tor-ctrl - Tor control port command line tool

Patrick · February 20, 2022, 3:58pm

The Tor Project feature request:

Patrick · February 20, 2022, 11:10pm

Patrick · February 20, 2022, 11:10pm

github.com/nyxnor/tor-ctrl

tor-observe - tool to see to which destinations Tor is connecting to

opened 03:42PM - 20 Feb 22 UTC

closed 06:16PM - 21 Feb 22 UTC

adrelanos

Sometimes users request a feature to observe connections between Whonix-Workstat…ion and Whonix-Gateway. But it's not really limited to Whonix. Also users that are using Tor Browser would like to check what connections Tor is actually creating. (related: https://github.com/nyxnor/tor-ctrl/issues/27) In https://github.com/nyxnor/tor-ctrl/issues/13#issuecomment-1017007037 a Tor Browser regression was found, Tor Browser (Firefox) phoning home to firefox.settings.services.mozilla.com: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/31575 Which you then reported at: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40788 Including some potential other unwanted connections. There might be many more such privacy violations. But these are difficult to spot when these are routed over Tor. Therefore it would be useful to have some tool that users can run which shows everything where Tor is resolving DNS and connecting to. * Output should be safe to copy/paste into public places such as mailing lists, forums, IRC without de-anonymizing oneself. Therefore Tor entry guard, middle relay and exit relay and even onion rendezvous relay should be omitted. * Duplicates might often be not helpful, but sometimes helpful to see the how many there really are or guess what is causing it? Default probably best to not show duplicates? * Simple to start monitoring by just staring 1 utility? * Similar to tor-ctrl-stream but simpler and OK for copy/paste? * If connecting to IPs, get the reverse DNS of the IP and add it to the script output to make it easier for the user to find out what kind of connection it is? * Live. Show connections when they are created. Better usability than having to press another button to actually see what happened. * Not sure if there is a way to find out which application was responsible for the traffic?

nyxnor · February 22, 2022, 11:34pm

Move tor-ctrl from deprecated section to currently used.
I tried editing the wiki, but couldn’t find how to edit the whole page in a stance, would need to make two separate edits apparently.

Note: Vidalia and tor-ctrl have been deprecated and are no longer packaged in Debian.

Deprecated

nyxnor · February 23, 2022, 12:11am

I was thinking of using tor-ctrl SETEVENTS GUARD but figuring out exactly what to do on what events would require a lot of testing.

TPO does not document that on purpose, not only how to react to guards, but how to interact with the controller. They don’t teach you how to that for whatever reason they restrict people who has spent hours reading the code to make the interaction with the controller works. The specs control.spec.txt does not works for this because it doesn’t teach what the tor events means, it is just sent and up to you to decide.

For GUARDS reaction, there is GitHub - mikeperry-tor/vanguards: Vanguards help guard you from getting vanned..., but the debian package is almost 3 years old now.

Would be good to document all the guards important events.

Raspberry Pi TorBox log_check_config.py and log_check.py is an event based reaction to tor logs, it can restart tor or drop guards. The same could be done with the controller.

I was thinking, if we could aggregate enough info on tor guards, circuits events, we could take a better action towards a better connection.

BTW, on my experience, if I see guards problem for a long time that couldn’t make a connection even after restarting tor, I send the command tor-ctrl DROPGUARDS, to change guards. They seem to want to remove this option and I am not advising anyone to use it, just saying. If one day, they remove dropguards commands, it would still be possible to change guards by deleting some files on DataDirectory.

nyxnor · February 23, 2022, 12:21am

The Tor Project feature request:

Already posted here on the correct thread:

Patrick · February 23, 2022, 11:05am

That is very much OK. We’re accepting even 10 tiny edits each just fixing a single letter typo. There aren’t requirements such as “pretty git history” or “good edit comment”.

For tor-ctrl-observe I was even wondering about creating a dedicated wiki page. Anything appropriate to maximize usefulness for users.

Great!
Yeah. Ideally would be nicely documented. Soon tor-ctrl will be pre-installed. I forgot adding it in this point release but it’s done already in git.

There is a arrow down symbol. Called “supermenu”.

Direct link to edit all just in case not easy to find:

https://www.whonix.org/w/index.php?title=Tor%20Controller&action=edit

Please let me know if there are other wiki edit questions.

Would simplify Manual Rotation of Tor Guards.

nyxnor · February 23, 2022, 12:21pm

Thanks, found the supermenu.

For tor-ctrl-observe I was even wondering about creating a dedicated wiki page. Anything appropriate to maximize usefulness for users.

Made the edit but yet, it feels like needing a separate wiki page.

nyxnor · February 23, 2022, 3:51pm

tor-ctrl should probably have an onion-grater profile if anyone wants to create services from the Workstation.
Different than onionshare, target ports are not limited, so don’t know how to limit the profile with this.

I don’t have any reason to limit target port, it is ok for onionshare as it is designed around a one click installation and the server is configured for you. But for tor-ctrl, you probably will configure your server and you need to specify the target address that will be listened to by the webserver.

github.com

Whonix/onion-grater/blob/master/usr/share/doc/onion-grater-merger/examples/40_onionshare.yml

## Copyright (C) 2016 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions

#### meta start
#### project Whonix
#### category tor-control
#### description
## Shipped but not enabled by default onion-grater profile.
#### meta end

## tested with onionshare v0.9.2-67-g12acb89
## tested with tor 0.2.9.8-2~d80.jessie+1

## Tor's reply ClientAuth
## 250-ClientAuth=onionshare:xxxKEYBLOBxxxxxxxxxxxx
## is left intact because onionshare's button 'Copy HidServAuth' coppies the
## following into the clipboard, which is a usability feature.
## HidServAuth xxxdomainxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.onion xxxKEYBLOBxxxxxxxxxxxx
## Otherwise the user would have to extract it from onion-grater
## logs.

This file has been truncated. show original

Patrick · February 24, 2022, 11:29am

A general tor-ctrl profile would be difficult. In that case, one could also set onion-grater to complain mode which lets through everything.

I don’t see the use case yet. Adding onion services isn’t a frequent task?
Anyhow. This would be contributions welcome. Not trivial to implement but easy on my side, it 1 more example profile in the onion-grater-merger examples folder.

Patrick · February 26, 2022, 9:18am

Created an empty tor-ctrl-observer - Tor Connection Destination Viewer just now. (The page name can certainly be modified/moved if there are better suggestions.)

nyxnor · March 18, 2022, 12:17pm

I was looking tor command line tools and found carml.
It is very nice the monitor command, the log messages are easy to read not raw, even though you can still see raw with events command.
Carml is built upon txtorcon, both by Meejah.

Unfortunately carml does not have a debian package, but txtorcon the library has, so possible that in the feature he provides pushes it to debian.org.

interesting commands:

monitor → beautify events
onion → create onion services
newid → newnym
cmd → any controller command

Thoughts:

Much better than tor-ctrl of course in terms of user friendliness, interpreting events, has a whole library.
Not available on deb.debian.org so one would need to maintain the package. Has some dependencies not available on debian repos such as ansicolors.

It is a great tool and I hope it becomes available on debian soon, but it it on version 21.1.0, so maybe there is something blocking.

Docs

https://carml.readthedocs.io/en/latest/

Patrick · June 19, 2022, 9:32am

github.com/nyxnor/tor-ctrl

messages improvement

opened 09:32AM - 19 Jun 22 UTC

closed 05:15PM - 19 Jun 22 UTC

adrelanos

tor-ctrl-observer > tor-ctrl-observer: [info]: subscribed to Tor stream even…ts, as soon as streams are created, output will be shown below. Good. > tor-ctrl: [notice] connecting to socket with command: nc -U /run/tor/control Good. > attempting to connect to [1] attempting to connect to... To what? And did it succeed? I guess so. But still a bit confusing. > stop listening with Ctrl+C Maybe rather write `To stop listening and show a summary, please Ctrl+C.` ? User could further think, yeah, sure, with Ctrl+C I can exit this. Thanks for the tip. But instead, I could also just close the window. But that's wrong, the Ctrl+C will actually show additional information. > connecting to socket with connecting to socket with... With what? And did it succeed? I guess so. But still a bit confusing. Similar to [1].

Patrick · June 19, 2022, 10:05am

tor-control-observe documentation written:

(The thumbnail is outdated, cached by this forum.)

If some screenshots / thumbnail / project logo was freely available, I’d add it to the wiki page.

nyxnor · June 19, 2022, 5:18pm

issues corrected.

about the logo, I am not proficient in arts.

In the whonix usage page

**3.** Terminate `tor-ctrl-observe` with signal sigint.

Press keyboard keys `Ctrl` + `C`.

Ctrl+C will not terminate the whole script, just listening the stream, and then a summary will be shown.

Patrick · June 20, 2022, 9:34am

For me, if I press Ctrl+C during tor-control-observe, I get the summary and the script terminates. Bug?

nyxnor · June 26, 2022, 10:18pm

For me, if I press Ctrl+C during tor-control-observe, I get the summary and the script terminates.

That is expected when calling from the command line.
The problem is when using the Desktop file, when using Ctrl+C, it will kill the terminal emulator.

The Ctrl+D option mentioned on gh seems to be posible and plausible.

Patrick · June 27, 2022, 1:58pm

Yes, the signals can be “shuffled” to what makes most sense / easiest to use for the user. Usage of signals could be documented by adding a short console output message at script startup.

That seems like a good solution.

nyxnor · June 27, 2022, 9:05pm

seeing again, eof (^D) is not a trap action, so it cannot execute another thing after being called, it will simply ignore or not ignore eof.

set
trap

But QUIT is an action (^), altough kind weird, it works the Ctrl+\ (backslash).
The commands can be found with stty -a.

In this way I am thinking that ^C INT should interrupt the script and print summary and ^\ QUIT should quit the script immediately.

Patrick · June 27, 2022, 10:03pm

I guess any keys are OK as long as the program says so. Bonus points for following standards / conventions as much as possible.

derivative-maker (previously Whonix build script) taps ctrl + c (sigterm) and shows a custom error handler once pressed. Does not necessarily end the script. One could even have a sigterm trap and do nothing, whatever that would be useful for.