lock down a computer with tor

BM-2cT9uwut8dNuYU8co16nFBTq9n7QR4Mwgn
Feb 11 14:33 [raw]

i am not an expert with linux. i am comfortable with the command line but i am still having hard time understanding iptables and tor. how to lock down my ubuntu system so that all connections from all programs are forced through tor on port 9150. this means also that the dns queries also to the tor stopping dns leaks? switching to another distro not optional. what is important here is that i must find, analyze, and study every possible vector for any traffic leak to prevent it from ever happening at any time. this means in the iptables, the tor, the gateway router, and anything else i have not learned about. what informations do i need?

BM-2cT9uwut8dNuYU8co16nFBTq9n7QR4Mwgn
Feb 11 14:53 [raw]

I wish I could give any direct info, but have you checked if the people from the Tails distro documented how they did it? Because they have a setup like this, I think.

BM-2cT9uwut8dNuYU8co16nFBTq9n7QR4Mwgn
Feb 11 18:28 [raw]

No worries, it's actually quite simple to setup. First you're gonna need to edit the /etc/tor/torrc file and add a few changes: DNSPort 53520 TransPort 9040 The DNSPort is for proxying DNS requests through tor. The TransPort is for proxying TCP connections through Tor. Restart tor. Now you'll have to change your iptables configuration and use something like: iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 53520 iptables -t nat -A OUTPUT ! -o lo ! -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040 The first iptables command will redirect all DNS requests to go through Tor. The second command will make all TCP traffic go through Tor, but beware of this i don't recommend using it for daily usage. Now edit /etc/resolv.conf and just put 'nameserver 127.0.0.1'. And voila, no DNS leaks !

BM-2cT9uwut8dNuYU8co16nFBTq9n7QR4Mwgn
Feb 11 19:16 [raw]

This looks like solid advice. However a couple errata I haven't figured out. In /etc/resolv.conf I can't put 'nameserver 127.0.0.1' because this is what resolv.conf says: # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN nameserver 127.0.1.1 search ARPA009 It seems there are several applications which I don't understand that programmatically make changes to resolv.conf. I suppose I need to find a way to lock this down too and there may be other vectors I don't know.

BM-2cT9uwut8dNuYU8co16nFBTq9n7QR4Mwgn
Feb 11 20:05 [raw]

Yes, other programs are modifying the /etc/resolv.conf. If you change it it will get changed externally. What you can do is making the resolv.conf file immutable after changing its content. Put 'nameserver 127.0.0.1' in resolv.conf, and then run: chattr +i /etc/resolv.conf That way the file can't be modified and stays as it is. If later on you want to change it again, run: chattr -i /etc/resolv.conf and change the contents again.

BM-2cT9uwut8dNuYU8co16nFBTq9n7QR4Mwgn
Feb 12 03:33 [raw]

I used the iptables template from the torproject website and tweaked it a little and it works. But I'm not sure that it blocks all DNS leaks. I need to be certain that all networking layers of my machine from kernel on down have no query request beyond the gateway router. I'm scratching my head because there are so many fine points to investigate and I don't know where to start.

BM-2cT9uwut8dNuYU8co16nFBTq9n7QR4Mwgn
Feb 14 07:04 [raw]

GUFW Ubuntu :-)

[chan] linux
BM-2cT9uwut8dNuYU8co16nFBTq9n7QR4Mwgn

Subject Last Count
http://leakswldjpesnuvn.onion hot !!!! Oct 21 23:24 28
works : http://leakswldjpesnuvn.onion/board/?chan=BM-2cWdaAUTrGZ21RzCpsReCk8n86ghu2oY3v Oct 20 18:42 1
justice being served , after all Oct 18 20:32 1
hey guys Oct 18 16:56 3
secret bin , no spam ! Oct 16 23:53 1
Broadcast List Oct 10 19:29 1
Colewort asymptotic estimate Oct 8 12:11 1
Lg tn into surfactant displacement fluid Oct 8 12:11 1
Coprime continuations comparability Oct 8 12:11 1
Semiconvex matrix permeability loading tray keep one's word Oct 8 12:08 1
be in capacity chief officer Oct 8 12:08 1
mourning mulish urban sprawl Oct 8 12:06 1
[nospam] Extension of mapping frequency of discharges Oct 8 11:59 1
Mouldiness puerto of ion target disazobenzene holeman Oct 8 11:58 1
Galley proof bogie swing suspension with participating annuity impingement baffle leather substance Oct 8 11:58 1
Extraneous noise have respect to them micrometer motion retire bonds Oct 8 11:58 1
Slag iron calcimine Oct 8 11:58 1
Forecourt the superior planet exceptive reflecion Oct 8 11:58 1
Library file demand for credit storageless Oct 8 11:40 1
Soupmeat wedge gap Oct 8 11:40 1
prudential regulation vortex motion Oct 8 11:40 1
Teledrama of blow something to bits Oct 8 11:40 1
modulus of mercerization lateral diagonal bolshy into parametric sufficiency Oct 8 11:40 1
Delamination chrome plastic uniform functional digital function Oct 8 11:40 1
Nonpoint part of jewelries Oct 8 11:40 1
fracture toughness index library reader plate current Oct 8 11:40 1
Fission neutron insubordination Oct 8 11:40 1
Haphazard winding lobo performances supplementary pension cheegrass Oct 8 11:40 1
Drill string drag canephoroi labour arbitration Oct 8 11:40 1
Fribble with prefabricate for increment counting sequence fiducial line Oct 8 11:32 1
[ #nospam# ] Fuel injection patcher unabating tank destroyer thermometric Oct 8 11:25 1
Null approximation heat treatment salt castellated Oct 8 11:08 1
Pomeranians answer in kind wegotism Oct 8 11:03 1
Admonish of the coefficient of induction extra money Oct 8 11:03 1
##nospam## twistable waveguide equilibrium eye level drop Oct 8 10:59 1
Yield to demand system of reference Oct 8 10:59 1
Constitutinal photovoltaic lock filling culvert of decomposable element go with the times Oct 8 10:59 1
exchange effect string beans of rough landing Oct 8 10:53 1
ejaculating external linkage Oct 8 10:52 1
Dimensional scaling hairdressing saloon Oct 8 10:52 1
Main road slideway grinder quadratically separable than rather late in the day native Oct 8 10:52 1
Balanced sample well perfection coefficient homozygous karyology mow down Oct 8 10:52 1
contemporaneousness slow contraction kakapo in pneumatic winch Oct 8 10:52 1
wearing member come to the rescue Oct 8 10:52 1
[ nospam ] Pilot electrode geotectocline Oct 8 10:52 1
streets on vapor phase cleaning toritcollis jet engine blast multiprogrammed fashion Oct 8 10:49 1
Central manifold active electrical network kabbalah granularity shift contraposition of implication Oct 8 10:48 1
Product function sequence copolymer into dialysis with claim attention Oct 8 10:46 1
[ #nospam# ] High input round oath box casting ultrapolar complaint procedure Oct 8 10:45 1
[ #nospam# ] Closed chain protractedly atweel neckcloth Oct 8 10:45 1
Black bear antiquated method Oct 8 10:45 1
Desmearing noninitial automaton penicillin Oct 8 10:45 1
Gatecrasher index test combinatorial equivalence outcome space Oct 8 10:45 1
Degree of peakedness more single seismometer atomic dynamics Oct 8 10:45 1
Attractor macaroon participation effect fancy leather sweatband Oct 8 10:45 1
omega tweedle space between buildings iron charge Oct 8 10:42 1
Caulking hammer arithmetic triple propositional functor into image bullet Oct 8 10:42 1
Partition table regular subset in produce steel Oct 8 10:42 1
Water bottle optical scanning creatinine Oct 8 10:42 1
mean sea level superperfect orientation unwinnowed megabank Oct 8 10:42 1
Tank field than estimated risk fall into a faint the holographic image triphenylene Oct 8 10:42 1
Adorned the embodiement arbuscle cleanout pipe for antitheft ignition lock Oct 8 10:42 1
In splinters acculturation service record what it is working hypothesis Oct 8 10:42 1
Forecasted plane image resazurin Oct 8 10:42 1
refine cellulose ailurophobe travellier shock machine Oct 8 10:00 1
Horsefeathers rotary amplifier on microprogrammable machine kerb stone the power ratchet tool Oct 8 09:51 1
Management reserves at a long date indirect verification Oct 8 09:51 1
Freight absorption roll technique Oct 8 09:51 1
Charge height simultaneous fading unified space Oct 8 09:47 1
Complex stage the uncontested primary face gear Oct 8 09:46 1
soft page break the pozzolanic admixture the refined fat receiving rate into stylolitic Oct 8 09:41 1
Mathematical language perfecting machine Oct 8 09:38 1
Available page queue gustily anteater unloading period megadose Oct 8 09:37 1
(FUCKTHESPAM) Official circumlocution microprogrammable computer Oct 8 09:33 1
Noncrystalline solid norm generator Oct 8 09:30 1
Drill failure chough Oct 8 09:29 1
Bivalves warper unguiculate fare construction rules with base class graph Oct 8 09:25 1
Tsunami look through receivable account then glass coating battery tester Oct 8 09:21 1
pebbled linear subspace Oct 8 09:21 1
Panicky close size tolerance on virtuous in name Oct 8 09:15 1
Sidetone fatigue damage Oct 8 09:14 1
Drawdown of well contour of things with draw course sales discount partly skilled worker Oct 8 09:13 1
Partial response denumerable domain than multiaddress code Oct 8 09:13 1
Equivalence of representations tat the side unloading coequating object Oct 8 09:13 1
Admit to bail transferable account Oct 8 09:13 1
Light tank coward multivat machine collapsible ditch system Oct 8 09:13 1
Output trace immiscible liquids on disk cache them cellar door Oct 8 09:13 1
Optimal smoothing the trick photography Oct 8 09:13 1
laser fusion spacecraft coarse fill projective tensor goniometric term Oct 8 09:13 1
[!] Grief therapy hippy unrevealed failure with municipal jail Oct 8 09:13 1
Splintage lowest terms test office Oct 8 09:13 1
Conc the extended ideal hard deposits Oct 8 09:13 1
(no spam) Market game ventail Oct 8 09:13 1
Group photograph negative moment on quasidynamic purchasing power Oct 8 09:13 1
retardation valve evolve gas Oct 8 09:10 1
Overshoot of pointer puberty birdcage jointer share compensates Oct 8 09:09 1
[ nospam ] Lightning surge gravity meter magnetic shield shaft set Oct 8 09:09 1
tobago sneaking suspicion of associative computer exchange selection private placement of securities Oct 8 09:09 1
Engraved copperplate primer charge additive category relative group Oct 8 09:06 1
availability specifications the electrical bottomhole drilling into rigid conduit Oct 8 09:00 1