monero in Whonix with torsocks for better stream isolation

[Patrick]

This is not something that users should do. It’s a task for developers.

@bafkamama

The documentation lists Monero in the SocksPort table but does not specify a port number. Please designate a port for Monero.

Fortunately, no IETF style approach required. The “designated port number” style is outdated. [1]

If you must, you can use any of these for a choice that is non-controversial from a Tor network load perspective.

@Whonix Stream Isolation wiki page

• Default range without isolation flags: Without IsolateDestAddr and without IsolateDestPort: SocksPort 9153 to 9159

That doesn’t answer what is the right choice form the perspective of Monero developers. [1]

@bafkamama

I am fairly confident that my systemd unit file would be a significant improvement for Monero to include in the documentation, especially since it is tailor-made for Whonix. I don’t know what else to do but provide it to you. It is well tested.

I cannot confidently talk about settings such as --proxy= and --tx-proxy=. Specifically not under time pressure.

Also not about other settings not limited to --prune-blockchain, --sync-pruned-blocks. In my position, it’s best not to comment on it and refer to upstream.

@bafkamama

Besides the discussion of Monero in the context of Whonix, this note states that the documentation includes a blanket statement about isolation flags that requires further explanation. This is a Whonix-specific question.

The thing which I guess you are referring to is this:

@Whonix Stream Isolation wiki page

• Isolation flags are usually unnecessary: What are IsolateDestAddr and IsolateDestPort? You can learn about them in the Tor manual. See also tor-talk mailing list: Tor’s stream isolation features defaults. Usually, unless you know better, you are better off not using IsolateDestAddr or IsolateDestPort.

Based on a linked tor-talk discussion from 2012.

If you are seeking guidance which stream isolation flags are suitable/acceptable, you cannot get this from me.

• Tor network health impact: Responsible for this answer would be The Tor Project.
• Monero specific network impact: Responsible for this answer would be The Monero Project.

It seems wrong for me to comment on this any further other than existing upstream Tor Project guidance.

---

[1] So what is the right approach if manual SocksPort number selection, Stream Isolation flags configuration is not something users should deal with? It’s not a task for Whonix / Monero / Tor users. It’s a task for Monero / Tor Project developers.

“Do it like Tor Browser. Do it like OnionShare.”

The two relevant websites are [A] and [B]:

[A] Tor friendly applications best practices

Tor_friendly_applications_best_practices · Wiki · Legacy / Trac · GitLab

This is a task for Monero upstream.

Settings such as --proxy= and --tx-proxy= should come with reasonable defaults. These could point to “localhost”, even in case of Whonix. [2] This is not something users should need to tinker with. These should be options for advanced users only.

Tor friendly applications best practices by The Tor Project guide is minimal.

This project is archived. Its data is read-only.

It was migrated from Tor project trac. I don’t have the edit history handy. It would probably only be available on the web archive. Upstream Tor Project doesn’t provide great guidance on this. Application developers such as Monero developers realistically can only look “how other applications are doing it” and try to emulate that.

[B] Whonix friendly applications best practices

Whonix friendly applications best practices

The way to go for upstream applications such as Tor Browser, OnionShare at the time of writing for:

• outgoing traffic is to use IsolateSOCKSAuth, and
• incoming traffic is to use Tor onions created through Tor control protocol.

And now maybe for Monero is not the best time to deeply integrate with these C-Tor features. Tor Arti (Tor rewrite written in Rust) may have a very different interface.

• outgoing traffic: IsolateSOCKSAuth is quite simple (and “almost optional”) to upgrade to the newer torS0X stream isolation.
• incoming traffic: Tor control protocol may or may no longer be existing.
  • Defining an Interface to Arti - Arti Development - Tor Project Forum
  • related: Keep an eye on Arti (Tor)

So in short, the way to make progress it for Monero developers and/or Tor Project developers show interest in this topic and engage in a conversation. They’re welcome to ping me, and I am happy to share my knowledge and opinions.

@bafkamama

5. The Whonix documentation includes Monero. Of course, because what could be more relevant to a Tor anonymity system than anonymous currency? I hoped to start a discussion about the tweaks I made to adapt Monero to Whonix. I understand that Whonix strives to be a great baseline platform for Tor. But if not Monero, then which application should be the first-class citizen?

Documentation is good enough as is. Detail enhancements to perfect Tor integration / stream isolation are up to Monero / Tor Project.

@bafkamama

Hire someone who can maintain the documentation better and perform community work.

The skills required are not readily available on the job market. It’s a complex threat model, there is no education curriculum and it’s not a straight-forward task at all. Related:

Development Bounties

Open Source Business Models

@bafkamama

It’s laughable that there are documents about running an onion-based Mumble server and outdated messaging services, yet Monero doesn’t receive the necessary attention.

Wiki pages are based on contributions depending on contributor interest. The VoIP wiki page first edit is 2018. Monero wiki page 2020.

See also:
User Expectations - What Documentation Is and What It Is Not

---

[2] Thanks to:

anon-ws-disable-stacked-tor

anon-ws-disable-stacked-tor redirects connections on Whonix-Workstation localhost to Whonix-Gateway. IsolateSOCKSAuth remains intact.