default socksification of ssh, wget, curl, etc. is confusing for local connections

[phabricator-migrator]

Information

ID: 73
PHID: PHID-TASK-4ye5vuidy5kq6o7jl2oo
Author: JasonJAyalaP
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

Many advanced users are confused by Whonix’s socksification of default applications such as ssh, wget, curl, etc. (For stream isolation by uwt.

When they do ssh 10.152.152.11, uwt will result in actually executing torsocks /usr/bin/ssh.anondist-orig 10.152.152.11 . Therefore traffic will flow though torsocks and go a Tor SocksPort. This will fail for local connections. It will result in the following error message:

libtorsocks(12021): connect: Connection is to a local address (10.152.152.11), may be a TCP DNS request to a local DNS server so have to reject to be safe. Please report a bug to Google Code Archive - Long-term storage for Google Code Project Hosting. if this is preventing a program from working properly with torsocks

Maybe in ~/.bashrc (as terminal greeting) we should output the contents of the UWT_DEV_PASSTHROUGH variable.

Users can either use export UWT_DEV_PASSTHROUGH=1 or ssh.anondist-orig to circumvent uwt. This is documented.

---

Example support request: 1

$ ssh -NgD 4444 root@111.222.333.444

listen: Operation not permitted
listen: Operation not permitted
channel_setup_fwd_listener_tcpip: cannot listen to port: 4444
Could not request local forwarding.

---

TODO:

• run this from .bashrc
• upgrade existing .bashrc files?

Comments

---

JasonJAyalaP

2015-01-13 23:44:02 UTC

Is there a way to flip socks on and off depending on the destination? That would be the most elegant (and I hope not impossible) solution.

---

Patrick

2015-01-14 01:51:09 UTC

Not sure. The wrapper or uwt (?) would need to have a concept of local networks and understand the command line of each individual command. Make sure something like wget https://www.somedoc.com/explain/what_is_10.152.152.11_about does not trigger it. uwt is doing some sort of this already - no the best code:
https://github.com/Whonix/uwt/blob/master/usr/bin/uwt#L247
Not sure how sane that is. Well, at worst, traffic would pollute Tor’s TransPort, rather than use expected Tor SocksPort (stream isolation).

---

Patrick

2016-10-12 21:02:48 UTC

Ideally for usability after the user run into some torsocks warning message, a tooltip or konsole message would offer help. But I don’t think terminals support that feature.

---

WIP:

When a terminal is opened, uwt_settings_show is run.

uwt INFO: Stream isolation for some applications enabled. uwt / torsocks will be automatically prepended to some commands. What is that? See:
uwt INFO: Stream Isolation: Easy

Any feedback?

---

entr0py

2016-10-25 19:02:45 UTC

The other option would be to present INFO every time a wrapped command is invoked, but that would probably be too intrusive for anyone other than occasional terminal users.

If you want to be verbose, you could append the list of wrapped executables to your INFO message.

In general, this is a good idea. Took me a while to figure out why I couldn’t ssh to a server on my vpn network. This kind of reminder would probably have helped.

---

Patrick

2016-11-22 01:59:53 UTC

Thanks for the feedback!

entr0py (entr0py):

The other option would be to present INFO every time a wrapped command is invoked, but that would probably be too intrusive for anyone other than occasional terminal users.

Yes, and break scripts that parse the output of these commands.

---

Patrick

2017-01-09 07:34:26 UTC

run this from .bashrc

Done:
etc/skel/.bashrc.whonix: output uwt settings · Whonix/whonix-base-files@34782f8 · GitHub

upgrade existing .bashrc files?

Probably not worth the effort. Would require changes to https://github.com/Whonix/whonix-base-files/blob/master/usr/lib/anon-base-files/first-boot-skel or so which could introduce some regressions.