As many of you know, most of the information from within Iran is coming from on-the-ground new-media and social networking sites such as Twitter, YouTube, and Facebook. This is happening despite crackdowns on communications networks by the Iranian government. The way this information is able to escape the firewalls of Iran is via proxies which relay and “hide” the destination of the communications so that it becomes difficult to block. This allows those on the ground in Iran to communicate with the world instantly and effectively, without fear of government crackdown. But it is a constant arms race. As soon as a relay becomes known by the Iranian government it gets shut down. The only way to keep the lines of communication open are to strengthen the distributed Tor network by adding more relays and bridges, making it more difficult for the Iranian government to block them all.
There have already been great write-ups on how you can contribute to the distributed proxy network Tor:
http://anonygreen.wordpress.com/2009/06/18/how-to-setup-a-tor-relay-or-tor-bridge/
http://smokingfish.blogspot.com/2009/06/brief-introduction-to-tor-and-why-its.htmlPlease read over those documents for an overview. I wanted to provide detailed instructions on how to get a Tor network set up quickly, easily, and cheaply for those of you who would like to contribute. You can provide invaluable assistance to the people of Iran for as little as 15 minutes of your time and $20/month.
First off, this document assumes you have some system administration knowledge with Linux (Fedora) and are comfortable installing and configuring packages from the command line. If that’s you, you can have a Tor relay up and running in about 15 minutes.
Key:
Shell commands are in purple
Config file settings are in blue
Register at Slicehost
Slicehost is a VPS provider that allows you to quickly build/deploy webservers very cheaply. Sign up here and purchase the cheapest $20 slice to get started. Pick Fedora 10 as your Linux Distribution. Do not pick Fedora 11, as it is incompatible with the current version of Tor. Once you are registered, Slicehost will email you your IP and root password. It can take a few minutes to build your new slice, so be patient.
Slice Security
Log in to your new slice. Please note that this document covers the bare minimum of commands to get Tor up and running. You should follow due diligence when it comes to securing your new slice, something which is outside the scope of this document. Common practice security configurations are recommended. Security is your own responsibility, and I will not be held liable for any security issues with your slice. There are a few bare-minimum security things you should do to your slice:
Change the root password:
passwd rootCreate your own account & set password:
adduser yourusername
passwd yourusernameDisable root login to ssh
vim /etc/ssh/sshd_config
Change to this: PermitRootLogin no
service sshd restartThese steps are the BARE MINIMUM you should do to secure your slice.
Update your system
yum -y update
Install prerequisites
yum install wget vim-enhanced gcc make libevent libevent-devel openssl openssl-devel zlib zlib-devel rpm-build
Download, build, and install Tor
wget https://www.torproject.org/dist/rpm/tor-0.2.0.34-tor.0.fc10.src.rpm
rpmbuild --rebuild tor-0.2.1.15.rc-tor.0.fc10.src.rpm
rpm -i rpmbuild/RPMS/x86_64/tor-0.2.1.15.rc-tor.0.fc10.x86_64.rpm
Configure Tor
vim /etc/tor/torrc
Change the following settings, substituting your own values for Nickname and Address:
DataDirectory /var/lib/tor
ORPort 9001
DirPort 9030
Nickname YOUR_NICKNAME
Address YOUR.IP.ADDRESS.XX
Save & ExitSet bandwidth limits for Tor
These settings are largely dependent on which slice you have purchased. The ones you see below are for a 20GB slice, and they allow 2GB of transfer per day, so you should be well within the 20GB slice limit of 100GB/month. If you have purchased a larger slice, these settings can be increased accordingly. Be careful here, incorrect settings can push you over your monthly bandwidth limit very quickly! I did over 12GB of transfer in a little over 8 hours before limiting bandwidth with these settings.
RelayBandwidthRate 40Kbytes
RelayBandwidthBurt 100KBytes
AccountingStart day 12:00
AccountingMax 2 GB
Configure your firewall
iptables-save > /etc/sysconfig/iptables.default
iptables-save > /etc/sysconfig/iptables.test
vim /etc/sysconfig/iptables.test
Insert the following settings:
# tor ORPort & DirPort
-A INPUT -p tcp –dport 9001 -j ACCEPT
-A INPUT -p tcp –dport 9030 -j ACCEPT
# tor Allow all outbound traffic
-A OUTPUT -j ACCEPT
Save & Exit.
iptables-restore < /etc/sysconfig/iptables.test
iptables -L (verify the rules are correct)
iptables-save > /etc/sysconfig/iptables
Increase the number of open file descriptors
vim /etc/security/limits.conf
Add this line:
_tor hard nofile 8192
Save & Exit
Start up the Tor service
service tor start
If everything starts correctly, you should see output like this:
Starting tor: Jun 21 15:44:04.219 [notice] Tor v0.2.1.15-rc. This is experimental software. Do not rely on it for strong anonymity. (Running on Linux x86_64)
Jun 21 15:44:04.219 [notice] Your ContactInfo config option is not set. Please consider setting it, so we can contact you if your server is misconfigured or something else goes wrong.
Jun 21 15:44:04.223 [notice] Initialized libevent version 1.4.5-stable using method epoll. Good.
Jun 21 15:44:04.223 [notice] Opening OR listener on 0.0.0.0:9001
Jun 21 15:44:04.223 [notice] Opening Directory listener on 0.0.0.0:9030
Jun 21 15:44:04.223 [notice] Opening Socks listener on 127.0.0.1:9050
/usr/bin/torctl start: tor started [ OK ]Also, you should view the tor.log and verify that you see the following (after 20-minutes):
cat /var/log/tor/tor.log
Jun 21 15:44:13.835 [notice] Tor has successfully opened a circuit. Looks like client functionality is working.
Jun 21 15:44:13.835 [notice] Bootstrapped 100%: Done.
Jun 21 15:44:13.835 [notice] Now checking whether ORPort XXX.XXX.XXX.XXX:9001 and DirPort XXX.XXX.XXX.XXX:9030 are reachable.. (this may take up to 20 minutes -- look for log messages indicating success)
Jun 21 15:44:18.492 [notice] Self-testing indicates your DirPort is reachable from the outside. Excellent.
Jun 21 15:44:18.492 [notice] Not advertising DirPort (Reason: AccountingMax enabled)
Jun 21 15:44:26.804 [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.
Jun 21 15:44:43.813 [notice] Performing bandwidth self-test.. done.If you see some errors or it doesn’t start correctly, post in the comments and I’ll see if I can help you out. Here are some references to help you get it going:
http://www.torproject.org/docs/tor-doc-unix.html.en#installing
http://www.torproject.org/docs/tor-doc-relay.html.enThat’s it! You now have a fully functioning Tor Relay and are helping the Iranian people get news and information out to the rest of the world. The cool thing about Slicehost is that you can easily upgrade your Slice with the click of a button to allow more bandwidth, RAM, and other resources. They also have a Clone option so that once you have your initial Tor slice running, you can clone it multiple times so that you can have multiple Tor servers at a time.
8 years ago
No comments:
Post a Comment