Tor: Difference between revisions
Bonafide14 (talk | contribs) m Added a template for configuring a webtunnel bridge. It would've saved me some time a week ago. |
m style fixes |
||
| Line 12: | Line 12: | ||
==== Using nix-shell ==== | ==== Using nix-shell ==== | ||
<syntaxhighlight lang= | <syntaxhighlight lang=console> | ||
nix-shell -p tor-browser | $ nix-shell -p tor-browser | ||
</syntaxhighlight> | </syntaxhighlight> | ||
==== Using Global Configuration ==== | ==== Using Global Configuration ==== | ||
<syntaxhighlight lang= | <syntaxhighlight lang=nix> | ||
environment.systemPackages = [ | environment.systemPackages = [ | ||
pkgs.tor-browser | pkgs.tor-browser | ||
]; | ]; | ||
</syntaxhighlight>After modifying your configuration, apply the changes by running:<syntaxhighlight lang= | </syntaxhighlight> | ||
After modifying your configuration, apply the changes by running: | |||
<syntaxhighlight lang=console> | |||
# nixos-rebuild switch | |||
</syntaxhighlight> | </syntaxhighlight> | ||
==== Using Home Configuration ==== | ==== Using Home Configuration ==== | ||
<syntaxhighlight lang= | <syntaxhighlight lang=nix> | ||
home.packages = [ | home.packages = [ | ||
pkgs.tor-browser | pkgs.tor-browser | ||
]; | ]; | ||
</syntaxhighlight>After updating your configuration, apply the changes by running:<syntaxhighlight lang= | </syntaxhighlight> | ||
home-manager switch | After updating your configuration, apply the changes by running: | ||
<syntaxhighlight lang=console> | |||
$ home-manager switch | |||
</syntaxhighlight> | </syntaxhighlight> | ||
| Line 138: | Line 142: | ||
Tor can be enabled as a system service by enabling options {{nixos:option|services.tor.enable}}. Configuration of tor service is an example of [https://nixos.org/manual/nixos/stable/index.html#sec-freeform-modules Freeform module], so you can pass not only explicitly supported {{nixos:option|services.tor.settings}}, but all other [https://2019.www.torproject.org/docs/tor-manual.html.en torrc] options. For example, a client obfs4 bridge config can be set like this: | Tor can be enabled as a system service by enabling options {{nixos:option|services.tor.enable}}. Configuration of tor service is an example of [https://nixos.org/manual/nixos/stable/index.html#sec-freeform-modules Freeform module], so you can pass not only explicitly supported {{nixos:option|services.tor.settings}}, but all other [https://2019.www.torproject.org/docs/tor-manual.html.en torrc] options. For example, a client obfs4 bridge config can be set like this: | ||
<syntaxhighlight lang="nix">services.tor.settings = { | <syntaxhighlight lang="nix"> | ||
services.tor.settings = { | |||
UseBridges = true; | |||
ClientTransportPlugin = "obfs4 exec ${pkgs.obfs4}/bin/lyrebird"; | |||
};</syntaxhighlight>For a webtunnel bridge, use:<syntaxhighlight lang="nix">services.tor.settings = { | Bridge = "obfs4 IP:ORPort [fingerprint]"; | ||
}; | |||
</syntaxhighlight> | |||
For a webtunnel bridge, use: | |||
};</syntaxhighlight> | <syntaxhighlight lang="nix"> | ||
services.tor.settings = { | |||
UseBridges = true; | |||
ClientTransportPlugin = "webtunnel exec ${pkgs.webtunnel}/bin/client"; | |||
Bridge = "webtunnel IP:ORPort [fingerprint]"; | |||
}; | |||
</syntaxhighlight> | |||
By default, Tor in NixOS provides one SOCKS proxy on port 9050. Port 9050 is a "slow" SOCKS port which can be used for email, git, and pretty much any other protocol except HTTP(S). This is a safe default which complicates identity correlation attacks, although it isn't sufficient to completely thwart them. | By default, Tor in NixOS provides one SOCKS proxy on port 9050. Port 9050 is a "slow" SOCKS port which can be used for email, git, and pretty much any other protocol except HTTP(S). This is a safe default which complicates identity correlation attacks, although it isn't sufficient to completely thwart them. | ||