How tor-check works? #1781

nicfab · 2022-09-17T11:29:14Z

nicfab
Sep 17, 2022

From the TOR browser, after activating from the web page of SearXNG (Preferences-> Special Queries) tor-check, I searched by inputting tor-check in the search box.
The answer was: "You are not using TOR. Your IP address seems to be: 127.0.0.1.".

Why?

Tor browser is configured to use Tor.
On the server side, I set tor, and it works.

Is there anyone who can explain that to me?

dalf · 2022-09-17T11:39:47Z

dalf
Sep 17, 2022

SearXNG makes a request to https://check.torproject.org/api/ip and check that IsTor is true.

For reference:

[enh] verify that Tor proxy works every time searx starts #341

searxng/searx/network/network.py

Lines 176 to 180 in b3708e4

    
           response = await client.get("https://check.torproject.org/api/ip", timeout=10) 
        
           if not response.json()["IsTor"]: 
        
               result = False 
        
           Network._TOR_CHECK_RESULT[proxies] = result 
        
           return result

11 replies

nicfab Sep 17, 2022
Author

Maybe also set the X-Real-IP header.

Thank you.
May I ask you to post your configuration, considering that it works?

tiekoetter Sep 17, 2022
Collaborator

I currently use the unix socket.

    uwsgi_param    HTTP_X_REAL_IP        $remote_addr;
    uwsgi_param    HTTP_X_FORWARDED_FOR  'TOR Network';

But previously I used this.

    proxy_set_header   X-Real-IP        $remote_addr;
    proxy_set_header   X-Forwarded-For  'TOR Network';

I hope this helps a bit.
You could also post your config if you want to.

nicfab Sep 17, 2022
Author

@tiekoetter you are very kind.

I don't understand.
The onion address http://lgmekfnpealdqhnctyg3p5fuelpdwnbqbwnl2ickpdoodzatzgz27ryd.onion is reachable on the onion network, and it works correctly via tor browser.

The torrc file contains only:

HiddenServiceDir /var/lib/tor/searx/
HiddenServicePort 80 127.0.0.1:8888

IPv6Exit 1

The nginx file conf contains:

server {
  server_name searxng.nicfab.it;
  location / {

    proxy_pass http://127.0.0.1:8888;

    proxy_set_header   Host             $host;
    proxy_set_header   Connection       $http_connection;

    # see flaskfix.py
    proxy_set_header   X-Scheme         $scheme;
    proxy_set_header   X-Script-Name    /searxng;

    # see limiter.py
    proxy_set_header   X-Real-IP        $remote_addr;
    proxy_set_header   X-Forwarded-For  'TOR Network';

    # proxy_buffering  off;
    # proxy_request_buffering off;
    # proxy_buffer_size 8k;

  }

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/searxng.nicfab.it/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/searxng.nicfab.it/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    ssl_protocols TLSv1.3;

    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header Onion-Location http://lgmekfnpealdqhnctyg3p5fuelpdwnbqbwnl2ickpdoodzatzgz27ryd.onion$request_uri;


}

server {

        listen 80;
        server_name lgmekfnpealdqhnctyg3p5fuelpdwnbqbwnl2ickpdoodzatzgz27ryd.onion;
        access_log /var/log/nginx/searxng-tor;
}

server {
    if ($host = searxng.nicfab.it) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

  server_name searxng.nicfab.it;
  listen [2a05:d01a:ece:df00:5f20:a74d:75a1:d17b]:80 ipv6only=off;
  listen 80;
    return 404; # managed by Certbot
}

The file /etc/uwsgi/apps-available/searxng.ini has the following content:

# -*- mode: conf; coding: utf-8  -*-
[uwsgi]

# uWSGI core
# ----------
#
# https://uwsgi-docs.readthedocs.io/en/latest/Options.html#uwsgi-core

# Who will run the code / Hint: in emperor-tyrant mode uid & gid setting will be
# ignored [1].  Mode emperor-tyrant is the default on fedora (/etc/uwsgi.ini).
#
# [1] https://uwsgi-docs.readthedocs.io/en/latest/Emperor.html#tyrant-mode-secure-multi-user-hosting
#
uid = searxng
gid = searxng

# set (python) default encoding UTF-8
env = LANG=C.UTF-8
env = LANGUAGE=C.UTF-8
env = LC_ALL=C.UTF-8

# chdir to specified directory before apps loading
chdir = /usr/local/searxng/searxng-src/searx

# SearXNG configuration (settings.yml)
env = SEARXNG_SETTINGS_PATH=/etc/searxng/settings.yml

# disable logging for privacy
disable-logging = true

# The right granted on the created socket
chmod-socket = 666

# Plugin to use and interpretor config
single-interpreter = true

# enable master process
master = true

# load apps in each worker instead of the master
lazy-apps = true

# load uWSGI plugins
plugin = python3,http

# By default the Python plugin does not initialize the GIL.  This means your
# app-generated threads will not run.  If you need threads, remember to enable
# them with enable-threads.  Running uWSGI in multithreading mode (with the
# threads options) will automatically enable threading support. This *strange*
# default behaviour is for performance reasons.
enable-threads = true


# plugin: python
# --------------
#
# https://uwsgi-docs.readthedocs.io/en/latest/Options.html#plugin-python

# load a WSGI module
module = searx.webapp

# set PYTHONHOME/virtualenv
virtualenv = /usr/local/searxng/searx-pyenv

# add directory (or glob) to pythonpath
pythonpath = /usr/local/searxng/searxng-src


# speak to upstream
# -----------------

# https://uwsgi-docs.readthedocs.io/en/latest/Options.html#plugin-http
# Native HTTP support: https://uwsgi-docs.readthedocs.io/en/latest/HTTP.html

http = 127.0.0.1:8888
buffer-size = 8192

# uWSGI serves the static files and in settings.yml we use::
#
#   ui:
#     static_use_hash: true
#
static-map = /static=/usr/local/searxng/searxng-src/searx/static
# expires set to one year since there are hashes
static-expires = /* 31557600
static-gzip-all = True
offload-threads = %k

# Cache
cache2 = name=searxngcache,items=2000,blocks=2000,blocksize=4096,bitmap=1

I don't know where I was wrong.

tiekoetter Sep 17, 2022
Collaborator

Your config is a little wrong. You currently have the headers set for your clear net site (https://searxng.nicfab.it/searxng/search?q=ip)

Your onion config also needs the headers.
Also you should consider separating your http and onion config. Normally you should configure nginx to listen on the tor proxy port and not on port 80.

I have some questions about your setup:

Why is the tor proxy listening on the same port as SearXNG?
Why did you set ipv6only=on?
Why only TLS 1.3? (which gets probably overwritten by your included letsencrypt ssl config, which is not recommended as it will give you a bad TLS grade)
Why is the nginx tor config listening on port 80?

My recommendations:

Create separate sections for http (port 80) and https (port 443)
Run your hidden service (tor proxy) on a dedicated port which you should also block via the Firewall (as an example I will use 2345)
Add the listen 2345 part to your tor config in nginx and include the common headers from your https config. The tor part should basically mirror your working https config.
Fix your TLS/SSL config.
Fix your listening directives.

I hope I am not bothering you with my questions.

nicfab Sep 17, 2022
Author

Your config is a little wrong. You currently have the headers set for your clear net site (https://searxng.nicfab.it/searxng/search?q=ip)

Your onion config also needs the headers. Also you should consider separating your http and onion config. Normally you should configure nginx to listen on the tor proxy port and not on port 80.

I have some questions about your setup:

Why is the tor proxy listening on the same port as SearXNG?

Why did you set ipv6only=on?

Why only TLS 1.3? (which gets probably overwritten by your included letsencrypt ssl config, which is not recommended as it will give you a bad TLS grade)

Why is the nginx tor config listening on port 80?

My recommendations:

Create separate sections for http (port 80) and https (port 443)

Run your hidden service (tor proxy) on a dedicated port which you should also block via the Firewall (as an example I will use 2345)

Add the listen 2345 part to your tor config in nginx and include the common headers from your https config. The tor part should basically mirror your working https config.

Fix your TLS/SSL config.

Fix your listening directives.

I hope I am not bothering you with my questions.

Thank you very much.
You don't bother me, on the contrary, you are helping me.

Regarding your questions:

Why is the tor proxy listening on the same port as SearXNG?

Because I tried to change and it didn't work. I will try with another port (for example, 8081)

Why did you set ipv6only=on?

It's wrong, indeed.

Why only TLS 1.3? (which gets probably overwritten by your included letsencrypt ssl config, which is not recommended as it will give you a bad TLS grade)

I tried to set ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; but I received an NGINX error, and I had to change it on TLS 1.3 only.

Why is the nginx tor config listening on port 80?

Because it worked so, otherwise it didn't work, but certainly, it depended on my mistake.

I will start working on your suggestions to set a better configuration.

I will probably bother you again.
Thank you very much again.

How tor-check works? #1781

Uh oh!

nicfab Sep 17, 2022

Replies: 1 comment · 11 replies

Uh oh!

dalf Sep 17, 2022

Uh oh!

nicfab Sep 17, 2022 Author

Uh oh!

Uh oh!

tiekoetter Sep 17, 2022 Collaborator

Uh oh!

Uh oh!

nicfab Sep 17, 2022 Author

Uh oh!

Uh oh!

tiekoetter Sep 17, 2022 Collaborator

Uh oh!

nicfab Sep 17, 2022 Author

nicfab
Sep 17, 2022

Replies: 1 comment 11 replies

dalf
Sep 17, 2022

nicfab Sep 17, 2022
Author

tiekoetter Sep 17, 2022
Collaborator

nicfab Sep 17, 2022
Author

tiekoetter Sep 17, 2022
Collaborator

nicfab Sep 17, 2022
Author