1.6 Privacy (Tor)

Monero hides amounts, senders and receivers on the blockchain, but your IP address can still leak, for example when your node broadcasts a transaction. Tor hides it. With the system configured and locked down, set it up now, before any Monero software. In this step you:

1. Install Tor from Ubuntu
2. Move Tor itself to the Tor Project's own repository, through its onion address

Later, 2.2 Anonymous networking connects monerod to Tor too.

Install Tor

Install Tor from Ubuntu's archive, together with the tools that let apt and other programs use it:

sudo apt update
sudo apt install -y tor apt-transport-tor curl gpg

What goes over Tor, and what doesn't

Ubuntu's packages and updates download directly from Ubuntu's servers, like this command. That only shows that you run Ubuntu, and which Ubuntu packages you install, like millions of other machines. Tor's own updates come from the Tor Project's onion repository, through Tor. The other downloads in this guide (Monero releases, signing keys and source code) use plain wget, curl and git, over the clearnet.

Check that Tor runs and has connected to the Tor network:

systemctl is-active tor@default
sudo journalctl -u tor@default --no-pager | grep Bootstrapped | tail -1

active
... [notice] Bootstrapped 100% (done): Done

If it says less than 100%, wait a minute and check again. Then test that traffic really goes through Tor:

curl --socks5-hostname 127.0.0.1:9050 https://check.torproject.org/api/ip

{"IsTor":true,"IP":"185.220.101.x"}

Get Tor from the Tor Project

Ubuntu's Tor package is often older than the Tor Project's own. Switch to the Tor Project's repository, through its official onion address, so not even the Tor Project's servers see your IP.

Download the Tor Project's signing key through Tor, from the onion repository. --socks5-hostname sends this one curl through Tor's local proxy:

curl --socks5-hostname 127.0.0.1:9050 -fsS http://apow7mjfryruh65chtdydfmqfpj5btws7nbocgtaovhvezgccyjazpqd.onion/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc \
  | gpg --dearmor | sudo tee /usr/share/keyrings/deb.torproject.org-keyring.gpg >/dev/null
gpg --show-keys /usr/share/keyrings/deb.torproject.org-keyring.gpg | head -2

The fingerprint must be A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.

Add the repository. The codename (resolute) is read from /etc/os-release:

sudo tee /etc/apt/sources.list.d/tor.sources >/dev/null <<EOF
Types: deb
URIs: tor+http://apow7mjfryruh65chtdydfmqfpj5btws7nbocgtaovhvezgccyjazpqd.onion/torproject.org
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
Components: main
Signed-By: /usr/share/keyrings/deb.torproject.org-keyring.gpg
EOF
cat /etc/apt/sources.list.d/tor.sources

Check that Suites: says resolute, then upgrade Tor to the Tor Project's version, and install the package that keeps its signing key up to date:

sudo apt update
sudo apt install -y tor deb.torproject.org-keyring
apt policy tor | head -4

tor:
  Installed: 0.4.9.x-1~resolute+1
  Candidate: 0.4.9.x-1~resolute+1
  Version table:

A version ending in ~resolute+1 comes from the Tor Project.

Validation

grep -h '^URIs:' /etc/apt/sources.list.d/tor.sources

URIs: tor+http://apow7mjfryruh65chtdydfmqfpj5btws7nbocgtaovhvezgccyjazpqd.onion/torproject.org

Tor's updates come from its onion repository, through Tor. Ubuntu's sources in ubuntu.sources stay unchanged, as http://.

Extras (optional)

SSH into your node over Tor, from anywhere

Log in from outside your home without opening any router port: see the SSH over Tor bonus guide.

Get a new onion address

If an onion address leaks, delete its service folder and reload Tor. A fresh address is created, and the old one stops working forever:

sudo rm -rf /var/lib/tor/SERVICE_NAME
sudo systemctl reload tor
sudo cat /var/lib/tor/SERVICE_NAME/hostname

Replace SERVICE_NAME with the folder name from torrc, for example monero-rpc. Update every wallet that used the old address.

Upgrade

Tor comes from an apt repository, so it updates with the rest of the system, through Tor: sudo apt update && sudo apt upgrade. Restart it after an upgrade:

sudo systemctl restart tor

Uninstall

Remove the Tor Project's repository first, since apt can only reach it through Tor:

sudo rm /etc/apt/sources.list.d/tor.sources
sudo apt purge -y tor deb.torproject.org-keyring apt-transport-tor
sudo rm /usr/share/keyrings/deb.torproject.org-keyring.gpg
sudo rm -rf /var/lib/tor    # deletes all onion service keys

Troubleshooting

Tor is stuck at Bootstrapped 5% (or another low number)

• Check the clock. Tor refuses to work when the system time is far off. timedatectl must show System clock synchronized: yes.
• Your network may block Tor. Some ISPs, workplaces and countries do. Tor bridges get around this. See the Tor Project's bridges documentation.

apt update: Failed to fetch tor+http://… / Could not connect

• Tor must be running and fully started: systemctl is-active tor@default prints active, and the log shows Bootstrapped 100%.
• Onion addresses can be slow to answer the first time. Run sudo apt update again.

apt: The following signatures couldn't be verified … NO_PUBKEY

The Tor Project's signing key has changed, or the keyring file is broken. Download the key again with the curl command in Get Tor from the Tor Project, then run sudo apt update. The deb.torproject.org-keyring package keeps it current after that.

curl: (97) Can't complete SOCKS5 connection

Tor isn't fully started yet. Watch sudo journalctl -fu tor@default until it reaches Bootstrapped 100%, then try again.

Port reference

Port	Protocol	Use
9050	TCP	Tor SOCKS proxy (localhost only)
9051	TCP	Tor control port (localhost only, if enabled)