<p>If you're positive your <code>/var/lib/tor/onion_auth/zerotobtc.auth_private</code> file on your client is correct (a single line, containing: <code>{replace-with-your-onion-url-without-the-extension}:descriptor:x25519:{replace-with-your-base32-encoded-private-key}</code>) then the most likely reason it isn't working is your file permissions aren't allowing Tor to read the file. Try <code>sudo chmod 700 -R /var/lib/tor/onion_auth</code> and try again; if that works, then you just need to adjust your permissions more carefully to allow Tor to access the file.</p>
<p>As far as which .onion address is correct to use: yes, you will have 2 addresses, but you only need to pay attention to one. I think <code>getnetworkinfo</code> is meant for the Bitcoin P2P protocol (port 8333) - the P2P hidden service must be public (no client authentication), and I'd suggest you just let Bitcoin automatically configure its own temporary hidden service (which is the address <code>getnetworkinfo</code> gives you). You can ignore this address, I think it changes regularly anyways so there's no need to look it up, it's just the address your node is using to talk to the Bitcoin network and there's not much worth changing on it.</p>
<p>Your node's RPC interface (usually port 8332) is what you should secure with Tor client auth. Use the <code>/var/lib/tor/USER/hostname</code> address for the RPC interface; these addresses saved in the <code>/var/lib/tor</code> folder are permanent and won't change unless you explicitly change them. Make sure you saved your client auth public key in <code>/var/lib/tor/USER/authorized_clients/zerotobtc.auth</code>, in the format <code>descriptor:x25519:{replace-with-your-base32-encoded-public-key}</code>, and again make sure your permissions are correct.</p>

CC BY-SA 4.0
2022-01-04T23:29:05.323Z
2022-01-04T23:29:05.323Z
ieatpizza
<p>I'm trying to secure my onion service running on my VPS node. I followed the steps of the <a href="https://community.torproject.org/onion-services/advanced/client-auth/" rel="nofollow noreferrer">official tor guide</a> and <a href="https://matt.traudt.xyz/posts/creating-private-v3-FgbdRTFr/" rel="nofollow noreferrer">this guide</a>. Everything works fine UNTIL I get to the point where I have to modify the torrc file on my local machine.</p>
<p>In the tor guide it says:</p>
<blockquote>
<p>On the client side: To access a version 3 onion service with client
authorization as a client, make sure you have <code>ClientOnionAuthDir</code> set
in your <code>torrc</code>. For example, add this line to <code>/etc/tor/torrc</code>:</p>
<p><code>ClientOnionAuthDir /var/lib/tor/onion_auth</code></p>
<p>Then, in the
 directory, create an <code>.auth_private</code> file for the
onion service corresponding to this key. [...]
Then restart tor and you should be able to connect to the onion service address.</p>
</blockquote>
<p>However, I am NOT able to restart tor... I added the line <code>ClientOnionAuthDir /var/lib/tor/onion_auth</code> to the end of the torrc file (is that right or do I have to put it someplace else?).</p>
<p>When I try to restart tor I get the following error:</p>
<pre><code>Job for tor.service failed because the control process exited with error code.
See &quot;systemctl status tor.service&quot; and &quot;journalctl -xeu tor.service&quot; for details.
</code></pre>
<p>When I take a look at <code>systemctl status tor.service</code> I get the following:</p>
<pre><code>× tor.service - Anonymizing overlay network for TCP
     Loaded: loaded (/usr/lib/systemd/system/tor.service; enabled; vendor pres&gt;
     Active: failed (Result: exit-code) since XXX XXXX-XX-XX XX:XX:XX XXX; 2mi&gt;
    Process: 67134 ExecStartPre=/usr/bin/tor -f /etc/tor/torrc --verify-config&gt;
        CPU: 21ms

XXXXXXXXXXXXXXXX systemd[1]: tor.service: Scheduled restart job, restart&gt;
XXXXXXXXXXXXXXXX systemd[1]: Stopped Anonymizing overlay network for TCP.
XXXXXXXXXXXXXXXX systemd[1]: tor.service: Start request repeated too qui&gt;
XXXXXXXXXXXXXXXX systemd[1]: tor.service: Failed with result 'exit-code'.
XXXXXXXXXXXXXXXX systemd[1]: Failed to start Anonymizing overlay network&gt;

</code></pre>
<p>When I remodify the torrc and remove the <code>ClientOnionAuthDir</code> option and restart tor, it's running fine.</p>
<p>Can anybody help me out here? What do I have to do differently concerning the <code>ClientOnionAuthDir</code>?</p>
<p><em><strong>Additional information:</strong> I realized, that I have two .onion addresses: one in the <code>/var/lib/tor/USER/hostname</code> file and I get displayed another one when I run the <code>getnetworkinfo</code> command. Is this how it should be?</em></p>
<p>THANKS IN ADVANCE!</p>

CC BY-SA 4.0
2021-12-16T07:19:05.097Z
@Prayank I know they are not required. But I want to know how I can add an extra layer of security by requiring a password (or a private/public key in this case) for anyone who wants to connect to the hidden service...
zerotobtc
<full-node><nodes><tor>
Not able to create private V3 onion service
zerotobtc
# Not able to create private V3 onion service

(Asked by: username_0 on 2021-12-15)

I'm trying to secure my onion service running on my VPS node. I followed the steps of the [official tor guide](https://community.torproject.org/onion-services/advanced/client-auth/) and [this guide](https://matt.traudt.xyz/posts/creating-private-v3-FgbdRTFr/). Everything works fine UNTIL I get to the point where I have to modify the torrc file on my local machine.

In the tor guide it says:

> On the client side: To access a version 3 onion service with client
> authorization as a client, make sure you have `ClientOnionAuthDir` set
> in your `torrc`. For example, add this line to `/etc/tor/torrc`:
>
> `ClientOnionAuthDir /var/lib/tor/onion_auth`
>
> Then, in the
> directory, create an `.auth_private` file for the
> onion service corresponding to this key. [...]
> Then restart tor and you should be able to connect to the onion service address.

However, I am NOT able to restart tor... I added the line `ClientOnionAuthDir /var/lib/tor/onion_auth` to the end of the torrc file (is that right or do I have to put it someplace else?).

When I try to restart tor I get the following error:

```
Job for tor.service failed because the control process exited with error code.
See "systemctl status tor.service" and "journalctl -xeu tor.service" for details.

```

When I take a look at `systemctl status tor.service` I get the following:

```
× tor.service - Anonymizing overlay network for TCP
     Loaded: loaded (/usr/lib/systemd/system/tor.service; enabled; vendor pres>
     Active: failed (Result: exit-code) since XXX XXXX-XX-XX XX:XX:XX XXX; 2mi>
    Process: 67134 ExecStartPre=/usr/bin/tor -f /etc/tor/torrc --verify-config>
        CPU: 21ms

XXXXXXXXXXXXXXXX systemd[1]: tor.service: Scheduled restart job, restart>
XXXXXXXXXXXXXXXX systemd[1]: Stopped Anonymizing overlay network for TCP.
XXXXXXXXXXXXXXXX systemd[1]: tor.service: Start request repeated too qui>
XXXXXXXXXXXXXXXX systemd[1]: tor.service: Failed with result 'exit-code'.
XXXXXXXXXXXXXXXX systemd[1]: Failed to start Anonymizing overlay network>

```

When I remodify the torrc and remove the `ClientOnionAuthDir` option and restart tor, it's running fine.

Can anybody help me out here? What do I have to do differently concerning the `ClientOnionAuthDir`?

***Additional information:** I realized, that I have two .onion addresses: one in the `/var/lib/tor/USER/hostname` file and I get displayed another one when I run the `getnetworkinfo` command. Is this how it should be?*

THANKS IN ADVANCE!

**Tags:** full-node, nodes, tor

> **Comments:**
> **username_0**: @Prayank I know they are not required. But I want to know how I can add an extra layer of security by requiring a password (or a private/public key in this case) for anyone who wants to connect to the hidden service...  

---

## 1 answers

### Answer by username_1 on 2022-01-04. Score: 1 | Accepted answer

If you're positive your `/var/lib/tor/onion_auth/username_0.auth_private` file on your client is correct (a single line, containing: `{replace-with-your-onion-url-without-the-extension}:descriptor:x25519:{replace-with-your-base32-encoded-private-key}`) then the most likely reason it isn't working is your file permissions aren't allowing Tor to read the file. Try `sudo chmod 700 -R /var/lib/tor/onion_auth` and try again; if that works, then you just need to adjust your permissions more carefully to allow Tor to access the file.

As far as which .onion address is correct to use: yes, you will have 2 addresses, but you only need to pay attention to one. I think `getnetworkinfo` is meant for the Bitcoin P2P protocol (port 8333) - the P2P hidden service must be public (no client authentication), and I'd suggest you just let Bitcoin automatically configure its own temporary hidden service (which is the address `getnetworkinfo` gives you). You can ignore this address, I think it changes regularly anyways so there's no need to look it up, it's just the address your node is using to talk to the Bitcoin network and there's not much worth changing on it.

Your node's RPC interface (usually port 8332) is what you should secure with Tor client auth. Use the `/var/lib/tor/USER/hostname` address for the RPC interface; these addresses saved in the `/var/lib/tor` folder are permanent and won't change unless you explicitly change them. Make sure you saved your client auth public key in `/var/lib/tor/USER/authorized_clients/username_0.auth`, in the format `descriptor:x25519:{replace-with-your-base32-encoded-public-key}`, and again make sure your permissions are correct.


---

