Table of Contents

Following Tor Project's onion-location header documentation, Ubuntu 20.04 LTS AppArmor was preventing yawnbox.com's v3 onionsite to work. Tor Browser was saying "We can’t connect to the server..." when trying to connect.

sudo tail -f /var/log/kern.log

Apr 4 13:29:37 yawnbox kernel: [239228.849923] audit: type=1400 audit(1617568177.174:59): apparmor="DENIED" operation="connect" profile="system_tor" name="/run/tor-hs-my-website.sock" pid=8229 comm="tor" requested_mask="wr" denied_mask="wr" fsuid=112 ouid=0

Per the log, I had to add an AppArmor exception:

sudo vim /etc/apparmor.d/system_tor

Add this line to the bottom, above the last bracket:

/run/tor-hs-my-website.sock wr,

Restart AppArmor:

sudo service apparmor restart

Additional security headers

In addition to the security headers mentioned in Tor Project's documentation for the nginx onionsite server, I use the same security headers for all three nginx servers in /etc/nginx/sites-available/default:

        server_tokens off;
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header Referrer-Policy "no-referrer";

Have any suggestions to make this better? Get in touch.

yawnbox