1. Enable Automatic Software Updates
One of the most important things to keep your relay secure is to install security updates timely and ideally automatically so you can not forget about it.
Follow the instructions to enable automatic software updates for your operating system.
2. Bootstrap pkg
This article assumes we have already a base installation of FreeBSD running, and only the base system (here, we are running 12.2-RELEASE).
That means we do not have any packages installed, or even the pkg
packages manager itself (there's no sudo
available - we are running commands as root).
To bootstrap and install pkg
we should run the following command:
# pkg bootstrap
# pkg update -f
2.1. Recommended Steps to Setup pkg
To follow upstream updates in a "faster way" we recommend changing the 'quarterly' branch used by pkg
to its 'latest' branch.
One additional step is to prefer using HTTPS to fetch our packages, and updates - so here we also need an extra package to help us out (ca_root_nss).
Installing the ca_root_nss
package:
# pkg install ca_root_nss
We are keeping the original setting used by pkg
but setting a new one that will override it.
So we set up a new directory, and then create a configuration file to override what we need.
This configuration file will be /usr/local/etc/pkg/repos/FreeBSD.conf
.
Creating the new directory:
# mkdir -p /usr/local/etc/pkg/repos
This is how the new configuration file /usr/local/etc/pkg/repos/FreeBSD.conf
must look like:
FreeBSD: {
url: pkg+https://pkg.freebsd.org/${ABI}/latest
}
After applying all these changes, we update the packages list again and try to check if there's already a new update to apply:
# pkg update -f
# pkg upgrade -y -f
3. Package installation
Install tor
FreeBSD's package.
Here we can choose to install the latest stable version, like:
# pkg install tor
... or install an alpha release:
# pkg install tor-devel
4. Configuration file
Put the configuration file /usr/local/etc/tor/torrc
in place:
Nickname myNiceRelay # Change "myNiceRelay" to something you like
ContactInfo your@e-mail # Write your e-mail and be aware it will be published
ORPort 443 # You might use a different port, should you want to
ExitRelay 0
SocksPort 0
Log notice syslog
5. Enable net.inet.ip.random_id
# echo "net.inet.ip.random_id=1" >> /etc/sysctl.conf
# sysctl net.inet.ip.random_id=1
6. Start the service
Here we set tor
to start at boot time and use the setuid feature, in order to bind to lower ports like 443 (the daemon itself will still run as a regular non-privileged user).
# sysrc tor_setuid=YES
# sysrc tor_enable=YES
# service tor start
7. Final Notes
If you are having trouble setting up your relay, have a look at our help section.
If your relay is now running, check out the post-install notes.