Mainly Tor and DNS because that’s what I’ve been doing lately.
Before we start, let’s get into the habit of cleaning up some files when we shut down the computer. For this you need a systemd unit file (see Appendix 1) and a simple script (see Apendix 2). Copy the unit file in
/etc/systemd/system directory, and the script in /etc. The contents of the script is as follows:
.cache directory is the place where people find copies of all the webpages you visited, torrent trackers you connected to, and all that emails you thought you deleted – all 3 GB of them!
After that, take a look at
/etc/machine-id. This is a world-readable file containing a huge random number:
Sort of a serial number, it is used to uniquely identify Linux computers. You definitely don’t want it on your home network. But since it is required by systemd, generate a new one on shutdown. Actually, there is another copy of this file in
/var/lib/dbus/machine-id, so you have to deal with both of them:
Next time you start, your computer has a new identity. Add more to the script: bash history, x11/xfce logs, trash folder, whatever… Let’s proceed with Tor Browser installation.
Installing Tor Browser
Download the browser from the “original equipment manufacturer”. It comes as a tar software archive that you unpack it in your home directory:
The software is extracted in
~/tor-browser_en-US. Mount this directory on top of your home using Firejail’s
The browser starts in a container filesystem created on-the-fly by Firejail. Take a look around, no personally identifiable information should be available:
- home directory with the files from the software archive and some miscellaneous config files created by the browser
- virtually empty
- small subset of system files in
- most of everything else is re-mounted read-only after some basic cleanup
If you don’t intend to play music under tor, also add
--machine-id on the command line, and new random numbers will be generated in the sandbox for the files we discussed above.
Use a network namespace for additional fun and glory. This is basically a new TCP/IP stack in kernel space:
- an unused IP address is obtained by ARP-probing your network
- the MAC address allocated by kernel is random by default
- brand new interfaces and routing table
- and a desktop iptables firewall
Find the name of your Ethernet interface (eth0):
… and start tor:
The command is ugly, but you can set a desktop starter to make your life easier (see Appendix 3).
You can also use firetools to check your new network setting.
Not many people know Tor also offers a DNS proxy service. It is restricted to A, AAAA, and PTR requests, enough to run a browser or any other desktop application.
The service is built directly in Tor communication protocol, and it follows the same privacy and security principles as HTTP: at least 3 layers of redirection and randomization in a cluster of several thousand servers.
Start by installing tor package from your distro (Debian example):
Debian starts the proxy automatically upon install. Open
/etc/tor/torrc in a text editor and add the following lines at the end of the file:
Restart the proxy:
Tor should be running in this moment on UDP port 53, try it out:
266 ms query time means your domain was resolved by a server on a different continent. It happens a lot with tor. The numbers I am getting are between 200 and 400 ms. If you end up with an exit node on your continent, probably the query crossed the Atlantic twice.
Try it out, is not so bad! For comparison, I get 50 to 100 ms query time for on-continent connections in our own Firejail DNS over HTTPS proxy project.
You can find out where the circuit is terminated using torsocks (
apt-get install torsocks):
As Tor rebuilds the circuit every few minutes, the DNS traffic is continuously moving to another random server.
Odds and Ends
In other news, Fedora 33 implemented something called split DNS, an obscure enterprise feature you would never need on your home network. It also broadcasts all DNS traffic on D-Bus, opening the door for user-space applications to spy on your browsing habits. Sounds great, sign me up!
(or similar) when you play music or videos downloaded over Tor. Media players have the bad habit of going on the web to grab whatever was promised in the metadata. In the process, they de-anonymize the user.
When you are using a DNS proxy – Tor, DoH, or otherwise – it is a good idea to cut down the DNS traffic coming from your browser. On a regular IPv4-only network go in
about:config and disable IPv6 (
network.dns.disableIPv6). This will remove half the traffic. Also, install an adblocker – about 40% of all DNS exchanges are ads.
But the easiest way to protect your DNS traffic is to enable DoH in your browser. Don’t necessarily go for the trusted resolver list embedded in the program, there are plenty to choose from. That’s all for now, have fun!
Appendix 1 – systemd unit file
Reload systemd configuration and enable the service:
Appendix 2 – cleanup script
I use “
sudo -u netblue” to run
rm command as user
netblue, just in case I mistype something and end up deleting system files:
Appendix 3 – Tor Browser desktop file
Add an icon somewhere in your home directory and link it in your desktop file, then move the desktop file in