Re: [vserver] tor in a vserver?

From: Martin Fick <mogulguy_at_yahoo.com>
Date: Wed 24 Oct 2007 - 01:03:06 BST
Message-ID: <147474.88174.qm@web36112.mail.mud.yahoo.com>

--- Arjan <sw-vserver@el-c.xs4all.nl> wrote:
> > On Monday 22 October 2007, Martin Fick wrote:
>
> I'm running a tor node in a vserver behind a NAT
> router.
>
> If you're running a tor server, and not using it as
> a client to route local traffic through tor, you
> don't need the socks stuff.
> Set SocksPort to 0 in your torrc to disable it.
>
> This is all that's in the torrc of my debian-based
> tor 0.1.2.17 vserver:
> SocksPort 0
> Nickname elc
> Address el-c.xs4all.nl
> BandwidthRate 50 KB
> BandwidthBurst 50 KB
> ContactInfo tor-admin@el-c.xs4all.nl
> ORPort 9001
> #DirPort 9030 # I disabled this because of my
> limited bandwidth
> ExitPolicy reject *:*
>
> If you want to run an exit node, you'll have to use
> a different exit policy.
>
> Because of the NAT, you'll have to forward incoming
> traffic on ORPort (and optionally DirPort) to your
> tor vserver.

This is the part I was unclear about from the tor
docs. Do I simply have to configure my router to port
forward to the vservers IP or do I have to (the tor
docs make it seem like I do) do some NAT/IP forwarding
on the linux host also?

In other words, is your tor server listening to the
private vserver IP? If so, how do the other tor
servers know how to contact it? Do they simply wait
for your server to contact them and then note the
public NATted IP?

...
> If you want to enable your SocksPort and
> ControlPort, only allow
> connections from trusted locations (localhost, or
> maybe lan). Also make
> sure to setup authentication for the ControlPort if
> you enable it.

Is there perhaps a large security benefit from running
separate tor server and the tor client instances in
separate vservers? I.E. If someone breaks into your
tor server vserver, they will still not be able to see
your local unencrypted tor traffic since it will enter
the other (client tor) vserver which does not have any
listening ports exposed to the internet?

Thanks,

-Martin

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
Received on Wed Oct 24 01:03:48 2007

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 24 Oct 2007 - 01:03:53 BST by hypermail 2.1.8