Tor

USE flags

Emerge

Install net-vpn/tor:

Services

Emerge messages

* Messages for package net-misc/tor-0.2.3.25:

* We created a configuration file for tor, /etc/tor/torrc, but you can
* change it according to your needs.  Use the torrc.sample that is in
* that directory as a guide.  Also, to have privoxy work with tor
* just add the following line
* 
* forward-socks4a / localhost:9050 .
* 
* to /etc/privoxy/config.  Notice the . at the end!

Browsers

<syntaxhighlight lang="javascript">function FindProxyForURL(url, host)
{
   if(host.match(/^(localhost|127[.]0[.]0[.]1|192[.]168[.]1[.]1)$/))
       return 'DIRECT';
   if(host.match(/[.]i2p$/))
       return 'PROXY 127.0.0.1:4444';

   return 'SOCKS 127.0.0.1:9050';
}</syntaxhighlight>

manual proxy configuration:
http proxy           port: 0
ssl proxy            port: 0
ftp proxy            port: 0
socks host 127.0.0.1 port: 9050
check SOCKS v4
No Proxy for: localhost, 127.0.0.1

network.proxy.socks_remote_dns    true
network.dns.disablePrefetch       true
network.dns.disableIPv6           true

media.peerconnection.enabled    false

SSH

openssh doesn't have any native support for SOCKS5, so you will need to install openbsd-netcat. You'll need to modify your SSH config too. It is possible with netcat' also but the configuration below uses flags specific to the OpenBSD variant.

For all hosts:

Host *
	# Tell SSH to pass its connections through netcat, using a SOCKS5 proxy at 127.0.0.1:9050 (tor default).
	ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p

	# Privacy protections
	# Prevents SSH from telling the remote server about all of your public keys, potentially revealing your ID
	ForwardAgent no
	IdentitiesOnly yes

        # Merges connections to a server to prevent expensive reconnections
        # To avoid this, invoke ssh as: ssh -o 'ControlMaster no' ...
	ControlMaster auto
	ControlPath ~/.ssh/master-%r@%n:%p

        # Compression for low bandwidth lines (like Tor)
	Compression yes

You may prefer to do this for a specific host:

Host yourserver.com
        ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p

You could instead want to only enable the proxy for .onion addresses:

Host *.onion
        ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p

DNS

Some applications may leak DNS requests. The easiest way to check if this really happens is to look at system logs.

If an application is configured correctly, nothing shows in the logs. Below is an example of a message for a misconfigured application (or for a webpage that stores links in form of IP addresses):

Oct 14 14:44:44 localhost Tor[666]: Your application (using socks5 to port 80) is giving Tor only an IP address. 
Applications that do DNS resolves themselves may leak information. Consider using Socks4A (e.g. via privoxy or socat) instead. 
For more information, please see https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.

In order to check how this works, one needs to give an application an IP address instead of a domain name, retrieved by running the tor-resolve command for example.

<pre>
...
## Torified DNS
DNSPort 127.0.0.1:9053
AutomapHostsOnResolve 1
</pre>

<pre>
nameserver 127.0.0.1
</pre>

<pre>
nohook resolv.conf
</pre>

<pre>
DNSTYPE=NOCHANGE
</pre>

Disabling non-tor traffic

The following iptables rules will prevent non-Tor traffic leaving the host and disable all new connections from outside in case if the host must be configured as a Tor client:

And to flush these and any other existing rules:

Firewall

If you want allow Tor use only special addresses you can specify it. For example our firewall allow outgoing connection only through https (443) port, so add to /etc/tor/torrc:

# If 1, Tor will only create outgoing connections to ORs running on ports that your firewall allows
FascistFirewall 1
# A comma-separated list of IP addresses and ports that your firewall allows you to connect to.
ReachableAddresses accept *:443, reject *:*
ReachableORAddresses *:443

torsocks

For applications which do not support the use of proxies or Tor, you can use the "torsocks" command to force their traffic through the Tor network. (e.g. - torsocks irssi -c irc.afraidirc.net or torify irssi -c mqctemuqfc3tp5ji.onion).

<pre>
...
## Transparent proxy
TransPort 127.0.0.1:9040
</pre>

Stream isolation

You might not want to mix GPG traffic with the traffic of a web browser or to mix irssi circuits with the circuits of a bitcoin wallet. In all cases an exit node can make correlation between separate activities. Stream isolation provides an easy way to separate different Tor circuits and make different applications use isolated streams.

By default, multiple *Port lines (SocksPort, DNSPort, TransPort) will never share circuits. If you want to do stream isolation on a single *Port option, you can add one or more of the following isolation flags to *Port options: IsolateClientAddr, IsolateSOCKSAuth, IsolateClientProtocol, IsolateDestPort, IsolateDestAddr.

Note that some are enabled by default already and that more isolation flags does not necessarily mean more security/anonymity/privacy. To see the most up-to-date list of stream isolation flags, see `man tor`.

So if you want to be sure your GPG client and your instant messenger don't put streams on the same circuit, the easiest thing to do is add the following to your torrc and point them at different SocksPorts.

# gpg client
SocksPort 127.0.0.1:9100
# instant messenger
SocksPort 127.0.0.1:9150
# More isolation:
SOCKSPort 9200 IsolateClientAddr IsolateSOCKSAuth IsolateClientProtocol IsolateDestPort IsolateDestAddr
# etc...

Rules for Tor circuits

man tor gives us a good explanation of various useful options. If you want to get away from ECHELON, you may consider adding the following to /etc/tor/torrc:

StrictNodes 1
GeoIPExcludeUnknown 1
#ExcludeNodes {au}, {ca}, {gb}, {nz}, {us}
ExcludeExitNodes {au}, {ca}, {gb}, {nz}, {us}
NodeFamily {au}, {ca}, {gb}, {nz}, {us}
#UseNTorHandshake 1
PathsNeededToBuildCircuits 0.95

StrictNodes =1 together with ExcludeNodes {au}, {ca}, {gb}, {nz}, {us} will completely exclude Tor nodes from that country, but we also disallow connection to Tor hidden services located there. So it is better to comment ExcludeNodes or set StrictNodes 0. Also we mark NodeFamily {au}, {ca}, {gb}, {nz}, {us} all that nodes as "single administration" by Five Eyes. Directive NodeFamily can be used multiple times.

EntryNodes and ExitNodes can be used to select spacial nodes for entering end exit from Tor network respectively.

Instead of country codes you can use IPv4, IPv6 addresses and subnets.

Sandbox

Tor has own sandbox features. It may give more protection of your system if Tor is compromised. To turn it on, first compile Tor with the secomp USE flag:

<syntaxhighlight lang="ini"># Allow Tor to use sandbox
net-vpn/tor seccomp</syntaxhighlight>

Then rebuild tor:

Then add to /etc/tor/torrc:

Sandbox 1

Setting up a hidden service

Setting up a tor hidden service is easy.

All you need to do is add 2 lines to the /etc/tor/torrc configuration file, and make sure your permissions are correct for the data directory.

<pre>
HiddenServiceDir /var/lib/tor/data/hiddenservice
HiddenServicePort 80 127.0.0.1:80
</pre>

The first line tells Tor to insert the public and private keys into the directory specified.

The next line tells Tor to direct traffic on hidden service port 80 to the IP and port specified.

Simple command-line file downloading

The popular wget utility cannot talk to socks proxy. However, you can use the tor network to download any resource located at a given URL and save it in a FILE using curl:

The --socks5-hostname means that hostnames are resolved via tor instead of your system's DNS resolution, thus preventing DNS leaks.

If you don't have curl on your system, you can just emerge net-misc/curl.

Portage

Portage can be configured to sync its tree and fetch packages via tor. Add the following to /etc/portage/make.conf:

<pre>
FETCHCOMMAND="curl --socks5-hostname 127.0.0.1:9050 --retry 3 --connect-timeout 60 -o \"\${DISTDIR}/\${FILE}\" \"\${URI}\""
RESUMECOMMAND="curl -C - --socks5-hostname 127.0.0.1:9050 --retry 3 --connect-timeout 60 -o \"\${DISTDIR}/\${FILE}\" \"\${URI}\""
</pre>

All the extra quoting is necessary. Have a look at man curl for more customization options.

Curl doesn't follow 302 redirect by default (cf. bug #543268). Pass -L to enable that behaviour.

emerge --sync cannot be used to update the Portage tree via tor, because rsync cannot use socks proxy. In order to sync the Portage tree via tor, use the command:

This fetches the portage tree snapshot over http. Additionally, emerge-webrsync can be configured to verify the cryptographic signature of the gentoo repository. Such verification is explained in the Gentoo Handbook. One negative effect is that only daily repository snapshots are retrieved. Issues that are fixed in the interim will not be available until the following daily snapshot.

Installing or updating is done as usual, e.g.:

app-crypt/gnupg

Users who use cryptographic Portage tree verification can refresh Gentoo keys over Tor. Add 'use-tor' to dirmngr.conf:

Then refresh expired Gentoo keys over Tor:

Unfortunately currently (app-crypt/gnupg-2.2.10) there is no option for specifying Tor port, so the standard SOCKSPort 9050 is necessary in etc/tor/torrc.

Check if using Tor

Visit: https://check.torproject.org/

There is a lots of site in Internet for testing your anonymity. One of the best is whoer.net. Another nice one: ipleak.net. To hide more information, you can try disable: Javascript, Flash, Java, ActiveX, WebRTC. For hide HTML headers use Random Agent Spoofer and/or net-proxy/privoxy. Some mozila addons also may keep you privacy Request Policy, Privacy Badger and others...

For web browsing, you should just get Tor Browser from https://torproject.org. Change the security slider if you want, but you should not start adding "privacy" addons. The more you change in your browser, the more you'll stand out from the crowd.

Checking for network leaks

Tor is a great tool for enhancing your privacy in many situations. Unfortunately, it is a common misconception that it makes you always 100% anonymous. Unfortunately it's not so. Let's have a brief look at how our privacy has changed now that we have tor up and running.