freedombone-utils-onion 12KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Onion functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2016 Bob Mottram <bob@freedombone.net>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. function onion_update {
  31. # update so that new onion services appear
  32. systemctl reload tor
  33. }
  34. function onion_service_exists {
  35. onion_service_name="$1"
  36. if [ -f /var/lib/tor/hidden_service_${onion_service_name}/hostname ]; then
  37. echo "1"
  38. else
  39. echo "0"
  40. fi
  41. }
  42. function wait_for_onion_service_base {
  43. onion_service_name="$1"
  44. sleep_ctr=0
  45. while [ $(onion_service_exists ${onion_service_name}) == "0" ]; do
  46. sleep 1
  47. sleep_ctr=$((sleep_ctr + 1))
  48. if [ $sleep_ctr -gt 10 ]; then
  49. break
  50. fi
  51. done
  52. }
  53. function wait_for_onion_service {
  54. onion_service_name="$1"
  55. wait_for_onion_service_base ${onion_service_name}
  56. if [ $(onion_service_exists ${onion_service_name}) == "0" ]; then
  57. # try a second time
  58. onion_update
  59. wait_for_onion_service_base ${onion_service_name}
  60. fi
  61. }
  62. function remove_onion_service {
  63. onion_service_name="$1"
  64. onion_service_port_to=$2
  65. #sed -i "/stealth ${onion_service_name}/d" /etc/tor/torrc
  66. sed -i "/hidden_service_${onion_service_name}/d" /etc/tor/torrc
  67. sed -i "/127.0.0.1:${onion_service_port_to}/d" /etc/tor/torrc
  68. if [ $3 ]; then
  69. sed -i "/127.0.0.1:${3}/d" /etc/tor/torrc
  70. if [ $4 ]; then
  71. sed -i "/127.0.0.1:${4}/d" /etc/tor/torrc
  72. if [ $5 ]; then
  73. sed -i "/127.0.0.1:${5}/d" /etc/tor/torrc
  74. fi
  75. fi
  76. fi
  77. if [ $(onion_service_exists ${onion_service_name}) == "1" ]; then
  78. shred -zu /var/lib/tor/hidden_service_${onion_service_name}/*
  79. rm -rf /var/lib/tor/hidden_service_${onion_service_name}
  80. fi
  81. remove_completion_param "${onion_service_name} onion domain"
  82. onion_update
  83. }
  84. function add_onion_service {
  85. onion_service_name="$1"
  86. onion_service_port_from=$2
  87. onion_service_port_to=$3
  88. if [ $(onion_service_exists ${onion_service_name}) == "1" ]; then
  89. echo $(cat /var/lib/tor/hidden_service_${onion_service_name}/hostname)
  90. return
  91. fi
  92. if [ ! -d /var/lib/tor ]; then
  93. echo $"No Tor installation found. ${onion_service_name} onion site cannot be configured."
  94. exit 877367
  95. fi
  96. if ! grep -q "hidden_service_${onion_service_name}" /etc/tor/torrc; then
  97. echo "HiddenServiceDir /var/lib/tor/hidden_service_${onion_service_name}/" >> /etc/tor/torrc
  98. echo "HiddenServicePort ${onion_service_port_from} 127.0.0.1:${onion_service_port_to}" >> /etc/tor/torrc
  99. #echo "HiddenServiceAuthorizeClient stealth ${onion_service_name}" >> /etc/tor/torrc
  100. fi
  101. onion_update
  102. function_check wait_for_onion_service
  103. wait_for_onion_service ${onion_service_name}
  104. if [ $(onion_service_exists ${onion_service_name}) == "0" ]; then
  105. echo $"${onion_service_name} onion site hostname not found"
  106. exit 76362
  107. fi
  108. onion_address=$(cat /var/lib/tor/hidden_service_${onion_service_name}/hostname)
  109. # Record the domain in the completion file
  110. set_completion_param "${onion_service_name} onion domain" "${onion_address}"
  111. echo $onion_address
  112. }
  113. function set_default_onion_domains {
  114. # If sites are only visible via Tor then for installation
  115. # purposes assign them some default domain names
  116. if [[ $ONION_ONLY == "no" ]]; then
  117. return
  118. fi
  119. POSTACTIV_DOMAIN_NAME='postactiv.local'
  120. GNUSOCIAL_DOMAIN_NAME='gnusocial.local'
  121. HTMLY_DOMAIN_NAME='htmly.local'
  122. DOKUWIKI_DOMAIN_NAME='dokuwiki.local'
  123. DEFAULT_DOMAIN_NAME="${PROJECT_NAME}.local"
  124. GIT_DOMAIN_NAME='gogs.local'
  125. MEDIAGOBLIN_DOMAIN_NAME='media.local'
  126. }
  127. function create_avahi_onion_domains {
  128. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  129. return
  130. fi
  131. if [ ! -d /etc/avahi/services ]; then
  132. return
  133. fi
  134. if [ $GNUSOCIAL_DOMAIN_NAME ]; then
  135. function_check create_avahi_service
  136. create_avahi_service gnusocial http tcp $GNUSOCIAL_ONION_PORT
  137. fi
  138. if [ $HTMLY_DOMAIN_NAME ]; then
  139. function_check create_avahi_service
  140. create_avahi_service blog http tcp $HTMLY_ONION_PORT
  141. fi
  142. if [ $GIT_DOMAIN_NAME ]; then
  143. function_check create_avahi_service
  144. create_avahi_service git http tcp $GIT_ONION_PORT
  145. fi
  146. if [ $DOKUWIKI_DOMAIN_NAME ]; then
  147. function_check create_avahi_service
  148. create_avahi_service dokuwiki http tcp $DOKUWIKI_ONION_PORT
  149. fi
  150. }
  151. function allow_ssh_to_onion_address {
  152. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  153. return
  154. fi
  155. if [ ! -d /home/$MY_USERNAME/.ssh ]; then
  156. mkdir /home/$MY_USERNAME/.ssh
  157. fi
  158. if [ ! -d /etc/tor ]; then
  159. echo $'Tor not found when updating ssh'
  160. exit 528257
  161. fi
  162. if ! grep -q "onion" /home/$MY_USERNAME/.ssh/config; then
  163. echo 'Host *.onion' >> /home/$MY_USERNAME/.ssh/config
  164. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> /home/$MY_USERNAME/.ssh/config
  165. fi
  166. }
  167. function enable_ssh_via_onion {
  168. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  169. return
  170. fi
  171. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  172. return
  173. fi
  174. apt-get -yq install tor connect-proxy
  175. if ! grep -q 'Host *.onion' /home/$MY_USERNAME/.ssh/config; then
  176. if [ ! -d /home/$MY_USERNAME/.ssh ]; then
  177. mkdir /home/$MY_USERNAME/.ssh
  178. fi
  179. echo 'Host *.onion' >> /home/$MY_USERNAME/.ssh/config
  180. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> /home/$MY_USERNAME/.ssh/config
  181. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh
  182. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh/config
  183. fi
  184. if ! grep -q 'Host *.onion' /root/.ssh/config; then
  185. if [ ! -d /root/.ssh ]; then
  186. mkdir /root/.ssh
  187. fi
  188. echo 'Host *.onion' >> /root/.ssh/config
  189. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> /root/.ssh/config
  190. fi
  191. mark_completed $FUNCNAME
  192. }
  193. function configure_ssh_onion {
  194. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  195. return
  196. fi
  197. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  198. return
  199. fi
  200. SSH_ONION_HOSTNAME=$(add_onion_service ssh ${SSH_PORT} ${SSH_PORT})
  201. set_completion_param "ssh onion domain" "${SSH_ONION_HOSTNAME}"
  202. mark_completed $FUNCNAME
  203. }
  204. function install_tor {
  205. if [[ $SYSTEM_TYPE == "mesh*" ]]; then
  206. return
  207. fi
  208. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  209. return
  210. fi
  211. apt-get -yq install tor
  212. if [ ! -f /etc/tor/torrc ]; then
  213. echo 'Tor failed to install'
  214. exit 38259
  215. fi
  216. mark_completed $FUNCNAME
  217. }
  218. function resolve_dns_via_tor {
  219. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  220. return
  221. fi
  222. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  223. return
  224. fi
  225. if [ ! -f /etc/tor/torrc ]; then
  226. echo $'tor was not installed'
  227. exit 52952
  228. fi
  229. # resolve DNS via tor
  230. if ! grep 'DNSPort 53' /etc/tor/torrc; then
  231. echo 'DNSPort 53' >> /etc/tor/torrc
  232. echo 'AutomapHostsOnResolve 1' >> /etc/tor/torrc
  233. echo 'AutomapHostsSuffixes .exit,.onion' >> /etc/tor/torrc
  234. onion_update
  235. fi
  236. # don't change resolv.conf
  237. sed -i 's|, domain-name-servers||g' /etc/dhcp/dhclient.conf
  238. # point resolv.conf to tor
  239. echo 'nameserver 127.0.0.1:53' > /etc/resolv.conf
  240. # prevent resolv.conf from changing
  241. chattr +i /etc/resolv.conf
  242. mark_completed $FUNCNAME
  243. }
  244. # see https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy
  245. # Local Redirection and Anonymizing Middlebox
  246. function route_outgoing_traffic_through_tor {
  247. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  248. return
  249. fi
  250. if [[ $ROUTE_THROUGH_TOR != "yes" ]]; then
  251. return
  252. fi
  253. apt-get -yq install tor tor-arm
  254. ### set variables
  255. # Destinations you don't want routed through Tor
  256. _non_tor="192.168.1.0/24 192.168.0.0/24"
  257. # The user that Tor runs as
  258. _tor_uid="debian-tor"
  259. # Tor's TransPort
  260. _trans_port="9040"
  261. # Your internal interface
  262. _int_if="eth0"
  263. ### Set iptables *nat
  264. iptables -t nat -A OUTPUT -o lo -j RETURN
  265. iptables -t nat -A OUTPUT -m owner --uid-owner $_tor_uid -j RETURN
  266. iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 53
  267. # Allow clearnet access for hosts in $_non_tor
  268. for _clearnet in $_non_tor; do
  269. iptables -t nat -A OUTPUT -d $_clearnet -j RETURN
  270. iptables -t nat -A PREROUTING -i $_int_if -d $_clearnet -j RETURN
  271. done
  272. # Redirect all other pre-routing and output to Tor
  273. iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $_trans_port
  274. iptables -t nat -A PREROUTING -i $_int_if -p udp --dport 53 -j REDIRECT --to-ports 53
  275. iptables -t nat -A PREROUTING -i $_int_if -p tcp --syn -j REDIRECT --to-ports $_trans_port
  276. ### set iptables *filter
  277. iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  278. # Allow clearnet access for hosts in $_non_tor
  279. for _clearnet in $_non_tor 127.0.0.0/8; do
  280. iptables -A OUTPUT -d $_clearnet -j ACCEPT
  281. done
  282. # Allow only Tor output
  283. iptables -A OUTPUT -m owner --uid-owner $_tor_uid -j ACCEPT
  284. iptables -A OUTPUT -j REJECT
  285. function_check save_firewall_settings
  286. save_firewall_settings
  287. if ! grep -q "fs.file-max" /etc/sysctl.conf; then
  288. echo "fs.file-max=100000" >> /etc/sysctl.conf
  289. /sbin/sysctl -p -q
  290. fi
  291. echo 'domain localdomain' > /etc/resolv.conf
  292. echo 'search localdomain' >> /etc/resolv.conf
  293. echo 'nameserver 127.0.0.1' >> /etc/resolv.conf
  294. if ! grep -q "VirtualAddrNetworkIPv4" /etc/tor/torrc; then
  295. echo 'VirtualAddrNetworkIPv4 10.192.0.0/10' >> /etc/tor/torrc
  296. fi
  297. if ! grep -q "AutomapHostsOnResolve" /etc/tor/torrc; then
  298. echo 'AutomapHostsOnResolve 1' >> /etc/tor/torrc
  299. fi
  300. if ! grep -q "TransPort" /etc/tor/torrc; then
  301. echo 'TransPort 9040' >> /etc/tor/torrc
  302. fi
  303. if ! grep -q "TransListenAddress 127.0.0.1" /etc/tor/torrc; then
  304. echo 'TransListenAddress 127.0.0.1' >> /etc/tor/torrc
  305. fi
  306. if ! grep -q "TransListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" /etc/tor/torrc; then
  307. echo "TransListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" >> /etc/tor/torrc
  308. fi
  309. if ! grep -q "DNSPort" /etc/tor/torrc; then
  310. echo 'DNSPort 53' >> /etc/tor/torrc
  311. fi
  312. if ! grep -q "DNSListenAddress 127.0.0.1" /etc/tor/torrc; then
  313. echo 'DNSListenAddress 127.0.0.1' >> /etc/tor/torrc
  314. fi
  315. if ! grep -q "DNSListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" /etc/tor/torrc; then
  316. echo "DNSListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" >> /etc/tor/torrc
  317. fi
  318. mark_completed $FUNCNAME
  319. }
  320. # NOTE: deliberately no exit 0