I am attempting to set up a Tor hidden service on CentOS 7 (with systemd), using the
tor package from the EPEL repository.
Previously this was working fine until a few days ago when it stopped working. Nothing on the system was restarted at this time, though automatic updates are enabled via yum-cron so perhaps something updated.
However, for what it's worth, I have also seen this issue on a mostly-stock installation of Fedora Server and on Fedora Workstation.
Now when I attempt to start the tor service with the hidden service lines in the
/etc/tor/torrc file, it fails to start.
I have been checking error messages using
journalctl -xn, and they are not consistent - however the primary errors seem to be:
Nov 09 22:05:18 hostname tor: Nov 09 22:05:18.245 [warn] Directory /var/lib/tor/sshservice/ cannot be read: Permission denied
Nov 09 22:12:33.119 [warn] /var/lib/tor/sshservice/ is not owned by this user (root, 0) but by toranon (997). Perhaps you are running Tor as the wrong user
I have ensured the following about the entire
/var/lib/tor path, but with no success:
- Directory is owned by user/group
toranon(default tor user for the EPEL package)
- Permissions are set appropriately (I have tried 700, 770, 600, 660) on the directory.
- SELinux contexts are set appropriately for the directory and I have verified this using
- If I change ownership of the directory to root, I recieve the same "wrong user" message as before, but with the usernames reversed.
- I have attempted to disable SELinux completely and verified that the tor service still does not start.
- The hidden service directory is already populated with the private key and hostname files, and they were created by the tor daemon on this system. This configuration previously fully worked.
- If I completely remove the
HiddenServicePortlines from the config, tor starts up as expected.
Some potentially helpful output from
# Do not run as client SocksPort 0 #Run Tor only as a relay and do not create a local SOCKS proxy SocksPolicy reject * # Define hidden service for SSH HiddenServiceDir /var/lib/tor/sshservice/ HiddenServicePort 44674 127.0.0.1:22 #Redirect local SSH port to a nonstandard public port
ls -Z of
[root@sagan tor]# ls -Z -rw-------. toranon toranon system_u:object_r:tor_var_lib_t:s0 cached-certs -rw-------. toranon toranon system_u:object_r:tor_var_lib_t:s0 cached-microdesc-consensus -rw-------. toranon toranon unconfined_u:object_r:tor_var_lib_t:s0 cached-microdescs -rw-------. toranon toranon unconfined_u:object_r:tor_var_lib_t:s0 cached-microdescs.new -rw-------. toranon toranon unconfined_u:object_r:tor_var_lib_t:s0 lock drwx------. toranon toranon system_u:object_r:tor_var_lib_t:s0 sshservice -rw-------. toranon toranon unconfined_u:object_r:tor_var_lib_t:s0 state
Not sure what might be causing this issue, but I suspect it's something to do with the precise configuration of systemd. I have experimented with commenting and removing some of the lines in the default systemd
tor.service file, but with no success.
Currently I am attempting to start tor using
systemctl start tor using the default systemd
tor.service file shipped with CentOS.
Any ideas? Help would be greatly appreciated.