From e1c9016311454d192c47be89500deb00f91fbfcc Mon Sep 17 00:00:00 2001 From: Peter Dave Hello Date: Sat, 23 Jan 2021 17:46:23 +0800 Subject: [PATCH] Limit the whole Tor process to tor user, change default DNSPort to 8853 cc #4 --- Dockerfile | 3 ++- README.md | 6 +++++- docker-compose.yml | 2 +- torrc | 3 +-- 4 files changed, 9 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index 5f376e9..c054391 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,6 +15,7 @@ COPY torrc /etc/tor/ HEALTHCHECK --timeout=10s --start-period=60s \ CMD curl --fail --socks5-hostname localhost:9150 -I -L 'https://www.facebookcorewwwi.onion/' || exit 1 -EXPOSE 53/udp 9150/tcp +USER tor +EXPOSE 8853/udp 9150/tcp CMD ["/usr/bin/tor", "-f", "/etc/tor/torrc"] diff --git a/README.md b/README.md index a5f5f01..cc553aa 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ The super easy way to setup a [Tor](https://www.torproject.org) [SOCKS5](https:/ - Change to first `9150` to any valid and free port you want, please note that port `9050`/`9150` may already taken if you are also running other Tor client, like TorBrowser. - Do not touch the second `9150` as it's the port inside the docker container unless you're going to change the port in Dockerfile. - If you want to expose Tor's DNS port, also add `-p 127.0.0.1:53:53/udp` in the command, see [DNS over Tor](#dns-over-tor) for more details. + If you want to expose Tor's DNS port, also add `-p 127.0.0.1:53:8853/udp` in the command, see [DNS over Tor](#dns-over-tor) for more details. If you already setup the instance before *(not the first time)* but it's in stopped state, you can just start it instead of creating a new one: @@ -87,6 +87,10 @@ The super easy way to setup a [Tor](https://www.torproject.org) [SOCKS5](https:/ If you publish the DNS port in the first step of [Usage](#usage) section, you can query DNS request over Tor +The DNSPort here is set to `8853` by default, but not the common `53`, because non-privileged port is preferred, and then [`libcap`](https://pkgs.alpinelinux.org/package/edge/main/x86/libcap)/[`CAP_NET_BIND_SERVICE` capability](https://man7.org/linux/man-pages/man7/capabilities.7.html) won't be needed, which is more *[Alpine Linux](https://alpinelinux.org/about/)(Small. Simple. Secure.)* + +You can still expose the port to `53` for outside the container by the parameter `-p 127.0.0.1:53:8853/udp. `nslookup` also supports to specify the port to `8853` by `-port=8853`, e.g. `nslookup -port=8853 ipinfo.tw 127.0.0.1` + This port only handles A, AAAA, and PTR requests, see details on [official manual](https://www.torproject.org/docs/tor-manual.html.en) Set the DNS server to `127.0.0.1` (Or another IP you set), use [macvk/dnsleaktest](https://github.com/macvk/dnsleaktest) or go to one of the following DNS leaking test websites to verify the result: diff --git a/docker-compose.yml b/docker-compose.yml index b1bd8cc..ad46544 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -6,6 +6,6 @@ services: container_name: tor-socks-proxy image: peterdavehello/tor-socks-proxy:latest ports: - - "127.0.0.1:53:53/udp" + - "127.0.0.1:8853:53/udp" - "127.0.0.1:9150:9150/tcp" restart: unless-stopped diff --git a/torrc b/torrc index 30ee3a7..1cbee66 100644 --- a/torrc +++ b/torrc @@ -1,6 +1,5 @@ -User tor HardwareAccel 1 Log notice stdout -DNSPort 0.0.0.0:53 +DNSPort 0.0.0.0:8853 SocksPort 0.0.0.0:9150 DataDirectory /var/lib/tor