In this article we talk about Tor browser: how to install it, how to sandbox it, and some tips on how to increase the security of the setup.
Also, we have a short demo video covering some of the sandboxing aspects discussed below.
Cleanup
Before we start, let’s get into the habit of deleting some files when we shut down the computer. For this you need a systemd unit file (see Appendix 1) and a simple script. Copy the unit file in /etc/systemd/system directory, and the script in /etc. The script is as follows:
#!/bin/sh -e
# to be stored in /etc/cleanup.sh
# clear user cache
sudo -u netblue rm -fr /home/netblue/.cache
# generate a new machine-id
# this is running as root, be careful!
rm -f /var/lib/dbus/machine-id
dbus-uuidgen > /var/lib/dbus/machine-id
cp /var/lib/dbus/machine-id /etc/machine-id
chmod 444 /etc/machine-id
exit 0
First, we look at .cache in home user directory. This is the place where where most programs store runtime information, such as the webpages you visited, torrent trackers you connected to, and all that emails you thought you deleted – all 3 GB of them! It is a very good idea to delete this directory at shutdown. Next time when you log in, an empty ~/.cache directory will be created.
After that, we look at /etc/machine-id. This is a world-readable file containing a huge random number:
$ cat /etc/machine-id
0b46feb27a20469da0ee62baaeb51c5c
Sort of a serial number, it is used to uniquely identify Linux computers. You definitely don’t want something like this. But since it is required by systemd, let’s generate a brand-new one on shutdown. Next time we start, the computer has a new identity.
Note: Actually, there is another copy of this file in /var/lib/dbus/machine-id, so we have to deal with both of them.
Installing Tor Browser
Download the browser from torproject website. It comes as a tar software archive that you unpack in your home directory:
$ tar -xvf ~/Downloads/tor-browser-linux64-10.0.8_en-US.tar.xzThe software is extracted in ~/tor-browser_en-US. Mount this directory on top of your home using Firejail’s --private command:
$ firejail –private=~/tor-browser_en-US ./start-tor-browser.desktop
The browser starts in a container filesystem created on-the-fly by Firejail. Take a look around, no personally identifiable information should be available:
- home directory with the files from the software archive and some miscellaneous config files created by the browser
- virtually empty
/tmp - small subset of system files in
/devand/etc - private /bin and /usr/bin directories have a very small subset of system executables; only the files required by Tor browser to function are present in these directories
- most of everything else is re-mounted read-only after some basic cleanup
Network Namespace
Use a network namespace for additional fun and glory. This is basically a new TCP/IP stack in kernel space:
- a random unused IP address is obtained by ARP-probing your network
- the MAC address allocated by kernel is random by default
- brand new interfaces and routing table
- and a network firewall
Find the name of your Ethernet interface (eth0):
$ ip link show
1: lo: mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether e0:3f:42:7a:15:09 brd ff:ff:ff:ff:ff:ff
… and start tor:
Locking Down the Network
The network namespace takes care of two things. First, it makes your main system network stack invisible to the program running inside the sandbox. The sandbox Ethernet interface is connected to the main system in such a way, no network traffic is possible between the sandbox and the main system. So, if you have and SSH server running on your system, the attacker would not be able to access it.
The second reason is once we have a new network stack, we can deploy a firewall to further restrict the traffic. The default firewall is a generic desktop firewall that drops incoming TCP connections, but in the case of Tor browser we can do much better!
Tor browser talks to the onion network using a very small number of IP addresses: a guard node, and one or two more guards in case the main one fails. Using --netlock option, Firejail detects these guards at startup, and builds and deploys a firewall that allows only traffic going to/coming from these guards. We call this network locking.
More about netlocker in the video demo.
Desktop Starter
The previous command is ugly, but you can set a desktop starter to make your life easier (see Appendix 2).
You can also use firetools to check your new network setting.
Tor DNS
Not many people know Tor also offers a DNS proxy service. It is restricted to A, AAAA, and PTR requests, enough to run a browser or any other desktop application.
The service is built directly in Tor communication protocol, and it follows the same privacy and security principles as HTTP: at least 3 layers of redirection and randomization in a cluster of several thousand servers.
Start by installing tor package from your distro (Debian example):
$ sudo apt-get install torDebian starts the proxy automatically upon install. Open /etc/tor/torrc in a text editor and add the following lines at the end of the file:
DNSPort 53
AutomapHostsOnResolve 1
AutomapHostsSuffixes .exit,.onion
ClientDNSRejectInternalAddresses 1Restart the proxy:
$ sudo systemctl restart torTor should be running in this moment on UDP port 53, try it out:
$ dig @127.0.0.1 example.com
; <> DiG 9.11.5-P4-5.1+deb10u2-Debian <> @127.0.0.1 example.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43746
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;example.com. IN A
;; ANSWER SECTION:
example.com. 3600 IN A 93.184.216.34
;; Query time: 266 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Jan 17 08:46:13 EST 2021
;; MSG SIZE rcvd: 45
266 ms query time means your domain was resolved by a server on a different continent. It happens a lot with Tor. The numbers I am getting are between 200 and 400 ms. If you end up with an exit node on your continent, probably the query crossed the Atlantic twice.
Try it out, is not so bad! For comparison, I get 50 to 100 ms query time for on-continent connections in our own Firejail DNS over HTTPS proxy project.
You can find out where the circuit is terminated using torsocks (apt-get install torsocks):
$ torsocks curl ifconfig.me
62.102.148.68
(exit node in Sweden)As Tor rebuilds the circuit every few minutes, the DNS traffic is continuously moving to another random server.
Odds and Ends
Run “firejail –net=none vlc” (or equivalent) when you play music or videos downloaded over Tor. Media players have the bad habit of going on the web to grab whatever was promised in the metadata. In the process, they de-anonymize the user.
When you are using a DNS proxy – Tor, DoH, or otherwise – it is a good idea to cut down the DNS traffic coming from your browser. On a regular IPv4-only network go in about:config and disable IPv6 (network.dns.disableIPv6). This will remove half the traffic. Also, install an adblocker – about 40% of all DNS exchanges are ads.
Appendix 1 – systemd unit file
$ ls -l /etc/systemd/system/cleanup.service
-rw-r--r-- 1 root root 286 Jan 19 09:42 /etc/systemd/system/cleanup.service
$ cat /etc/systemd/system/cleanup.service
[Unit]
Description=Custom shutdown system cleanup
DefaultDependencies=no
Conflicts=reboot.target
Before=poweroff.target halt.target shutdown.target
Requires=poweroff.target
[Service]
Type=oneshot
ExecStart=/etc/cleanup.sh
RemainAfterExit=yes
[Install]
WantedBy=shutdown.target
Reload systemd configuration and enable the service:
$ sudo systemctl daemon-reload
$ sudo systemctl enable cleanupAppendix 2 – Tor Browser desktop file
$ ls -l /home/netblue/Desktop/tor.desktop
-rwx--x--x 1 netblue netblue 412 Nov 1 09:20 /home/netblue/Desktop/tor.desktop
$ cat /home/netblue/Desktop/tor.desktop
[Desktop Entry]
Name=Tor
Exec=firejail --private=~/tor-browser_en-US ./start-tor-browser.desktop
#Exec=firejail --net=eth0 --private=~/tor-browser_en-US ./start-tor-browser.desktop
Icon=/home/netblue/.config/tor.svg
Terminal=false
Type=Application
Add an icon somewhere in your home directory and link it in your desktop file, then move the desktop file in ~/Desktop directory.
Firejail 