Archive for April 2010
First, install the OpenBSD version of netcat. If you’re on a BSD-based system, this should already be the case. If you’re using Debian, run
sudo apt-get install netcat-openbsd. Users of other distributions should consult their system’s documentation and package repositories to learn how to install this package. If
nc -zX5 127.0.0.1 1337 doesn’t give an error, you have the correct version.
Next, because Git isn’t able to understand a GIT_PROXY_COMMAND with arguments, we need to create a wrapper for the proxy. Put the following in
~/.torgit, and then make it executable using
chmod +x ~/.torgit.
exec nc -X5 -x 127.0.0.1:9050 "$@"
Note: If Tor is listening on a non-standard port, use that instead of
Now, we need to set up Git so that it knows that we want it to use our script. Add the following to your
Warning: After you do this, you’ll need to run
source ~/.bashrc every time you start a terminal until you reboot, otherwise Git won’t know you set this.
That should take care of pulling. Now to set up pushing, we’d do it just as if we were to set up SSH for proxying. First, make a public key using
ssh-keygen -f ~/.ssh/tor_git_key. We’re passing a filename to make sure not to confuse this key with regular SSH keys for non-Tor sessions. Then, to make sure SSH uses our keys, put the following into
ProxyCommand nc -X5 -x 127.0.0.1:9050 %h %p
Note: If you’re going to be pushing to somewhere other than Gitorious, you’ll need to change the
Host line accordingly.
The more I’ve looked at the TorChat source, the more I’m seeing really significant issues in its design, not to mention some hacks that shouldn’t really ever appear in something you intend the public to use (i.e. something you’d make a Portable Executable out of.) At this point, I’d really recommend pretty strongly against using it.
There are several more security issues I’ve found in just a cursory inspection, and I’ve not gotten around to putting up patches yet. If you’ve got any coding ability, you might want to check out my git repository and even consider writing something for it.
This software seems to have gotten some use in our paranoid community, which I find a bit disturbing. Again, even though I’ve put up a repository and such, I strongly recommend that you do not use TorChat.
UPDATE: I’ve created a stability branch in the TorChat repository that makes as few modifications to prof7bit’s version as possible. A tarball of this repository (it contains all the patches needed) is available here. A tarball of my version is available here.