freedombone-utils-onion 11KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Onion functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2016 Bob Mottram <bob@robotics.uk.to>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. function wait_for_onion_service {
  31. onion_service_name="$1"
  32. sleep_ctr=0
  33. while [ ! -f /var/lib/tor/hidden_service_${onion_service_name}/hostname ]; do
  34. sleep 1
  35. sleep_ctr=$((sleep_ctr + 1))
  36. if [ $sleep_ctr -gt 10 ]; then
  37. break
  38. fi
  39. done
  40. if [ ! -f /var/lib/tor/hidden_service_${onion_service_name}/hostname ]; then
  41. # restart and try a second time
  42. systemctl restart tor
  43. sleep_ctr=0
  44. while [ ! -f /var/lib/tor/hidden_service_${onion_service_name}/hostname ]; do
  45. sleep 1
  46. sleep_ctr=$((sleep_ctr + 1))
  47. if [ $sleep_ctr -gt 10 ]; then
  48. break
  49. fi
  50. done
  51. fi
  52. }
  53. function remove_onion_service {
  54. onion_service_name="$1"
  55. onion_service_port_to=$2
  56. sed -i "/hidden_service_${onion_service_name}/d" /etc/tor/torrc
  57. sed -i "/127.0.0.1:${onion_service_port_to}/d" /etc/tor/torrc
  58. if [ $3 ]; then
  59. sed -i "/127.0.0.1:${3}/d" /etc/tor/torrc
  60. if [ $4 ]; then
  61. sed -i "/127.0.0.1:${4}/d" /etc/tor/torrc
  62. if [ $5 ]; then
  63. sed -i "/127.0.0.1:${5}/d" /etc/tor/torrc
  64. fi
  65. fi
  66. fi
  67. if [ -d /var/lib/tor/hidden_service_${onion_service_name} ]; then
  68. shred -zu /var/lib/tor/hidden_service_${onion_service_name}/*
  69. rm -rf /var/lib/tor/hidden_service_${onion_service_name}
  70. fi
  71. systemctl restart tor
  72. }
  73. function add_onion_service {
  74. onion_service_name="$1"
  75. onion_service_port_from=$2
  76. onion_service_port_to=$3
  77. if [ -f /var/lib/tor/hidden_service_${onion_service_name}/hostname ]; then
  78. echo $(cat /var/lib/tor/hidden_service_${onion_service_name}/hostname)
  79. return
  80. fi
  81. if [ ! -d /var/lib/tor ]; then
  82. echo $"No Tor installation found. ${onion_service_name} onion site cannot be configured."
  83. exit 877367
  84. fi
  85. if ! grep -q "hidden_service_${onion_service_name}" /etc/tor/torrc; then
  86. echo "HiddenServiceDir /var/lib/tor/hidden_service_${onion_service_name}/" >> /etc/tor/torrc
  87. echo "HiddenServicePort ${onion_service_port_from} 127.0.0.1:${onion_service_port_to}" >> /etc/tor/torrc
  88. fi
  89. systemctl restart tor
  90. function_check wait_for_onion_service
  91. wait_for_onion_service ${onion_service_name}
  92. if [ ! -f /var/lib/tor/hidden_service_${onion_service_name}/hostname ]; then
  93. echo $"${onion_service_name} onion site hostname not found"
  94. exit 76362
  95. fi
  96. echo $(cat /var/lib/tor/hidden_service_${onion_service_name}/hostname)
  97. }
  98. function set_default_onion_domains {
  99. # If sites are only visible via Tor then for installation
  100. # purposes assign them some default domain names
  101. if [[ $ONION_ONLY == "no" ]]; then
  102. return
  103. fi
  104. MICROBLOG_DOMAIN_NAME='microblog.local'
  105. FULLBLOG_DOMAIN_NAME='blog.local'
  106. WIKI_DOMAIN_NAME='wiki.local'
  107. DEFAULT_DOMAIN_NAME="${PROJECT_NAME}.local"
  108. GIT_DOMAIN_NAME='git.local'
  109. MEDIAGOBLIN_DOMAIN_NAME='media.local'
  110. }
  111. function create_avahi_onion_domains {
  112. if [[ $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  113. return
  114. fi
  115. if [ ! -d /etc/avahi/services ]; then
  116. return
  117. fi
  118. if [ $MICROBLOG_DOMAIN_NAME ]; then
  119. function_check create_avahi_service
  120. create_avahi_service microblog http tcp $MICROBLOG_ONION_PORT
  121. fi
  122. if [ $FULLBLOG_DOMAIN_NAME ]; then
  123. function_check create_avahi_service
  124. create_avahi_service blog http tcp $BLOG_ONION_PORT
  125. fi
  126. if [ $GIT_DOMAIN_NAME ]; then
  127. function_check create_avahi_service
  128. create_avahi_service git http tcp $GIT_ONION_PORT
  129. fi
  130. if [ $WIKI_DOMAIN_NAME ]; then
  131. function_check create_avahi_service
  132. create_avahi_service wiki http tcp $WIKI_ONION_PORT
  133. fi
  134. }
  135. function allow_ssh_to_onion_address {
  136. if [[ $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  137. return
  138. fi
  139. if [ ! -d /home/$MY_USERNAME/.ssh ]; then
  140. mkdir /home/$MY_USERNAME/.ssh
  141. fi
  142. if [ ! -d /etc/tor ]; then
  143. echo $'Tor not found when updating ssh'
  144. exit 528257
  145. fi
  146. if ! grep -q "onion" /home/$MY_USERNAME/.ssh/config; then
  147. echo 'Host *.onion' >> /home/$MY_USERNAME/.ssh/config
  148. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> /home/$MY_USERNAME/.ssh/config
  149. fi
  150. }
  151. function enable_ssh_via_onion {
  152. if [[ $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  153. return
  154. fi
  155. if grep -Fxq "enable_ssh_via_onion" $COMPLETION_FILE; then
  156. return
  157. fi
  158. apt-get -y install tor connect-proxy
  159. if ! grep -q 'Host *.onion' /home/$MY_USERNAME/.ssh/config; then
  160. if [ ! -d /home/$MY_USERNAME/.ssh ]; then
  161. mkdir /home/$MY_USERNAME/.ssh
  162. fi
  163. echo 'Host *.onion' >> /home/$MY_USERNAME/.ssh/config
  164. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> /home/$MY_USERNAME/.ssh/config
  165. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh
  166. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh/config
  167. fi
  168. if ! grep -q 'Host *.onion' /root/.ssh/config; then
  169. if [ ! -d /root/.ssh ]; then
  170. mkdir /root/.ssh
  171. fi
  172. echo 'Host *.onion' >> /root/.ssh/config
  173. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> /root/.ssh/config
  174. fi
  175. echo 'enable_ssh_via_onion' >> $COMPLETION_FILE
  176. }
  177. function configure_ssh_onion {
  178. if grep -Fxq "configure_ssh_onion" $COMPLETION_FILE; then
  179. return
  180. fi
  181. if [[ $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  182. return
  183. fi
  184. SSH_ONION_HOSTNAME=$(add_onion_service ssh ${SSH_PORT} ${SSH_PORT})
  185. if ! grep -q "ssh onion domain" $COMPLETION_FILE; then
  186. echo "ssh onion domain:${SSH_ONION_HOSTNAME}" >> $COMPLETION_FILE
  187. else
  188. sed -i "s|ssh onion domain.*|ssh onion domain:${SSH_ONION_HOSTNAME}|g" $COMPLETION_FILE
  189. fi
  190. echo 'configure_ssh_onion' >> $COMPLETION_FILE
  191. }
  192. function install_tor {
  193. if [[ $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  194. return
  195. fi
  196. if grep -Fxq "install_tor" $COMPLETION_FILE; then
  197. return
  198. fi
  199. apt-get -y install tor
  200. if [ ! -f /etc/tor/torrc ]; then
  201. echo 'Tor failed to install'
  202. exit 38259
  203. fi
  204. echo 'install_tor' >> $COMPLETION_FILE
  205. }
  206. function resolve_dns_via_tor {
  207. if [[ $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  208. return
  209. fi
  210. if grep -Fxq "resolve_dns_via_tor" $COMPLETION_FILE; then
  211. return
  212. fi
  213. if [ ! -f /etc/tor/torrc ]; then
  214. echo $'tor was not installed'
  215. exit 52952
  216. fi
  217. # resolve DNS via tor
  218. if ! grep 'DNSPort 53' /etc/tor/torrc; then
  219. echo 'DNSPort 53' >> /etc/tor/torrc
  220. echo 'AutomapHostsOnResolve 1' >> /etc/tor/torrc
  221. echo 'AutomapHostsSuffixes .exit,.onion' >> /etc/tor/torrc
  222. systemctl restart tor
  223. fi
  224. # don't change resolv.conf
  225. sed -i 's|, domain-name-servers||g' /etc/dhcp/dhclient.conf
  226. # point resolv.conf to tor
  227. echo 'nameserver 127.0.0.1:53' > /etc/resolv.conf
  228. # prevent resolv.conf from changing
  229. chattr +i /etc/resolv.conf
  230. echo 'resolve_dns_via_tor' >> $COMPLETION_FILE
  231. }
  232. # see https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy
  233. # Local Redirection and Anonymizing Middlebox
  234. function route_outgoing_traffic_through_tor {
  235. if grep -Fxq "route_outgoing_traffic_through_tor" $COMPLETION_FILE; then
  236. return
  237. fi
  238. if [[ $ROUTE_THROUGH_TOR != "yes" ]]; then
  239. return
  240. fi
  241. apt-get -y install tor tor-arm
  242. ### set variables
  243. # Destinations you don't want routed through Tor
  244. _non_tor="192.168.1.0/24 192.168.0.0/24"
  245. # The user that Tor runs as
  246. _tor_uid="debian-tor"
  247. # Tor's TransPort
  248. _trans_port="9040"
  249. # Your internal interface
  250. _int_if="eth0"
  251. ### Set iptables *nat
  252. iptables -t nat -A OUTPUT -o lo -j RETURN
  253. iptables -t nat -A OUTPUT -m owner --uid-owner $_tor_uid -j RETURN
  254. iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 53
  255. # Allow clearnet access for hosts in $_non_tor
  256. for _clearnet in $_non_tor; do
  257. iptables -t nat -A OUTPUT -d $_clearnet -j RETURN
  258. iptables -t nat -A PREROUTING -i $_int_if -d $_clearnet -j RETURN
  259. done
  260. # Redirect all other pre-routing and output to Tor
  261. iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $_trans_port
  262. iptables -t nat -A PREROUTING -i $_int_if -p udp --dport 53 -j REDIRECT --to-ports 53
  263. iptables -t nat -A PREROUTING -i $_int_if -p tcp --syn -j REDIRECT --to-ports $_trans_port
  264. ### set iptables *filter
  265. iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  266. # Allow clearnet access for hosts in $_non_tor
  267. for _clearnet in $_non_tor 127.0.0.0/8; do
  268. iptables -A OUTPUT -d $_clearnet -j ACCEPT
  269. done
  270. # Allow only Tor output
  271. iptables -A OUTPUT -m owner --uid-owner $_tor_uid -j ACCEPT
  272. iptables -A OUTPUT -j REJECT
  273. function_check save_firewall_settings
  274. save_firewall_settings
  275. if ! grep -q "fs.file-max" /etc/sysctl.conf; then
  276. echo "fs.file-max=100000" >> /etc/sysctl.conf
  277. /sbin/sysctl -p -q
  278. fi
  279. echo 'domain localdomain' > /etc/resolv.conf
  280. echo 'search localdomain' >> /etc/resolv.conf
  281. echo 'nameserver 127.0.0.1' >> /etc/resolv.conf
  282. if ! grep -q "VirtualAddrNetworkIPv4" /etc/tor/torrc; then
  283. echo 'VirtualAddrNetworkIPv4 10.192.0.0/10' >> /etc/tor/torrc
  284. fi
  285. if ! grep -q "AutomapHostsOnResolve" /etc/tor/torrc; then
  286. echo 'AutomapHostsOnResolve 1' >> /etc/tor/torrc
  287. fi
  288. if ! grep -q "TransPort" /etc/tor/torrc; then
  289. echo 'TransPort 9040' >> /etc/tor/torrc
  290. fi
  291. if ! grep -q "TransListenAddress 127.0.0.1" /etc/tor/torrc; then
  292. echo 'TransListenAddress 127.0.0.1' >> /etc/tor/torrc
  293. fi
  294. if ! grep -q "TransListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" /etc/tor/torrc; then
  295. echo "TransListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" >> /etc/tor/torrc
  296. fi
  297. if ! grep -q "DNSPort" /etc/tor/torrc; then
  298. echo 'DNSPort 53' >> /etc/tor/torrc
  299. fi
  300. if ! grep -q "DNSListenAddress 127.0.0.1" /etc/tor/torrc; then
  301. echo 'DNSListenAddress 127.0.0.1' >> /etc/tor/torrc
  302. fi
  303. if ! grep -q "DNSListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" /etc/tor/torrc; then
  304. echo "DNSListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" >> /etc/tor/torrc
  305. fi
  306. echo 'route_outgoing_traffic_through_tor' >> $COMPLETION_FILE
  307. }
  308. # NOTE: deliberately no exit 0