9

I’ve had success in setting up and using whonix gateway and workstation on one machine. But I would like to set them up on different hosts, to spread out the memory and CPU requirements.

I’ve not found out how to make the VMs talk to each other when they are on different hosts. The gateway seems to be working OK, as it did when running with the workstation on the same machine. Now the workstation is started on a different host, how do I make the workstation (or the host it is running on), aware of having to contact a gateway on a different host?

Both hosts are running Linux Mint 17

2
  • 1
    Does this help whonix.org/wiki/Dev/Build_Documentation/Physical_Isolation ?
    – adrelanos
    Oct 10, 2014 at 15:58
  • I will try to change both gateway and workstation to use NAT + DHCP on what is now the internal port for each. I assume the workstation will find the gateway based on its name? Or do I need to configure the gateway IP some where? I can set fixed IP DHCP on the router based on the gateway 2nd adapter MAC. Thx for the Link.
    – Torsten
    Oct 10, 2014 at 17:41

1 Answer 1

0

First some notes; I hit the StackExchange character limit so this is an abriged answer; use wisely ;-)

  • private bridge Tor ~=~ gateway Whonix

  • proxied client Tor ~=~ workstation Whonix

These terms are used interchangeably and there are other terms that these kinds of setups are called, I'll try as much as possible to use the Whonix terms for most of the following.

What you are likely looking for is referred to as a middle-box or private bridge for your gateway device and client (trans-proxy) setup. The RaspberryPi team at Adafruit host a fairly well put togeather guide on how to set up physical isolation with custom torrc configs and iptables magics. The requirements for your gateway will be that it has two network interfaces, this can be eth0 and eth1 or usb0 or ppp0 and your workstation (client) should only have one physical network interface; preferrably eth0 or usb0 try to avoid wlan0 as tempting it is you'll leave yourself open to more localized attacks and monitoring that is not simple to mitigate and easy to attack. These guides also go under the name of "Tor WiFi hot-spot" too so perhaps expand your search queries to Linux in general and Tor specifically. Though I wouldn't recommend using WiFi the guides that cover the subject can easily be modified via trading wlan0 for eth1 on your gateway and wlan0 for eth0 on your workstation.

I've been writing a script pack for this occasion, your lucky day, because I just published the first draft of a script pack that when done will also allow for auditing your configurations security too. Have a look-through the source code on GitHub and see the /functions/tor/torrc_writers/torrc_bridge_configs.sh file for the various configurations available. If there's a script/function without clear documentation at the bottom open an issue and I'll try to have the next push include more info. I'll be adding features and debugging over the next few days but here's a simple variable file example to load if you wish to test it out.

_application_list="tor"
_enable_ipv6="no"
#_external_ipv4=""
#_external_ipv6=""
_install_method="safe"
#_nat_ipv4=""
#_nat_ipv6=""
_temp_dir="/tmp"
_tor_user="debian-tor"
_tor_directory="/etc"
_bridge_types="private"
_tor_or_port="443"

Then call the script with above variable file with the following

bash /home/${USER}/Downloads/Perinoid_Linux_Project/sandcastle.sh --var-file="/path/to/bridge_variables.sh"

and if it works (most of the magics are preformed in /functions/shared/arg_checker.sh function if you're wondering) it should configure the gateway like you wish and with it's own separate start/stop scripts, to start just bridge service on the gateway device should be as easy as

sudo /etc/init.d/tor-bridge restart

For the workstation it should be possible to use the gateway's bridge on the gateway device. The firewall has yet to be scripted but I've provided a starting place for iptables filtering and forwarding in the /firewall directory that you may wish to look through as well.

Modified code for answering the specific question asked

Here's a modified version (just pulled out the pertinent bits from code linked above and modified it to show how easy this code can be re-purposed) that could be used on any Debian based chroot jail or virtualization jail. It'll run sudo internally so prompts for a password will happen, that's normal, and this version expects that Tor has already been installed.

Use bash to run this version ie bash bridge_tor_script.sh to have variables and functions work properly. The following code is only intended on the gateway device, you'll still have to setup a bridge networking and forwarding to the workstation device and lock down the workstation such that it only uses the IP provided by the gateway.

Write_tor_bridge_configs(){
    ## Modify the stuff between quotes if non-standerd installation paths where used
    Activate_torrc_nonclient "debian-tor" "bridge"
    Write_tor_init_nonclient "/etc" "debian-tor" "bridge" "bridge" "/etc"
    Torrc_bridge_configs "/etc" "bridge" "debian-tor" "443" "192.168.1.3"
}
Torrc_bridge_configs(){
    _tor_dir="${1:-/etc}/tor"
    _tor_node_name="${2:-bridge}"
    _tor_user="${3:-debian-tor}"
    _tor_or_port="${4:-443}"
    _bridge_type="${5:-private}"
    _nat_ipv4="${6:?Error no local NAT IP passed to Torrc_bridge_configs function}"
    _external_ipv4="${7:?Error no external IP passed to Torrc_bridge_configs function}
    echo "## Attention [Torrc_bridge_configs] function writing general configuration lines to [${_tor_dir}/torrc-bridge] file"
    echo "User ${_tor_user}" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo 'RunAsDaemon 1' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo "DataDirectory /var/lib/tor_${_tor_node_name}" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo "PidFile /var/run/tor_${_tor_node_name}.pid" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo 'AvoidDiskWrites 1' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo 'BridgeRelay 1' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo "RelayBandwidthRate 100 Kbytes" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo "RelayBandwidthBurst 200 Kbytes" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo "BandwidthRate 300 Kbytes" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo "BandwidthBurst 350 Kbytes" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo 'AccountingStart month 1 00:00' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo "AccountingMax 80 GB" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo "ORPort ${_tor_or_port:-443}" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo 'ClientOnly 0' | sudo tee -a ${_torrc_dir}/torrc-${_tor_node_name}
    echo 'ExcludeSingleHopRelays 1' | sudo tee -a ${_torrc_dir}/torrc-${_tor_node_name}
    echo 'Exitpolicy reject *:*' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo "## Only uncomment next line if geoip support is confermed" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo "#GeoIPFile ${_tor_dir}/geoip" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
    echo "## Notice [Torrc_bridge_configs] function writing spicific configuration lines to [${_tor_dir}/torrc-bridge] file"
    echo "# based on arguments passed via [-T] and [-B] and [-vf] arguments."
    for _node_type in ${_bridge_type//,/ }; do
        case $_node_type in
            private)
                echo 'PublishServerDescriptor 0' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo "Address ${_nat_ipv4}" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo "ORListenAddress ${_nat_ipv4}:${_tor_or_port:-443}" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo 'VirtualAddrNetwork 10.192.0.0/10' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo 'AutomapHostsOnResolve 1' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo 'TransPort 9040' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo 'DNSPort 9053' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo "TransListenAddress ${_nat_ipv4}" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo "DNSPort 9053" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo "DNSListenAddress ${_nat_ipv4}" | sudo tee -a ${_torrc_dir}/torrc-${_tor_node_name}
            ;;
            public)
                echo 'PublishServerDescriptor 1' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo "Address ${_external_ipv4}" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo "OutboundBindAddress ${_external_ipv4}" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo "ORListenAddress ${_external_ipv4}:${_tor_or_port:-443}" | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo 'SocksPort 0' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
            ;;
            authoritative)
                echo 'AuthoritativeDirectory 1' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
                echo 'BridgeAuthoritativeDir 1' | sudo tee -a ${_tor_dir}/torrc-${_tor_node_name}
            ;;
        esac
    done
}
Write_tor_init_nonclient(){
    _tor_dir="${1:-/etc}"
    _tor_node_user="${2:-debian-tor}"
    _tor_node_nickname="${3:?}"
    _tor_node_type="${4:?}"
    _init_dir="${5:-/etc}/init.d"
    echo "## Attention [Write_tor_init] function now writing init script with assigned variables"
    echo "# to [${_init_dir}/tor_${_tor_node_type}] file for node [${_tor_node_nickname}] nickname..."
    echo '#!/bin/bash' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '### BEGIN INIT INFO' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo "# Provides:       tor ${_tor_node_nickname}" | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '# Required-Start:     $local_fs $remote_fs $network $named $time' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '# Required-Stop:      $local_fs $remote_fs $network $named $time' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '# Should-Start:       $syslog' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '# Should-Stop:        $syslog' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '# Default-Start:      2 3 4 5' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '# Default-Stop:       0 1 6' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '# Short-Description:  Starts The Onion Router daemon processes' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '# Description:        Starts The Onion Router, a TCP overlay' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '#             network client that provides anonymous' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '#             trasport. See following link for source' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '#             of this script' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '#             https://terminal28.com/anonymity-online-how-to-install-and-configure-squid3-tor-privoxy-debian-ubuntu-linux/' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '### END INIT INFO' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'set -e' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    ## Note if installing from source some of these file path
    #   variables may need changed
    echo 'DAEMON=/usr/sbin/tor' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo "NAME=tor" | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'DESC="tor daemon"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo "CONFDIR=${_tor_dir:-/etc}/tor" | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo "TORPIDDIR=/var/run/tor_${_tor_node_nickname}" | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo "TORPID=\$TORPIDDIR/tor_${_tor_node_nickname}" | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo "DEFAULTSFILE=${_tor_dir:-/etc}/defaults/\$NAME" | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'WAITFORDEAMON=60' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo "ARGS=\"--quiet -f\"\$CONFDIR/torrc-${_tor_node_nickname}\"" | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '# Set sane defaults' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'if [ -r /proc/sys/fs/file-max ]; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  system_max=`cat /proc/sys/fs/file-max`' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  if [ "$system_max" -gt "80000" ]; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      MAX_FILEDESCRIPTORS=32768' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  elif [ "$system_max" -gt "40000" ]; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      MAX_FILEDESCRIPTORS=16384' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  elif [ "$system_max" -gt "10000" ]; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      MAX_FILEDESCRIPTORS=8192' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  else' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      MAX_FILEDESCRIPTORS=1024' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      cat << EOF' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'Warning: Your system has very few filedescriptors available in total' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo "Maybe you should try rassing that by adding 'fs.file-max=10000' to your" | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '/etc/sysctl.conf file. Feel free to pick any number that you deem appropriate.' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo "Then run 'sysctl -p'. See /proc/sys/fs/file-max for the current value, and" | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'file-nr in the same directory for how many of those are sed at the moment' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'EOF' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'else' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  MAX_FILEDESCRIPTORS=8192' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'NICE=""' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'test -x $DEAMON || exit 0' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '# Include tor defaults if available' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'if [ -f $DEFAULTSFILE ]; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  . $DEFAULTSFILE' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'wait_for_deaddaemon () {' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  pid=$1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  sleep 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  if test -n "$pid"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      if kill -0 $pid 2>/dev/null' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo -n "."' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          cnt=0' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          while kill -0 $pid 2>/dev/null' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          do' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '              cnt=`expr $cnt + 1`' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '              if [ $cnt -gt $WAITFORDAEMON  ]; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '                  echo "still running"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '                  exit 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '              fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '              sleep 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '              echo -n "."' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          done' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  return 0' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '}' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'check_torpiddir () {' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  if test ! -d $TORPIDDIR' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      echo "There is no $TORPIDDIR directory. Creating one for you."' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      mkdir -m 02750 "$TORPIDDIR"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo "      chown ${_tor_node_user:-debian-tor}:${_tor_node_user:-debian-tor} \"\$TORPIDDIR\"" | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  if test ! -x $TORPIDDIR' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      echo "Cannot access $TORPIDDIR directory, are you root?" >&2' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      exit 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '}' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'check_config () {' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  if ! $DAEMON --verify-config > /dev/null' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      echo "ABORTED: Tor configuration invalid" >&2' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      $DAEMON --verify-config >&2' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      exit 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '}' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'check_torlogdir () {' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  if ! [ -d "$TORLOGDIR" ]; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      mkdir -m 02750 "$TORLOGDIR"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo "      chown ${_tor_node_user:-debian-tor}:adm \"\$TORLOGDIR\"" | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      ! [ -x /sbin/restorecon ] || /sbin/restorecon \"$TORLOGDIR\"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '}' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'case "$1" in ' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  start)' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  if [ "$RUN_DAEMON" != "yes" ]; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      echo "Not starting $DESC (Dissabled in $DEFAULTSFILE)."' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      exit 0' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  if [ -n "$MAX_FILEDESCRIPTORS" ]; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      echo -n "Raising maximum number of filedescriptors (ulimit -n) to $MAX_FILEDESCRIPTORS"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      if ulimit -n "$MAX_FILEDESCRIPTORS"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "."' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      else' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo ": FAILED."' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  check_torpiddir' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  check_torlogdir' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  echo "Starting $DESC: $NAME..."' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  check_config' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  echo "Starting $DESC: $NAME..."' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    ## Notice 1 : This is where firejail should be added if used,
    #   otherwise try another "Sandbox" utility for keeping unknown
    #   vunerabilities from easily infecting the rest of your system
    ## Notice 2 : This is also one of the places to modify if installing
    #   app-amore from source, if you expect the next [if] statment
    #   to find the app-armor exicutables
    ## Notice 3 : Additionally this is where calls to chroot should
    #   be preformed if running in chroot jail.
    echo '  if start-stop-daemon --stop --signal 0 --quiet --pidfile $TORPID --exec $DAEMON; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      echo "$NAME already running"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  else' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      if [ "$USE_AA_EXEC" = "yes" ] && [ -x /usr/sbin/aa-status ] && [ -x /usr/sbin/aa-exec ] && [ -e /etc/apparmor.d/system_tor ] && /usr/sbin/aa-status --enabled ; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          AA_EXEC="--startas /usr/sbin/aa-exec"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          AA_EXEC_ARGS="--profile=system_tor -- $DAEMON"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      else' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          AA_EXEC=""' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          AA_EXEC_ARGS=""' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      if start-stop-daemon --start --quiet --pidfile $TORPID $NICE $AA_EXEC --exec $DAEMON -- $AA_EXEC_ARGS $DEFAULT_ARGS $ARGS; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "$NAME done"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      else' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "Error starting $NAME"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          return 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  ;;' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  stop)' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      echo -n "Stopping $DESC: "' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      pid=$(cat $TORPID 2>/dev/null) || true' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      if ! test -f $TORPID -o -z "$pid"; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "not running"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          return 0' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      if start-stop-daemon --stop --signal INT --quite --pidfile $TORPID --exec $DAEMON; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          wait_for_deaddaemon $pid' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      elif kill -0 $pid 2>/dev/null; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "Is $pid not $NAME? Is $DAEMON a different binary now?"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          return 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      else' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "$DAEMON died: process $pid not running; or permission denied"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          return 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  ;;' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    ## End of nessisary edits section
    echo '  reload|force-reload)' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      check_config' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      echo "Reloading $DESC configuration"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      pid=$(cat $TORPID 2>/dev/null) || true' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      if test ! -f $TORPID -o -z "$pid"; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "not running - there is no $TORPID"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          return 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      if start-stop-daemon --stop --signal 1 --quiet --pidfile $TORPID --exec $DAEMON' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "done"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      elif kill -0 $pid 2>/dev/null; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "Is $pid not $NAME? Is $DAEMON a different binary now?"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          return 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      else' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "$DAEMON died: process $pid not running; or permission denied"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          return 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  ;;' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  restart)' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      check_config' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      $0 stop' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      sleep 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      $0 start' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  ;;' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  status)' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      if test ! -r $(dirname $TORPID); then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "cannot read PID file $TORPID"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          return 4' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      pid=$(cat $TORPID 2>/dev/null) || true' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      if test ! -f $TORPID -o -z "$pid"; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "$NAME is not running"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          return 3' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      if ps "$pid" >/dev/null 2>&1; then' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "$NAME is running"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          return 0' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      else' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          echo "$NAME is not running"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '          return 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      fi' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  ;;' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  *)' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      echo "Usage: $0 (start|stop|restart|reload|force-reload|status)"' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '      return 1' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo '  ;;' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'esac' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo 'exit 0' | sudo tee -a ${_init_dir}/tor_${_tor_node_type}
    echo "## Attention [Write_tor_init] function finished writing init file for [${_tor_node_type}]]"
    echo "# now providing [${_init_dir}/tor_${_tor_node_type}] exicutable permissions"
    sudo chmod +x ${_init_dir}/tor_${_tor_node_type}
}
Activate_torrc_nonclient(){
    _tor_node_user="${1:-debian-tor}"
    _tor_node_name="${2:?}"
    echo "## Activating configs for [torrc-${_tor_node_name}] now."
    echo "# With lib file path under [/var/lib/tor_${_tor_node_name}]"
    sudo install -o ${_tor_user:-debian-tor} -g ${_tor_user:-debian-tor} -m 700 /var/lib/tor_${_tor_node_name:-service} || Arg_checker --help='Activate_torrc_nonclient' --exit='# [sudo install -o ${_tor_user:-debian-tor} -g ${_tor_user:-debian-tor} -m 700 /var/lib/tor_${_tor_node_name}] # Failed'
}
Write_tor_bridge_configs

The above should get you closer to your goals, like stated previously I'll be de-bugging the main script pack and adding features so feel free to make requests via GitHub's tracking system, by the end of the month (health and time providing) I'll be adding installers for Whonix but will nead help testing as all my systmes seem to fight with my on installing KVM and VMWare pre-reqs.

2
  • 1
    You might want to look into HEREDOCs.
    – terdon
    Jan 13, 2016 at 11:32
  • Thank you @terdon I've used cat <<EOF ## some commands ## EOF > /some/file.sufix for re-detection before and have some broken scripts in an older github repo to fix because I didn't know enough about bash vs ./ exsicution and variable expansion. Since then I've used echo 'litaral' | tee -a /some/file.sufix and echo "${variable}" | tee -a /some/file.sufix because it's far easier to de-bug and see what will and will not nead to be escaped with `\`'s. Above is a sacrifice in readabilaty in prefferance of verbose'ness. But your suggestion is a valid way of performing the same tasks.
    – S0AndS0
    Jan 13, 2016 at 11:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .