From owner-freebsd-hackers@freebsd.org Wed Dec 12 18:13:25 2018 Return-Path: Delivered-To: freebsd-hackers@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 88E7613178BE for ; Wed, 12 Dec 2018 18:13:25 +0000 (UTC) (envelope-from oliver@fromme.com) Received: from nox.thiemo.net (nox.thiemo.net [IPv6:2a01:4f8:110:1345::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "nox.thiemo.net", Issuer "thiemo.net CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 14FEC70D19 for ; Wed, 12 Dec 2018 18:13:24 +0000 (UTC) (envelope-from oliver@fromme.com) Received: from nox.thiemo.net (localhost [127.0.0.1]) by nox.thiemo.net (8.15.2/8.15.2) with ESMTPS id wBCIDL9t047123 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 12 Dec 2018 19:13:21 +0100 (CET) (envelope-from olli@nox.thiemo.net) X-Clacks-Overhead: GNU Terry Pratchett Received: (from olli@localhost) by nox.thiemo.net (8.15.2/8.15.2/Submit) id wBCIDLHa047117; Wed, 12 Dec 2018 19:13:21 +0100 (CET) (envelope-from olli) From: Oliver Fromme Message-Id: <201812121813.wBCIDLHa047117@nox.thiemo.net> Subject: Re: Running Tor service in the jail environment To: freebsd-hackers@freebsd.org, atypical@autisticstory.net (Hubert Hauser) Date: Wed, 12 Dec 2018 19:13:21 +0100 (CET) In-Reply-To: <65a5540f-2f1c-0470-b650-cf9fd696ea7a@autisticstory.net> X-Mailer: ELM [version 2.5 PL8] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.2 (nox.thiemo.net [127.0.0.1]); Wed, 12 Dec 2018 19:13:22 +0100 (CET) X-Rspamd-Queue-Id: 14FEC70D19 X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-4.95 / 15.00]; NEURAL_HAM_SHORT(-0.95)[-0.945,0]; REPLY(-4.00)[] X-Mailman-Approved-At: Wed, 12 Dec 2018 20:36:59 +0000 X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Dec 2018 18:13:25 -0000 Hubert Hauser wrote: > It sounds like a good idea but weren't a better solution use an > open-hardware device acting as Tor router with installed OpenBSD > or HardenedBSD? Personally I trust FreeBSD more than the alternatives. But that's just me. ;-) > Why wouldn't you use for it jail environment? I want to place > Tor in the jail environment because I want to prevent system > being compromised in case compromising Tor service. I think it would be better to put the Tor service inside a virtual machine, for example VirtualBox or FreeBSD's own technology called bhyve. It has two advantages: First, the separation is somewhat "stricter" and more extensive than jails (for example, jails still share the same kernel, but VMs do not). Second, it is easier to create a setup suitable for networking with Tor. It might be possible with a jail, too, but I think that would be more difficult and error-prone. And you *do* want to avoid errors when you're going to set up a Tor service. Disclaimer: I've never set up a Tor service myself. Best regards Olli -- Oliver Fromme, München -- FreeBSD + DragonFly BSD ``We are all but compressed light'' - Albert Einstein