research non-persistent entry guards

[phabricator-migrator]

Information

ID: 94
PHID: PHID-TASK-jnaivhgs2gg7gswuuymy
Author: JasonJAyalaP
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

older info:

• anonymity - Tracking User Location using Entry Guards? - Tor Stack Exchange (http://www.webcitation.org/6RTwwSWvw)
• anonymity - Is it dangerous to use Tails without persistent entry guards? - Tor Stack Exchange (http://www.webcitation.org/6RTwx8bil)
• Support more stable guards for live CDs: Support more stable guards for live CDs (#2653) · Issues · Legacy / Trac · GitLab
• The tor-talk October 2012 Archive by subject
• [tor-talk] Location-aware persistent guards

update:

Number of entry guards was reduced to 1 since then. (As per changelog.)

see also:

• persistent_Tor_state · Wiki · tails / blueprints · GitLab
• https://blog.torproject.org/blog/tor-weekly-news-—-june-17th-2015#A_persistent_Tor_state_for_Tails section A persistent Tor state for Tails?

TODO:

• Under the new situation of reduced number of default entry guards, ask the above questions again to see if situation has changed.

Documentation could explain how to stop the Tor service; wipe Tor’s data dir; start Tor service; connect.

Editing /etc/tor/torrc by adding the following could do the trick.

DataDirectory /var/run/tor

After every reboot, Tor would use new entry guards. Maybe extra AppArmor rules would be required.

Comments

---

JasonJAyalaP

2015-01-16 20:01:44 UTC

Adding DataDirectory /var/run/tor to /etc/tor/torrc could do the trick. After every reboot, Tor would use new entry guards. Maybe extra AppArmor rules would be required.

So, first, we need someone to study and test this and report back.

---

Patrick

2015-01-17 00:22:25 UTC

/var/lib/tor is owned by user/group debian-tor.
/var/run/tor is owned by user/group root.
Therefore using DataDirectory /var/run/tor in /etc/tor/torrc would maybe not be a great idea. (Would lead to permission issue.)

Must be some non-persistent folder owned by user/group debian-tor.

---

HulaHoop

2015-06-21 19:55:23 UTC

A script on boot up that runs

chgrp -R debian-tor /var/run/tor

can do it?

chgrp Man Page - Linux - SS64.com

---

Patrick

2015-06-21 22:23:28 UTC

Seems like on jessie there is no permission issue anymore. /var/run/tor is owned by user/group debian-tor by default. Check /etc/init.d/tor function check_torpiddir. Therefore /etc/tor/torrc setting DataDirectory /var/run/tor works out of the box in Whonix 11.

/usr/lib/whonixcheck/check_tor_pid in whonixcheck needs a patch. That whonixcheck test fails because it’s hardcoded to /var/run/tor/tor.pid. For Whonix 11 purposed you could add to documentation to skip this test then.*

*(Somewhat documented in /etc/whonix.d/30_whonixcheck_default. Create a file /etc/whonix.d/50_user with content whonixcheck_skip_functions+=" check_tor_pid ".)

---

Patrick

2015-06-22 16:22:38 UTC

Where to add this? Not sure where this fits best.

Maybe on Tor Documentation for Whonix Users?

Link from:

• Whonix Documentation

Maybe mentioned on:

• Configure (Private) (Obfuscated) Tor Bridges and/or
• Hide Tor use from the Internet Service Provider

---

HulaHoop

2015-06-22 19:37:20 UTC

Where to add this? Not sure where this fits best.

Maybe on Tor Documentation for Whonix Users?

Yes I added it there.

---

Patrick

2015-06-22 23:09:50 UTC

Good work! Added to Whonix Documentation. Moved/incorporated Tor chapter from Advanced Security Guide - Whonix to Tor Documentation for Whonix Users. Made some changes.

On Whonix Documentation the page Tor Documentation for Whonix Users is listed under advanced topics. Non-ideal. Too buried. Not something regular users read.

What about making Tor Documentation for Whonix Users a template (https://www.whonix.org/wiki/Template:Persistent_Entry_Guards_Introduction), and adding a new chapter to the Whonix and Tor Limitations page ‘Guard Relays can make you fingerprintable Across Different Physical Locations’ or so? (Is “fingerprintable” the right term here?) What do you think? Could you do that please?

---

Patrick

2016-02-10 17:32:53 UTC

Whonix and Tor Limitations