## ============================================================================
## Hardened torrc -- Pentesting + Privacy Configuration
## Place at: /etc/tor/torrc or ~/.torrc
## ============================================================================

## --- SOCKS PROXY ---
SocksPort 9050                              # default SOCKS5 port
SocksPort 9150                              # Tor Browser port

## Isolate circuits per destination (prevents correlation)
SocksPort 9050 IsolateDestAddr IsolateDestPort

## Additional isolated ports for specific tools
SocksPort 9060 IsolateDestAddr IsolateDestPort  # nmap
SocksPort 9070 IsolateDestAddr IsolateDestPort  # curl
SocksPort 9080 IsolateDestAddr IsolateDestPort  # browser

## --- DNS ---
DNSPort 5353                                # local DNS resolution through Tor
AutomapHostsOnResolve 1                     # auto-map .onion addresses
AutomapHostsSuffixes .onion,.exit           # suffixes to map

## --- CIRCUIT BEHAVIOR ---
CircuitBuildTimeout 30                      # timeout for circuit build (seconds)
LearnCircuitBuildTimeout 0                  # dont learn timeout (use fixed)
MaxCircuitDirtiness 600                     # new circuit every 10 minutes
NewCircuitPeriod 30                         # try new circuit every 30s if needed
NumEntryGuards 3                            # number of entry guards

## --- NODE SELECTION ---
## Exclude nodes in Five Eyes countries (comment out if not needed)
# ExcludeNodes {us},{gb},{ca},{au},{nz},{dk},{fr},{nl},{no},{de},{be},{it},{se},{es}
# ExcludeExitNodes {us},{gb},{ca},{au},{nz}
# StrictNodes 1                             # enforce exclusions strictly

## Prefer exit nodes in privacy-friendly countries
# ExitNodes {ch},{is},{ro},{md},{bg},{cz},{lu}

## --- BRIDGES (for censored networks) ---
## Uncomment and add bridge lines if Tor is blocked
# UseBridges 1
# ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy
# Bridge obfs4 <IP>:<PORT> <FINGERPRINT> cert=<CERT> iat-mode=0
# ClientTransportPlugin meek_lite exec /usr/bin/obfs4proxy
# Bridge meek_lite 0.0.2.0:2 url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com
# ClientTransportPlugin snowflake exec /usr/bin/snowflake-client -url https://snowflake-broker.torproject.net.global.prod.fastly.net/ -front cdn.sstatic.net

## --- LOGGING ---
Log notice file /var/log/tor/notices.log    # log to file
# Log notice stdout                        # or log to stdout

## --- HIDDEN SERVICES (client) ---
## For accessing .onion services
HiddenServiceStatistics 0                   # dont report HS stats

## --- SECURITY HARDENING ---
SafeSocks 1                                 # reject unsafe SOCKS requests
TestSocks 1                                 # log SOCKS connection test results
WarnPlaintextPorts 23,109,110,143           # warn on plaintext protocol ports
RejectPlaintextPorts 23,109,110,143         # reject plaintext connections
AvoidDiskWrites 1                           # minimize disk writes
DisableDebuggerAttachment 1                 # prevent debugger attachment
Sandbox 1                                   # enable seccomp sandbox (Linux only)
ProtocolWarnings 1                          # log anomalous protocol violations
RejectPlaintextSocksRequests 1              # force SOCKS5, reject SOCKS4/4a (leaks hostnames)

## --- BANDWIDTH ---
# RelayBandwidthRate 100 KBytes             # if running as relay
# RelayBandwidthBurst 200 KBytes
# AccountingMax 10 GBytes                   # monthly cap
# AccountingStart month 1 00:00

## --- CONTROL PORT (for stem/nyx monitoring) ---
# ControlPort 9051
# HashedControlPassword <generate with: tor --hash-password yourpassword>
# CookieAuthentication 1