March 2021 - tor-commits - lists.torproject.org

[community/staging] Use wget instead of curl.
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 1882f3ea3d3a67ad752da03fbbc9a5687d7173b6 Author: gus <gus(a)torproject.org> Date: Thu Oct 15 23:01:07 2020 -0400 Use wget instead of curl. --- .../onion-services/advanced/onion-location/contents.lr | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/content/onion-services/advanced/onion-location/contents.lr b/content/onion-services/advanced/onion-location/contents.lr index ae3fbeb..6808c37 100644 --- a/content/onion-services/advanced/onion-location/contents.lr +++ b/content/onion-services/advanced/onion-location/contents.lr @@ -186,17 +186,14 @@ Or, open the web site in Tor Browser and a purple pill will appear in the addres ### Caddy -Caddy features [automatic HTTPS](https://caddyserver.com/docs/automatic-https) -by default, so it provisions your TLS certificate and takes care of -HTTP-to-HTTPS redirection for you. If you're using Caddy 2, to include an -Onion-Location header, add the following declaration in your Caddyfile: +Caddy features [automatic HTTPS](https://caddyserver.com/docs/automatic-https) by default, so it provisions your TLS certificate and takes care of HTTP-to-HTTPS redirection for you. +If you're using Caddy 2, to include an Onion-Location header, add the following declaration in your Caddyfile: ``` header Onion-Location http://<your-onion-address>.onion{path} ``` -If you're running a static site and have the onion address in a `$TOR_HOSTNAME` -environment variable, your Caddyfile will look like this: +If you're running a static site and have the onion address in a `$TOR_HOSTNAME` environment variable, your Caddyfile will look like this: ``` your-website.tld @@ -208,11 +205,10 @@ file_server **Testing it out:** Test it out with: -``` -curl --head https://your-website.tld -``` + $ wget --server-response --spider your-website.tld -and look for the `onion-location` line. +Look for `onion-location` entry and the onion service address. +Or, open the web site in Tor Browser and a purple pill will appear in the address bar. ### Using an HTML `<meta>` attribute

1 0

[community/staging] fixed path of favicon images
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit e069d90ca2d3d6858c7f10686530783301e52616 Author: Kim Le <kle2(a)student.unimelb.edu.au> Date: Wed Oct 14 13:20:18 2020 +1100 fixed path of favicon images --- templates/meta.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/meta.html b/templates/meta.html index e839d36..a265687 100644 --- a/templates/meta.html +++ b/templates/meta.html @@ -4,7 +4,7 @@ <link rel="stylesheet" href="{{ '/static/css/bootstrap.css'|asseturl }}"> <link rel="stylesheet" href="{{ '/static/fonts/fontawesome/css/all.min.css'|asseturl }}" rel="stylesheet">  -<link rel="icon" type="image/x-icon" href="{{ '/static/images/favicon/favicon.ico'|asseturl }}"> +<link rel="icon" type="image/x-icon" href="{{ '/static/images/favicon.ico'|asseturl }}">  -<link rel="icon" type="image/png" href="{{ '/static/images/favicon/favicon.png'|asseturl }}"> +<link rel="icon" type="image/png" href="{{ '/static/images/favicon.png'|asseturl }}"> <title>{{ _("Tor Project") }} | {% block title %}{{ this.title }}{% endblock %}</title>

1 0

[community/staging] Changed keyweb.de conditions
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 50dc8ad10cd42bfd46e0fdc1dc36b7bcbad6fcdc Author: Tom Matt <beather(a)posteo.net> Date: Fri Aug 21 12:55:15 2020 +0000 Changed keyweb.de conditions --- content/relay-operations/community-resources/good-bad-isps/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/community-resources/good-bad-isps/contents.lr b/content/relay-operations/community-resources/good-bad-isps/contents.lr index 61ff218..dfef1a1 100644 --- a/content/relay-operations/community-resources/good-bad-isps/contents.lr +++ b/content/relay-operations/community-resources/good-bad-isps/contents.lr @@ -88,7 +88,7 @@ For network diversity and stronger anonymity, you should avoid providers and cou | [Weesly](http://weesly.de) | - | Yes | Yes | Yes | Note that you should let them know about your intention when ordering a server or in advance. | 06/2013 | | [EUServ](http://euserv.de) | - | - | Yes | No | They have a bad support, but if you know how to maintain your server, this ISP is a good choice. | - | | [IPX-Server](https://www.ipx-server.de/) | - | Yes | Yes | - | - | - | -| [Keyweb](https://www.keyweb.de/) | - | - | Yes | Yes | - | - | +| [Keyweb](https://www.keyweb.de/) | - | - | No | No | "Unfortunately this is not possible with us." | 2020 | | [Afterburst](http://afterburst.com) | - | - | Yes | No | - | - | | [myLoc Managed IT](https://myloc.de) | AS31010, AS24961 | Yes | Yes | No | - | 2018-10-25 | | [linevast](https://www.linevast.de/) | - | Yes | Yes | Yes | Only allowed on dedicated servers | 13/11/2015 |

1 0

[community/staging] Add tor-onions mailing list and why setup a separate webserver
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 07d636dad7fed03d3a3d062902ef0fb6fbdb280b Author: gus <gus(a)torproject.org> Date: Tue Dec 8 13:24:45 2020 -0500 Add tor-onions mailing list and why setup a separate webserver --- content/onion-services/setup/contents.lr | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/onion-services/setup/contents.lr b/content/onion-services/setup/contents.lr index 50fed1c..b872eaf 100644 --- a/content/onion-services/setup/contents.lr +++ b/content/onion-services/setup/contents.lr @@ -33,10 +33,10 @@ You should also know where Tor's configuration files are. As a first step, you should set up a web server locally, like Nginx, Apache, or your favorite web server. Setting up a web server can be complex. -If you get stuck or want to do more, find a friend who can help you or connect with any of the forums online that offer help. +If you get stuck or want to do more, find a friend who can help you or join our [tor-onions](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-onion… mailing list to speak with other operators. As an example, we will cover how to set up an onion site with Nginx and Apache on Debian. -We recommend you install a new separate web server for your onion service. +We recommend you install a new separate web server for your onion service, since even if you already have one installed, you may be using it (or want to use it later) for a regular website. On this page, the commands to manage the web server are based on Debian-like operating systems and may differ from other systems. Check your web server and operating system documentation.

1 0

[community/staging] Add new onion services images. Fix #152
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 80623c484a325f45036e2f6ded98988336434730 Author: gus <gus(a)torproject.org> Date: Wed Dec 9 21:58:26 2020 -0500 Add new onion services images. Fix #152 --- .../onion-services/overview/onion-service-01.png | Bin 0 -> 152528 bytes .../onion-services/overview/onion-service-02.png | Bin 0 -> 119489 bytes .../onion-services/overview/onion-service-03.png | Bin 0 -> 141765 bytes .../onion-services/overview/onion-service-04.png | Bin 0 -> 159940 bytes .../onion-services/overview/onion-service-05.png | Bin 0 -> 172457 bytes .../onion-services/overview/onion-service-06.png | Bin 0 -> 147472 bytes .../onion-services/overview/onion-service-07.png | Bin 0 -> 137636 bytes .../onion-services/overview/onion-service-08.png | Bin 0 -> 137909 bytes .../onion-services/overview/onion-service-09.png | Bin 0 -> 125387 bytes .../overview/tor-onion-services-1.png | Bin 17222 -> 0 bytes .../overview/tor-onion-services-4.png | Bin 21419 -> 0 bytes content/onion-services/overview/contents.lr | 101 ++++++++++++--------- 12 files changed, 57 insertions(+), 44 deletions(-) diff --git a/assets/static/images/onion-services/overview/onion-service-01.png b/assets/static/images/onion-services/overview/onion-service-01.png new file mode 100755 index 0000000..cd92201 Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-01.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-02.png b/assets/static/images/onion-services/overview/onion-service-02.png new file mode 100755 index 0000000..d50c0ad Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-02.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-03.png b/assets/static/images/onion-services/overview/onion-service-03.png new file mode 100755 index 0000000..e551d9c Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-03.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-04.png b/assets/static/images/onion-services/overview/onion-service-04.png new file mode 100755 index 0000000..7f68c8a Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-04.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-05.png b/assets/static/images/onion-services/overview/onion-service-05.png new file mode 100755 index 0000000..5e8ba7a Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-05.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-06.png b/assets/static/images/onion-services/overview/onion-service-06.png new file mode 100755 index 0000000..cb59f60 Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-06.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-07.png b/assets/static/images/onion-services/overview/onion-service-07.png new file mode 100755 index 0000000..ad20f47 Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-07.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-08.png b/assets/static/images/onion-services/overview/onion-service-08.png new file mode 100755 index 0000000..34d4ba7 Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-08.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-09.png b/assets/static/images/onion-services/overview/onion-service-09.png new file mode 100755 index 0000000..062a158 Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-09.png differ diff --git a/assets/static/images/onion-services/overview/tor-onion-services-1.png b/assets/static/images/onion-services/overview/tor-onion-services-1.png deleted file mode 100644 index 75de366..0000000 Binary files a/assets/static/images/onion-services/overview/tor-onion-services-1.png and /dev/null differ diff --git a/assets/static/images/onion-services/overview/tor-onion-services-4.png b/assets/static/images/onion-services/overview/tor-onion-services-4.png deleted file mode 100644 index 88db970..0000000 Binary files a/assets/static/images/onion-services/overview/tor-onion-services-4.png and /dev/null differ diff --git a/content/onion-services/overview/contents.lr b/content/onion-services/overview/contents.lr index 1122aa1..1fa3c20 100644 --- a/content/onion-services/overview/contents.lr +++ b/content/onion-services/overview/contents.lr @@ -45,7 +45,6 @@ Is your network filtered and you can't open ports on your firewall? This could happen if you are in a university campus, an office, an airport, or pretty much anywhere. Onion services don't need open ports because they punch through NAT. They only establish outgoing connections. - ## The Onion Service Protocol: Overview Now the question becomes **what kind of protocol is needed to achieve all these properties?** @@ -56,79 +55,93 @@ In particular, an onion service's address looks like this: `vww6ybal4bd7szmgncyr This looks weird and random because it's the _identity public key_ of the onion service. That's one of the reasons we can achieve the security properties above. -The onion service protocol uses the Tor network so that the client (Alice) can introduce itself to the service (Bob), and then set up a rendezvous point with the service over the Tor network. +The onion service protocol uses the Tor network so that the client can introduce itself to the service, and then set up a rendezvous point with the service over the Tor network. Here is a detailed breakdown of how this happens: ### Act 1: Where the onion service sets up its introduction points -![Onion Services: Step 1](/static/images/onion-services/overview/tor-onion-services-1.png) +Let's imagine that your local newspaper decides to set up an onion service (using [SecureDrop](https://securedrop.org/)) to receive anonymous tips. +As the first step in the protocol, the onion service will contact a bunch of Tor relays and ask them to act as its _introduction points_ by establishing long-term circuits to them. +These circuits are anonymized circuits, so the server does not reveal the service location to the introduction points. -As the first step in the protocol, Bob (the onion service) contacts a bunch of Tor relays and asks them to act as his _introduction points_, by establishing long-term circuits to them. -These circuits are anonymized circuits, so Bob does not reveal his locations to his introduction points. +The onion service will hide and protect itself behind the Tor network by only allowing access through three introduction points that it connects to through a three-hop Tor circuit. -As part of this step, Bob gives its introduction point a special "authentication key", so that if any clients come for introductions later the introduction point can use that key to match them to Bob. +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-01.png" alt="Onion Services: Step 1"> ### Act 2: Where the onion service publishes its descriptors -![Onion Services: Step 2](/static/images/onion-services/overview/tor-onion-services-2.png) - -Now that the introduction points are setup, we need to create a way for clients to be able to find them. +Now that the introduction points are set up, we need to create a way for clients to be able to find them. -For this reason, Bob assembles an _onion service descriptor_, containing a list of his introduction points (and their "authentication keys"), and signs this descriptor with his _identity private key_. +For this reason, the onion service assembles an _onion service descriptor_, containing a list of its introduction points (and "authentication keys"), and signs this descriptor with the onion service's _identity private key_. The _identity private key_ used here is the private part of the **public key that is encoded in the onion service address**. -Now, Bob uploads that signed descriptor to a _distributed hash table_ which is part of the Tor network, so that clients can also get it. -Bob uses an anonymized Tor circuit to do this upload, so that he does not reveal his location. +The onion service upload that signed descriptor to a _distributed hash table_, which is part of the Tor network, so that clients can also get it. +It uses an anonymized Tor circuit to do this upload so that it does not reveal its location. -### Act 3: Where a client wants to visit the onion service +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-02.png" alt="Onion Services: Step 2"> -All the previous steps were just setup for the onion service so that it's reachable by clients. -Now let's fast-forward to the point where an actual client wants to visit the service: +### Act 3: Where a client wants to visit the onion service -![Onion Services: Step 3](/static/images/onion-services/overview/tor-onion-services-3.png) +Say you want to anonymously send some tax fraud data to your local newspaper through its SecureDrop. +You find the onion address for the newspaper's SecureDrop from a public website or friend. -In this case, Alice (the client) has the onion address of Bob and she wants to visit it, so she connects to it with her Tor Browser. -Now the next thing that needs to happen is that Alice goes to the _distributed hash table_ from the step above, and ask for the signed descriptor of Bob. +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-03.png" alt="Onion Services: Step 3"> -When Alice receives the signed descriptor, she verifies the signature of the descriptor using the public key that is encoded in the onion address. -This provides the _end-to-end authentication_ security property, since we are now sure that this descriptor could only be produced by Bob and no one else. -And inside the descriptor there are the introduction points which allow Alice to introduce herself to Bob. +### Act 4: Where the client introduces itself to the onion service -### Act 4: Where the client establishes a rendezvous point +All the previous steps were just set up for the onion service so that it's reachable by clients. +Now let's fast-forward to the point where an actual client wants to visit the service. -Now before the introduction takes place, Alice picks a Tor relay and establishes a circuit to it. -Alice asks the relay to become her _rendezvous point_ and gives it an "one-time secret" that will be used as part of the rendezvous procedure. +In this case, the client has the onion address of SecureDrop and want to visit it, so they connect to the service with Tor Browser. +Now the next thing that needs to happen is that the client goes to the _distributed hash table_ from **Step 2** and ask for the signed descriptor of SecureDrop. -### Act 5: Where the client introduces itself to the onion service +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-04.png" alt="Onion Services: Step 4"> -![Onion Services: Step 4](/static/images/onion-services/overview/tor-onion-services-4.png) +### Act 5: Where the client verify onion address signature -Now, Alice goes ahead and connects to one of Bob's introduction points and introduces herself to Bob. -Through this introduction Bob learns Alice's choice of rendezvous point and the "one-time secret". +When the client receives the signed descriptor, they verify the signature of the descriptor using the public key that is encoded in the onion address. +This provides the _end-to-end authentication_ security property, since we are now sure that this descriptor could only be produced by that onion service and no one else. -### Act 6: Where the onion service rendezvous with the client +And inside the descriptor, there are the introduction points that allow the client to introduce themselves to SecureDrop. -![Onion Services: Step 5](/static/images/onion-services/overview/tor-onion-services-5.png) +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-05.png" alt="Onion Services: Step 5"> -In this last act, the onion service is now aware of Alice's rendezvous point. -The onion service connects to the rendezvous point (through an anonymized circuit) and sends the "one-time secret" to it. +### Act 6: Where the client establishes a rendezvous point + +Before the introduction takes place, the client (in this case, you) picks a Tor relay and establishes a circuit to it. +The client asks the relay to become their rendezvous point and give it an "one-time secret" that will be used as part of the rendezvous procedure. + +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-06.png" alt="Onion Services: Step 6"> + +### Act 7: Where the onion service rendezvous with the client + +The introduction point passes your details on to the onion service, which runs multiple verification processes to decide whether you're trustworthy or not. -Upon the rendezvous point receiving the "one-time secret" from Bob, it informs Alice that the connection has been **successfuly completed**, and now Alice and Bob can use this circuit to communicate with each other. +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-07.png" alt="Onion Services: Step 7"> + +### Act 8: Where the rendezvous point verifies the client's secret + +The onion service connects to the rendezvous point (through an anonymized circuit) and sends the "one-time secret" to it. The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa. -In general, the complete connection between client and onion service consists of 6 relays: 3 of them were picked by the client with the third being the rendezvous point and the other 3 were picked by the onion service. -This provides _location hiding_ to this connection: +The rendezvous point makes one final verification to match the secret strings from you and service (the latter also comes from you but has been relayed through the service). + +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-08.png" alt="Onion Services: Step 8"> + +### Act 9: Where the onion service rendezvous with the client + +In general, the complete connection between client and onion service consists of 6 relays: 3 of them were picked by the client, with the third being the rendezvous point, and the other 3 were picked by the onion service. +This provides _location hiding_ to this connection. + +Finally, using the rendezvous point, a Tor circuit is formed between you and your newspaper's SecureDrop onion service. -![Onion Services: Step 6](/static/images/onion-services/overview/tor-onion-services-6.png) +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-09.png" alt="Onion Services: Step 9"> ## Further resources -This was just a high-level overview of the Tor onion services protocol. Here are some more resources if you want to learn more: +This was just a high-level overview of the Tor onion services protocol. +Here are some more resources if you want to learn more: -- The original Tor design paper describing the original design: -https://svn.torproject.org/svn/projects/design-paper/tor-design.pdf -- The Tor v3 onion services protocol specification. -https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt -- Presentations about onion services -https://www.youtube.com/watch?v=VmsFxBEN3fc -https://www.youtube.com/watch?v=Di7qAVidy1Y +- The [Tor design paper](https://svn.torproject.org/svn/projects/design-paper/tor-design.pdf) describing the original design. +- The [Tor v3 onion services](https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt) protocol specification. +- Presentations about onion services: [Understanding Tor Onion Services and Their Use Cases - HOPE XI 2016](https://www.youtube.com/watch?v=VmsFxBEN3fc), [DEF CON 25 - Roger Dingledine - Next Generation Tor Onion Services](https://www.youtube.com/watch?v=Di7qAVidy1Y).

1 0

[community/staging] the systemd bypass advice applies only if setcap
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 935df8b1f5754870c720d6ac8b1e1ab3fce55e97 Author: Roger Dingledine <arma(a)torproject.org> Date: Sun Sep 6 23:50:16 2020 -0400 the systemd bypass advice applies only if setcap In its current location, the paragraph implies that you need to turn off NoNewPrivileges in order to run obfsproxy on any port, and I think you only need to run it if you're using a low port. --- .../relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr b/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr index 2633204..c820d2c 100644 --- a/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr +++ b/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr @@ -55,12 +55,12 @@ Don't forget to change the `ORPort`, `ServerTransportListenAddr`, `ContactInfo`, `sudo setcap cap_net_bind_service=+ep /usr/bin/obfs4proxy` + To work around systemd hardening, you will also need to set `NoNewPrivileges=no` in `/lib/systemd/system/tor(a)default.service` and `/lib/systemd/system/tor@.service` and then run `systemctl daemon-reload`. For more details, see [ticket 18356](https://gitlab.torproject.org/tpo/core/tor/-/issues/18356). + * Note that both Tor's OR port and its obfs4 port must be reachable. If your bridge is behind a firewall or NAT, make sure to open both ports. You can use [our reachability test](https://bridges.torproject.org/scan/) to see if your obfs4 port is reachable from the Internet. -You will also need to set `NoNewPrivileges=no` in `/lib/systemd/system/tor(a)default.service` and `/lib/systemd/system/tor@.service` and then run `systemctl daemon-reload`. (see [bug #18356](https://trac.torproject.org/projects/tor/ticket/18356)) - ### 4. Restart tor `systemctl restart tor`

1 0

[community/staging] Fix htaccess issue #171
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 6e73830f04c5fd88af3c7d9f97ab95c924d9f23b Author: gus <gus(a)torproject.org> Date: Wed Nov 18 15:58:46 2020 -0500 Fix htaccess issue #171 --- .htaccess | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.htaccess b/.htaccess index 7da81c3..893b7b1 100644 --- a/.htaccess +++ b/.htaccess @@ -19,4 +19,4 @@ RewriteRule ^ga-IE/(.*) /ga$1 [R=302,L] # but don't have a community page # You can see them at https://dist.torproject.org/torbrowser/, pick the last alpha for the most languages # this languages are the translation priority for the community portal! -RewriteRule ^(ar|ca|cs|da|de|el|fa|fr|ga|he|hu|id|is|it|ja|ka|ko|lt|mk|ms|nb-NO|nl|pl|pt-BR|pt-PT|ro|ru|sv-SE|th|tr|vi|zh-CN|zh-TW)(.*) /$2 [R=302,L] +RewriteRule ^(ar|ca|cs|da|de|el|fa|fr|ga|he|hu|id|is|it|ja|ka|ko|lt|mk|ms|nb-NO|nl|pl|pt-BR|pt-PT|ro|ru|sv-SE|th|tr|vi|zh-CN|zh-TW)/(.*) /$2 [R=302,L]

1 0

[community/staging] Update contents.lr Typing error correction
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 85620e3d0694f14c3bc204ef5f93e28710ae7b27 Author: Kaede <74188936+kaedech(a)users.noreply.github.com> Date: Mon Nov 30 20:01:47 2020 +0000 Update contents.lr Typing error correction (9 9.9.9.9) → (9.9.9.9) --- content/relay-operations/community-resources/bad-relays/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/community-resources/bad-relays/contents.lr b/content/relay-operations/community-resources/bad-relays/contents.lr index 7ccfca5..520a40d 100644 --- a/content/relay-operations/community-resources/bad-relays/contents.lr +++ b/content/relay-operations/community-resources/bad-relays/contents.lr @@ -15,7 +15,7 @@ A bad relay is one that either doesn't work properly or tampers with our users' * Tampering with exit traffic in any way (including dropping accepted connections). This might be accidental (such as an anti-virus filter) or malicious (commonly SSLStrip, which replaces https:// links with http:// to snoop on traffic) or even intentional (such as layer 7 inspection for P2P traffic detection/mitigation). * Running HSDirs that harvest and probe .onion addresses * Manipulating the DHT that is used for onion services, e.g., by positioning itself in the DHT. - * Using a DNS provider that censors its results (such as some [OpenDNS](http://www.opendns.com) or Quad (9 9.9.9.9) configurations). + * Using a DNS provider that censors its results (such as some [OpenDNS](http://www.opendns.com) or Quad (9.9.9.9) configurations). * Performing a [Sybil attack](https://en.wikipedia.org/wiki/Sybil_attack), which means flooding the network with new relays in an effort to deanonymize users. If you want to run multiple relays then that's great! But please be sure to set the [MyFamily parameter](https://www.torproject.org/docs/tor-manual.html.en#MyFamily). * Exit relays routing their exit traffic back into the tor network (not actually exiting any traffic)

1 0

[community/staging] Merge branch 'captcha'
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 5858da87d5d39692ee6e4efa48072be77a195e36 Merge: 2f66f49 1bd7c21 Author: gus <gus(a)torproject.org> Date: Tue Dec 15 17:44:00 2020 -0500 Merge branch 'captcha' content/gsoc/cloudflare-captcha-monitoring/contents.lr | 18 +++++++++--------- .../tor-abuse-templates/contents.lr | 12 ++++++------ 2 files changed, 15 insertions(+), 15 deletions(-) diff --cc content/relay-operations/community-resources/tor-abuse-templates/contents.lr index 483cb2c,6b4549e..1cd12f9 --- a/content/relay-operations/community-resources/tor-abuse-templates/contents.lr +++ b/content/relay-operations/community-resources/tor-abuse-templates/contents.lr @@@ -100,10 -100,10 +100,10 @@@ https://check.torproject.org/cgi-bin/To In general however, we believe that problems like this are best solved by improving the service to defend against the attack from the Internet at large. - Scraping and robot activity can be reduced/slowed by captchas, which is the approach taken by Gmail for this same problem. - In fact, Google provides a free captcha service, complete with code for easy inclusion in a number of systems to help other sites deal with this issue: https://code.google.com/apis/recaptcha/intro.html + Scraping and robot activity can be reduced/slowed by Captchas, which is the approach taken by Gmail for this same problem. + In fact, Google provides a free Captcha service, complete with code for easy inclusion in a number of systems to help other sites deal with this issue: https://code.google.com/apis/recaptcha/intro.html -Slow DoS attacks [aimed to consume the Apache MaxClients limit](http://www.guerilla-ciso.com/archives/2049) can be alleviated by reducing the httpd.conf TimeOut and KeepAliveTimeout config values to 15-30 and raising the ServerLimit and MaxClients values to omething like 3000. +Slow DoS attacks [aimed to consume the Apache MaxClients limit](http://www.guerilla-ciso.com/archives/2049) can be alleviated by reducing the httpd.conf TimeOut and KeepAliveTimeout config values to 15-30 and raising the ServerLimit and MaxClients values to something like 3000. If this fails, DoS attempts can also be solved with iptables-based rate limiting solutions, load balancers such as nginx, and also IPS devices, but be aware that Internet traffic is not always uniform in quantity by IP, due to large corporate and even national outproxies, NATs, and services like Tor. http://kevin.vanzonneveld.net/techblog/article/block_brute_force_attacks_wi…

1 0

[community/staging] How to install tor. Fix #156.
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit eec5e527dae1da3e733f3e6c1a88a7d0382fce28 Author: gus <gus(a)torproject.org> Date: Tue Dec 8 09:05:06 2020 -0500 How to install tor. Fix #156. --- content/onion-services/setup/install/contents.lr | 105 +++++++++++++++++++++++ 1 file changed, 105 insertions(+) diff --git a/content/onion-services/setup/install/contents.lr b/content/onion-services/setup/install/contents.lr new file mode 100644 index 0000000..2796c55 --- /dev/null +++ b/content/onion-services/setup/install/contents.lr @@ -0,0 +1,105 @@ +section: onion services +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: How to install Tor +--- +subtitle: +--- +key: 1 +--- +cta: Get Started +--- +html: two-columns-page.html +--- +body: + +**Admin access:** To install Tor you need root privileges. +Below all commands that need to be run as root user like apt and dpkg are prepended with '#', while commands to be run as user with '$' resembling the standard prompt in a terminal. +To open a root terminal you have several options: sudo su, or sudo -i, or su -i. Note that sudo asks for your user password, while su expects the root password of your system. + +### macOS + +1. Install a package manager + +There are two package manager on OS X: Homebrew and Macports. +You can use the package manager of your choice. + +To install Homebrew follow the instructions on [brew.sh](https://brew.sh/). + +To install Macports follow the instructions on [macports.org/install.php](https://www.macports.org/install.php). + +2. Package installation + +If you are using Homebrew in a Terminal window, run: + + # brew install tor + +If you are using Macports in a Terminal window, run: + + $ sudo port install tor + +### Debian / Ubuntu + +**Do not use the packages in Ubuntu's universe**. +In the past they have not reliably been updated. That means you could be missing stability and security fixes. + +1. Configure Tor package repository + +Enable the Torproject package repository by following the [instructions](https://support.torproject.org/apt/tor-deb-repo/). + +2. Package installation + + # apt install tor + +### Fedora + +1. Configure Tor Package repository + +Add the following to /etc/yum.repos.d/tor.repo and then install the tor package. + +``` +[tor] +name=Tor for Fedora $releasever - $basearch +baseurl=https://rpm.torproject.org/fedora/$releasever/$basearch +enabled=1 +gpgcheck=1 +gpgkey=https://rpm.torproject.org/fedora/public_gpg.key +cost=100 +``` + +2. Package installation + + # dnf install tor + +### FreeBSD + +1. Package installation + + # pkg install tor + +### OpenBSD + +1. Package Installation + + # pkg_add tor + +### Installing Tor from source + +1. Download latest release and dependecies + +The latest release of Tor can be found on the [download](https://www.torproject.org/download/tor/) page. + +If you're building from source, first install [libevent](http://www.monkey.org/~provos/libevent/), and make sure you have openssl and zlib (including the -devel packages if applicable). + +2. Install Tor + + tar xzf tor-0.4.3.6.tar.gz; cd tor-0.4.3.6 + + ./configure && make + +Now you can run tor as src/app/tor (0.4.3.x and later), or you can run `make install` (as root if necessary) to install it into /usr/local/, and then you can start it just by running tor.

1 0