Not able to create private V3 onion service

Question

I'm trying to secure my onion service running on my VPS node. I followed the steps of the official tor guide and this guide. Everything works fine UNTIL I get to the point where I have to modify the torrc file on my local machine.

In the tor guide it says:

On the client side: To access a version 3 onion service with client authorization as a client, make sure you have ClientOnionAuthDir set in your torrc. For example, add this line to /etc/tor/torrc:

ClientOnionAuthDir /var/lib/tor/onion_auth

Then, in the directory, create an .auth_private file for the onion service corresponding to this key. [...] Then restart tor and you should be able to connect to the onion service address.

However, I am NOT able to restart tor... I added the line ClientOnionAuthDir /var/lib/tor/onion_auth to the end of the torrc file (is that right or do I have to put it someplace else?).

When I try to restart tor I get the following error:

Job for tor.service failed because the control process exited with error code.
See "systemctl status tor.service" and "journalctl -xeu tor.service" for details.

When I take a look at systemctl status tor.service I get the following:

× tor.service - Anonymizing overlay network for TCP
     Loaded: loaded (/usr/lib/systemd/system/tor.service; enabled; vendor pres>
     Active: failed (Result: exit-code) since XXX XXXX-XX-XX XX:XX:XX XXX; 2mi>
    Process: 67134 ExecStartPre=/usr/bin/tor -f /etc/tor/torrc --verify-config>
        CPU: 21ms

XXXXXXXXXXXXXXXX systemd[1]: tor.service: Scheduled restart job, restart>
XXXXXXXXXXXXXXXX systemd[1]: Stopped Anonymizing overlay network for TCP.
XXXXXXXXXXXXXXXX systemd[1]: tor.service: Start request repeated too qui>
XXXXXXXXXXXXXXXX systemd[1]: tor.service: Failed with result 'exit-code'.
XXXXXXXXXXXXXXXX systemd[1]: Failed to start Anonymizing overlay network>

When I remodify the torrc and remove the ClientOnionAuthDir option and restart tor, it's running fine.

Can anybody help me out here? What do I have to do differently concerning the ClientOnionAuthDir?

Additional information: I realized, that I have two .onion addresses: one in the /var/lib/tor/USER/hostname file and I get displayed another one when I run the getnetworkinfo command. Is this how it should be?

THANKS IN ADVANCE!

Answer 1

If you're positive your /var/lib/tor/onion_auth/zerotobtc.auth_private file on your client is correct (a single line, containing: {replace-with-your-onion-url-without-the-extension}:descriptor:x25519:{replace-with-your-base32-encoded-private-key}) then the most likely reason it isn't working is your file permissions aren't allowing Tor to read the file. Try sudo chmod 700 -R /var/lib/tor/onion_auth and try again; if that works, then you just need to adjust your permissions more carefully to allow Tor to access the file.

As far as which .onion address is correct to use: yes, you will have 2 addresses, but you only need to pay attention to one. I think getnetworkinfo is meant for the Bitcoin P2P protocol (port 8333) - the P2P hidden service must be public (no client authentication), and I'd suggest you just let Bitcoin automatically configure its own temporary hidden service (which is the address getnetworkinfo gives you). You can ignore this address, I think it changes regularly anyways so there's no need to look it up, it's just the address your node is using to talk to the Bitcoin network and there's not much worth changing on it.

Your node's RPC interface (usually port 8332) is what you should secure with Tor client auth. Use the /var/lib/tor/USER/hostname address for the RPC interface; these addresses saved in the /var/lib/tor folder are permanent and won't change unless you explicitly change them. Make sure you saved your client auth public key in /var/lib/tor/USER/authorized_clients/zerotobtc.auth, in the format descriptor:x25519:{replace-with-your-base32-encoded-public-key}, and again make sure your permissions are correct.