The Onion Digest

Archive for April 2010

First, install the OpenBSD version of netcat. If you’re on a BSD-based system, this should already be the case. If you’re using Debian, run sudo apt-get install netcat-openbsd. Users of other distributions should consult their system’s documentation and package repositories to learn how to install this package. If nc -zX5 1337 doesn’t give an error, you have the correct version.

Next, because Git isn’t able to understand a GIT_PROXY_COMMAND with arguments, we need to create a wrapper for the proxy. Put the following in ~/.torgit, and then make it executable using chmod +x ~/.torgit.

exec nc -X5 -x "$@"

Note: If Tor is listening on a non-standard port, use that instead of 9050

Now, we need to set up Git so that it knows that we want it to use our script. Add the following to your ~/.bashrc:

export GIT_PROXY_COMMAND=~/.torgit

Warning: After you do this, you’ll need to run source ~/.bashrc every time you start a terminal until you reboot, otherwise Git won’t know you set this.

That should take care of pulling. Now to set up pushing, we’d do it just as if we were to set up SSH for proxying. First, make a public key using ssh-keygen -f ~/.ssh/tor_git_key. We’re passing a filename to make sure not to confuse this key with regular SSH keys for non-Tor sessions. Then, to make sure SSH uses our keys, put the following into ~/.ssh/config:

User git
PreferredAuthentication publickey
Compression yes
ProxyCommand nc -X5 -x %h %p
IdentityFile ~/.ssh/tor_git_key

Note: If you’re going to be pushing to somewhere other than Gitorious, you’ll need to change the Host line accordingly.

Tags: , ,

I’ve set up a git repository containing a versioned and tagged TorChat with the third-party patch that fixed some security issues in prof7bit’s version.

The more I’ve looked at the TorChat source, the more I’m seeing really significant issues in its design, not to mention some hacks that shouldn’t really ever appear in something you intend the public to use (i.e. something you’d make a Portable Executable out of.) At this point, I’d really recommend pretty strongly against using it.

There are several more security issues I’ve found in just a cursory inspection, and I’ve not gotten around to putting up patches yet. If you’ve got any coding ability, you might want to check out my git repository and even consider writing something for it.

This software seems to have gotten some use in our paranoid community, which I find a bit disturbing. Again, even though I’ve put up a repository and such, I strongly recommend that you do not use TorChat.

UPDATE: I’ve created a stability branch in the TorChat repository that makes as few modifications to prof7bit’s version as possible. A tarball of this repository (it contains all the patches needed) is available here. A tarball of my version is available here.