A whitelisting proxy for the Tor control port.
The Tor Browser, when not used in "Transparent Torification" mode, requires access to the Tor control port so that it can test that the browser is configured to use Tor correctly and send a NEWNYM signal when the "New Identity" button is clicked.
While these are nice features to have, exposing the control port to the browser
results in an increased attack surface. For example, an attacker could tamper
with the Tor configuration to only use relays that they control or obtain the
IP address of the machine running Tor by using the
GETINFO address command.
Inspired by a similar project written as part of Whonix, I wrote a simple proxy that only allows commands necessary for operation of the Tor Browser and rejects all others.
Note that this simple proxy does not enforce authentication; I do not believe there are significant anonymity concerns with this, but this does present an increased attack risk if someone compromises a user account on your machine. In the future, I may add support for a separate auth cookie for the proxy itself, so that authentication can be used without exposing the main Tor auth cookie to your Torified VMs.
- Python 3+
Note: if you already have Tor's control port running on port 9151
ControlPort 9151), you can use filtor's
-p option to change the port.
Install the proxy. Arch users can find a PKGBUILD in the AUR; other users should copy filtor to /usr/bin, copy filtor.service to /etc/systemd/system, and create a filtor user. (If you're not using systemd, you'll need to write your own initscript.)
Configure Tor; set the following options (and restart if necessary):
ControlPort unix:/run/tor/control GroupWritable CookieAuthentication 1 CookieAuthFile /run/tor/control.authcookie CookieAuthFileGroupReadable 1
sudo systemctl start filtor.service
Commit ad6a56520c8ae30d486200bb9c105c2de8b53fc3 introduced support for the
ADD_ONION command without filtering the allowed ports. This was on by default
and would allow an attacker to create an onion service for the actual control
port and bypass the filter. This feature was disabled by default with commit
19b7f7828c141bf9e326754e75ffc45ebabcc20b and must be enabled with the