CLIENTS 3.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566
  1. Part one: Overview and explanation
  2. Because tor is an application-level proxy, it needs client-side support
  3. from every client program that wants to use it. (This is different from
  4. systems like Freedom, which used a single client-side program to capture
  5. all packets and redirect them to the Freedom network.) Client applications
  6. need two general classes of modifications to be compatible with tor:
  7. 1) Whenever they call connect(), they instead should connect() to the
  8. local onion proxy and tell it "address and port". The onion proxy will
  9. itself make a connection to "address and port", and then the client
  10. application can talk through that socket as if it's directly connected. To
  11. support as many applications as possible, tor uses the common "socks"
  12. protocol which does exactly the above. So applications with socks support
  13. will support tor without needing any modifications.
  14. 2) Applications must not call gethostbyname() to resolve an address
  15. they intend to later connect() to via onion routing. gethostbyname()
  16. contacts the dns server of the target machine -- thus giving away the
  17. fact that you intend to make an anonymous connection to it.
  18. To clarify, I need to explain more about the socks protocol. Socks
  19. comes in three flavors: 4, 4a, and 5. The socks4 protocol basically
  20. uses IP and port -- so it is unsuitable because of the gethostbyname()
  21. issue above. Socks4a is a slight modification to the socks4 protocol,
  22. whereby you can specify an IP of 0.0.0.x to signal the socks server
  23. that you will instead be sending a hostname (fqdn). So applications with
  24. socks4a support are all set. Socks5, on the other hand, allows the client
  25. to specify "address type" and then an address -- so some applications
  26. choose to supply an IP and others choose to supply a hostname. If the
  27. application uses socks5 you must investigate further to decide whether
  28. it's leaking anonymity.
  29. Part two: using tsocks to transparently replace library calls
  30. tsocks (available from http://tsocks.sourceforge.net/ or from your
  31. favorite apt-get equivalent) allows you to run a program as normal,
  32. but it replaces the system calls for connect() to connect to the socks
  33. server first and then pass it your destination info. In our case the
  34. socks server is a tor process (running either locally or elsewhere).
  35. In general this works quite well for command-line processes like finger,
  36. ssh, etc. But there are a couple of catches: A) tsocks doesn't intercept
  37. calls to gethostbyname. So unless you specify an IP rather than hostname,
  38. you'll be giving yourself away. B) Programs which are suid don't let you
  39. intercept the system calls -- ssh falls into this category. But you can
  40. make a local copy of ssh and use that. C) Probably tsocks doesn't behave
  41. well for behemoths like Mozilla.
  42. Part three: applications which support tor correctly
  43. [this section is outdated and wrong. we should tie it into the main
  44. tor-doc.html one day.]
  45. http: Mozilla: set your socks4 proxy to be the onion proxy (but see above)
  46. privoxy: set your socks4a proxy to be the onion proxy
  47. wget: run privoxy, and then add the line
  48. "http_proxy=http://localhost:8118" to your ~/.wgetrc.
  49. ssh: tsocks ssh arma@18.244.0.188
  50. ftp: tsocks wget ftp://18.244.0.188/quux.tar --passive
  51. Mozilla: set your socks4 proxy to be the onion proxy