tor-commits March 2021

tor-commits@lists.torproject.org

17 participants
2169 discussions

[community/staging] Add more featured onion sites. Fix #176
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 9bdf61fe93387bb5304e13527dcaef9f8e3ed390 Author: gus <gus(a)torproject.org> Date: Fri Dec 18 14:07:46 2020 -0500 Add more featured onion sites. Fix #176 --- assets/static/images/onions/png/bbc.png | Bin 0 -> 11312 bytes assets/static/images/onions/png/brave.png | Bin 0 -> 13285 bytes assets/static/images/onions/png/debian.png | Bin 0 -> 18153 bytes assets/static/images/onions/png/dw.png | Bin 0 -> 56986 bytes assets/static/images/onions/png/facebook.png | Bin 0 -> 96975 bytes assets/static/images/onions/png/fop.png | Bin 0 -> 4856 bytes .../images/onions/png/frontlinedefenders.png | Bin 0 -> 360818 bytes .../images/onions/png/privacyinternational.png | Bin 0 -> 532301 bytes assets/static/images/onions/png/qubesos.png | Bin 0 -> 30163 bytes assets/static/images/onions/png/riseup.png | Bin 0 -> 5141 bytes assets/static/images/onions/svg/fop.svg | 149 +++++++++++++++++++++ databags/onions.ini | 54 +++++++- 12 files changed, 201 insertions(+), 2 deletions(-) diff --git a/assets/static/images/onions/png/bbc.png b/assets/static/images/onions/png/bbc.png new file mode 100644 index 0000000..79b62a8 Binary files /dev/null and b/assets/static/images/onions/png/bbc.png differ diff --git a/assets/static/images/onions/png/brave.png b/assets/static/images/onions/png/brave.png new file mode 100644 index 0000000..448fe7b Binary files /dev/null and b/assets/static/images/onions/png/brave.png differ diff --git a/assets/static/images/onions/png/debian.png b/assets/static/images/onions/png/debian.png new file mode 100644 index 0000000..8696c4c Binary files /dev/null and b/assets/static/images/onions/png/debian.png differ diff --git a/assets/static/images/onions/png/dw.png b/assets/static/images/onions/png/dw.png new file mode 100644 index 0000000..777eade Binary files /dev/null and b/assets/static/images/onions/png/dw.png differ diff --git a/assets/static/images/onions/png/facebook.png b/assets/static/images/onions/png/facebook.png new file mode 100644 index 0000000..5dbdc75 Binary files /dev/null and b/assets/static/images/onions/png/facebook.png differ diff --git a/assets/static/images/onions/png/fop.png b/assets/static/images/onions/png/fop.png new file mode 100644 index 0000000..babf4f0 Binary files /dev/null and b/assets/static/images/onions/png/fop.png differ diff --git a/assets/static/images/onions/png/frontlinedefenders.png b/assets/static/images/onions/png/frontlinedefenders.png new file mode 100644 index 0000000..5523489 Binary files /dev/null and b/assets/static/images/onions/png/frontlinedefenders.png differ diff --git a/assets/static/images/onions/png/privacyinternational.png b/assets/static/images/onions/png/privacyinternational.png new file mode 100644 index 0000000..7d96a26 Binary files /dev/null and b/assets/static/images/onions/png/privacyinternational.png differ diff --git a/assets/static/images/onions/png/qubesos.png b/assets/static/images/onions/png/qubesos.png new file mode 100644 index 0000000..046c13a Binary files /dev/null and b/assets/static/images/onions/png/qubesos.png differ diff --git a/assets/static/images/onions/png/riseup.png b/assets/static/images/onions/png/riseup.png new file mode 100644 index 0000000..6f3ae3d Binary files /dev/null and b/assets/static/images/onions/png/riseup.png differ diff --git a/assets/static/images/onions/svg/fop.svg b/assets/static/images/onions/svg/fop.svg new file mode 100644 index 0000000..edd3b2d --- /dev/null +++ b/assets/static/images/onions/svg/fop.svg @@ -0,0 +1,149 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://creativecommons.org/ns#" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + version="1.1" + x="0px" + y="0px" + viewBox="0 0 563.7 85" + xml:space="preserve" + id="svg4547" + sodipodi:docname="Freedom of the Press Foundation logo.svg" + inkscape:version="0.92.1 r15371"><metadata + id="metadata4553"><rdf:RDF><cc:Work + rdf:about=""><dc:format>image/svg+xml</dc:format><dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /><dc:title></dc:title></cc:Work></rdf:RDF></metadata><defs + id="defs4551" /><sodipodi:namedview + pagecolor="#ffffff" + bordercolor="#666666" + borderopacity="1" + objecttolerance="10" + gridtolerance="10" + guidetolerance="10" + inkscape:pageopacity="0" + inkscape:pageshadow="2" + inkscape:window-width="1920" + inkscape:window-height="1017" + id="namedview4549" + showgrid="false" + inkscape:showpageshadow="false" + borderlayer="true" + inkscape:zoom="2.5545502" + inkscape:cx="281.85001" + inkscape:cy="42.5" + inkscape:window-x="-8" + inkscape:window-y="-8" + inkscape:window-maximized="1" + inkscape:current-layer="svg4547" /><rect + class="logo-rect" + width="84" + height="23" + id="rect4485" /><rect + class="logo-rect logo-rect--red" + x="92" + width="23" + height="23" + id="rect4487" + style="fill:#c70000;fill-opacity:1" /><rect + class="logo-rect" + x="46" + y="31" + width="69" + height="23" + id="rect4489" /><rect + class="logo-rect" + y="62" + width="115" + height="23" + id="rect4491" /><path + class="logo-heading-text" + d="M156.7,5h-16.8v10.5h14.3v4.7h-14.3v14.6h-5.2V0.3h22V5z" + id="path4493" /><path + class="logo-heading-text" + d="M175.4,0.3c6.5,0,10.7,4.2,10.7,10.1c0,4.9-3,8.1-6.9,9.1l7.9,15.2H181l-7.3-14.5h-6.5v14.5H162V0.3H175.4z M167.2,5v10.8 h7.7c3.5,0,5.9-2,5.9-5.4S178.5,5,175,5H167.2z" + id="path4495" /><path + class="logo-heading-text" + d="M214.8,5H198V15h14.3v4.7H198V30h16.8v4.7h-22V0.3h22V5z" + id="path4497" /><path + class="logo-heading-text" + d="M243,5h-16.8V15h14.3v4.7h-14.3V30H243v4.7h-22V0.3h22V5z" + id="path4499" /><path + class="logo-heading-text" + d="M261.3,0.3c4.3,0,7.4,1.4,9.8,4.4c2.5,3.1,2.6,7.4,2.6,12.9s-0.1,9.8-2.6,12.9c-2.4,3-5.5,4.4-9.8,4.4h-12.1V0.3H261.3z M254.4,5V30h6.3c2.5,0,4.5-0.6,5.9-2.3c1.7-1.9,1.8-5.1,1.8-10.2c0-5.1-0.1-8.3-1.8-10.2c-1.4-1.7-3.4-2.3-5.9-2.3H254.4z" + id="path4501" /><path + class="logo-heading-text" + d="M300.5,3.5c3.4,3.4,3.5,6.8,3.5,14s-0.1,10.6-3.5,14c-2.2,2.2-5.1,3.5-8.9,3.5c-3.8,0-6.7-1.3-8.9-3.5 c-3.4-3.4-3.5-6.8-3.5-14s0.1-10.6,3.5-14c2.2-2.2,5.1-3.5,8.9-3.5C295.4,0,298.3,1.3,300.5,3.5z M286.5,6.8c-1.7,1.8-2,3.9-2,10.7 c0,6.8,0.3,8.9,2,10.7c1.3,1.4,3,2.1,5.1,2.1s3.8-0.8,5.1-2.1c1.7-1.8,2-3.9,2-10.7c0-6.8-0.3-9-2-10.7c-1.3-1.4-3-2.1-5.1-2.1 S287.8,5.4,286.5,6.8z" + id="path4503" /><path + class="logo-heading-text" + d="M341.2,34.7h-5.2v-23L328,28.5h-3.9L316,11.7v23h-5.2V0.3h5.2l10.1,21.4l9.9-21.4h5.2V34.7z" + id="path4505" /><path + class="logo-heading-text logo-heading-text--gray" + d="M379.9,3.5c3.4,3.4,3.5,6.8,3.5,14s-0.1,10.6-3.5,14c-2.2,2.2-5.1,3.5-8.9,3.5s-6.7-1.3-8.9-3.5 c-3.4-3.4-3.5-6.8-3.5-14s0.1-10.6,3.5-14c2.2-2.2,5.1-3.5,8.9-3.5S377.7,1.3,379.9,3.5z M365.9,6.8c-1.7,1.8-2,3.9-2,10.7 c0,6.8,0.3,8.9,2,10.7c1.3,1.4,3,2.1,5.1,2.1s3.8-0.8,5.1-2.1c1.7-1.8,2-3.9,2-10.7c0-6.8-0.3-9-2-10.7c-1.3-1.4-3-2.1-5.1-2.1 S367.2,5.4,365.9,6.8z" + id="path4507" + style="fill:#7c7c7c;fill-opacity:1" /><path + class="logo-heading-text logo-heading-text--gray" + d="M412.2,5h-16.8v10.5h14.3v4.7h-14.3v14.6h-5.2V0.3h22V5z" + id="path4509" + style="fill:#7c7c7c;fill-opacity:1" /><path + class="logo-heading-text logo-heading-text--gray" + d="M449.3,5h-9.5v29.8h-5.2V5h-9.5V0.3h24.2V5z" + id="path4511" + style="fill:#7c7c7c;fill-opacity:1" /><path + class="logo-heading-text logo-heading-text--gray" + d="M478.8,34.7h-5.2v-15h-14v15h-5.2V0.3h5.2V15h14V0.3h5.2V34.7z" + id="path4513" + style="fill:#7c7c7c;fill-opacity:1" /><path + class="logo-heading-text logo-heading-text--gray" + d="M508.8,5h-16.8V15h14.3v4.7h-14.3V30h16.8v4.7h-22V0.3h22V5z" + id="path4515" + style="fill:#7c7c7c;fill-opacity:1" /><path + class="logo-heading-text" + d="M147.7,50.1c6.7,0,11,4.5,11,10.5s-4.3,10.4-11,10.4h-7.8v13.6h-5.2V50.1H147.7z M139.9,54.8v11.5h7.5 c3.7,0,6.1-2.1,6.1-5.7c0-3.7-2.4-5.8-6.1-5.8H139.9z" + id="path4517" /><path + class="logo-heading-text" + d="M177.5,50.1c6.5,0,10.7,4.2,10.7,10.1c0,4.9-3,8.1-6.9,9.1l7.9,15.2h-6.1L175.9,70h-6.5v14.5h-5.2V50.1H177.5z M169.4,54.8 v10.8h7.7c3.5,0,5.9-2,5.9-5.4s-2.4-5.4-5.9-5.4H169.4z" + id="path4519" /><path + class="logo-heading-text" + d="M216.9,54.8h-16.8v10.1h14.3v4.7h-14.3v10.3h16.8v4.7h-22V50.1h22V54.8z" + id="path4521" /><path + class="logo-heading-text" + d="M243.4,53.7l-3.3,3.3c-2.1-2-4.6-2.7-7.6-2.7c-4.1,0-6.2,2.2-6.2,5.4c0,1.3,0.3,2.4,1.3,3.2c0.9,0.8,1.9,1.3,3.8,1.5 l4.1,0.6c3.1,0.5,4.9,1.2,6.4,2.6c1.8,1.7,2.8,4.1,2.8,7.1c0,6.3-5.1,10.1-12.4,10.1c-5.2,0-8.9-1.2-12.2-4.5l3.4-3.4 c2.5,2.5,5.4,3.3,8.9,3.3c4.5,0,7.1-1.9,7.1-5.3c0-1.5-0.4-2.8-1.4-3.6c-0.9-0.8-2-1.2-3.8-1.5l-4.1-0.6c-2.8-0.4-5-1.3-6.5-2.8 c-1.7-1.5-2.6-3.8-2.6-6.6c0-6,4.4-10.1,11.5-10.1C237.3,49.8,240.5,51,243.4,53.7z" + id="path4523" /><path + class="logo-heading-text" + d="M270.8,53.7l-3.3,3.3c-2.1-2-4.6-2.7-7.6-2.7c-4.1,0-6.2,2.2-6.2,5.4c0,1.3,0.3,2.4,1.3,3.2c0.9,0.8,1.9,1.3,3.8,1.5 l4.1,0.6c3.1,0.5,4.9,1.2,6.4,2.6c1.8,1.7,2.8,4.1,2.8,7.1c0,6.3-5.1,10.1-12.4,10.1c-5.2,0-8.9-1.2-12.2-4.5l3.4-3.4 c2.5,2.5,5.4,3.3,8.9,3.3c4.5,0,7.1-1.9,7.1-5.3c0-1.5-0.4-2.8-1.4-3.6c-0.9-0.8-2-1.2-3.8-1.5l-4.1-0.6c-2.8-0.4-5-1.3-6.5-2.8 c-1.7-1.5-2.6-3.8-2.6-6.6c0-6,4.4-10.1,11.5-10.1C264.7,49.8,267.8,51,270.8,53.7z" + id="path4525" /><path + class="logo-heading-text" + d="M310.7,54.8h-16.8v10.5h14.3V70h-14.3v14.6h-5.2V50.1h22V54.8z" + id="path4527" /><path + class="logo-heading-text" + d="M335.1,53.3c3.4,3.4,3.5,6.8,3.5,14s-0.1,10.6-3.5,14c-2.2,2.2-5.1,3.5-8.9,3.5c-3.8,0-6.7-1.3-8.9-3.5 c-3.4-3.4-3.5-6.8-3.5-14s0.1-10.6,3.5-14c2.2-2.2,5.1-3.5,8.9-3.5C330,49.8,332.9,51.1,335.1,53.3z M321.1,56.6 c-1.7,1.8-2,3.9-2,10.7c0,6.8,0.3,8.9,2,10.7c1.3,1.4,3,2.1,5.1,2.1c2.1,0,3.8-0.8,5.1-2.1c1.7-1.8,2-3.9,2-10.7c0-6.8-0.3-9-2-10.7 c-1.3-1.4-3-2.1-5.1-2.1C324.1,54.5,322.4,55.2,321.1,56.6z" + id="path4529" /><path + class="logo-heading-text" + d="M369.6,72.9c0,7.1-5.4,11.9-12.4,11.9c-7,0-12.3-4.8-12.3-11.9V50.1h5.2v22.6c0,4.6,2.8,7.5,7.1,7.5s7.2-2.9,7.2-7.5V50.1 h5.2V72.9z" + id="path4531" /><path + class="logo-heading-text" + d="M403.1,84.5h-4.8l-15.9-24.2v24.2h-5.2V50.1h4.8l15.9,24.2V50.1h5.2V84.5z" + id="path4533" /><path + class="logo-heading-text" + d="M423.2,50.1c4.3,0,7.4,1.4,9.8,4.4c2.5,3.1,2.6,7.4,2.6,12.9s-0.1,9.8-2.6,12.9c-2.4,3-5.5,4.4-9.8,4.4h-12.1V50.1H423.2z M416.3,54.8v25.1h6.3c2.5,0,4.5-0.6,5.9-2.3c1.7-1.9,1.8-5.1,1.8-10.2c0-5.1-0.1-8.3-1.8-10.2c-1.4-1.7-3.4-2.3-5.9-2.3H416.3z" + id="path4535" /><path + class="logo-heading-text" + d="M467.3,84.5h-5.6l-2.4-6.9h-13.6l-2.4,6.9h-5.6l12.6-34.5h4.2L467.3,84.5z M447.2,73.2h10.6l-5.3-15.3L447.2,73.2z" + id="path4537" /><path + class="logo-heading-text" + d="M489.2,54.8h-9.5v29.8h-5.2V54.8H465v-4.7h24.2V54.8z" + id="path4539" /><path + class="logo-heading-text" + d="M499.4,84.5h-5.2V50.1h5.2V84.5z" + id="path4541" /><path + class="logo-heading-text" + d="M527.5,53.3c3.4,3.4,3.5,6.8,3.5,14s-0.1,10.6-3.5,14c-2.2,2.2-5.1,3.5-8.9,3.5c-3.8,0-6.7-1.3-8.9-3.5 c-3.4-3.4-3.5-6.8-3.5-14s0.1-10.6,3.5-14c2.2-2.2,5.1-3.5,8.9-3.5C522.4,49.8,525.3,51.1,527.5,53.3z M513.4,56.6 c-1.7,1.8-2,3.9-2,10.7c0,6.8,0.3,8.9,2,10.7c1.3,1.4,3,2.1,5.1,2.1c2.1,0,3.8-0.8,5.1-2.1c1.7-1.8,2-3.9,2-10.7c0-6.8-0.3-9-2-10.7 c-1.3-1.4-3-2.1-5.1-2.1C516.5,54.5,514.8,55.2,513.4,56.6z" + id="path4543" /><path + class="logo-heading-text" + d="M563.7,84.5h-4.8L543,60.3v24.2h-5.2V50.1h4.8l15.9,24.2V50.1h5.2V84.5z" + id="path4545" /></svg> \ No newline at end of file diff --git a/databags/onions.ini b/databags/onions.ini index 10645a4..99c440c 100644 --- a/databags/onions.ini +++ b/databags/onions.ini @@ -1,9 +1,59 @@ [propublica] -link = http://www.propub3r6espa33w.onion/ +link = https://p53lf57qovyuvwsc6xnrppyply3vtqm7l6pcobkmyqsiofyeznfu5uqd.onion image = /static/images/onions/png/propublica.png label = ProPublica [nytimes] -link = http://www.nytimes3xbfgragh.onion/ +link = https://www.nytimes3xbfgragh.onion image = /static/images/onions/png/nytimes.png label = The New York Times + +[dw] +link = https://www.dwnewsvdyyiamwnp.onion +image = /static/images/onions/png/dw.png +label = Deutsche Welle + +[bbc] +link = https://www.bbcnewsv2vjtpsuy.onion +image = /static/images/onions/png/bbc.png +label = BBC + +[facebook] +link = https://facebookcorewwwi.onion +image = /static/images/onions/png/facebook.png +label = Facebook + +[frontlinedefenders] +link = http://3g2wfrenve2xcxiotthk4fcsnymzwfbttqbiwveoaox7wxkdh7voouqd.onion +image = /static/images/onions/png/frontlinedefenders.png +label = Frontline Defenders + +[fop] +link = http://fpfjxcrmw437h6z2xl3w4czl55kvkmxpapg37bbopsafdu7q454byxid.onion +image = /static/images/onions/svg/fop.svg +label = Freedom of Press Foundation + +[privacyinternational] +link = https://privacyintyqcroe.onion/ +image = /static/images/onions/png/privacyinternational.png +label = Privacy International + +[debian] +link = http://sejnfjrq6szgca7v.onion/ +image = /static/images/onions/png/debian.png +label = Debian + +[qubesos] +link = http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion +image = /static/images/onions/png/qubesos.png +label = Qubes OS + +[riseup] +link = http://vww6ybal4bd7szmgncyruucpgfkqahzddi37ktceo3ah7ngmcopnpyyd.onion +image = /static/images/onions/png/riseup.png +label = Riseup + +[brave] +link = https://brave5t5rjjg3s6k.onion +image = /static/images/onions/png/brave.png +label = Brave

1 0

[community/staging] Fix #173
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 7ad8087892283e1d05b975c80550e4c9fd06cd61 Author: gus <gus(a)torproject.org> Date: Mon Dec 14 16:59:13 2020 -0500 Fix #173 --- content/relay-operations/technical-setup/post-install/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/technical-setup/post-install/contents.lr b/content/relay-operations/technical-setup/post-install/contents.lr index 36a3c22..dbd00c6 100644 --- a/content/relay-operations/technical-setup/post-install/contents.lr +++ b/content/relay-operations/technical-setup/post-install/contents.lr @@ -91,7 +91,7 @@ ORPort [IPv6-address]:9001 ``` The location of that line in the configuration file does not matter. -You can simply add it next to the first ORPort lins in your torrc file. +You can simply add it next to the first ORPort lines in your torrc file. Note: You have to explicitly specify your IPv6 address in square brackets, you can not tell tor to bind to any IPv6 (like you do for IPv4). If you have a global IPv6 address you should be able to find it in the output of the following command:

1 0

[community/staging] Add terraform-onions and heroku. Fix #151
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit c9bc488589746935764b2d6b0a457a62032e9514 Author: gus <gus(a)torproject.org> Date: Mon Dec 21 14:39:13 2020 -0500 Add terraform-onions and heroku. Fix #151 --- content/onion-services/setup/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/onion-services/setup/contents.lr b/content/onion-services/setup/contents.lr index b872eaf..a95fe51 100644 --- a/content/onion-services/setup/contents.lr +++ b/content/onion-services/setup/contents.lr @@ -163,5 +163,5 @@ That is not an easy task, and these resources will help on how to make this poss Finally, if you plan to keep your service available for a long time, you might want to make a backup copy of the `private_key` file somewhere. -Now that you have an onion site working, you may want to deploy [Onion-Location](https://community.torproject.org/onion-services/advanced/on…, or use tools like Docker, [Ansible](https://galaxy.ansible.com/systemli/onion) or [stem](https://stem.torproject.org/tutorials/over_the_river.html) to automate the management of your onion services. +Now that you have an onion site working, you may want to deploy [Onion-Location](https://community.torproject.org/onion-services/advanced/on…, or use tools like Docker, [Heroku](https://gitlab.torproject.org/hiro/onions-on-heroku), [Terraform](https://gitlab.torproject.org/hiro/terraform-onions), [Ansible](https://galaxy.ansible.com/systemli/onion) or [stem](https://stem.torproject.org/tutorials/over_the_river.html) to automate the management of your onion services. If you have a static website, but never installed Nginx or Apache, another project to try is [OnionShare](https://onionshare.org), where running an onion site will be easier: guided with a graphic interface and with minimal configuration.

1 0

[community/staging] Update onion services topics order
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit f99b2e8c26735ea82acf9db0390f56286390718a Author: gus <gus(a)torproject.org> Date: Mon Dec 21 15:24:58 2020 -0500 Update onion services topics order --- content/onion-services/setup/contents.lr | 2 +- content/onion-services/talk/contents.lr | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/onion-services/setup/contents.lr b/content/onion-services/setup/contents.lr index a95fe51..e00cfd8 100644 --- a/content/onion-services/setup/contents.lr +++ b/content/onion-services/setup/contents.lr @@ -12,7 +12,7 @@ title: Set up Your Onion Service --- subtitle: Learn how to set up a .onion site of your very own. --- -key: 1 +key: 2 --- cta: Get Started --- diff --git a/content/onion-services/talk/contents.lr b/content/onion-services/talk/contents.lr index d22860d..6196620 100644 --- a/content/onion-services/talk/contents.lr +++ b/content/onion-services/talk/contents.lr @@ -10,7 +10,7 @@ title: Talk about onions --- subtitle: Become an onion advocate and explain the importance of onion services. --- -key: 0 +key: 1 --- html: two-columns-page.html ---

1 0

[community/staging] Add guideline document.
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 2d35ea1dc8e6db282e0e5232320fdd57547ac92e Author: gus <gus(a)torproject.org> Date: Mon Dec 21 09:55:39 2020 -0500 Add guideline document. --- content/onion-services/advanced/dos/contents.lr | 65 +++++++++++++++++++++++++ 1 file changed, 65 insertions(+) diff --git a/content/onion-services/advanced/dos/contents.lr b/content/onion-services/advanced/dos/contents.lr new file mode 100644 index 0000000..297e88b --- /dev/null +++ b/content/onion-services/advanced/dos/contents.lr @@ -0,0 +1,65 @@ +section: advanced configuration +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: Onion service DoS guidelines +--- +subtitle: Tips to help you keep afloat in turbulent times. +--- +key: 5 +--- +html: two-columns-page.html +--- +body: + +In this page we present a few ways to mitigate DoS attacks currently. +However there is no single one-size-fits-all solution for this problem at the moment. +Defending a site under attack requires creativity and a custom-tailored approach. +Here are a few tips: + +### Onionbalance + +[Onionbalance](https://onionbalance-v3.readthedocs.io/en/latest/v3/tutorial-v3.html) allows onion service operators to achieve the property of high availability by allowing multiple machines to handle requests for an onion service. +You can use Onionbalance to scale horizontally. +The more you scale, the harder it is for attackers to overwhelm you. +Onionbalance is available for [v3 onion services](https://blog.torproject.org/cooking-onions-reclaiming-onionbalanc…. + +### Client authorization or multiple onion addresses to compartmentalize your users + +If you have users you trust, give them dedicated onion service and client authorization credentials so that it can always be available. +For users you don't trust, split them into multiple addresses. +That said, having too many onion addresses is actually bad for your security (because of the use of many guard nodes), so try to use [client authorization](https://community.torproject.org/onion-services/advanced/cli… when possible. + +### Captchas and cookies + +If you need to further rate-limit users, split your infrastructure into layers and put Captchas near the frontend. +This way attackers will have to solve Captchas before they are able to attack deeper into your infrastructure. + +Captchas are a way to mitigate DDoS attacks. +When a request comes from a client checks if the client contains the correct secure cookie otherwise redirects to the recaptcha page. +The client inputs the captcha letters. +Nginx sends this input letters to recaptcha server for verification. + +The correct answer from recaptcha server with beginning of "true...", else it's beginning with "false...". +Add the secure cookie for the correct verified client, redirect the client to the page which he wants to view. + +It is possible to implement Captchas directly at your webserver with Nginx and OpenResty using [Lua to generate and verify the captcha images](https://github.com/openresty/lua-nginx-module). +This implementation isn't easy to configure. + +An alternative might be to just implement a test-cookie challenge. +At your webserver check that clients can set valid cookies, malicious clients often do not have this feature. +In Nginx, Cloudflare provide a [library](https://github.com/cloudflare/lua-resty-cookie) to interact with cookies. + +Other methods include making sure that clients connecting to your .onion have valid User-Agent header and the Referer header is not set to a value you can associate with the attack. + +### Webserver rate limiting + +If attackers are overwhelming you with aggressive circuits that perform too many queries, try to detect that overuse and kill them using the `HiddenServiceExportCircuitID` torrc option. +You can use your own heuristics or use your web server's [rate limiting module](https://www.nginx.com/blog/rate-limiting-nginx/). + +The above tips should help you keep afloat in turbulent times. +At the same time [we are working on more advanced defenses](https://blog.torproject.org/stop-the-onion-denial), so that less manual configuration and tinkering is needed by onion operators.

1 0

[community/staging] Merge branch 'onion-guide-dos'
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 6afc1945816178a49857b9386896a0dfa347e746 Merge: 08c7257 2d35ea1 Author: gus <gus(a)torproject.org> Date: Mon Dec 21 14:33:41 2020 -0500 Merge branch 'onion-guide-dos' content/onion-services/advanced/dos/contents.lr | 65 +++++++++++++++++++++++++ 1 file changed, 65 insertions(+)

1 0

[community/staging] Fix typos
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 2f66f498aafc2df826acaba85346e0c83f5e5eaf Author: Dimitris Apostolou <dimitris.apostolou(a)icloud.com> Date: Tue Dec 15 23:12:44 2020 +0200 Fix typos --- README.md | 4 ++-- content/gsoc/onion-toolbox/contents.lr | 4 ++-- content/gsoc/privacy-friendly-web/contents.lr | 2 +- content/localization/becoming-tor-translator/contents.lr | 2 +- content/onion-services/setup/install/contents.lr | 2 +- content/relay-operations/community-resources/bad-relays/contents.lr | 2 +- content/relay-operations/community-resources/contents.lr | 2 +- .../community-resources/eff-tor-legal-faq/contents.lr | 2 +- .../relay-operations/community-resources/good-bad-isps/contents.lr | 2 +- .../community-resources/tor-abuse-templates/contents.lr | 4 ++-- .../community-resources/tor-exit-guidelines/contents.lr | 4 ++-- .../community-resources/tor-relay-universities/contents.lr | 2 +- content/relay-operations/technical-setup/bridge/freebsd/contents.lr | 2 +- 13 files changed, 17 insertions(+), 17 deletions(-) diff --git a/README.md b/README.md index fc5b24c..d0d917a 100644 --- a/README.md +++ b/README.md @@ -41,7 +41,7 @@ You can click ```Edit this page``` and submit your content changes in a [Pull Re ```$ cd community/lego && git submodule update --init --recursive``` -5. Translations for the website are imported by Jenkins when bulding the page, but if you want to test them, download the correct branch of the translations repo to the ./i18n/ folder. +5. Translations for the website are imported by Jenkins when building the page, but if you want to test them, download the correct branch of the translations repo to the ./i18n/ folder. 6. Finally: @@ -75,7 +75,7 @@ This is the workflow that Tor Internal people should use when making changes on - Contents file, containing your changes where it would be located on the **reviewer's repo**, e.g. `https://gitlab.torproject.org/steph/community/blob/develop/content/onion-services/contents.lr`. - For the review workflow, please see (Reviewer Workflow). 5. Once the work has been reviewed and any necessary changes and merge request has been made, a repo maintainer or team members with write access to gitweb master will then merge or cherry-pick these changes to master, following the workflow outlined in [How to use our git flow](https://gitlab.torproject.org/web/tpo/wikis/Git-flow-and-merge-reques…. -6. Merger should then move the the ticket to the `Closed` column. +6. Merger should then move the ticket to the `Closed` column. ### Reviewer Workflow diff --git a/content/gsoc/onion-toolbox/contents.lr b/content/gsoc/onion-toolbox/contents.lr index 1d52e87..fa998f7 100644 --- a/content/gsoc/onion-toolbox/contents.lr +++ b/content/gsoc/onion-toolbox/contents.lr @@ -49,7 +49,7 @@ Ultimately myonion is about creating a better experience for onion services deve Myonion is a developer tool box, providing a command line interface and a GUI to configure and deploy existing services via .onion. A minimal prototype for myonion already [exists](https://github.com/hiromipaw/myonion). -Someone that may want to run an onion service can use the myonion wrapper app to start a .onion from their computer and sharea static website or a web application. +Someone that may want to run an onion service can use the myonion wrapper app to start a .onion from their computer and share a static website or a web application. Myonion can also be used to deploy the resulting configured app to a defined set of cloud providers. @@ -57,7 +57,7 @@ Myonion provides a way to build and deploy onion ready applications, allowing de The experience for developers will be similar to using other industry solutions, like the [Docker desktop app](https://www.docker.com/products/docker-desktop). -Developers using myonion are provided with pre-defined and customizable application templates, with corresponding configuration and a test set, eliminating error-prone manual setup and known onion service configuration mistakes. +Developers using myonion are provided with pre-defined and customizable application templates, with corresponding configuration and a test set, eliminating error-prone manual setup and known onion service configuration mistakes. The resulting application is therefore deployable via a set of endpoint management tools to known providers. Providing a way to deploy onion services at scale. diff --git a/content/gsoc/privacy-friendly-web/contents.lr b/content/gsoc/privacy-friendly-web/contents.lr index 7ab642b..36cdd00 100644 --- a/content/gsoc/privacy-friendly-web/contents.lr +++ b/content/gsoc/privacy-friendly-web/contents.lr @@ -49,7 +49,7 @@ Websites can work seamlessly with the Tor Browser and other privacy enhancing br The Tor Browser is in fact, based on Mozilla's Extended Support Release (ESR) Firefox branch. We have a series of patches against this browser to enhance privacy and security. Browser behavior is additionally augmented through the Torbutton extension, and we also change a number of Firefox preferences from their defaults. -The Tor Project has developed over the years a set of web development guidelines that allow websites to work with security enhanced browsers without causing any or minimal functionality destruption to their users. These guidelines have been shaped in an internal styleguide that has been adopted across all torproject.org websites. +The Tor Project has developed over the years a set of web development guidelines that allow websites to work with security enhanced browsers without causing any or minimal functionality disruption to their users. These guidelines have been shaped in an internal styleguide that has been adopted across all torproject.org websites. We are now formalizing these web development patterns and some security concerns that need to be considered when developing websites for users surfing the web with security enhanced browsers and tools. The scope of this project is creating a open-source community-driven browsable list of patterns and release a css/js framework that web developers can extend and use in their work. diff --git a/content/localization/becoming-tor-translator/contents.lr b/content/localization/becoming-tor-translator/contents.lr index 9f5e07b..362df91 100644 --- a/content/localization/becoming-tor-translator/contents.lr +++ b/content/localization/becoming-tor-translator/contents.lr @@ -20,7 +20,7 @@ Thank you for your interest in helping us with translations. # Localization mailing list <a name="tor-l10n" /> -To communicate with other translators, please join the [Tor localization mailing list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n), where we organize translations, take decisions, report errors in source strings, etc. Please introduce yourself and ask any questions you may have after following up this instructions. +To communicate with other translators, please join the [Tor localization mailing list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n), where we organize translations, take decisions, report errors in source strings, etc. Please introduce yourself and ask any questions you may have after following up these instructions. # Translation platform diff --git a/content/onion-services/setup/install/contents.lr b/content/onion-services/setup/install/contents.lr index 2796c55..6f12cc9 100644 --- a/content/onion-services/setup/install/contents.lr +++ b/content/onion-services/setup/install/contents.lr @@ -90,7 +90,7 @@ cost=100 ### Installing Tor from source -1. Download latest release and dependecies +1. Download latest release and dependencies The latest release of Tor can be found on the [download](https://www.torproject.org/download/tor/) page. diff --git a/content/relay-operations/community-resources/bad-relays/contents.lr b/content/relay-operations/community-resources/bad-relays/contents.lr index 520a40d..4de7718 100644 --- a/content/relay-operations/community-resources/bad-relays/contents.lr +++ b/content/relay-operations/community-resources/bad-relays/contents.lr @@ -49,7 +49,7 @@ We have three types of flags we can apply: Which we use depends on the severity of the issue, and if it can still be safely used in certain situations. -### My relays was given the BadExit flag. What's up? +### My relay was given the BadExit flag. What's up? In just about all cases we're unable to contact the operator to resolve the issue, so if your relay has been flagged as a BadExit then please let us know (see above for contact info) so we can work together to fix the issue. diff --git a/content/relay-operations/community-resources/contents.lr b/content/relay-operations/community-resources/contents.lr index f2e2f0e..392fbfa 100644 --- a/content/relay-operations/community-resources/contents.lr +++ b/content/relay-operations/community-resources/contents.lr @@ -33,7 +33,7 @@ Also see the [Tor Exit Guidelines](tor-exit-guidelines). Operators can put together their own abuse complaint template responses from one of many templates that Tor has created: [Tor Abuse Templates](tor-abuse-templates). -It is important to respond to abuse complaints in a timely manner (usually within 24 hours). If the hoster gets annoyed by the amount of abuse you can reduce the amount of ports allowed in your exit policy. +It is important to respond to abuse complaints in a timely manner (usually within 24 hours). If the hoster gets annoyed by the amount of abuse you can reduce the amount of ports allowed in your exit policy. Please document your experience with new hosters on the following page: [GoodBadISPs](good-bad-isps) Other docs we like: diff --git a/content/relay-operations/community-resources/eff-tor-legal-faq/contents.lr b/content/relay-operations/community-resources/eff-tor-legal-faq/contents.lr index 1a9ba2c..a50fdd8 100644 --- a/content/relay-operations/community-resources/eff-tor-legal-faq/contents.lr +++ b/content/relay-operations/community-resources/eff-tor-legal-faq/contents.lr @@ -136,7 +136,7 @@ For information on what to do if law enforcement seeks access to your digital de EFF has written a [short template](tor-dmca-response) to help you write a response to your ISP, university, etc., to let them know about the details of the Digital Millennium Copyright Act's safe harbor, and how Tor fits in. Note that template only refers to U.S. jurisdictions, and is intended only to address copyright complaints that are based on a relay of allegedly infringing material through the Tor node. -If you like, you should consider submitting a copy of your notice to the Lumen DatabaseThe email address for submissions is team(a)lumendatabase.org. +If you like, you should consider submitting a copy of your notice to the Lumen Database. The email address for submissions is team(a)lumendatabase.org. This will help us recognize trends and issues that the lawyers might want to focus on. Lumen encourages submissions from people outside the United States too. diff --git a/content/relay-operations/community-resources/good-bad-isps/contents.lr b/content/relay-operations/community-resources/good-bad-isps/contents.lr index 98eca4c..54e6759 100644 --- a/content/relay-operations/community-resources/good-bad-isps/contents.lr +++ b/content/relay-operations/community-resources/good-bad-isps/contents.lr @@ -32,7 +32,7 @@ For network diversity and stronger anonymity, you should avoid providers and cou |-------------------------|-------------|-----------------|--------------|-------------|---------------------|------------------------| | [UPC Austria GmbH](https://www.upc.at/) | - | - | Yes | Yes | (ISP) does not care what their customers do at all (unless you have a business connection) | 12/2011 | | [Silver Server GmbH](http://sil.at/) | - | -| Yes | Yes | Forwards abuse. Hosts already some big exit/entry nodes which seem to have no problems. Very expensive traffic. | 12/2011 | -| [Tele2 Austria GmbH](https://tele2.at/) | - | - | Yes | Yes | Forwards abuse at business connections, good quality traffic, does not like "proxys" on private lines. Cheap synchronous (SDSL) connections. | 12/2011 | +| [Tele2 Austria GmbH](https://tele2.at/) | - | - | Yes | Yes | Forwards abuse at business connections, good quality traffic, does not like "proxies" on private lines. Cheap synchronous (SDSL) connections. | 12/2011 | | [A1(former Telekom Austria)](http://a1.net) | - | - | Yes | No | Does not like Abuse (in any form) at all. Seems to give out customer data at alleged abuse. Not recommended but cheap. | 12/2011 | | [xpirio GmbH](http://xpirio.at) | - | - | Yes | ? | In general rather relaxed at all services, but better get in touch with their (very understanding) support when you expect abuse. | 12/2011 | diff --git a/content/relay-operations/community-resources/tor-abuse-templates/contents.lr b/content/relay-operations/community-resources/tor-abuse-templates/contents.lr index a590159..483cb2c 100644 --- a/content/relay-operations/community-resources/tor-abuse-templates/contents.lr +++ b/content/relay-operations/community-resources/tor-abuse-templates/contents.lr @@ -92,7 +92,7 @@ We're sorry your site is experiencing this heavy load from Tor. However, it is possible that your rate limiting alarms simply experienced a false positive due to the amount of traffic that flows through the router. We provide service to almost a gigabit of traffic per second, 98% of which is web traffic. -If the attack is real and ongoing, however, the Tor project provides an automated DNSRBL for you to query to block login attempts coming +If the attack is real and ongoing, however, the Tor project provides an automated DNSRBL for you to query to block login attempts coming from Tor nodes: https://www.torproject.org/projects/tordnsel.html.en It is also possible to download a list of all Tor exit IPs that will connect to your server port: @@ -103,7 +103,7 @@ In general however, we believe that problems like this are best solved by improv Scraping and robot activity can be reduced/slowed by captchas, which is the approach taken by Gmail for this same problem. In fact, Google provides a free captcha service, complete with code for easy inclusion in a number of systems to help other sites deal with this issue: https://code.google.com/apis/recaptcha/intro.html -Slow DoS attacks [aimed to consume the Apache MaxClients limit](http://www.guerilla-ciso.com/archives/2049) can be alleviated by reducing the httpd.conf TimeOut and KeepAliveTimeout config values to 15-30 and raising the ServerLimit and MaxClients values to omething like 3000. +Slow DoS attacks [aimed to consume the Apache MaxClients limit](http://www.guerilla-ciso.com/archives/2049) can be alleviated by reducing the httpd.conf TimeOut and KeepAliveTimeout config values to 15-30 and raising the ServerLimit and MaxClients values to something like 3000. If this fails, DoS attempts can also be solved with iptables-based rate limiting solutions, load balancers such as nginx, and also IPS devices, but be aware that Internet traffic is not always uniform in quantity by IP, due to large corporate and even national outproxies, NATs, and services like Tor. http://kevin.vanzonneveld.net/techblog/article/block_brute_force_attacks_wi… diff --git a/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr index 7ad8ffd..61e4084 100644 --- a/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr +++ b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr @@ -39,7 +39,7 @@ Once you identified your ISP, you can follow the two-step advice of TorServers.n 2. If they come back positively, ask them if they are OK with an IP range reassignment. If not, you can still explain that you are a non-profit superb large organization filled with security professionals, and that all will be good, and why IP reassignment helps reduce their workload. -The two-step process usually helps in elevating your request to higher levels of support staff without scaring them off too early, even if you don't end up with your own IP range. Here is template you can use: [Inquiry](https://www.torservers.net/wiki/hoster/inquiry) +The two-step process usually helps in elevating your request to higher levels of support staff without scaring them off too early, even if you don't end up with your own IP range. Here is template you can use: [Inquiry](https://www.torservers.net/wiki/hoster/inquiry) ## Legal @@ -134,7 +134,7 @@ A simple notice can be published without a separate webserver using Tor's "DirPo * Disk encryption might be useful to protect your node keys, but on the other hand unencrypted machines are easier to "audit" if required. We feel it's best to be able to easily show that you do Tor exiting, and nothing else (on that IP or server). -* Set reverse DNS to something that signals its use, e.g. 'anonymous-relay', 'proxy', 'tor-proxy'. so when other people see the address in their web logs, they will more quickly understand what's going on. +* Set reverse DNS to something that signals its use, e.g. 'anonymous-relay', 'proxy', 'tor-proxy'. So when other people see the address in their web logs, they will more quickly understand what's going on. If you do, and if SMTP is allowed in your exit policy, consider configuring [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework) on your domain: this will protect you from users using your exit node to forge e-mails which look like they come from you. --- html: two-columns-page.html diff --git a/content/relay-operations/community-resources/tor-relay-universities/contents.lr b/content/relay-operations/community-resources/tor-relay-universities/contents.lr index 5d57cac..6fa5dc9 100644 --- a/content/relay-operations/community-resources/tor-relay-universities/contents.lr +++ b/content/relay-operations/community-resources/tor-relay-universities/contents.lr @@ -19,7 +19,7 @@ Most likely it is ambiguously worded, to let them allow or deny things based on But it might be extremely restrictive ("no services of any kind"), in which case you're going to have a tough road ahead of you. * Second, learn about your local laws with respect to liability of traffic that exits from your Tor relay. -In the US, these appear to be mainly the [DMCA](/relay/community-resources/eff-tor-legal-faq/) and [CDA](/relay/community-resources/eff-tor-legal-faq/), and the good news is that many lawyers believe that Tor exit node operators are in the same boat as the ISPs themselves. +In the US, these appear to be mainly the [DMCA](/relay/community-resources/eff-tor-legal-faq/) and [CDA](/relay/community-resources/eff-tor-legal-faq/), and the good news is that many lawyers believe that Tor exit node operators are in the same boat as the ISPs themselves. Become familiar with [the EFF's template letter regarding DMCA notices for Tor](/relay/community-resources/eff-tor-legal-faq/tor-dmca-response/), which is quite clear about not putting liability on service providers. The CDA is less clear, because it was written before the modern Internet emerged, but EFF and ACLU are optimistic. Of course, you need to understand that without actual clear precedent (and even then), it's still possible that a given judge will not interpret things the way the lawyers expect. diff --git a/content/relay-operations/technical-setup/bridge/freebsd/contents.lr b/content/relay-operations/technical-setup/bridge/freebsd/contents.lr index 28ed6ba..e1cef75 100644 --- a/content/relay-operations/technical-setup/bridge/freebsd/contents.lr +++ b/content/relay-operations/technical-setup/bridge/freebsd/contents.lr @@ -85,7 +85,7 @@ To confirm your bridge is running with no issues, you should see something like ``` -### 6. To get the fastest package updates, switch from the "quarterly" package repo to the "latest" repo. +### 6. To get the fastest package updates, switch from the "quarterly" package repo to the "latest" repo. Create the following folder:

1 0

[community/staging] Rephrase onion services overview docs to make it more clear. Fix #179
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 10bc0c9b88ddf50345e590d1ae05a8a49a6c63f2 Author: gus <gus(a)torproject.org> Date: Fri Jan 8 15:12:12 2021 -0500 Rephrase onion services overview docs to make it more clear. Fix #179 --- content/onion-services/overview/contents.lr | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/onion-services/overview/contents.lr b/content/onion-services/overview/contents.lr index 8d6be84..8895acd 100644 --- a/content/onion-services/overview/contents.lr +++ b/content/onion-services/overview/contents.lr @@ -64,7 +64,7 @@ Let's imagine that your local newspaper decides to set up an onion service (usin As the first step in the protocol, the onion service will contact a bunch of Tor relays and ask them to act as its _introduction points_ by establishing long-term circuits to them. These circuits are anonymized circuits, so the server does not reveal the service location to the introduction points. -The onion service will hide and protect itself behind the Tor network by only allowing access through three introduction points that it connects to through a three-hop Tor circuit. +The onion service will hide and protect itself behind the Tor network by only allowing access through three introduction points that it connects to through a two-hop Tor circuit. <img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-01.png" alt="Onion Services: Step 1"> @@ -122,10 +122,10 @@ The introduction point passes your details (secret string and rendezvous address ### Act 8: Where the rendezvous point verifies the client's secret The onion service connects to the rendezvous point (through an anonymized circuit) and sends the "one-time secret" to it. -The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa. - The rendezvous point makes one final verification to match the secret strings from you and service (the latter also comes from you but has been relayed through the service). +The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa. + <img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-08.png" alt="Onion Services: Step 8"> ### Act 9: Where the onion service rendezvous with the client

1 0

[community/staging] Merge branch 'onion-services-overview'
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit bc58546d31cfcbebbc1972ab8d99c57c2eb1ffbe Merge: 4c16d95 10bc0c9 Author: gus <gus(a)torproject.org> Date: Fri Jan 8 15:15:25 2021 -0500 Merge branch 'onion-services-overview' content/onion-services/overview/contents.lr | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)

1 0

[community/staging] Merge branch 'add-new-isps'
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 229ae6d0d928dab35d569becccf4bcebb27f6fb5 Merge: f99b2e8 a6b0fb8 Author: gus <gus(a)torproject.org> Date: Tue Dec 22 14:47:25 2020 -0500 Merge branch 'add-new-isps' content/relay-operations/community-resources/good-bad-isps/contents.lr | 3 +++ 1 file changed, 3 insertions(+)

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits March 2021