[privoxy-users] Reverse DNS Lookups?

[icmp30]

TOR questions should be directed to the onion router mailing list - I've added
them to the cc: list

I've just installed Privoxy and am using the Tor plugin on Firefox on a
Windows XP machine. I installed it after coming across a reference to
it, and whilst I don't fully understand it, my gut feeling is that it is
a 'good thing'.
Having installed Privoxy and enabled Tor, I quite expected remote web
sites to be unable to identify my machine with reverse DNS lookup - my
real IP address being hidden by Privoxy, but I find this is not so. On
visiting grc.com I find that my machine identification can still be
recovered.

grc.com is good enough to tell if you've got things configured correctly, but
it isn't a very good test site. I just tried it & they didn't display my real
IP adddress. A better test site is
http://metasploit.com/research/misc/decloak/ that one can find my real IP
address if I leave enough plugins enabled.

I thought that the whole point of Privoxy/Tor was to give the
user anonymity, including their real IP address.

Are you sure that you've got Firefox configured correctly? Click on
Tools/Options and then Advanced/Network/Settings. Make sure "Manual Proxy
Configuration" is selected. Enter 127.0.0.1 port 8118 for the http host & port
and make sure that "Use this proxy server for all protocols" is checked.

Are you sure that you've got Privoxy configured correctly? Somewhere in the
main config file you need to have a line like this
forward-socks4a / 127.0.0.1:9050 .
to tell Privoxy to forward all traffic to TOR

I obviously misunderstand Privoxy/Tor and would be grateful for an
explanation!

I think your browser and/or privoxy is not configured correctly. Once you
straighten out the configuration issues then you get to deal with the problem
of plug-ins leaking info. I don't know where the Tor group is with that.. but
it seems like the only resolution is to disable all plugins. I've been reading
things about running your browser session inside a virtual machine that sends
all of the network traffic through Tor but I don't if or how well that works.

Hope this helps..



____________________________________________________________________________________
Fussy? Opinionated? Impossible to please? Perfect. Join Yahoo!'s user panel and lay it on us. http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7

[Roger Dingledine]

Post by icmp30

I obviously misunderstand Privoxy/Tor and would be grateful for an
explanation!

I think your browser and/or privoxy is not configured correctly. Once you
straighten out the configuration issues then you get to deal with the problem
of plug-ins leaking info. I don't know where the Tor group is with that..

See https://tor.eff.org/download#Warning (item #2).

Post by icmp30
but
it seems like the only resolution is to disable all plugins.

Right. The dev version of Torbutton does this by default:
https://torbutton.torproject.org/dev/

Post by icmp30
I've been reading
things about running your browser session inside a virtual machine that sends
all of the network traffic through Tor

Right. See for example JanusVM or Xerobank VM. (Actually, rather than
running the browser inside the VM, some people think the better approach
is to run the Tor client in the VM and handle the network there too.)

Alternatively, you can redirect your network traffic through Tor directly
with iptables/pf on Linux/BSD, using the TransPort feature that tup
helped add:
http://wiki.noreply.org/noreply/TheOnionRouter/TransparentProxy

Post by icmp30
but I don't if or how well that works.

Quite so. One day one of them will write a clear set of documentation for
how to configure the VM and associated apps, what security properties
they aim to get, etc, and then people will have a chance to judge how
well the implementations match up with the design goals. I am optimistic
that this approach will turn out to be the right way to run a Tor client
for people who a) need to stay on Windows and b) have the horsepower
for the extra VM layer. But there are still some missing steps.

--Roger

[Someone User]

I want to use transparent proxying with iptables, but running sniffer,
iptraf or IDS from local DNS not desireable: I view connection to entry
node,
but DNS resolve will be visiblble on the Exit node.

Is it possible for some users, or root (UID=0) use provider DNS?

like this:

iptables -t nat -A OUTPUT-m owner --uid-owner $NON_TOR_USER_UID -j RETURN

before:

iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 53

or any better idea?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/tor-talk/attachments/20071015/f00ddf36/attachment.htm>