Arm (Tor controller) questions

Support
1

I have used Tor for a while in the past, and just started to use Whonix recently (with VirtualBox). I can’t seem to understand or find extensive documentation for Arm (Tor Controller).

My questions are mainly regarding the connections / circuits (page 2) in arm in Whonix-Gateway:

  1. Why does it display so many circuits? is there a way to refresh this list to include only active / current circuits? when I just start the Tor Browser in the Workstation, I already see 4 different circuits. When I use several tabs, then close all but one, I still see many circuits, all of them show the same number of seconds / minutes.

  2. How can I easily identify the last circuit opened? for example, if I open a new Tab in the Tor browser in the Workstation, where exactly does it appear and when?

  3. I noticed a few times that instead of 3 nodes (Guard-Middle-Exit), I got 4 nodes in some of the circuits (Guard-Middle-Middle-Exit). In which cases does that happen?

2

Your questions relate specifically to Tor functionality - not Whonix, or even Arm for that matter. You’ll get best answers from tor-talk mailing list: tor-talk Info Page

Building circuits takes time, so Tor builds a bunch of them and keeps them ready. As old ones expire, Tor builds new ones. You’ll find details here: Tor: The Second-Generation Onion Router (see section 4.2).

To get more details about which circuits are active and what they’re doing, try onioncircuits: https://tails.boum.org/doc/anonymous_internet/tor_status/index.en.html

You can also try arm’s successor, nyx: https://nyx.torproject.org

3

When I use Tor Bundle without Whonix things are quite clear to me - I just have to look at the tor circuits using the Tor button to easily identify the circuit per site.

This feature isn’t visible on the Tor Browser in Whonix workstation - from what I’ve read it was removed for security reasons.

I get " Unable to locate package nyx" when I try to install it using “sudo apt-get install nyx”.

4

Hi pano

nyx is not available in packages.debian (jessie or stretch). Only available in packages.debian buster (testing) sid (unstable)

Debian -- Details of package nyx in buster

Only packages.debian tor-arm is available for jessie and stretch

https://packages.debian.org/jessie/tor-arm

Note: Whonix 13 is based on jessie, Whonix 14 is based on stretch

5

I see. Any other solutions to easily figure out what are the current / active / last opened circuits?

I just rebooted both the Gateway and the Workstation. I now have 2 Tor tabs, and no less than 42 circuits are displayed in Arm, all show the same uptime (if the minutes left to “(CIRCUIT)” mean uptime).

When I open a new Tor tab and connect to https://check.torproject.org/ in some cases the IP displayed there does not appear at all in any of the Circuits shown by Arm. How is this possible?

None of it makes sense to me. Is there a way to re-activate the onion circuits in the Tor browser on the workstation? I am surprised there is so little documentation about it or about Arm.

6

I tried to clone and install onioncircuits on the gateway from GitHub - david415/onioncircuits: fork of https://git-tails.immerda.ch/onioncircuits/ (using git).

Running onioncircuits, I get:

No protocol specified
** (onioncircuits:2705): WARNING ** Could not open X display
No protocol specified
Unable to init server: Could not connect: Connection refused
No protocol specified

(onioncircuits:2705): Gtk-WARNING **: cannot open display: 0

Is this going to be included in Whonix 14?

7

Sounds like

?

1 Like
8

Thanks, that helped. It launches now, however I don’t see anything on the right pane when clicking on the paths, instead I get exceptions (the application doesn’t crash though).

Interestingly, I see the name of the first node vs “UNKNOWN” in arm (I use bridges).

9

Ha! I tested it now without bridges, it runs smoothly, including the right pane information.

Anyone tried it with bridges?

10

That is a 2-year old fork of the Tails’ project. The official Tails repository is here: https://git-tails.immerda.ch/onioncircuits/

But… in general, you should look first in Debian repositories because:

  1. packages will be signed
  2. packages will be updated with the rest of your system

onioncircuits is in the jessie-backports repo. Instructions. Is also included in debian stretch and Whonix-14.

Note on Bridges:

Bridges can be useful for circumventing censorship (ie ISP filtering). They don’t increase your anonymity and they don’t hide Tor usage from somewhat sophisticated adversaries. (Research problems: Ten ways to discover Tor bridges | The Tor Project)

You shouldn’t use a bridge unless you have difficulty accessing the Tor network:

  1. Bridges tend to be slower and less reliable than entry guards.
  2. Bridges have limited bandwidth that should be reserved for people who need them.
2 Likes
11

Thanks, using onioncircuits from the jessie-backport repo work for me, with or without bridges.

A few followup questions:

  • Tor Circuit View issue: I understand the reasoning behind removing it is not to have Whonix-Workstation know which guard or middle relay are used. It nevertheless has to know the exit relay anyway, right? is it possible to show at least that instead of the whole circuit?
  • The “New Tor Circuit for this Site” feature: it seems that new circuits are generated for all the tabs. Is it not supposed to change the circuit only for the current tab?
  • Say I want to fork onioncircuits and revise it, how do you recommended doing it (I know Python, question is about the repos/git).
    I want an option for a more concise view, with country names in bold or in another color, at the left pane so they’d stand out at first glance, and an option to filter out non-active circuits from the view. Basically something that emulates the normal Tor Circuit View with just a bit of extra info.
12

pano:

  • Tor Circuit View issue: I understand the reasoning behind removing it is not to have Whonix-Workstation know which guard or middle relay are used. It nevertheless has to know the exit relay anyway, right? is it possible to show at least that instead of the whole circuit?

No, because the information comes from the same Tor control protocol
command, which is blocked. In theory it’s fixable (onion-grater could
redact entry guard and middle relay) but unlikely anyone will work on that.

  • Say I want to fork onioncircuits and revise it, how do you recommended doing it (I know Python, question is about the repos/git).
    I want an option for a more concise view, with country names in bold or in another color, at the left pane so they’d stand out at first glance, and an option to filter out non-active circuits from the view. Basically something that emulates the normal Tor Circuit View with just a bit of extra info.

To be discussed with onioncircuits developers, not Whonix developers.