search

StreisandEffect / streisand

Streisand sets up a new server running your choice of WireGuard, OpenConnect, OpenSSH, OpenVPN, Shadowsocks, sslh, Stunnel, or a Tor bridge. It also generates custom instructions for all of these services. At the end of the run you are given an HTML file with instructions that can be shared with friends, family members, and fellow activists.
https://twitter.com/streisandvpn
Other
23.16k stars 2k forks source link

Ubuntu 14.04 obfproxy config with tor-bridge timeout issue #88

Closed thundr closed 8 years ago

thundr commented 9 years ago

After running the ansible playbook with the args "ansible-playbook -i ../inventory -kK -s -vvvv -u midas streisand.yml", the playbook seems to run well with no issues, until it hits the task "tor-bridge | Wait until obfsproxy information has shown up in the state file". This times out.

sshing into the server and running "obfsproxy managed" crashes with the error "pyptlib.config.EnvError: neither TORPT{SERVER,CLIENT}_TRANSPORTS set"

System running playbook and system being configured are both 14.04.

Quick fix? Or is this part of larger issues that are on the roadmap for later on?

EDIT: After reading issues, this is an inherent Ubuntu/Tor conflict. Waiting for support!

jlund commented 9 years ago

The quick fix is to comment out the tor-bridge role in streisand.yml and run the playbook again. Tor with obfsproxy pluggable transports doesn't work properly on Ubuntu 14.04. It works on Debian 7 (the officially supported distribution) and on Ubuntu 12.04. The speculation that I read a while ago was that it had something to do with new AppArmor profiles that are present in 14.04. After you comment it out, all of the other services should work just fine.

I need to check into this again and see what's new. Streisand ultimately has to work on Ubuntu 14.04 in order to support Azure because Microsoft doesn't offer Debian. So it's on my radar and I'll figure out a workaround of some sort. Completely losing obfsproxy would be a shame though, and I'm hoping there's an elegant solution.

thundr commented 9 years ago

After more research, there seems to be a workaround Here

However, it doesn't seem to be working for me even with adding PUx instead of Ux. Indeed, the apparmor service doesn't start properly with the proposed fix for me unless the rule is PUx. At some point in the future, I assume obfsproxy will come with apparmor profiles.

jlund commented 9 years ago

That's my hope too. There was a recent update on the progress in the issue you linked to. As soon as a fix is ready, I am leaning towards making the necessary adjustments so Ubuntu 14.04 is the foundation for Streisand moving forward.

jlund commented 8 years ago

This has been completed as part of #174.