setup/bridge/dragonflybsd/contents.lr b/content/relay-operations/technical-setup/bridge/dragonflybsd/contents.lr new file mode 100644 index 0000000..7300d3d --- /dev/null +++ b/content/relay-operations/technical-setup/bridge/dragonflybsd/contents.lr @@ -0,0 +1,140 @@ +_model: page +--- +color: primary +--- +title: DragonflyBSD +--- +html: two-columns-page.html +--- +key: 3 +--- +body: + +### 1. Bootstrap `pkg` + +DragonFlyBSD's daily snapshots and releases (starting with 3.4) come with `pkg` already installed. Upgrades from earlier releases, however, will not have it. + +If `pkg` is missing on the system for any reason, it can be quickly bootstrapped without having to build it from source or even having **DPorts** installed: + +``` +cd /usr +make pkg-bootstrap +rehash +pkg-static install -y pkg +rehash +``` + +##### 1.1. Recommended Steps to Setup `pkg` + +Here, it will be similar to what we have on a **FreeBSD** system, and we are going to use HTTPS to fetch our packages, and updates - so here we also need an extra package to help us out (`ca_root_nss`). + +Installing the `ca_root_nss` package: + +``` +pkg install ca_root_nss +``` + +For fresh installations, the file `/usr/local/etc/pkg/repos/df-latest.conf.sample` is copied to `/usr/local/etc/pkg/repos/df-latest`. The files ending in the ".sample" extension are ignored; pkg(8) only reads files that end in ".conf" and it will read as many as it finds. + +**DragonflyBSD** has 2 packages repositories: + + - Avalon (mirror-master.dragonflybsd.org) + - Wolfpond (pkg.wolfpond.org) + +We can simply edit the **URL** used to point out the repositories on `/usr/local/etc/pkg/repos/df-latest` and that's it! Remember to use **pkg+https://** for Avalon. + +After applying all these changes, we update the packages list again and try to check if there's already a new update to apply: + +``` +pkg update -f +pkg upgrade -y -f +``` + +### 2. Install `tor` DragonflyBSD's Package + +Here we can choose to install the latest stable version, like: + +``` +pkg install tor +``` + + ... or install an alpha release: + + +``` +pkg install tor-devel + +### 3. Configure `/usr/local/etc/tor/torrc` to run **Tor** as a Bridge + +``` +RunAsDaemon 1 +BridgeRelay 1 + +# Replace "TODO1" with a Tor port of your choice. This port must be externally +# reachable. Avoid port 9001 because it's commonly associated with Tor and +# censors may be scanning the Internet for this port. +ORPort TODO1 + +ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy + +# Replace "TODO2" with an obfs4 port of your choice. This port must be +# externally reachable and must be different from the one specified for ORPort. +# Avoid port 9001 because it's commonly associated with +# Tor and censors may be scanning the Internet for this port. +ServerTransportListenAddr obfs4 0.0.0.0:TODO2 + +# Local communication port between Tor and obfs4. Always set this to "auto". +# "Ext" means "extended", not "external". Don't try to set a specific port +# number, nor listen on 0.0.0.0. +ExtORPort auto + +# Replace "<address(a)email.com>" with your email address so we can contact you if +# there are problems with your bridge. This is optional but encouraged. +ContactInfo <address(a)email.com> + +# Pick a nickname that you like for your bridge. This is optional. +Nickname PickANickname + +Log notice file /var/log/tor/notices.log +``` + +Don't forget to change the `ORPort`, `ServerTransportListenAddr`, `ContactInfo`, and `Nickname` options. + +* Please note that both `ORPort` and the port you used as `TODO2` (for obfs4) must be reachable. If your bridge is behind a firewall or NAT, make sure to open/forward both ports. You can use [our reachability test](https://bridges.torproject.org/scan/) to see if your obfs4 port is reachable from the Internet. + +* Are you firewalling your DragonflyBSD? If so, make sure that `obfs4proxy` can talk to `tor` over the loopback interface - do not forget to whitelist the **ExtORPort**. + +### 4. Start `tor`: + +Here we set `tor` to start at boot time and use the setuid feature, in order to bind to lower ports like 443 (the daemon itself will still run as a regular non-privileged user). + +``` +echo "tor_setuid=YES" >> /etc/rc.conf +echo "tor_enable=YES" >> /etc/rc.conf +service tor start +``` + +### 5. Monitor your logs + +To confirm your bridge is running with no issues, you should see something like this in `/var/log/tor/notices.log`: + +``` +[notice] Your Tor server's identity key fingerprint is '<NICKNAME> <FINGERPRINT>' +[notice] Your Tor bridge's hashed identity key fingerprint is '<NICKNAME> <HASHED FINGERPRINT>' +[notice] Registered server transport 'obfs4' at '[::]:46396' +[notice] Tor has successfully opened a circuit. Looks like client functionality is working. +[notice] Bootstrapped 100%: Done +[notice] Now checking whether ORPort <redacted>:3818 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) +[notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. +``` + +### 6. Final Notes + +If you are having troubles setting up your bridge, have a look at [our help section](https://community.torproject.org/relay/getting-help/). If your bridge is now running, check out the [post-install notes](https://community.torproject.org/relay/setup/bridge/post-install/). + +--- +subtitle: How to deploy an obfs4 bridge on DragonflyBSD +--- +section: Bridge +--- +section_id: bridge

1 0