| 
					
				 | 
			
			
				@@ -41,11 +41,12 @@ As above, but send log messages to the listed filename.  The "Log" 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 option may appear more than once in a configuration file.  Messages 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 are sent to all the logs that match their severity level. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBBandwidthRateBytes \fR\fINUM\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-A token bucket limits the average incoming bandwidth on this node to NUM bytes per second. (Default: 800000) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBBandwidthRate \fR\fIN\fR \fBbytes\fR|\fBKB\fR|\fBMB\fR|\fBGB\fR|\fBTB\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+A token bucket limits the average incoming bandwidth on this node to 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+the specified number of bytes second. (Default: 780 KB) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBBandwidthBurstBytes \fR\fINUM\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-Limit the maximum token bucket size (also known as the burst) to NUM bytes. (Default: 50000000) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBBandwidthBurst \fR\fIN\fR \fBbytes\fR|\fBKB\fR|\fBMB\fR|\fBGB\fR|\fBTB\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+Limit the maximum token bucket size (also known as the burst) to the given number of bytes. (Default: 48 MB) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 \fBDataDirectory \fR\fIDIR\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 Store working data in DIR (Default: @LOCALSTATEDIR@/lib/tor) 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -106,6 +107,19 @@ except when the connecting process knows the contents of a file named 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 "control_auth_cookie", which Tor will create in its data directory.  This 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 authentication methods should only be used on systems with good filesystem 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 security. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBDirFetchPeriod \fR\fIN\fR \fBseconds\fR|\fBminutes\fR|\fBhours\fR|\fBdays\fR|\fBweeks\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+Every time the specified period elapses, Tor downloads a directory. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+A directory contains a signed list of all known servers as well as 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+their current their liveness status.  (Default: 1 hour) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+.TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBStatusFetchPeriod \fR\fIN\fR \fBseconds\fR|\fBminutes\fR|\fBhours\fR|\fBdays\fR|\fBweeks\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+Every time the specified period elapses, Tor downloads signed status 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+information about the current state of known servers.  (Default: 20 minutes.) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+.TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBRendPostPeriod \fR\fIN\fR \fBseconds\fR|\fBminutes\fR|\fBhours\fR|\fBdays\fR|\fBweeks\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+Every time the specified period elapses, Tor uploads any rendezvous 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+service descriptors to the directory servers.  This information is also 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+uploaded whenever it changes.  (Default: 10 minutes.) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .SH CLIENT OPTIONS 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .PP 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -115,25 +129,18 @@ The following options are useful only for clients (that is, if \fBSOCKSPort\fP i 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 Where on our circuits should we allow Tor servers that the directory 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 servers haven't authenticated as "verified"?  (Default: middle,rendezvous.) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBDirFetchPostPeriod \fR\fIseconds\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-Every N seconds, Tor downloads a fresh directory, and re-uploads 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-information about hidden services to the directory servers.  If 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-running as a server, Tor also re-uploads information about itself to 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-the directory servers.  (Tor also uploads this information whenever it 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-changes.)  (Default: 600.) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-.TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 \fBClientOnly \fR\fB0\fR|\fB1\fR\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 If set to 1, Tor will under no circumstances run as a server.  (Usually, 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 you don't need to set this; Tor is pretty smart at figuring out whether 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 you are reliable and high-bandwidth enough to be a good server.) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBEntryNodes \fR\fInickname,nickname,...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBEntryNodes \fR\fInickname\fR,\fInickname\fR,\fI...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 A list of preferred nodes to use for the first hop in the circuit, if possible. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBExitNodes \fR\fInickname,nickname,...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBExitNodes \fR\fInickname\fR,\fInickname\fR,\fI...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 A list of preferred nodes to use for the last hop in the circuit, if possible. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBExcludeNodes \fR\fInickname,nickname,...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBExcludeNodes \fR\fInickname\fR,\fInickname\fR,\fI...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 A list of nodes to never use when building a circuit. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 \fBStrictExitNodes \fR\fB0\fR|\fB1\fR\fP 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -158,7 +165,7 @@ A list of ports that your firewall allows you to connect to.  Only used when 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 \fBNewCircuitPeriod \fR\fINUM\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 Every NUM seconds consider whether to build a new circuit. (Default: 60) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBNodeFamily \fR\fInickname,nickname,...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBNodeFamily \fR\fInickname\fR,\fInickname\fR,\fI...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 The named Tor servers constitute a "family" of similar or co-administered 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 servers, so never use any two of them in the same circuit. Defining a 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 NodeFamily is only needed when a server doesn't list the family itself 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -167,10 +174,10 @@ NodeFamily is only needed when a server doesn't list the family itself 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .\" \fBPathlenCoinWeight \fR\fI0.0-1.0\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .\" Paths are 3 hops plus a geometric distribution centered around this coinweight. Must be >=0.0 and <1.0. (Default: 0.3) NOT USED CURRENTLY 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .\" .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBRendNodes \fR\fInickname,nickname,...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBRendNodes \fR\fInickname\fR,\fInickname\fR,\fI...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 A list of preferred nodes to use for the rendezvous point, if possible. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBRendExcludeNodes \fR\fInickname,nickname,...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBRendExcludeNodes \fR\fInickname\fR,\fInickname\fR,\fI...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 A list of nodes to never use when choosing a rendezvous point. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 \fBSOCKSPort \fR\fIPORT\fP 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -181,7 +188,7 @@ Set this to 0 if you don't want to allow application connections. (Default: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 \fBSOCKSBindAddress \fR\fIIP\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 Bind to this address to listen for connections from socks-speaking applications. (Default: 127.0.0.1) You can also specify a port (e.g. 192.168.0.1:9100). This directive can be specified multiple times to bind to multiple addresses/ports. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBSOCKSPolicy \fR\fIpolicy,policy,...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBSOCKSPolicy \fR\fIpolicy\fR,\fIpolicy\fR,\fI...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 Set an entrance policy for this server, to limit who can connect to the socks ports. The policies have the same form as exit policies below. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .SH SERVER OPTIONS 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -192,10 +199,10 @@ The following options are useful only for servers (that is, if \fBORPort\fP is n 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 The IP or fqdn of this server (e.g. moria.mit.edu). You can leave this 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 unset, and Tor will guess your IP. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBContactInfo \fR\fIemail address\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBContactInfo \fR\fIemail_address\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 Administrative contact information for server. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBExitPolicy \fR\fIpolicy,policy,...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBExitPolicy \fR\fIpolicy\fR,\fIpolicy\fR,\fI...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 Set an exit policy for this server. Each policy is of the form 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 "\fBreject\fP \fIADDR\fP\fB/\fP\fIMASK\fP\fB:\fP\fIPORT\fP". 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 If \fB/\fP\fIMASK\fP is omitted then this policy just applies to the host 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -240,7 +247,7 @@ space. The default exit policy is: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 \fBMaxOnionsPending \fR\fINUM\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 If you have more than this number of onionskins queued for decrypt, reject new ones. (Default: 100) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBMyFamily \fR\fInickname,nickname,...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBMyFamily \fR\fInickname\fR,\fInickname\fR,\fI...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 Declare that this Tor server is controlled or administered by a group 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 or organization identical or similar to that of the other named servers. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 When two servers both declare that they are in the same 'family', Tor clients 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -271,20 +278,33 @@ redirection is to be performed on a given set of addresses by using the 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 special target string "pass", which prevents subsequent rules from being 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 considered. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBAccountingMaxKB \fR\fInum\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-Never send more than \fInum\fP kilobytes in a given accounting period, 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-or receive more than \fInum\fP kilobytes in the period (currently, 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-only months are supported).  When the number of kilobytes is exhausted, 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-Tor will hibernate until some time 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-in the next accounting period.  If you have bandwidth cost issues, 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBDirPostPeriod \fR\fIN\fR \fBseconds\fR|\fBminutes\fR|\fBhours\fR|\fBdays\fR|\fBweeks\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+Every time the specified period elapses, Tor uploads its server 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+descriptors to the directory servers.  This information is also 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+uploaded whenever it changes.  (Default: 10 minutes.) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+.TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBAccountingMax \fR\fIN\fR \fBbytes\fR|\fBKB\fR|\fBMB\fR|\fBGB\fR|\fBTB\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+Never send more than the specified number of bytes in a given 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+accounting period,or receive more than that number in the period. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+When the number of bytes is exhausted, Tor will hibernate until some 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+time in the next accounting period.  To prevent all servers from 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+waking at the same time, Tor will also wait until a random point in 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+each period before waking up.  If you have bandwidth cost issues, 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 using this option is preferable to setting a low bandwidth, since it 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 provides users with a collection of fast servers that are up some of 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 the time, which is more useful than a set of slow servers that are 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 always "available". 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBMonthlyAccountingStart \fR\fIday\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-Always start the accounting period on the provided day of the month, 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-which must be between 1 and 28.  (Defaults to 1.) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBAccountingStart \fR\fBday\fR|\fBweek\fR|\fBmonth\fR [\fIday\fR] \fIHH:MM\fR\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+Specify how long accounting periods last.  If \fBmonth\fP is given, 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+each accounting period runs from the time \fIHH:MM\fR on the 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fIday\fRth day of one month to the same day and time of the next. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+(The day must be between 1 and 28.)  If \fBweek\fP is given, each 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+accounting period runs from the time \fIHH:MM\fR of the \fIday\fRth 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+day of one week to the same day and time of the next week, with Monday 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+as day 1 and Sunday as day 7.  If \fBday\fR is given, each accounting 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+period runs from the time \fIHH:MM\fR each day to the same time on the 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+next day.  All times are local.  (Defaults to "month 1 0:00".) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .SH DIRECTORY SERVER OPTIONS 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .PP 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -304,7 +324,7 @@ Bind the directory service to this port. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 \fBDirBindAddress \fR\fIIP\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 Bind the directory service to this address. (Default: 0.0.0.0) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBDirPolicy \fR\fIpolicy,policy,...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBDirPolicy \fR\fIpolicy\fR,\fIpolicy\fR,\fI...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 Set an entrance policy for this server, to limit who can connect to the directory ports. The policies have the same form as exit policies above. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 \fBRecommendedVersions \fR\fISTRING\fP 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -336,11 +356,11 @@ hiddenservicedir.  By default, this option maps the virtual port to the 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 same port on 127.0.0.1.  You may override the target port, address, or both 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 by specifying a target of addr, port, or addr:port. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBHiddenServiceNodes \fR\fInickname,nickname,...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBHiddenServiceNodes \fR\fInickname\fR,\fInickname\fR,\fI...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 If possible, use the specified nodes as introduction points for the hidden 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 service. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 .TP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-\fBHiddenServiceExcludeNodes \fR\fInickname,nickname,...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+\fBHiddenServiceExcludeNodes \fR\fInickname\fR,\fInickname\fR,\fI...\fP 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 Do not use the specified nodes as introduction points for the hidden 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 service. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 |