Little-t-tor

Attention: These instructions are meant for installing tor the network daemon i.e. little-t-tor. 有关安装Tor浏览器的说明,请参阅Tor Browser用户手册

Admin access: To install Tor you need root privileges. Below all commands that need to be run as root user like apt and dpkg are prepended with '#', while commands to be run as user with '$' resembling the standard prompt in a terminal. To open a root terminal you have several options: sudo su, or sudo -i, or su -i. Note that sudo asks for your user password, while su expects the root password of your system.

Debian / Ubuntu

Do not use the packages in Ubuntu's universe. In the past they have not reliably been updated. That means you could be missing stability and security fixes.

  1. Configure Tor package repository

Enable the Tor Project APT repository by following the instructions.

  1. Package installation

    # apt install tor

Fedora

  1. Configure Tor Package repository

Enable the Tor Project's RPM package repository by following the instructions.

  1. Package installation

    # dnf install tor

FreeBSD

  1. 包安装

    # pkg install tor

OpenBSD

  1. 包安装

    # pkg_add tor

macOS

1.安装包管理器

There are two package manager on OS X: Homebrew and Macports. You can use the package manager of your choice.

要安装 Homebrew,请按照 brew.sh 上的说明进行操作。

To install Macports follow the instructions on macports.org/install.php.

  1. Package installation

If you are using Homebrew in a Terminal window, run:

# brew install tor

If you are using Macports in a Terminal window, run:

$ sudo port install tor

Arch Linux

  1. To install the tor package on Arch Linux, run:
# pacman -Syu tor

DragonFlyBSD

  1. Bootstrap pkg

DragonFlyBSD's daily snapshots and releases (starting with 3.4) come with pkg already installed. Upgrades from earlier releases, however, will not have it. If pkg is missing on the system for any reason, it can be quickly bootstrapped without having to build it from source or even having DPorts installed:

# cd /usr
# make pkg-bootstrap
# rehash
# pkg-static install -y pkg
# rehash

1.1 Recommended steps to setup pkg

Here, it will be similar to what we have on a FreeBSD system, and we are going to use HTTPS to fetch our packages, and updates - so here we also need an extra package to help us out (ca_root_nss).

安装ca_root_nss软件包:

# pkg install ca_root_nss

For fresh installations, the file /usr/local/etc/pkg/repos/df-latest.conf.sample is copied to /usr/local/etc/pkg/repos/df-latest. The files ending in the ".sample" extension are ignored; pkg(8) only reads files that end in ".conf" and it will read as many as it finds.

DragonflyBSD has 2 packages repositories:

  • Avalon (mirror-master.dragonflybsd.org);
  • Wolfpond (pkg.wolfpond.org).

We can simply edit the URL used to point out the repositories on /usr/local/etc/pkg/repos/df-latest and that's it! Remember to use pkg+https:// for Avalon.

After applying all these changes, we update the packages list again and try to check if there's already a new update to apply:

# pkg update -f
# pkg upgrade -y -f
  1. Package installation

安装tor软件包:

# pkg install tor

NetBSD

  1. Setup pkg_add

Modern versions of the NetBSD operating system can be set to use pkgin, which is a piece of software aimed to be like apt or yum for managing pkgsrc binary packages. We are not convering its setup here, and opt to use plain pkg_add instead.

# echo "PKG_PATH=http://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/$(uname -m)/$(uname -r)/All" > /etc/pkg_install.conf
  1. Package installation

安装torNetBSD的软件包:

# pkg_add tor

Void Linux

To install the tor package on Void Linux, please run:

# xbps-install -S tor

Installing Tor from source

  1. Download latest release and dependencies

The latest release of Tor can be found on the download page.

If you're building from source, first install libevent, and make sure you have openssl and zlib (including the -devel packages if applicable).

  1. Install Tor

    tar -xzf tor-0.4.3.6.tar.gz; cd tor-0.4.3.6

    ./configure && make

Now you can run tor as src/app/tor (0.4.3.x and later), or you can run make install (as root if necessary) to install it into /usr/local/, and then you can start it just by running tor.

注意:这些指南是为了验证 Tor 源代码。 请按照正确的指示来验证 Tor 浏览器的签名

数字签名用于确保某个程序包有其开发者生产并且没有被篡改。 下面我们解释为什么它很重要,以及如何验证你下载的 tor 源代码是我们创建的,没有被某些攻击者修改。

我们下载页面上的每个文件都附带两个文件,标签为“校验和”和“签名”,其名称与软件包相同,扩展名分别为“.sha256sum”和“.sha256sum.asc”。

.asc 文件将验证 .sha256sum 文件(包含软件包的校验和)没有被篡改。一旦签名被验证有效(见下面的方法),软件包的完整性就可以用以下方法验证:

$ sha256sum -c *.sha256sum

这些文件用于验证你所下载的文件正是我们希望你得到的文件。 一般来说,你可以通过右击 “签名”和“校验和”链接并选择“另存为”选项来下载该文件,不过这可能因网络浏览器而异。

例如,tor-0.4.6.7.tar.gz配有文件tor-0.4.6.7.tar.gz.sha256sum.asc。 这些是示例文件名,并下载文件不会完全相同。

下面将解释如何在不同的操作系统上验证下载文件的数字签名。 请注意,数字签名的日期指对程序包进行签名的时间。 因此,每次新文件上传时,将生产新的签名,并且日期不同。 只要你验证了签名,不必担心报告的日期可能有所不同。

安装 GnuPG

首先,验证签名之前,你需要安装 GnuPG。

对于 Windows 的用户:

如果使用 Windows,请下载 Gpg4win 并运行安装包。

为了验证签名,你需要在 Windows 命令行(cmd.exe)中输入一些命令。

对于 macOS 的用户:

如果使用 macOS,你可以安装 GPGTools

为了验证签名,你需要在终端(位于“应用程序”下)中输入一些命令。

对于 GNU/Linux 的用户:

如果使用 GNU/Linux,那么系统大概已安装 GnuPG,因为大多数 Linux 发行版都预装了该软件。

为了验证签名,你需要在 windows 命令行中输入几个命令。 如何做到这一点,将取决于你的发行版。

提取 Tor 开发者密钥

下面的密钥可以对 tarball 签名。不要期望都有签名,这可能取决于谁来发布。

可通过上述链接获得密钥,或通过:

$ gpg --auto-key-locate nodefault,wkd --locate-keys ahf@torproject.org
$ gpg --auto-key-locate nodefault,wkd --locate-keys dgoulet@torproject.org
$ gpg --auto-key-locate nodefault,wkd --locate-keys nickm@torproject.org

这应该显示类似结果(对于 Nickm):

gpg: key FE43009C4607B1FB: public key "Nick Mathewson <nickm@torproject.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
pub   rsa4096 2016-09-21 [C] [expires: 2025-10-04]
      2133BC600AB133E1D826D173FE43009C4607B1FB
uid           [ unknown] Nick Mathewson <nickm@torproject.org>
sub   rsa4096 2016-09-23 [S] [expires: 2025-10-04]
sub   rsa4096 2016-09-23 [E] [expires: 2025-10-04]

如果看到错误信息,那就是出了问题,你不能继续下去,直到你弄清楚为什么这不行。 也许可以使用 其他方法(使用公钥)部分来导入密钥。

导入密钥后,你可以将其保存到文件中(此处提供其指纹来指定):

$ gpg --output ./tor.keyring --export 0x2133BC600AB133E1D826D173FE43009C4607B1FB

该命令将密钥保存在路径为./tor.keyring的文件中,即当前目录。 如果运行这个命令后 ./tor.keyring不存在,就说明出了问题,不能继续操作,直到你弄清楚为什么出现错误。

验证签名

要验证你下载的软件包的签名,你需要下载相应的 .sha256sum.asc 签名文件和 .sha256sum 文件,并通过命令要求 GnuPG 验证你下载的文件来验证它。

以下示例假设已在“Downloads”文件中下载这两个文件。 请注意,这些命令使用示例文件名,而实际文件名是不同的:你下载的版本与 9.0 不同,并且没有选择英文(en-US)版本。

对于 Windows 的用户:

gpgv --keyring .\tor.keyring Downloads\tor-0.4.6.10.tar.gz.sha256sum.asc Downloads\tor-0.4.6.10.tar.gz.sha256sum

对于 macOS 的用户:

gpgv --keyring ./tor.keyring ~/Downloads/tor-0.4.6.10.tar.gz.sha256sum.asc ~/Downloads/tor-0.4.6.10.tar.gz.sha256sum

对于 BSD/Linux 用户:

gpgv --keyring ./tor.keyring ~/Downloads/tor-0.4.6.10.tar.gz.sha256sum.asc ~/Downloads/tor-0.4.6.10.tar.gz.sha256sum

该命令的结果应该产生这样的结果(取决于签名用的哪个密钥):

gpgv: Signature made Mon 16 Aug 2021 04:44:27 PM -03
gpgv:                using RSA key 7A02B3521DC75C542BA015456AFEE6D49E92B601
gpgv: Good signature from "Nick Mathewson <nickm@torproject.org>"

如果错误消息含有“No such file or directory”,上述某个步骤出错,或者未更改命令中的示例文件名。

另外,你可能想要了解更多 GnuPG 信息

验证校验和

现在我们验证了校验和的签名,接着需要验证软件包的完整性。

对于 Windows 的用户:

certUtil -hashfile tor-0.4.6.10.tar.gz.sha256sum SHA256

对于 macOS 的用户:

shasum -a 256 tor-0.4.6.10.tar.gz.sha256sum

对于 BSD/Linux 用户:

sha256sum -c tor-0.4.6.10.tar.gz.sha256sum