August 2018 - tor-commits - lists.torproject.org

[webwml/staging] faq: add ipv6 wiki resources (#20045)
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit cf9c6cf300e9796341c45480577d1e97ad8af534 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Mon Aug 20 13:57:44 2018 +0200 faq: add ipv6 wiki resources (#20045) --- docs/en/faq.wml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/en/faq.wml b/docs/en/faq.wml index 1856a193..1dc41104 100644 --- a/docs/en/faq.wml +++ b/docs/en/faq.wml @@ -2111,8 +2111,11 @@ the program iptables (for *nix) useful. ClientUseIPv6 1 </pre> <p> - Note that as of 2018 there aren't many IPv6 users, or IPv6 guards, so - Tor over IPv6 is less anonymous than Tor over IPv4. + Note that as of 2018 there aren't many IPv6 users, or IPv6 guards, so Tor over IPv6 + is less anonymous than Tor over IPv4. You can review the IPv6 implemetation status at our + <a href="https://trac.torproject.org/projects/tor/wiki/org/roadmaps/Tor/IPv6Features">IPv6Features</a> + wiki page, known issues can be found with the + <a href="https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~ipv6">ipv6 keyword</a>. </p> <hr>

1 0

[webwml/staging] onion services: add v3 manual from wiki (fixes #24880)
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit d52ef8ebd4f4ad9514abfaebd99d8f01083adde9 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Sun Aug 19 23:25:31 2018 +0200 onion services: add v3 manual from wiki (fixes #24880) --- docs/en/tor-onion-service.wml | 124 ++++++++++++++++++++++++++++++++++++++---- 1 file changed, 112 insertions(+), 12 deletions(-) diff --git a/docs/en/tor-onion-service.wml b/docs/en/tor-onion-service.wml index 8fc9e894..7ef903e1 100644 --- a/docs/en/tor-onion-service.wml +++ b/docs/en/tor-onion-service.wml @@ -134,8 +134,9 @@ <pre> HiddenServiceDir C:\Users\username\Documents\tor\hidden_service HiddenServicePort 80 127.0.0.1:8080 </pre> - <p>Note that since 0.2.6, both <var>SocksPort</var> and <var>HiddenServicePort</var> support Unix sockets. - This means that you can point the <var>HiddenServicePort</var> to a Unix socket:</p> + <p>Note that since 0.2.6, both <var>SocksPort</var> and <var>HiddenServicePort</var> + support Unix sockets. This means that you can point the <var>HiddenServicePort</var> + to a Unix socket:</p> <pre> HiddenServiceDir /Library/Tor/var/lib/tor/hidden_service/ HiddenServicePort 80 unix:/path/to/socket @@ -199,8 +200,8 @@ service, just add more <var>HiddenServicePort</var> lines. If you want to run multiple onion services from the same Tor client, just add another <var>HiddenServiceDir</var> line. All the following - <var>HiddenServicePort</var> lines refer to this <var>HiddenServiceDir</var> line, until - you add another <var>HiddenServiceDir</var> line: + <var>HiddenServicePort</var> lines refer to this <var>HiddenServiceDir</var> + line, until you add another <var>HiddenServiceDir</var> line: </p> <pre> @@ -212,13 +213,13 @@ HiddenServicePort 22 127.0.0.1:22 </pre> - <p>Onion services operators need to practice proper operational security - and system administration to maintain security. For some security - suggestions please make sure you read over Riseup's <a - href="https://help.riseup.net/en/security/network-security/tor/onionservices-best…">"Tor - Hidden (Onion) Services Best Practices" document</a>. Also, here are some - more anonymity issues you should keep in mind: - + <p>Onion services operators need to practice proper + <a href="https://trac.torproject.org/projects/tor/wiki/doc/OperationalSecurity"> + operational security</a> and system administration to maintain security. + For some security suggestions please make sure you read over Riseup's + <a href="https://help.riseup.net/en/security/network-security/tor/onionservices-best…"> + "Tor Hidden (Onion) Services Best Practices" document</a>. + Also, here are some more anonymity issues you should keep in mind: </p> <ul> <li>As mentioned above, be careful of letting your web server reveal @@ -238,7 +239,13 @@ <p>Another common issue is whether to use HTTPS on your relay or not. Have a look at this <a - href="https://blog.torproject.org/blog/facebook-hidden-services-and-https-certs">post</a> on the Tor Blog to learn more about these issues. + href="https://blog.torproject.org/blog/facebook-hidden-services-and-https-certs">post</a> + on the Tor Blog to learn more about these issues. + </p> + + <p>You can use <a href="https://stem.torproject.org">stem</a> to + <a href="https://stem.torproject.org/tutorials/over_the_river.html"> + automate the management of your onion services</a>. </p> <p>Finally, feel free to use the <a @@ -246,6 +253,99 @@ mailing list</a> to discuss the secure administration and operation of Tor onion services.</p> + <hr> + <a id="four"></a> + <h2><a class="anchor" href="#four">Step Four: Set up next-gen (v3) onions</a></h2> + <br> + + <p>Since Tor 0.3.2 and + <a href="https://blog.torproject.org/tor-browser-75a5-released">Tor Browser + 7.5.a5</a> 56 bit long v3 onion addresses are supported and should be used + instead. This newer version of onion services ("v3") features many + improvements over the legacy system: + </p> + <ul> + <li>Better crypto (replaced SHA1/DH/RSA1024 with SHA3/ed25519/curve25519)</li> + <li>Improved directory protocol, leaking much less information to directory servers.</li> + <li>Improved directory protocol, with smaller surface for targeted attacks.</li> + <li>Better onion address security against impersonation.</li> + <li>More extensible introduction/rendezvous protocol.</li> + <li>A cleaner and more modular codebase.</li> + </ul> + <p>For details see + <a href="https://trac.torproject.org/projects/tor/wiki/doc/HiddenServiceNames"> + Why are v3 onions better?</a>. You can identify a next-generation onion + address by its length: they are 56 characters long, as in + <var>4acth47i6kxnvkewtm6q7ib2s3ufpo5sqbsnzjpbi7utijcltosqemad.onion</a>. + + The specification for next gen onion services can be found + <a href="https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt"> + here</a>. + </p> + + <h3>How to setup your own prop224 service</h3> + + <p>It's easy! Just use your <a href"#two">regular onion service</a> torrc + and add <var>HiddenServiceVersion 3</var> in your onion service torrc block. + Here is an example torrc designed for testing: + </p> + <pre> +SocksPort auto + +HiddenServiceDir /home/user/tmp/hsv3 +HiddenServiceVersion 3 +HiddenServicePort 6667 127.0.0.1:6667 + </pre> + <p>Then your onion address is in <var>/home/user/tmp/hsv3/hostname</var>. + To host both a v2 and a v3 service using two onion service torrc blocks: + </p> + <pre> +HiddenServiceDir /home/user/tmp/hsv2 +HiddenServicePort 6667 127.0.0.1:6667 + +HiddenServiceDir /home/user/tmp/hsv3 +HiddenServiceVersion 3 +HiddenServicePort 6668 127.0.0.1:6667 + </pre> + + <p>Please note that tor is strict about directory permissions and does not + like to share its files. Make sure to restrict read and write access to the + onion services directory before restarting tor. For most linux based systems you can use: + </p> + <pre>chmod 700 -R /var/lib/tor</pre> + + <p>To restart tor it's safer to not use SIGHUP directly (see bug + <a href="https://trac.torproject.org/projects/tor/ticket/21818">#21818</a>), + but to check the validity of the config first. On Debian based systems the + services management tool does this for you:</p> + <pre> + service tor restart + </pre> + + <h3>How to help the next-gen onion development</h3> + + <p>Please let us know if you find any bugs! + We are still in testing & development stage so things are very liquid and + in active development. If you want to help with development, check out the list of + <a href="https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~pro…"> + open prop224 bugs</a>. + </p> + + <p>For researchers our wiki page + <a href="https://trac.torproject.org/projects/tor/wiki/doc/OnionServiceNamingSystems"> + Onion Service Naming Systems</a> could be of value. If you are more of the bug + hunting type, please check our code and spec for errors and inaccuracies. + We would be thrilled to know about them! + </p> + + <p>For debugging and to send us more helpful log files, turn on info logging: + </p> + <pre> +SafeLogging 0 +Log notice file /home/user/tmp/hs/hs.log +Log info file /home/user/tmp/hs/hsinfo.log + </pre> + </div>  <div id = "sidecol">

1 0

[webwml/staging] faq: minor html fix (</li>)
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit a8c0bfc2c95f63e99ee132e16ab9c1787231932e Author: traumschule <traumschuleriebau(a)riseup.net> Date: Sun Aug 19 01:59:05 2018 +0200 faq: minor html fix (</li>) --- docs/en/faq.wml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/docs/en/faq.wml b/docs/en/faq.wml index fca9170d..2778485f 100644 --- a/docs/en/faq.wml +++ b/docs/en/faq.wml @@ -121,8 +121,7 @@ unsafe?</a></li> <li><a href="#DoesntWork">Tor is running, but it's not working correctly.</a></li> <li><a href="#TorCrash">My Tor keeps crashing.</a></li> - <li><a href="#ChooseEntryExit">Can I control which nodes (or -country) + <li><a href="#ChooseEntryExit">Can I control which nodes (or country) are used for entry/exit?</a></li> <li><a href="#FirewallPorts">My firewall only allows a few outgoing ports.</a></li> @@ -136,7 +135,7 @@ country) different computer than my applications.</a></li> <li><a href="#ServerClient">Can I install Tor on a central server, and have my clients connect to it?</a></li> - <li><a href="#IPv6">How do I use Tor from an IPv6 only host/computer?</a><li> + <li><a href="#IPv6">How do I use Tor from an IPv6 only host/computer?</a></li> </ul> <a id="relay"></a>

1 0

[webwml/staging] docs/faq: add note on IPv6-only hosts (fixes #20045)
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit 6396b10b3c14ace9094b3e2da35dd0314cc19f7a Author: traumschule <traumschuleriebau(a)riseup.net> Date: Sun Aug 19 01:37:36 2018 +0200 docs/faq: add note on IPv6-only hosts (fixes #20045) --- docs/en/faq.wml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docs/en/faq.wml b/docs/en/faq.wml index f9f9431a..fca9170d 100644 --- a/docs/en/faq.wml +++ b/docs/en/faq.wml @@ -136,6 +136,7 @@ country) different computer than my applications.</a></li> <li><a href="#ServerClient">Can I install Tor on a central server, and have my clients connect to it?</a></li> + <li><a href="#IPv6">How do I use Tor from an IPv6 only host/computer?</a><li> </ul> <a id="relay"></a> @@ -2100,6 +2101,14 @@ client/relay, instead of the server only being an optional proxy, you may find the program iptables (for *nix) useful. </p> + <a id="IPv6"></a> + <h3><a class="anchor" href="#IPv6">How do I use Tor from an IPv6 only host/computer?</a></h3> + <p>IPv6 is supported since Tor version 0.2.8.x or newer. To activate it add the following two entries into your torrc file: + <pre> + ClientUseIPv4 0 + ClientUseIPv6 1 + </pre> + <hr> <a id="RunningATorRelay"></a>

1 0

[webwml/staging] onion services: add TOC
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit 768f3cf2a1486222ac15a8c2024d22e67accf604 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Sun Aug 19 23:36:26 2018 +0200 onion services: add TOC --- docs/en/tor-onion-service.wml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/docs/en/tor-onion-service.wml b/docs/en/tor-onion-service.wml index 2fb77e8d..4f7929c7 100644 --- a/docs/en/tor-onion-service.wml +++ b/docs/en/tor-onion-service.wml @@ -11,7 +11,8 @@ </div> <div id="maincol"> <h1>Configuring Onion Services for <a href="<page index>">Tor</a></h1> - <hr> + + <hr /> <p>Tor allows clients and relays to offer onion services. That is, you can offer a web server, SSH server, etc., without revealing your @@ -32,6 +33,15 @@ </p> <hr> + <ul> + <li><a href="#zero">Step Zero: Get Tor working</a></li> + <li><a href="#one">Step One: Install a web server locally</a></li> + <li><a href="#two">Step Two: Configure your onion service</a></li> + <li><a href="#three">Step Three: More advanced tips</a></li> + <li><a href="#four">Step Four: Set up next-gen (v3) onions</a></li> + </ul> + <hr> + <a id="zero"></a> <h2><a class="anchor" href="#zero">Step Zero: Get Tor working</a></h2> <br>

1 0

[webwml/staging] download-unix: update OpenBSD install instructions (fixes #27231)
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit d2dbc95388f335527b4aac744bd32ce0dc2fb154 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Tue Aug 21 04:48:42 2018 +0200 download-unix: update OpenBSD install instructions (fixes #27231) --- download/en/download-unix.wml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/download/en/download-unix.wml b/download/en/download-unix.wml index 1993b47f..70d5ab79 100644 --- a/download/en/download-unix.wml +++ b/download/en/download-unix.wml @@ -62,7 +62,7 @@ <tr> <td align="center"><img src="$(IMGROOT)/distros/openbsd.png" alt="OpenBSD"></td> <td>OpenBSD</td> -<td colspan="2"><kbd>cd /usr/ports/net/tor && make && make install</kbd></td> +<td colspan="2"><kbd>pkg_add tor</kbd></td> <td> <a href="<page docs/tor-doc-unix>">Linux/BSD/Unix</a><br> <a href="<wiki>doc/OpenbsdChrootedTor">Guide to chrooting Tor in OpenBSD</a>

1 0

[webwml/staging] Remove strange characters
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit 0379553e11606db5ae70eda00aed109a8af99420 Author: hiro <hiro(a)torproject.org> Date: Wed Aug 22 12:00:48 2018 +0200 Remove strange characters --- docs/en/tor-onion-service.wml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/en/tor-onion-service.wml b/docs/en/tor-onion-service.wml index 4319ad3c..e17270c4 100644 --- a/docs/en/tor-onion-service.wml +++ b/docs/en/tor-onion-service.wml @@ -273,7 +273,7 @@ <h2><a class="anchor" href="#four">Step Four: Set up next-gen (v3) onions</a></h2> <br> - <p>Since Tor 0.3.2 and + <p>Since Tor 0.3.2 and <a href="https://blog.torproject.org/tor-browser-75a5-released">Tor Browser 7.5.a5</a> 56 bit long v3 onion addresses are supported and should be used instead. This newer version of onion services ("v3") features many @@ -292,7 +292,7 @@ Why are v3 onions better?</a>. You can identify a next-generation onion address by its length: they are 56 characters long, as in <var>4acth47i6kxnvkewtm6q7ib2s3ufpo5sqbsnzjpbi7utijcltosqemad.onion</a>. - + The specification for next gen onion services can be found <a href="https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt"> here</a>. @@ -300,7 +300,7 @@ <h3>How to setup your own prop224 service</h3> - <p>It's easy! Just use your <a href"#two">regular onion service</a> torrc + <p>It's easy! Just use your <a href"#two">regular onion service</a> torrc and add <var>HiddenServiceVersion 3</var> in your onion service torrc block. Here is an example torrc designed for testing: </p>

1 0

[webwml/staging] faq: add recommendation to not mess with the path (fixes #13843)
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit c10a4de4bf763721bfabffdf41d930bffa89ac55 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Tue Aug 21 06:10:54 2018 +0200 faq: add recommendation to not mess with the path (fixes #13843) --- docs/en/faq.wml | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/docs/en/faq.wml b/docs/en/faq.wml index d3e9300b..3287072d 100644 --- a/docs/en/faq.wml +++ b/docs/en/faq.wml @@ -262,6 +262,8 @@ packets, so people can't block the exits.</a></li> <li><a href="#ChoosePathLength">You should let people choose their path length.</a></li> + <li><a href="#ChoosePathCountries">You should change path selection to avoid + entering and exiting from the same country.</a></li> <li><a href="#SplitEachConnection">You should split each connection over many paths.</a></li> <li><a href="#MigrateApplicationStreamsAcrossCircuits">You should migrate @@ -4061,7 +4063,34 @@ best way to attack Tor is to attack the endpoints and ignore the middle <hr> -<a id="SplitEachConnection"></a> + <a id="ChoosePathCountries"></a> + <h3><a class="anchor" href="#ChoosePathCountries">You should change path + selection to avoid entering and exiting from the same country.</a></h3> + + <p> + It is better to not manually change the path. This could have unforeseen + consquences and you'll probably screw it up, we don't understand it very + well either. + </p> + + <p> + There are many attacks and adversaries that Tor is trying to defend against + at once, and constraining paths has surprising trickle-down effects on the + other attacks (e.g. if I see where you exit then I know where you *didn't* + enter, thus reducing your entropy, sometimes by a surprising amount + depending on what path constraints are choosen). + </p> + + <p> + In general, changing Tor's path selection makes your client look different + from other clients. Picking your entry and exit in different countries is + not a good defence, because it only defends against adversaries that are + unable to rent servers in other countries. + </p> + + <hr> + + <a id="SplitEachConnection"></a> <h3><a class="anchor" href="#SplitEachConnection">You should split each connection over many paths.</a></h3>

1 0

[webwml/staging] faq: add note on weaker anonymity for IPv6 (#20045)
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit 791da14f0c15fe8487d263caa517dce557aca279 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Sun Aug 19 03:08:35 2018 +0200 faq: add note on weaker anonymity for IPv6 (#20045) --- docs/en/faq.wml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/docs/en/faq.wml b/docs/en/faq.wml index 2778485f..1856a193 100644 --- a/docs/en/faq.wml +++ b/docs/en/faq.wml @@ -2102,11 +2102,18 @@ the program iptables (for *nix) useful. <a id="IPv6"></a> <h3><a class="anchor" href="#IPv6">How do I use Tor from an IPv6 only host/computer?</a></h3> - <p>IPv6 is supported since Tor version 0.2.8.x or newer. To activate it add the following two entries into your torrc file: + <p> + IPv6 is supported since Tor version 0.2.8.x or newer. To activate it add + the following two entries into your torrc file: + </p> <pre> ClientUseIPv4 0 ClientUseIPv6 1 </pre> + <p> + Note that as of 2018 there aren't many IPv6 users, or IPv6 guards, so + Tor over IPv6 is less anonymous than Tor over IPv4. + </p> <hr>

1 0

[webwml/staging] onion services: mention web servers
by hiro＠torproject.org 27 Aug '18

27 Aug '18

commit d23e1408f51187ef16dadca987f739bbf62e0d7c Author: traumschule <traumschuleriebau(a)riseup.net> Date: Sun Aug 19 23:31:21 2018 +0200 onion services: mention web servers --- docs/en/tor-onion-service.wml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/en/tor-onion-service.wml b/docs/en/tor-onion-service.wml index 7ef903e1..2fb77e8d 100644 --- a/docs/en/tor-onion-service.wml +++ b/docs/en/tor-onion-service.wml @@ -56,9 +56,11 @@ <br> <p> - First, you need to set up a web server locally. Setting up a web - server can be complex. We're not going to cover how to set up a web - server here. If you get stuck or want to do more, find a friend who + First, you need to set up a web server locally, for example nginx or + lighttpd (apache is not the best option for anomymity, see + <a href="#three">Step Three</a> below). + Setting up a web server can be complex. We're not going to cover how to set + up a web server here. If you get stuck or want to do more, find a friend who can help you. We recommend you install a new separate web server for your onion service, since even if you already have one installed, you may be using it (or want to use it later) for a normal website.

1 0