TOR(1) Tor Manual TOR(1) (NAME) tor - (SYNOPSIS) tor [OPTION value]... (DESCRIPTION) Tor . << >> . . . Tor (<< >>) . TCP ftp ssh . tor . (relay) ORPort . Tor . (COMMAND-LINE OPTIONS) Tor . tor . --OptionName OptionValue OptionName OptionValue . --SocksPort 9999 SocksPort 9999 SocksPort 9999 Tor 9999 SOCKS . . Tor debug.log --Log "debug file debug.log" . . THE CONFIGURATION FILE FORMAT . tor . -h --help . -f --torrc-file FILE Tor - Tor . (: /etc/tor/torrc $HOME/.torrc .) --allow-missing-torrc -f defaults-torrc ( ) . --defaults-torrc FILE Tor. . (: /etc/tor/torrc-defaults.) --ignore-missing-torrc Tor torrc . Tor torrc . --hash-password PASSWORD (control port). --list-fingerprint [key type] (nickname) (fingerprint). rsa () ed25519 . --verify-config . --dump-config short|full Tor . short . full . --service install [--options command-line options] Tor . : https://www.torproject.org/docs/faq#NTService --service remove|start|stop Tor. --nt-service . --list-torrc-options . --list-deprecated-options . ( .) --list-modules Tor. ( Tor .) --version Tor . "Tor version [version number]." . ( version-spec.txt .) --quiet|--hush (logging) . Tor "notice" . . . --hush --quiet . --keygen [--newpass] tor --keygen ed25519 . . Tor . --newpass --keygen ed25519 . ( ) ( ) . --DataDirectory --SigningKeyLifetime . SERVER OPTIONS . DataDirectory . DataDirectory/keys Tor Tor . --keygen-family basename basename.secret_family_key . . ( KeyDirectory .) basename.public_family_id . FamilyID . . https://community.torproject.org/relay/setup/post-install/family-ids . --passphrase-fd FILEDES . tor-gencert (newlines) . . --key-expiration [purpose] [--format iso8601|timestamp] purpose . purpose "sign" . tor --key-expiration sign stdout . --format . iso8601 timestamp . --format ISO-8601 . stdout : "signing-cert-expiry: 2017-07-25 08:30:15 UTC". --format timestamp (Unix timestamp) . stdout : "signing-cert-expiry: 1500971415". --dbg-... Tor "dbg" . Tor . . . (option value option "value") . # . . (escape) C . (\) . . %include . (wildcard) . (lexical) . : %include . . . . %include . Sandbox Tor . * ? . . . . : SocksPort SocksPort SocksPort . (+) . SocksPort 9100 9100 +SocksPort 9100 9100 9050 ( ). : SocksPort . (/) . (+) (/) . (GENERAL OPTIONS) AccelDir DIR (engine) OpenSSL . tor . AccelName NAME OpenSSL . . openssl engine . tor . "!" Tor . AlternateBridgeAuthority [nickname] [flags] ipv4address:port fingerprint, AlternateDirAuthority [nickname] [flags] ipv4address:port fingerprint DirAuthority (directory authorities) . AlternateDirAuthority Tor (bridge authorities) . AlternateBridgeAuthority . AvoidDiskWrites 0|1 . . (: 0) BandwidthBurst N bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBits (token bucket burst ) . (: 1 GByte) BandwidthRate N bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBits . 75 KBytes ( 600 kbits) 50 KBytes (400 kbits) -- 250 KBytes (2 mbits) . (: 1 GByte) TCP : TCP DNS . Tor 1 GByte 1024*1024*1024 . bytes KBytes . "KBytes" "kilobytes" "kb" "MBytes" "megabytes" "MB" "kbits" "kilobits" . . Tor "byte" "bit" . "tera" "T" . (bytes) . "bytes" "bits" "B" . CacheDirectory DIR DIR . tor . (: DataDirectory .) CacheDirectoryGroupReadable 0|1|auto 0 CacheDirectory . 1 CacheDirectory GID . "auto" CacheDirectory DataDirectory DataDirectoryGroupReadable 0 . (: auto) CircuitPriorityHalflife NUM . ( ) . -1 (consensus) 30 . : 1 : 2147483647. (float) . . (: -1) ClientTransportPlugin transport socks4|socks5 IP:PORT, ClientTransportPlugin transport exec path-to-binary [options] Bridge Tor SOCKS "IP:PORT" . ( IPv4 IPv6 .) . Bridge Tor (pluggable transport) path-to-binary options . . (: none) ConfluxEnabled 0|1|auto 1 Conflux () . (Onion services) . "auto" (consensus) . (: auto) ConfluxClientUX throughput|latency|throughput_lowmem|latency_lowmem (UX) (exit) . "throughput" . "Latency" (latency) . lowmem . (: "throughput") ConnLimit NUM (file descriptors) Tor . Tor ( "ulimit -H -n" ). ConnLimit Tor . Tor . Tor . Tor "ulimit -n 500" . tor ConnLimit 500 . DisableOOSCheck 0 . ConnLimit . getrlimit() . (: 1000) ConstrainedSockets 0|1 Tor ConstrainedSockSize . TCP . "Error creating network socket: No buffer space available" . /proc/sys/net/ipv4/tcp_mem ( ) . TCP DirPort . . "no buffer space available" . TCP (window size) TCP (round trip time) . (: 0) ConstrainedSockSize N bytes|KBytes ConstrainedSockets . 2048 262144 1024 . 8192 . ControlPort [address:]port|unix:path|auto [flags] Tor Tor Tor ( control-spec.txt torspec) . : HashedControlPassword CookieAuthentication Tor . ( Tor .) Tor 9051 . (unix domain socket) C . / (bind) . "auto" Tor . (: 0) : GroupWritable : (group-writable) . WorldWritable : (world-writable) . RelaxDirModeCheck : . ControlPortFileGroupReadable 0|1 0 . 1 GID . (: 0) ControlPortWriteToFile Path Tor . ControlPort "auto" . ControlSocket Path ControlPort TCP . 0 ControlSocket . ( .) (: 0) ControlSocketsGroupWritable 0|1 0 ( ControlSocket) . 1 GID . (: 0) CookieAuthentication 0|1 1 (control port) "control_auth_cookie" Tor . . (: 0) CookieAuthFile Path Tor . ( CookieAuthentication.) CookieAuthFileGroupReadable 0|1 0 . 1 GID . [ .] (: 0) CountPrivateBandwidth 0|1 (rate-limiting) Tor 127.0.0.1 10.0.0.1 . . (: 0) DataDirectory DIR DIR . tor . (: ~/.tor / /var/lib/tor. ApplicationData .) DataDirectoryGroupReadable 0|1 0 DataDirectory . 1 DataDirectory GID . (: 0) DirAuthority [nickname] [flags] ipv4address:dirport fingerprint (authoritative directory server) . . (Flags) . . "bridge" Tor . "orport=orport" Tor dirserver . "weight=num" ( 1.0). "v3ident=fp" dirserver v3 v3 fp . "ipv6=[ipv6address]:orport" IPv6 IPv6 OR Port . Tor ipv4address . ORPort . DirPort ORPort . ORPort IPv6 IPv6 IPv6 ORPort . DirAuthority Tor . : Tor . . DirAuthorityFallbackRate NUM (fallback directories) . 1.0 . 1 . (: 0.1) DisableAllSwap 0|1 1 Tor (paged out) . Windows OS X Solaris . Gnu/Linux *BSD (). Tor root User Tor . tor . (: 0) DisableDebuggerAttachment 0|1 1 Tor (debugging attachment) . (crash) core Tor . CAP_SYS_PTRACE root . Gnu/Linux *BSD (). Gnu/Linux Ubuntu sysctl kernel.yama.ptrace_scope PTRACE . PTRACE Tor - ptrace . gdb strace Tor 0 . . Tor . (: 1) DisableNetwork 0|1 ( ). Tor . Tor DisableNetwork ( DNS) . (: 0) ExtendByEd25519ID 0|1|auto 1 Ed25519 . 0 Ed25519 . "auto" . (: auto) ExtORPort [address:]port|auto Extended ORPort (pluggable transports) . (: DataDirectory/extended_orport_auth_cookie) ExtORPortCookieAuthFile Path Extended ORPort -- Extended ORPort . ExtORPortCookieAuthFileGroupReadable 0|1 0 Extended OR Port . 1 GID . [ .] (: 0) FallbackDir ipv4address:dirport orport=orport id=fingerprint [weight=num] [ipv6=[ipv6address]:orport] tor (directory cache) ( ) hard-coded . . FallbackDir hard-coded . FallbackDir . FallbackDir IP . DirPort . FallbackDir . FallbackDir FallbackDir hard-coded Tor ( ). ( DirAuthority .) FetchDirInfoEarly 0|1 1 Tor . . (: 0) FetchDirInfoExtraEarly 0|1 1 Tor . . . (: 0) FetchHidServDescriptors 0|1 0 Tor rendezvous . Tor . (: 1) FetchServerDescriptors 0|1 0 Tor . Tor . (: 1) FetchUselessDescriptors 0|1 1 Tor (flavors) extra info . 1 Tor . 0 Tor : . Tor . tor . extrainfo DirCache extrainfo DownloadExtraInfo* extrainfo DirCache UseMicrodescriptors . (: 0) HardwareAccel 0|1 () . tor . (: 0) HashedControlPassword hashed_password hashed_password . "tor --hash-password password" . HashedControlPassword . HTTPProxy host[:port] Tor host:port ( host:80 ) . ( : 0.3.1.0-alpha HTTPSProxy .) HTTPProxyAuthenticator username:password Tor username:password HTTP RFC 2617 . HTTP Tor (patch) . ( : 0.3.1.0-alpha HTTPSProxyAuthenticator .) HTTPSProxy host[:port] Tor OR (SSL) host:port ( host:443 ) HTTP CONNECT . HTTPS FascistFirewall . HTTPSProxyAuthenticator username:password Tor username:password HTTPS RFC 2617 . HTTPS Tor (patch) . KeepalivePeriod NUM NUM (padding keepalive cell) . (: 5 ) KeepBindCapabilities 0|1|auto root User KeepBindCapabilities . 1 0 auto . tor . (: auto.) Log minSeverity[-maxSeverity] stderr|stdout|syslog minSeverity maxSeverity (syslog) . ( <> .) debug info notice warn err. <> . . (signal handlers) (signal-safe) . (backtraces) . signal-safe stderr stdout . error bug general . syslog (control port) API . Log minSeverity[-maxSeverity] file FILENAME . <> . . Log [domain,...]minSeverity[-maxSeverity] ... file FILENAME Log [domain,...]minSeverity[-maxSeverity] ... stderr|stdout|syslog << >> (logging domains) . Tor . Log . ~ * << >> . . Tor . : general crypto net config fs protocol mm http app control circ rend bug dir dirserv or edge acct hist handshake heartbeat channel sched guard consdiff dos process pt btrack mesg. . <> stdout : handshake info (net) (mm) notice . LogMessageDomains 0|1 Tor . . (controller) . (: 0) LogTimeGranularity NUM Tor NUM . NUM . Tor . Tor ( ) <<>> (batch up) syslog mtime . (: 1 ) MaxAdvertisedBandwidth N bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBits BandwidthRate . ( ) CPU . MaxUnparseableDescSizeToLog N bytes|KBytes|MBytes|GBytes|TBytes ( ) . Tor . (: 10 MBytes) MetricsPort [address:]port [format] : tor Tor . . MetricsPortPolicy . format prometheus Prometheus . (HTTP) stunnel . HTTP GET <> . tor . MetricsPortPolicy . <> . Prometheus : https://prometheus.io/docs/concepts/data_model tor . tor . (: None) 5.6.7.8 : MetricsPort 1.2.3.4:9035 MetricsPortPolicy accept 5.6.7.8 MetricsPortPolicy policy,policy,... MetricsPort . . . (reject all) . (: None) MetricsPort NAT . localhost . stunnel . NoExec 0|1 Tor ClientTransportPlugin ServerTransportPlugin . Tor . (: 0) OutboundBindAddress IP IP . Tor . : IPv4 IPv6. IPv6 . (127.0.0.0/8 ::1) DNS . OutboundBindAddressExit IP (exit) IP . IP OutboundBindAddress . : IPv4 IPv6. IPv6 . (127.0.0.0/8 ::1) . OutboundBindAddressOR IP ( ) IP . IP OutboundBindAddress . : IPv4 IPv6. IPv6 . (127.0.0.0/8 ::1) . __OwningControllerProcess PID Tor PID . (polling interval) . PerConnBWBurst N bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBits <> Tor . (: 0) PerConnBWRate N bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBits <> Tor . (: 0) OutboundBindAddressPT IP (pluggable transports) IP . Tor . IP OutboundBindAddress . : IPv4 IPv6. IPv6 . (127.0.0.0/8 ::1) . PidFile FILE PID FILE . FILE . tor . ProtocolWarnings 0|1 Tor Tor 'warn' . 'info' . (: 0) RelayBandwidthBurst N bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBits ( burst ) _ _ . ( ) <<>> . (: 0) RelayBandwidthBurst RelayBandwidthRate . RelayBandwidthRate N bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBits _ _ . . ( ) <<>> . (: 0) RelayBandwidthRate RelayBandwidthBurst . RephistTrackTime N seconds|minutes|hours|days|weeks (authority) . (: 24 hours) RunAsDaemon 0|1 Tor (fork) . Windows --service . tor . (: 0) SafeLogging 0|1|relay Tor ( ) [scrubbed] . . Tor . relay . : Tor Notice . (: 1) Sandbox 0|1 Tor (syscall sandbox) . . Linux Tor libseccomp . libc . tor . Sandbox tor : Address ConnLimit CookieAuthFile DirPortFrontPage ExtORPortCookieAuthFile Logs ServerDNSResolvConfFile ClientOnionAuthDir ( HUP ). Onion Services . Tor ( ClientOnly ORPort ). Sandbox <> ControlPort . %include tor tor . (: 0) Schedulers KIST|KISTLite|Vanilla (scheduler) tor . Tor . . . . (: KIST,KISTLite,Vanilla) : KIST: Kernel-Informed Socket Transport. Tor TCP . KIST ( KISTSchedRunInterval). KIST Linux 2.6.39 . KISTLite: KIST . Tor KIST . KISTLite KIST KISTLite . Vanilla: Tor KIST . . Vanilla . KISTSchedRunInterval NUM msec KIST KISTLite Schedulers . 0 msec consensus 10 msec . 100 msec . (: 0 msec) KISTSockBufSizeFactor NUM KIST Schedulers KIST . (: 1.0) Socks4Proxy host[:port] Tor OR SOCKS 4 host:port ( host:1080 ) . Socks5Proxy host[:port] Tor OR SOCKS 5 host:port ( host:1080 ) . Socks5ProxyUsername username Socks5ProxyPassword password SOCKS 5 username password RFC 1929 . . SyslogIdentityTag tag syslog syslog "Tor-tag" . tor . (: none) TCPProxy protocol host:port Tor OR (SSL) TCP host:port . FascistFirewall . Tor OR . 'haproxy' . . (: none) + 1 HAProxy : https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt + IP . TruncateLogFile 0|1 1 Tor HUP (overwrite) . (: 0) UnixSocksGroupWritable 0|1 0 unix ( SocksPort unix:) . 1 Unix GID . (: 0) UseDefaultFallbackDirs 0|1 FallbackDirs (hard-coded) Tor ( ) . ( FallbackDir UseDefaultFallbackDirs FallbackDirs .) (: 1) User Username setuid setgid . tor . ( SocksPort HTTPTunnelPort TransPort DNSPort NATDPort ): AllowNonRFC953Hostnames 0|1 Tor ( @ :) . URL . (: 0) AutomapHostsOnResolve 0|1 AutomapHostsSuffixes . <<.onion>> . (: 0) AutomapHostsSuffixes SUFFIX,SUFFIX,... AutomapHostsOnResolve . <<.>> << >> . (: .exit,.onion). Bridge [transport] IP:ORPort [fingerprint] UseBridges Tor <> <<>> Tor . <> ( DirAuthority ) . fingerprint UpdateBridgesFromAuthority (bridge authority) . <> ClientTransportPlugin . (pluggable transport) . . <> . Tor <> . . CircuitPadding 0|1 0 Tor (pad) . . . 1 (consensus) ( ConnectionPadding CircuitPadding ). (: 1) ReducedCircuitPadding 0|1 1 Tor . . . (: 0) ClientBootstrapConsensusAuthorityDownloadInitialDelay N (bootstrap) ( ) . (fallback) . ( ) . (: 6) ClientBootstrapConsensusAuthorityOnlyDownloadInitialDelay N ( ) . . ( ) . (: 0) ClientBootstrapConsensusFallbackDownloadInitialDelay N ( ) . . ( ) . (: 0) ClientBootstrapConsensusMaxInProgressTries NUM (timeout) . (: 3) ClientDNSRejectInternalAddresses 0|1 Tor DNS ( 127.0.0.1 192.168.0.1) . . (: 1) ClientOnionAuthDir path v3. (onion) <<.auth_private>> ( <>). : :descriptor:x25519: <<.onion>> . base32 ( x25519). G rend-spec-v3.txt torspec . ClientOnly 0|1 1 Tor ORPort ExtORPort DirPort . ( : Tor . Tor ORPort ExtORPort DirPort .) (: 0) ClientPreferIPv6DirPort 0|1|auto 1 Tor IPv6 IPv4 . ( IPv4Client 0 Tor IPv6 .) auto IPv4 . . IPv6 . (: auto) (: .) ClientPreferIPv6ORPort 0|1|auto 1 Tor OR IPv6 IPv4 . ( IPv4Client 0 Tor ORPort IPv6 .) auto Tor IPv4 . . IPv6 . (: auto) ClientRejectInternalAddresses 0|1 Tor ( 127.0.0.1 192.168.0.1) ( .exit ). DNS ( *.local) . (: 1) ClientUseIPv4 0|1 0 Tor IPv4 . IPv4 Bridge ClientUseIPv4 0 IPv4 . (: 1) ClientUseIPv6 0|1 1 Tor IPv6 . IPv6 ClientUseIPv4 0 IPv4 . IPv6 Bridge ClientUseIPv6 0 IPv6 . (: 1) ConnectionPadding 0|1|auto Tor (padding) . auto Tor . 0 Tor . 1 Tor . . . (: auto) ReducedConnectionPadding 0|1 1 Tor OR . . . (: 0) DNSPort [address:]port|auto [isolation flags] UDP DNS . A AAAA PTR --- DNS . <> Tor . / . SocksPort . (: 0) DownloadExtraInfo 0|1 Tor <> . . Tor . (: 0) EnforceDistinctSubnets 0|1 1 Tor IP << >> . << >> /16 . (: 1) FascistFirewall 0|1 1 Tor OR ( 80 443 FirewallPorts ). Tor . ReachableAddresses . FirewallPorts PORTS . FascistFirewall . ReachableAddresses . (: 80, 443) HTTPTunnelPort [address:]port|auto [isolation flags] <> SOCKS . <> 0 . <> Tor . / . Tor . SocksPort . (: 0) LongLivedPorts PORTS ( ). (uptime) . ( ) . (: 21, 22, 706, 1863, 5050, 5190, 5222, 5223, 6523, 6667, 6697, 8300) MapAddress address newaddress address Tor newaddress . www.example.com torserver ( torserver ) <> . <<*.>> . example.com torserver ( torserver ) <> . ( <<*.>> .) . <>. Tor .+ :.sp 1. MapAddress Tor . torrc www.torproject.org 198.51.100.1 : MapAddress www.torproject.org 192.0.2.1 MapAddress www.torproject.org 198.51.100.1 2. Tor MapAddress . torrc www.torproject.org 203.0.113.1 : MapAddress 198.51.100.1 203.0.113.1 MapAddress www.torproject.org 198.51.100.1 3. MapAddress ( ) (wildcard) : MapAddress www.torproject.org *.torproject.org.torserver.exit 4. ( *ample.com) . 5. Tor IP . DNS MapAddress IP Tor DNS . 6. MapAddress (redirects) . HTTP alt-svc . . MaxCircuitDirtiness NUM NUM . (hidden services) . SOCKS SocksPorts KeepAliveIsolateSOCKSAuth MaxCircuitDirtiness . (: ) MaxClientCircuitsPending NUM NUM (pending) . . (: ) NATDPort [address:]port|auto [isolation flags] ipfw ( FreeBSD ) NATD . NATD 0 . Tor "auto" . / . Tor . SocksPort . TransPort . (: 0) NewCircuitPeriod NUM NUM . (: ) PathBiasCircThreshold NUM PathBiasDropGuards NUM PathBiasExtremeRate NUM PathBiasNoticeRate NUM PathBiasWarnRate NUM PathBiasScaleThreshold NUM Tor ( ) . (guard nodes) Tor . PathBiasCircThreshold . PathBiasNoticeRate PathBiasWarnRate PathBiasExtremeRate . PathBiasExtremeRate PathBiasDropGuards 1 . PathBiasScaleThreshold 0.5 ( consensus) . Tor networkstatus . 150 0.70 0.50 0.30 0 300 . PathBiasUseThreshold NUM PathBiasNoticeUseRate NUM PathBiasExtremeUseRate NUM PathBiasScaleUseThreshold NUM Tor ( ) . . . RELAY . Tor networkstatus . 20 0.80 0.60 100 . PathsNeededToBuildCircuits NUM Tor . 0.25 0.95 Tor (descriptors) . Tor (bootstrap) Tor . Tor . Tor 0.6 . (: -1) ReachableAddresses IP[/MASK][:PORT]... IP . ExitPolicy "accept" "reject" . 'ReachableAddresses 99.0.0.0/8, reject 18.0.0.0/8:80, accept *:80' 99 80 18 80 . (: 'accept *:*'.) ReachableDirAddresses IP[/MASK][:PORT]... ReachableAddresses . Tor HTTP GET . ReachableAddresses . HTTPProxy . (: .) ReachableORAddresses IP[/MASK][:PORT]... ReachableAddresses . Tor TLS/SSL . ReachableAddresses . HTTPSProxy . ReachableORAddresses ReachableDirAddresses (: HTTPProxy HTTPSProxy). TLS ( Tor ) 443 HTTP GET ( Tor ) 80 . SafeSocks 0|1 Tor socks -- IP DNS . socks4 socks5 DNS . (: 0) TestSocks 0|1 Tor Socks notice socks (: SafeSocks). Tor DNS . (: 0) WarnPlaintextPorts port,port,... Tor . . (: 23,109,110,143) RejectPlaintextPorts port,port,... WarnPlaintextPorts Tor . (: None) SocksPolicy policy,policy,... SocksPort DNSPort . . . SocksPort [address:]port|unix:path|auto [flags] [isolation flags] SOCKS . SOCKS 0 . Tor "auto" . / . C . . "No" . (: 9050) : IP localhost . SOCKS ( ) . Tor . isolation flags Tor SocksPort . : IsolateClientAddr . ( NoIsolateClientAddr . .) IsolateSOCKSAuth SOCKS . ( HTTPTunnelPort Proxy-Authorization X-Tor-Stream-Isolation . NoIsolateSOCKSAuth .) IsolateClientProtocol . ( SOCKS 4 SOCKS 5 HTTPTunnelPort TransPort NATDPort DNSPort .) IsolateDestPort . IsolateDestAddr . KeepAliveIsolateSOCKSAuth IsolateSOCKSAuth SOCKS . MaxCircuitDirtiness . SessionGroup=INT . ( SocksPort TransPort . .) flags SocksPort : NoIPv4Traffic SOCKS IPv4 . IPv6Traffic SOCKS5 IPv6 SOCKS . (SOCKS4 IPv6 .) PreferIPv6 IPv4 IPv6 IPv6 . (IPv4 .) NoDNSRequest DNS SOCKS5 . Tor IPv4 IPv6 ( IPv6Traffic) .onion . NoOnionTraffic SOCKS5 .onion . OnionTrafficOnly tor SOCKS5 .onion . NoDNSRequest NoIPv4Traffic NoIPv6Traffic . NoOnionTrafficOnly . CacheIPv4DNS DNS IPv4 . CacheIPv6DNS DNS IPv6 . GroupWritable : (group-writable) . WorldWritable : (world-writable) . CacheDNS DNS . UseIPv4Cache DNS IPv4 . (: UseIPv6Cache UseDNSCache . !) UseIPv6Cache DNS IPv6 . UseDNSCache DNS . NoPreferIPv6Automap ( AutomapHostsOnResolve) IPv4 IPv6 IPv4 . (Tor IPv6 .) PreferSOCKSNoAuth SOCKS5 << />> << >> Tor Tor / IsolateSOCKSAuth . / . IsolateSOCKSAuth Tor << >> . ExtendedErrors SOCKS . : X'F0' . ( v3) X'F1' . ( v3) X'F2' NACK . ( v3) X'F3' . ( v3) X'F4' . ( v3) X'F5' . . ( v3) X'F6' .onion . : ed25519 . ( v3) X'F7' X'F2' . ( v3) . . . TokenBucketRefillInterval NUM [msec|second] (token bucket) Tor NUM . NUM . Tor . : Tor . tor . (: 100 msec) TrackHostExits host,.domain,... Tor (exit node) . '.' . '.' . IP ( ). . . TrackHostExitsExpire NUM NUM . ( ) . TransPort [address:]port|auto [isolation flags] (transparent proxy) . 0 . "auto" Tor . (bind) / . Tor (stream isolation) . SocksPort . TransPort pf BSD IPTables Linux. Tor VirtualAddrNetwork . (: 0) TransProxyType default|TPROXY|ipfw|pf-divert TransProxyType . TPROXY TransPort "TPROXY" . TPROXY Documentation/networking/tproxy.txt . "ipfw" ipfw FreeBSD . *BSD pf "pf-divert" divert-to rdr-to . pf divert-to pf.conf(5) . OpenBSD divert-to OpenBSD 4.4 . "default" IPTables Linux rdr-to pf *BSD . (: "default") UpdateBridgesFromAuthority 0|1 ( UseBridges) Tor (bridge descriptors) . 404 (fall back) . (: 0) UseBridges 0|1 Tor "Bridge" (entry guard) . (: 0) UseEntryGuards 0|1 1 . . Directory Authorities Single Onion Services . . (: 1) UseGuardFraction 0|1|auto guardfraction (consensus) . auto UseGuardFraction . (: auto) GuardLifetime N days|weeks|months UseEntryGuards . . (: 0) NumDirectoryGuards NUM UseEntryGuards 1 NUM . 0 guard-n-primary-dir-guards-to-use 3 . (: 0) NumEntryGuards NUM UseEntryGuards 1 NUM . NUM 0 guard-n-primary-guards-to-use 1 . (: 0) NumPrimaryGuards NUM UseEntryGuards 1 NUM Tor . NUM 0 guard-n-primary-guards 3 . (: 0) VanguardsLiteEnabled 0|1|auto vanguards-lite . auto vanguards-lite-enabled . (: auto) UseMicrodescriptors 0|1|auto (Microdescriptors) Tor . Tor . . auto 1 . (: auto) VirtualAddrNetworkIPv4 IPv4Address/bits VirtualAddrNetworkIPv6 [IPv6Address]/bits Tor MAPADDRESS AutomapHostsOnResolve () . ( : 127.192.0.0/10 [FE80::]/10). dns-proxy-tor IPv4 "10.192.0.0/10" "172.16.0.0/12" IPv6 "[FC00::]/7" . VirtualAddrNetwork loopback link-local (route) . IPv6 IPv4 . ( ) IP . VirtualAddrNetwork . Tor : CircuitsAvailableTimeout NUM Tor . Tor . Tor TLS . . (: 30 : 24 ) LearnCircuitBuildTimeout 0|1 0 CircuitBuildTimeout . (: 1) CircuitBuildTimeout NUM NUM . . LearnCircuitBuildTimeout 1 . LearnCircuitBuildTimeout 0 . (: 60 ) CircuitStreamTimeout NUM (stream) (override) . 60 . (: 0) SocksTimeout NUM socks NUM (handshaking) NUM . (: 2 ) (DORMANT MODE OPTIONS) Tor (dormant mode) . Tor : DormantCanceledByStartup 0|1 Tor . true Tor . (: 0) : . Tor ( ) Tor ( ). DormantClientTimeout N minutes|hours|days|weeks Tor . onion . 10 . (: 24 ) DormantOnFirstStartup 0|1 true Tor DataDirectory . ( Tor .) false Tor (bootstrap) . Tor . (: 0) DormantTimeoutDisabledByIdleStreams 0|1 true (stream) ( ) DormantClientTimeout . false . (: 1) DormantTimeoutEnabled 0|1 false Tor . Tor Tor . (: 1) (NODE SELECTION OPTIONS) tor ( onion) . Tor : EntryNodes node,node,... (identity fingerprints) (hop) . . Bridge (bridges) UseBridges 1 . : . ExcludeNodes : EntryNodes ExcludeNodes . ExcludeNodes . ExcludeNodes node,node,... . ISO3166 . (: ExcludeNodes ABCD1234CDEF5678ABCD1234CDEF5678ABCD1234, {cc}, 255.254.0.0/8) : . Tor . (introduction points) Tor . StrictNodes ( ) . ( ) Tor . . (Controllers) Tor . . <<{??}>> . GeoIPFile {??} . GeoIPExcludeUnknown . ExcludeExitNodes node,node,... --- Tor . ExcludeNodes . ExcludeNodes . ExitNodes . : . ExitNodes node,node,... --- Tor . ExcludeNodes . : . ExcludeExitNodes . 80 443 . Tor . ( ) . ExcludeNodes StrictNodes . ExcludeNodes : ExitNodes ExcludeNodes . exit. MapAddress . GeoIPExcludeUnknown 0|1|auto auto ExcludeNodes ExcludeExitNodes ({??} {A1}) . 1 ExcludeNodes ExcludeExitNodes . GeoIP . (: auto) HSLayer2Nodes node,node,... (nicknames) Onion Service . (primary guard node) . (: .) (: HSLayer2Nodes ABCD1234CDEF5678ABCD1234CDEF5678ABCD1234, {cc}, 255.254.0.0/8) : . : C - G - L2 - M - Rend C - G - L2 - M - HSDir C - G - L2 - M - Intro S - G - L2 - M - Rend S - G - L2 - M - HSDir S - G - L2 - M - Intro C S G Guard L2 M . Rend HSDir Intro . HSLayer3Nodes : C - G - L2 - L3 - Rend C - G - L2 - L3 - M - HSDir C - G - L2 - L3 - M - Intro S - G - L2 - L3 - M - Rend S - G - L2 - L3 - HSDir S - G - L2 - L3 - Intro ExcludeNodes HSLayer2Nodes ExcludeNodes . HSLayer3Nodes /16 . guard Rend HSDir IP . guard layer2 layer3 . Tor https://github.com/mikeperry-tor/vanguards . 20 (load balancing) HSLayer2Nodes Tor . . HSLayer3Nodes node,node,... (identity fingerprints) (hop) Onion Service . Layer2 . (: .) (: HSLayer3Nodes ABCD1234CDEF5678ABCD1234CDEF5678ABCD1234, {cc}, 255.254.0.0/8) : . : C - G - M - L3 - Rend C - G - M - L3 - M - HSDir C - G - M - L3 - M - Intro S - G - M - L3 - M - Rend S - G - M - L3 - HSDir S - G - M - L3 - Intro C S G Guard L2 M . Rend HSDir Intro . HSLayer2Nodes : C - G - L2 - L3 - Rend C - G - L2 - L3 - M - HSDir C - G - L2 - L3 - M - Intro S - G - L2 - L3 - M - Rend S - G - L2 - L3 - HSDir S - G - L2 - L3 - Intro ExcludeNodes HSLayer3Nodes ExcludeNodes . HSLayer2Nodes /16 (node family) . Rend HSDir IP . guard layer2 layer3 . Tor https://github.com/mikeperry-tor/vanguards . (load balancing) HSLayer3Nodes Tor . . MiddleNodes node,node,... <<>> . . (exit) (entry) . : . Tor . . tor MiddleNodes . . HSLayer2Node HSLayer3Node onion service (override ). vanguards HSLayer2Nodes HSLayer3Nodes . ExcludeNodes (override) : MiddleNodes ExcludeNodes . <> . NodeFamily node,node,... Tor <<>> . NodeFamily ( MyFamily) . . IP {} . ExcludeNodes . StrictNodes 0|1 StrictNodes Tor ExcludeNodes (StrictNodes ExcludeExitNodes ExitNodes MiddleNodes MapAddress ). StrictNodes Tor ExcludeNodes . 0 StrictNodes Tor (relay reachability self-tests) .exit . (: 0) ( ORPort ) : AccountingMax N bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBits ( AccountingStart AccountingRule ). . . AccountingMax 1 TByte (900 GBytes) (800 GBytes) . (hibernate) 1 TByte . AccountingRule "sum" ( /). Tor . Tor . Tor . << >> . ( Bandwidth ) Tor : 1 GByte 1024*1024*1024 . : (ISP) . AccountingRule sum|max|in|out AccountingMax ( ) . "max" ( ). "sum" . "in" . "out" . (: max) AccountingStart day|week|month [day] HH:MM . month HH:MM dayth . (relay) . ( .) week HH:MM dayth . day HH:MM . . (: "month 1 0:00") Address address (FQDN) . Tor . Tor IPv4/IPv6 ( ORPort ). Tor (bind) . ORPort OutboundBindAddress . AddressDisableIPv6 0|1 ORPort IPv4Only Tor IPv6 . IPv6 . IPv6 ORPort IPv6 IPv6 . IPv6 ORPort (descriptor) . (: 0) AssumeReachable 0|1 (bootstrapping) Tor . 1 (self- reachability) . (: 0) AssumeReachableIPv6 0|1|auto AssumeReachable IPv6 ORPort . "auto" Tor AssumeReachable . (: auto) BridgeRelay 0|1 Tor <<>> (bridge) . Tor (bridge database) . : MyFamily torrc . BridgeDistribution string BridgeRelay Tor BridgeDB . BridgeDB "none" BridgeDB "any" . https://bridges.torproject.org/info . (: any) ContactInfo email_address . . (index) . / . ContactInfo . ( .) DisableOOSCheck 0|1 Tor . (out-of- sockets) OR . (: 1) ExitPolicy policy,policy,... (exit policy) . "accept[6]|reject[6] ADDR[/MASK][:PORT]" . /MASK . "*" (0.0.0.0/0 ::/0) *4 IPv4 *6 IPv6 . PORT "FROM_PORT-TO_PORT" "*" . PORT "*" . "accept 18.7.22.69:*,reject 18.0.0.0/8:*,accept *:*" IPv4 MIT web.mit.edu IPv4 IPv6 . Tor IPv6 . "reject6 [FC00::]/7:*" FC00:: . "accept6 [C000::]/3:*" C000:: . accept6 reject6 IPv6 . IPv4 accept6 reject6 . accept/reject IPv4 IPv6 . *4 (wildcard) IPv4 *6 IPv6 . accept/reject * IPv4 IPv6 . - (link-local) IPv4 IPv6 ( 0.0.0.0/8 169.254.0.0/16 127.0.0.0/8 192.168.0.0/16 10.0.0.0/8 172.16.0.0/12 [::]/8 [FC00::]/7 [FE80::]/10 [FEC0::]/10 [FF00::]/8 [::]/127) "private" . ("private" IPv4 IPv6 accept6/reject6 .) ( ) IPv4 IPv6 . ExitPolicyRejectPrivate 0 . "accept 127.0.0.1:80,reject private:*" HTTP 127.0.0.1 IP () . IP RFC 1918 RFC 3330 . ExitPolicyRejectLocalInterfaces . . . IPv4 IPv6 accept/reject * . IPv4 IPv6 IPv6 accept6/reject6 *6 IPv4 accept/reject *4 . __ reject *:* accept *:* . __ ( ) . "ReducedExitPolicy 1" . reject : accept : . ( ) . : reject *:25 reject *:119 reject *:135-139 reject *:445 reject *:563 reject *:1214 reject *:4661-4666 reject *:6346-6429 reject *:6699 reject *:6881-6999 accept *:* accept/reject * IPv4 IPv6 . ExitPolicyRejectLocalInterfaces 0|1 IPv4 IPv6 . OutboundBindAddress bind ControlPort DNSPort IPv4 IPv6 . ( IPv6Exit IPv6 .) ExitPolicy . IP ExitPolicy . (: 0) ExitPolicyRejectPrivate 0|1 () IPv4 IPv6 . ExitPolicy . (: 1) ExitRelay 0|1|auto Tor (exit relay) . Tor ExitRelay 1 Tor ExitPolicy ReducedExitPolicy ExitPolicy ( ) . ExitRelay 0 ExitPolicy ReducedExitPolicy IPv6Exit . ExitRelay "auto" Tor ExitPolicy ReducedExitPolicy IPv6Exit . Tor ExitRelay 1 . Tor ExitRelay 0 . (: auto) ReevaluateExitPolicy 0|1 . . 1 Tor . (: 0) ExtendAllowPrivateAddresses 0|1 Tor localhost RFC1918 . Tor OR Tor EXTEND . (Tor (pluggable transports) .) . (: 0) GeoIPFile filename GeoIP IPv4 . GeoIPv6File filename GeoIP IPv6 . HeartbeatPeriod N minutes|hours|days|weeks (heartbeat) HeartbeatPeriod . notice Tor . 0 . . (: 6 hours) IPv6Exit 0|1 IPv6 . ExitRelay auto ExitRelay 1 . (: 0) KeyDirectory DIR DIR . tor . (: "keys" DataDirectory.) KeyDirectoryGroupReadable 0|1|auto 0 KeyDirectory . 1 KeyDirectory GID . "auto" KeyDirectory DataDirectory DataDirectoryGroupReadable 0 . (: auto) MainloopStats 0|1 (main loop) HeartbeatPeriod . notice Tor . (: 0) MaxHSDirCacheBytes N bytes|KBytes|MBytes|GBytes Tor HSDir . 0 MaxMemInQueues . (: 0) MaxMemInQueues DDoS . MaxMemInQueues N bytes|KBytes|MBytes|GBytes Tor . . . . 0 Tor . (: 0) MaxOnionQueueDelay NUM [msec|second] (onionskins) . (: 1750 msec) MyFamily fingerprint,fingerprint,... Tor ( $) . : MyFamily . 'family' () Tor . ( .) (bridge) . MyFamily . : Tor MyFamily . FamilyId ident . ".secret_family_key" . . "--keygen-family" ident ".public_family_id" . : https://community.torproject.org/relay/setup/post-install/family-ids . MyFamily . ( Sandbox seccomp2 Tor .) FamilyId * Family ID . ".secret\_family\_key" . . FamilyKeyDirectory directory: . Nickname name 'name' . [a-zA-Z0-9] . Unnamed . . NumCPUs num . 0 Tor 1 . (: 0) OfflineMasterKey 0|1 Tor . "tor --keygen" ed25519 . (: 0) ORPort [address:]PORT|auto [flags] Tor. Tor . Tor "auto" . 0 ORPort . . (: 0) Tor ORPort : NoAdvertise (bind) . NoAdvertise . ( ) . NoListen (bind) . NoListen . ( port forwarding ) . IPv4Only IPv4 IPv6 IPv4 . IPv6Only IPv4 IPv6 IPv6 . NoAdvertise NoListen IPv4Only IPv6Only . PublishServerDescriptor 0|1|v3|bridge,... Tor . . 0 Tor . ( Tor .) Tor . "1" : " ". "v3" " " "bridge" " " . ReducedExitPolicy 0|1 . . TCP . . (peer-to-peer) . : accept *:20-21 accept *:22 accept *:23 accept *:43 accept *:53 accept *:79 accept *:80-81 accept *:88 accept *:110 accept *:143 accept *:194 accept *:220 accept *:389 accept *:443 accept *:464 accept *:465 accept *:531 accept *:543-544 accept *:554 accept *:563 accept *:587 accept *:636 accept *:706 accept *:749 accept *:873 accept *:902-904 accept *:981 accept *:989-990 accept *:991 accept *:992 accept *:993 accept *:994 accept *:995 accept *:1194 accept *:1220 accept *:1293 accept *:1500 accept *:1533 accept *:1677 accept *:1723 accept *:1755 accept *:1863 accept *:2082 accept *:2083 accept *:2086-2087 accept *:2095-2096 accept *:2102-2104 accept *:3128 accept *:3389 accept *:3690 accept *:4321 accept *:4643 accept *:5050 accept *:5190 accept *:5222-5223 accept *:5228 accept *:5900 accept *:6660-6669 accept *:6679 accept *:6697 accept *:8000 accept *:8008 accept *:8074 accept *:8080 accept *:8082 accept *:8087-8088 accept *:8232-8233 accept *:8332-8333 accept *:8443 accept *:8888 accept *:9418 accept *:9999 accept *:10000 accept *:11371 accept *:19294 accept *:19638 accept *:50002 accept *:64738 reject *:* (: 0) RefuseUnknownExits 0|1|auto (consensus) (relay). 1 0 "auto" ( ). (: auto) ServerDNSAllowBrokenConfig 0|1 (false) DNS Tor . Tor . (: 1) ServerDNSAllowNonRFC953Hostnames 0|1 Tor ( @ :) . URL . . (: 0) ServerDNSDetectHijacking 0|1 1 DNS ( ) . . . (: 1) ServerDNSRandomizeCase 0|1 Tor DNS DNS . "0x20 hack" DNS . "Increased DNS Forgery Resistance through 0x20-Bit Encoding" . . (: 1) ServerDNSResolvConfFile filename DNS filename . "resolv.conf" (7) . ServerDNS . ( DNS DNS localhost .) ServerDNSSearchDomains 0|1 1 . "example.com" "www" "www.example.com" . . (: 0) ServerDNSTestAddresses hostname,hostname,... DNS . DNS (exit policy) "reject *:*" . . (: "www.google.com, www.mit.edu, www.yahoo.com, www.slashdot.org") ServerTransportListenAddr transport IP:PORT Tor IP:PORT (pluggable transport proxy) transport . ( IPv4 IPv6 .) (: none) ServerTransportOptions transport k=v k=v ... Tor k=v transport . (: ServerTransportOptions obfs45 shared-secret=bridgepasswd cache=/var/lib/tor/cache) (: none) ServerTransportPlugin transport exec path-to-binary [options] Tor path-to-binary options . (: none) ShutdownWaitLength NUM SIGINT : . NUM . SIGINT . (: 30 seconds) SigningKeyLifetime N days|weeks|months Ed25519 Tor "" . . (: 30 days) SSLKeyLifetime N minutes|hours|days|weeks (link certificate) SSL . 0 Tor . (: 0) extra-info . Tor : BridgeRecordUsageByCountry 0|1 BridgeRelay GeoIP Tor (bridge authority) . ExtraInfoStatistics extra-info . (: 1) CellStatistics 0|1 . Tor ( ) 24 . . ExtraInfoStatistics extra-info . (: 0) ConnDirectionStatistics 0|1 . Tor 24 . . ExtraInfoStatistics extra-info . (: 0) DirReqStatistics 0|1 . Tor 24 . Tor . ExtraInfoStatistics extra-info . (: 1) EntryStatistics 0|1 . Tor 24 . Tor Tor . ExtraInfoStatistics extra-info . (: 0) ExitPortStatistics 0|1 . Tor 24 . Tor . ExtraInfoStatistics extra-info . (: 0) ExtraInfoStatistics 0|1 Tor extra-info . GeoIPFile GeoIPv6File extra-info . ServerTransportPlugin extra-info BridgeDB . (: 1) HiddenServiceStatistics 0|1 . Tor 24 . ExtraInfoStatistics extra-info . (: 1) OverloadStatistics 0|1* . Tor . (: 1) : o ntor onionskin . o OOM . o TCP. + ExtraInfoStatistics extra-info : - ( ) . - . PaddingStatistics 0|1 . Tor (padding cells) . . . ExtraInfoStatistics extra-info . (: 1) . ( DirCache .) DirCache 0|1 Tor extra info . DownloadExtraInfo extra info . DirPort DirCache ORPort . DirPort BridgeRelay DirCache 0 . (: 1) DirPolicy policy,policy,... . . . DirPort [address:]PORT|auto [flags] . "auto" Tor . DirPort : DirPort NoAdvertise . (: 0) ORPort . IPv4 . Tor 0.4.6.1-alpha (AuthoritativeDirectory ) DirPort . DirPort DirPort torrc . DirPortFrontPage FILENAME HTML "/" DirPort . . contrib/operator-tools/tor-exit-notice.html . MaxConsensusAgeForDiffs N minutes|hours|days|weeks Tor consensus diffs . Tor networkstatus . . . (: 0) (DENIAL OF SERVICE MITIGATION OPTIONS) Tor (DoS) / Tor . onion services . : 1. ( DoSConnectionMaxConcurrentCount ) . 2. IP (v4 v6) ( DoSCircuitCreationRate DoSCircuitCreationBurst ) ( DoSCircuitCreationMinConnections ) tor ( CREATE) ( ) . 3. (rendezvous point) ( Tor2Web) . torrc . . : https://consensus-health.torproject.org/#consensusparams DoS (heartbeat) NOTICE : DoS mitigation since startup: 429042 circuits rejected, 17 marked addresses. 2238 connections closed. 8052 single hop clients refused. . . DoSCircuitCreationEnabled 0|1|auto DoS . 1 () tor IP DoS . tor . DoSCircuitCreationDefenseType . . "auto" . 0 . (: auto) DoSCircuitCreationBurst NUM (burst) IP . DoS . "0" . 90 . (: 0) DoSCircuitCreationDefenseTimePeriod N seconds|minutes|hours DoS . N+1 3/2 * N . "0" . 3600 (1 ) . (: 0) DoSCircuitCreationDefenseType NUM . : 1: . 2: DoSCircuitCreationDefenseTimePeriod. "0" . 2 . (: 0) DoSCircuitCreationMinConnections NUM DoS . NUM . "0" . 3 . (: 0) DoSCircuitCreationRate NUM IP . 0 . 3 . (: 0) DoSConnectionEnabled 0|1|auto DoS . 1 () tor IP . "auto" . 0 . (: auto) DoSConnectionDefenseType NUM . : 1: . 2: . "0" . 2 . (: 0) DoSConnectionMaxConcurrentCount NUM IP . DoSConnectionDefenseType . "0" . 100 . (: 0) DoSConnectionConnectRate NUM . ( ) (DoSConnectionDefenseType) DoSConnectionConnectDefenseTimePeriod . 0 . (: 0) DoSConnectionConnectBurst NUM . DoSConnectionConnectRate . 0 . (: 0) DoSConnectionConnectDefenseTimePeriod N seconds|minutes|hours . N+1 3/2 * N . 0 . (: 24 hours) DoSRefuseSingleHopClientRendezvous 0|1|auto (single hop) . ESTABLISH_RENDEZVOUS . "auto" . 0 . (: auto) (exit relay) . DoSStreamCreationEnabled 0|1|auto (DoS) . 1 () tor dns . "auto" (consensus) . 0 . (: auto) DoSStreamCreationDefenseType NUM DoS . : 1: . 2: (resolve). 3: . "0" . 2 . (: 0) DoSStreamCreationRate NUM . (burst - ) (DoSStreamCreationDefenseType). 0 . 100 . (: 0) DoSStreamCreationBurst NUM (burst) . DoSStreamCreationRate . 0 . 300 . (: 0) (onion services) . (introduction point defense) . . : HiddenServiceEnableIntroDoSDefense 0|1 DoS . rate burst ( ) . . . (: 0) HiddenServiceEnableIntroDoSBurstPerSec NUM (burst) . 0 HiddenServiceEnableIntroDoSDefense . (: 200) HiddenServiceEnableIntroDoSRatePerSec NUM . 0 HiddenServiceEnableIntroDoSDefense . (: 25) (rate) . (burst) . 25 200 ( 3 HiddenServiceNumIntroductionPoints ) 25 200 1 (burst) . 200 1 25 8 (200/25) . . . tor . (rendezvous circuits) . . (proof-of-work) . : HiddenServicePoWDefensesEnabled 0|1 DoS (proof-of-work) . 1 () tor . . . (: 0) HiddenServicePoWQueueRate NUM . . 0 . (: 250) HiddenServicePoWQueueBurst NUM (burst) . (: 2500) : CompiledProofOfWorkHash 0|1|auto DoS (hash) . 1 ( ) . 0 . . (: auto) --list-modules (proof of work) "pow" ..SH " (DIRECTORY AUTHORITY SERVER OPTIONS)" (directory authority) Tor . (relay) (exit server) Tor . AuthoritativeDirectory 0|1 1 Tor . (cache) . . BridgeAuthoritativeDir 0|1 AuthoritativeDirectory Tor (server descriptors) (networkstatus) . (: 0) V3AuthoritativeDirectory 0|1 AuthoritativeDirectory Tor dir-spec.txt torspec ( Tor 0.2.0.x ). AuthDirBadExit AddressPattern... . AuthDirListBadExits (bad exits) . ( (exit policies) "accept" "reject" .) AuthDirMiddleOnly AddressPattern... . AuthDirListMiddleOnly - (middle-only) . AuthDirFastGuarantee N bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBits . Fast . (: 100 KBytes) AuthDirGuardBWGuarantee N bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBits . Guard . (: 2 MBytes) AuthDirHasIPv6Connectivity 0|1 . 0 OR IPv6 . 1 OR IPv6 OR IPv4 . IPv6 ORPort Running . IPv6 ORPort Running (: 0) (consensus) AuthDirHasIPv6Connectivity : AuthDirHasIPv6Connectivity 1 IPv6 ORPort . AuthDirHasIPv6Connectivity 1 IPv6 ORPort . -IPv4 Running . IPv6 ORPort AuthDirHasIPv6Connectivity 1 IPv6 ORPort Running . IPv6 ORPort ( IPv6 ORPort not Running 75% AuthDirHasIPv6Connectivity 1 .) AuthDirInvalid AddressPattern... . "valid" . AuthDirListBadExits 0|1 . 1 . ( 1 .) AuthDirListMiddleOnly 0|1 . 1 . ( 1 "middle only" - .) AuthDirMaxServersPerAddr NUM . IP . " " "0" . (: 2) AuthDirPinKeys 0|1 . . Tor . (: 1) AuthDirReject AddressPattern... . OR . AuthDirRejectRequestsUnderLoad 0|1 ( ) 503 . . (: 1) AuthDirBadExitCCs CC,... AuthDirInvalidCCs CC,... AuthDirMiddleOnlyCCs CC,... AuthDirRejectCCs CC,... . (country codes) / . AuthDirSharedRandomness 0|1 . (shared random protocol). . () "shared-rand-participate" . (: 1) AuthDirTestEd25519LinkKeys 0|1 . 0 (probe) RSA Ed25519 "Running" . 0 Ed25519 not Running . (: 1) AuthDirTestReachability 0|1 . 1 . 0 Running . (: 1) AuthDirVoteGuard node,node,... Guard (uptime) . ExcludeNodes . AuthDirVoteGuardBwThresholdFraction FRACTION Guard Guard . (: 0.75) AuthDirVoteGuardGuaranteeTimeKnown N seconds|minutes|hours|days|weeks (Guard) . (: ) AuthDirVoteGuardGuaranteeWFU FRACTION (WFU) (Guard) . (: 0.98) AuthDirVoteStableGuaranteeMinUptime N seconds|minutes|hours|days|weeks (Stable) . (: ) AuthDirVoteStableGuaranteeMTBF N seconds|minutes|hours|days|weeks (MTBF) . (: ) BridgePassword Password HTTP (bridge authority) . << >> (bridge community) ( ) . (: ) ConsensusParams STRING STRING key=value Tor "params" (networkstatus vote) . . DirAllowPrivateAddresses 0|1 1 Tor "Address" . IP IP . Tor (exit policies) Exit . (: 0) GuardfractionFile FILENAME (V3 authoritative directories). guardfraction . (: ) MinMeasuredBWsForAuthToIgnoreAdvertised N . (: 500) MinUptimeHidServDirectoryV2 N seconds|minutes|hours|days|weeks . (: ) RecommendedClientVersions STRING STRING Tor . . RecommendedVersions . VersioningAuthoritativeDirectory . RecommendedServerVersions STRING STRING Tor . . RecommendedVersions . VersioningAuthoritativeDirectory . RecommendedVersions STRING STRING Tor . . : . VersioningAuthoritativeDirectory . MinimalAcceptedServerVersion STRING STRING Tor . . (: 0.4.7.0-alpha-dev) V3AuthDistDelay N seconds|minutes|hours (V3 authoritative directories). . . (: ) V3AuthNIntervalsValid NUM (V3 authoritative directories). (VotingIntervals) . (network partitioning) . . . (: 3) V3AuthUseLegacyKey 0|1 <<>> (legacy) . (compromise) . (: 0) V3AuthVoteDelay N seconds|minutes|hours (V3 authoritative directories). . . (: ) V3AuthVotingInterval N minutes|hours (V3 authoritative directories). . . . (: ) V3BandwidthsFile FILENAME (V3 authoritative directories). . . (: ) VersioningAuthoritativeDirectory 0|1 1 Tor Tor . . : RecommendedVersions RecommendedClientVersions RecommendedServerVersions. . tor . HiddenServiceDir . (PER SERVICE OPTIONS): HiddenServiceAllowUnknownPorts 0|1 1 rendezvous . ( 0 .) (: 0) HiddenServiceDir DIRECTORY DIRECTORY . . . DIRECTORY Tor . Sandbox Onion Service Tor . (: Tor DIRECTORY Tor DataDirectory . .) HiddenServiceDirGroupReadable 0|1 1 hostname . 0 . (: 0) Windows . HiddenServiceExportCircuitID protocol (onion service) . 'haproxy' . v3 . (: none) haproxy : Tor (header) . : "PROXY TCP6 fc00:dead:beef:4dad::ffff:ffff ::1 65535 42\r\n" << >> IPv6 . . IPv6 "fc00:dead:beef:4dad::AABB:CCDD" : global_circuit_id = (0xAA << 24) + (0xBB << 16) + (0xCC << 8) + 0xDD; 0xffffffff 4294967295 . control port Tor . control-spec.txt . HAProxy : https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt HiddenServiceOnionBalanceInstance 0|1 1 OnionBalance OnionBalance . Tor "ob_config" HiddenServiceDir : MasterOnionAddress onion OnionBalance ( wrxdvcaqpuzakbfww5sxs6r2uybczwijzfn2ezy2osaj7iox7kl7nhad.onion). HiddenServiceMaxStreams N () rendezvous. 65535 . ( 0 .) (: 0) HiddenServiceMaxStreamsCloseCircuit 0|1 1 HiddenServiceMaxStreams rendezvous . (: 0) HiddenServiceNumIntroductionPoints NUM (introduction points) . 20 . (: 3) HiddenServicePort VIRTPORT [TARGET] VIRTPORT . HiddenServiceDir . 127.0.0.1 TCP . addr port addr:port unix:path . ( IPv6 [addr]:port . Unix C .) VIRTPORT : VIRTPORT TARGET . - . HiddenServiceVersion 3 rendezvous . 3 . (: 3) (PER INSTANCE OPTIONS): HiddenServiceSingleHopMode 0|1 - (Non Anonymous) tor HiddenServiceSingleHopMode () rendezvous . ( .) tor Single Onion Service . Single Onion . Single Onion . : tor HiddenServiceSingleHopMode . Single Onion Service . Single Onion Services tor : IP . HiddenServiceSingleHopMode HiddenServiceNonAnonymousMode 1 . Single Onion tor HiddenServiceSingleHopMode SOCKSPort . tor . (: 0) HiddenServiceNonAnonymousMode 0|1 tor . HiddenServiceSingleHopMode . . Tor SOCKSPort "0". tor . (: 0) PublishHidServDescriptors 0|1 0 Tor rendezvous . Tor hidserv . (: 1) : "/authorized_clients/" . ".auth" ( "alice.auth" ) : :: : "descriptor". : "x25519". base32 ( x25519). . . tor . . onion . ".auth" tor SIGHUP . : onion (v3) ClientOnionAuthDir torrc . .auth_private onion ( 'bob_onion.auth_private'). /.auth_private : <56-char-onion-addr-without-.onion-part>:descriptor:x25519: : https://2019.www.torproject.org/docs/tor-onion-service.html.en#ClientAuthorization ..SH " (TESTING NETWORK OPTIONS)" Tor . TestingTorNetwork 0|1 Tor Tor . DirAuthorities . Tor . (: 0) DirAllowPrivateAddresses 1 EnforceDistinctSubnets 0 AuthDirMaxServersPerAddr 0 ClientBootstrapConsensusAuthorityDownloadInitialDelay 0 ClientBootstrapConsensusFallbackDownloadInitialDelay 0 ClientBootstrapConsensusAuthorityOnlyDownloadInitialDelay 0 ClientDNSRejectInternalAddresses 0 ClientRejectInternalAddresses 0 CountPrivateBandwidth 1 ExitPolicyRejectPrivate 0 ExtendAllowPrivateAddresses 1 V3AuthVotingInterval 5 minutes V3AuthVoteDelay 20 seconds V3AuthDistDelay 20 seconds TestingV3AuthInitialVotingInterval 150 seconds TestingV3AuthInitialVoteDelay 20 seconds TestingV3AuthInitialDistDelay 20 seconds TestingAuthDirTimeToLearnReachability 0 minutes MinUptimeHidServDirectoryV2 0 minutes TestingServerDownloadInitialDelay 0 TestingClientDownloadInitialDelay 0 TestingServerConsensusDownloadInitialDelay 0 TestingClientConsensusDownloadInitialDelay 0 TestingBridgeDownloadInitialDelay 10 TestingBridgeBootstrapDownloadInitialDelay 0 TestingClientMaxIntervalWithoutRequest 5 seconds TestingDirConnectionMaxStall 30 seconds TestingEnableConnBwEvent 1 TestingEnableCellStatsEvent 1 TestingAuthDirTimeToLearnReachability N seconds|minutes|hours (authority) Running . TestingTorNetwork . (: 30 minutes) TestingAuthKeyLifetime N seconds|minutes|hours|days|weeks|months Ed25519 TLS Link . (: 2 days) TestingAuthKeySlop N seconds|minutes|hours TestingBridgeBootstrapDownloadInitialDelay N . TestingTorNetwork . (: 0) TestingBridgeDownloadInitialDelay N ( ) . TestingTorNetwork . (: 10800) TestingClientConsensusDownloadInitialDelay N (consensuses) . TestingTorNetwork . (: 0) TestingClientDownloadInitialDelay N . TestingTorNetwork . (: 0) TestingClientMaxIntervalWithoutRequest N seconds|minutes . TestingTorNetwork . (: 10 minutes) TestingDirAuthVoteExit node,node,... Exit . ExcludeNodes . TestingTorNetwork . ExcludeNodes . TestingDirAuthVoteExitIsStrict 0|1 True (1) Exit TestingDirAuthVoteExit . TestingTorNetwork . TestingDirAuthVoteGuard node,node,... Guard . ExcludeNodes . TestingTorNetwork . TestingDirAuthVoteGuardIsStrict 0|1 True (1) Guard TestingDirAuthVoteGuard . TestingTorNetwork . TestingDirAuthVoteHSDir node,node,... HSDir DirPort . ExcludeNodes . TestingTorNetwork . TestingDirAuthVoteHSDirIsStrict 0|1 True (1) HSDir TestingDirAuthVoteHSDir DirPort . TestingTorNetwork . TestingDirConnectionMaxStall N seconds|minutes . TestingTorNetwork . (: 5 minutes) TestingEnableCellStatsEvent 0|1 Tor CELL_STATS . TestingTorNetwork . (: 0) TestingEnableConnBwEvent 0|1 Tor CONN_BW . TestingTorNetwork . (: 0) TestingLinkCertLifetime N seconds|minutes|hours|days|weeks|months X509 ed25519 . (: ) TestingLinkKeySlop N seconds|minutes|hours TestingMinExitFlagThreshold N KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBits (exit flag) . 4 KBytes . (: 0) TestingMinFastFlagThreshold N bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBits Fast. (consensus) TestingTorNetwork . (: 0.) TestingMinTimeToReportBandwidth N seconds|minutes|hours . . (: ) TestingServerConsensusDownloadInitialDelay N . TestingTorNetwork . (: 0) TestingServerDownloadInitialDelay N . TestingTorNetwork . (: 0) TestingSigningKeySlop N seconds|minutes|hours Ed25519 (: link auth signing.) TestingV3AuthInitialDistDelay N seconds|minutes|hours V3AuthDistDelay . TestingTorNetwork . (: ) TestingV3AuthInitialVoteDelay N seconds|minutes|hours V3AuthVoteDelay . TestingTorNetwork . (: ) TestingV3AuthInitialVotingInterval N seconds|minutes|hours V3AuthVotingInterval . TestingTorNetwork . (: ) TestingV3AuthVotingStartOffset N seconds|minutes|hours (offset) . TestingTorNetwork . (: 0) (NON-PERSISTENT OPTIONS) "SAVECONF" torrc . control-spec.txt 5.4 . . __ControlPort, __DirPort, __DNSPort, __ExtORPort, __NATDPort, __ORPort, __SocksPort, __TransPort (underscore) Port . SAVECONF torrc . Tor : SIGTERM Tor . SIGINT Tor SIGTERM Tor (listeners) . ( ShutdownWaitLength .) SIGHUP Tor ( ) . SIGUSR1 (throughput) . SIGUSR2 debug. SIGHUP . SIGCHLD Tor . SIGPIPE Tor . SIGXFSZ Tor . (FILES) /etc/tor/torrc . $HOME/.torrc (fallback) torrc /etc/tor/torrc . /var/lib/tor/ tor . CacheDirectory/cached-certs (directory authorities) Tor . CacheDirectory/cached-consensus / cached-microdesc-consensus (consensus) . CacheDirectory/cached-descriptors cached-descriptors.new (router) . (descriptor) . @ (annotations) . .new (append-only journal) cached-descriptors . CacheDirectory/cached-extrainfo cached-extrainfo.new cached-descriptors <> . (relays) . . DownloadExtraInfo . CacheDirectory/cached-microdescs cached-microdescs.new (microdescriptors) . @ . .new cached-microdescs . DataDirectory/state - . : o (entry guards) . o (bandwidth accounting). o o Tor o . DataDirectory/sr-state (Authority only). (shared-random-value) . CacheDirectory/diff-cache (Directory cache only). (diff) . - NUL . DataDirectory/bw_accounting state . ( ). DataDirectory/control_auth_cookie . (controller) . CookieAuthFile . . control-spec.txt torspec . DataDirectory/lock Tor . Tor . DataDirectory/key-pinning-journal . RSA1024 Ed25519 . Ed25519 RSA1024 . KeyDirectory/authority_identity_key v3 . Tor . tor-gencert . . KeyDirectory/authority_certificate . v3 . KeyDirectory/authority_signing_key . v3 . authority_certificate . KeyDirectory/legacy_certificate authority_certificate V3AuthUseLegacyKey . V3AuthUseLegacyKey . KeyDirectory/legacy_signing_key authority_signing_key V3AuthUseLegacyKey . V3AuthUseLegacyKey . KeyDirectory/secret_id_key RSA1024 . . KeyDirectory/ed25519_master_id_public_key Ed25519 . KeyDirectory/ed25519_master_id_secret_key Ed25519 . ed25519 . . Tor tor --keygen . KeyDirectory/ed25519_signing_secret_key Ed25519 . Ed25519 ( ) . KeyDirectory/ed25519_signing_cert "ed25519_signing_secret_key" Ed25519 . KeyDirectory/secret_onion_key secret_onion_key.old RSA1024 . ("TAP") . .old . KeyDirectory/secret_onion_key_ntor secret_onion_key_ntor.old Curve25519 . ("ntor") . .old . KeyDirectory/keyname.secret_family_key . . https://community.torproject.org/relay/setup/post-install/family-ids . DataDirectory/fingerprint . RSA . DataDirectory/fingerprint-ed25519 . ed25519 . DataDirectory/hashed-fingerprint . . ( .) DataDirectory/bridgelines . (pluggable transports) . DataDirectory/approved-routers . . RSA hex ed25519 base-64 . fingerprint DataDirectory tor . !reject . !invalid . !badexit BadExit Tor . !middleonly . ( .) DataDirectory/v3-status-votes v3. . CacheDirectory/unverified-consensus . CacheDirectory/unverified-microdesc-consensus (microdescriptor) . DataDirectory/unparseable-desc Tor . . DataDirectory/router-stability . (mean-time-between-failures) Stable . DataDirectory/stats/dirreq-stats . . DataDirectory/stats/entry-stats . Tor . DataDirectory/stats/bridge-stats . Tor . DataDirectory/stats/exit-stats . Tor . DataDirectory/stats/buffer-stats . . DataDirectory/stats/conn-stats . ( ) . DataDirectory/stats/hidserv-stats . (rendezvous) . DataDirectory/networkstatus-bridges (authoritative bridge directories) . . HiddenServiceDirectory/hostname .onion . . . "xyz.onion" (virtual-hosting) "www.xyz.onion" "irc.xyz.onion" . HiddenServiceDirectory/private_key . HiddenServiceDirectory/client_keys . HiddenServiceDirectory/onion_service_non_anonymous HiddenServiceNonAnonymousMode . (SEE ALSO) Tor https://www.torproject.org Tor https://spec.torproject.org . torsocks(1) torify(1) . (BUGS) Tor . https://bugs.torproject.org . Tor 06/25/2026 TOR(1)