March 2021 - tor-commits - lists.torproject.org

[community/staging] Add bridge deploy for windows
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit e51d8af9fa0628b1c58f0b96cb11d3878609188d Author: Nicolei Ocana <nicoleiocana(a)gmail.com> Date: Mon Jun 1 02:36:07 2020 +0000 Add bridge deploy for windows --- .../technical-setup/bridge/windows/contents.lr | 105 +++++++++++++++++++++ 1 file changed, 105 insertions(+) diff --git a/content/relay-operations/technical-setup/bridge/windows/contents.lr b/content/relay-operations/technical-setup/bridge/windows/contents.lr new file mode 100644 index 0000000..6f1e088 --- /dev/null +++ b/content/relay-operations/technical-setup/bridge/windows/contents.lr @@ -0,0 +1,105 @@ +_model: page +--- +color: primary +--- +title: Windows +--- +html: two-columns-page.html +--- +key: 10 +--- +body: + +### 1. Download the Windows Expert Bundle and the Tor Browser + +* [Windows Expert Bundle](https://www.torproject.org/dist/torbrowser/9.0.10/tor-win32-0.4.2.7…. Unzip the contents on the desktop. + +* [Tor Browser](https://www.torproject.org/download/#windows). Run the `.exe` and install with default settings. + +**Note: You will need to show hidden items and file name extensions. In your Explorer window, in the top-left, click on the View tab. In the Show/hide section furthest to the right, check the checkbox for Hidden items; check the checkbox for File name extensions.** + +### 2. Build files and relocate + +Open up the Tor folder on your desktop. Double click `tor.exe`. Once the command prompt reads: `[notice] Bootstrapped 100% (done): Done`, close the window. This creates the folder `C:\Users\<user>\AppData\Roaming\tor\` (where `<user>` is your user name). + +From the Tor folder on your desktop, select all `.dll`'s and `.exe`'s and cut/paste them into the `C:\Users\<user>\AppData\Roaming\tor\` folder. + +Open up the Data folder on your desktop. Inside that Tor folder, select both `geoip` and `geoip6` and cut/paste them into the `C:\Users\<user>\AppData\Roaming\tor\` folder. + +Navigate to `C:\Users\<user>\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports`. Select `obfs4proxy.exe` and cut/paste it into the `C:\Users\<user>\AppData\Roaming\tor\` folder. + +### 3. Create and edit your Tor config file + +In the `C:\Users\<user>\AppData\Roaming\tor\` folder, right-click on white space and select `New > Text Document`. Name the file `torrc`; there is no extension. + +Double-click on the `torrc` file. When prompted *How do you want to open this file?*, select `Notepad`. Add the following: + +``` +Log notice file C:\Users\<user>\AppData\Roaming\tor\notice.log +GeoIPFile C:\Users\<user>\AppData\Roaming\tor\geoip +GeoIPv6File C:\Users\<user>\AppData\Roaming\tor\geoip6 + +BridgeRelay 1 + +# Replace "TODO1" with a Tor port of your choice. +# This port must be externally reachable. +# Avoid port 9001 because it's commonly associated with Tor and censors may be scanning the Internet for this port. +ORPort TODO1 + +ServerTransportPlugin obfs4 exec C:\Users\<user>\AppData\Roaming\tor\obfs4proxy.exe + +# Replace "TODO2" with an obfs4 port of your choice. +# This port must be externally reachable and must be different from the one specified for ORPort. +# Avoid port 9001 because it's commonly associated with Tor and censors may be scanning the Internet for this port. +ServerTransportListenAddr obfs4 0.0.0.0:TODO2 + +# Local communication port between Tor and obfs4. Always set this to "auto". +# "Ext" means "extended", not "external". Don't try to set a specific port number, nor listen on 0.0.0.0. +ExtORPort auto + +# Replace "<address(a)email.com>" with your email address so we can contact you if there are problems with your bridge. +# This is optional but encouraged. +ContactInfo <address(a)email.com> + +# Pick a nickname that you like for your bridge. This is optional. +Nickname PickANickname +``` + +Don't forget to change the `ORPort`, `ServerTransportListenAddr`, `ContactInfo`, `<user>`, and `Nickname` options. + +* Use a fixed obfs4 port larger than 1024, still avoiding 9001. + +* Note that both Tor's OR port and its obfs4 port must be reachable. + If your bridge is behind a firewall or NAT, make sure to open both ports. + You can use [our reachability test](https://bridges.torproject.org/scan/) to see if your obfs4 port is reachable from the Internet. + +### 4. Start tor + +Open up the Command Prompt App. Change your directory with: `cd C:\Users\<user>\AppData\Roaming\tor\`. Type: `tor.exe -f torrc`. + +### 5. Monitor your logs + +To confirm your bridge is running with no issues, you should see something like this in `C:\Users\<user>\AppData\Roaming\tor\notice.log`. + +``` +[notice] Your Tor server's identity key fingerprint is '<NICKNAME> <FINGERPRINT>' +[notice] Your Tor bridge's hashed identity key fingerprint is '<NICKNAME> <HASHED FINGERPRINT>' +[notice] Registered server transport 'obfs4' at '[::]:46396' +[notice] Tor has successfully opened a circuit. Looks like client functionality is working. +[notice] Bootstrapped 100%: Done +[notice] Now checking whether ORPort <redacted>:3818 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) +[notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. +``` + +### 6. Final notes + +If you are having troubles setting up your bridge, have a look at [our help section](https://community.torproject.org/relay/getting-help/). If your bridge is now running, check out the [post-install notes](https://community.torproject.org/relay/setup/bridge/post-install/). + +--- +subtitle: How to deploy an obfs4 bridge on Windows +--- +_template: layout.html +--- +section: Bridge +--- +section_id: bridge

1 0

[community/staging] Merge branch 'onion-advanced-tips'
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 883504023cab17750614a03e4be5e8eeaa139c78 Merge: e494731 3f25f45 Author: gus <gus(a)torproject.org> Date: Mon Jun 1 13:54:44 2020 -0400 Merge branch 'onion-advanced-tips' .../advanced/client-auth/contents.lr | 125 +++++++++++++++ content/onion-services/advanced/contents.lr | 19 +++ .../advanced/onion-location/contents.lr | 177 +++++++++++++++++++++ content/onion-services/advanced/opsec/contents.lr | 32 ++++ content/onion-services/setup/contents.lr | 25 +-- 5 files changed, 369 insertions(+), 9 deletions(-)

1 0

[community/staging] Small corrections: change onionsite to onion site and more little things.
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 0452aad860e20a7a19c007382cd5f0e439c138d8 Author: gus <gus(a)torproject.org> Date: Tue Jun 2 09:19:48 2020 -0400 Small corrections: change onionsite to onion site and more little things. --- .../advanced/client-auth/contents.lr | 24 +++++++++++----------- .../advanced/onion-location/contents.lr | 20 +++++++++--------- 2 files changed, 22 insertions(+), 22 deletions(-) diff --git a/content/onion-services/advanced/client-auth/contents.lr b/content/onion-services/advanced/client-auth/contents.lr index 071a8e7..18be426 100644 --- a/content/onion-services/advanced/client-auth/contents.lr +++ b/content/onion-services/advanced/client-auth/contents.lr @@ -18,20 +18,20 @@ body: Client authorization is a method to make an onion service private and authenticated. It requires Tor clients to provide an authentication credential in order to connect to the onion service. -In version 3 Onion services, this method works with a pair of keys (a public and a private). -The service side will be configured with a public key and the client can only access with a private key. +In Onion services version 3, this method works with a pair of keys (a public and a private). +The service side is configured with a public key and the client can only access it with a private key. -**Note:** Once you've configured client authorization, anyone else with the address won't be able to access it from this point on. +**Note:** Once you have configured client authorization, anyone with the address will not be able to access it from this point on. If no authorization is configured, the service will be accessible to anyone with the onion address. -## Configuring version 3 Onion service +## Configuring Onion service version 3 ### Service side To configure client authorization on the service side, the `<HiddenServiceDir>/authorized_clients/` directory needs to exist. Following the instructions described in the section [Setup](https://community.torproject.org/onion-services/setup/) will automatically create this directory. Client authorization will only be enabled for the service if tor successfully loads at least one authorization file. -At the moment you need to create the keys yourself with a script (like these written in [Bash](https://gist.github.com/mtigas/9c2386adf65345be34045dace134140b), [Rust](https://github.com/haxxpop/torkeygen) or [Python](https://github.com/pastly/python-snippits/blob/master/src/tor/x2551…) or manually. +For now, you need to create the keys yourself with a script (like these written in [Bash](https://gist.github.com/mtigas/9c2386adf65345be34045dace134140b), [Rust](https://github.com/haxxpop/torkeygen) or [Python](https://github.com/pastly/python-snippits/blob/master/src/tor/x2551…) or manually. To manually generate the keys, you need to install `openssl` version 1.1+ and `basez`. @@ -76,7 +76,7 @@ For example, the file `/var/lib/tor/hidden_service/authorized_clients/alice.auth descriptor:x25519:N2NU7BSRL6YODZCYPN4CREB54TYLKGIE2KYOQWLFYC23ZJVCE5DQ -If you're planning to have more authenticated clients, each file must contain one line only. Any malformed file will be ignored. +If you are planning to have more authenticated clients, each file must contain one line only. Any malformed file will be ignored. **Step 5.** Restart the tor service @@ -94,7 +94,7 @@ For example, add this line to `/etc/tor/torrc`: ClientOnionAuthDir /var/lib/tor/onion_auth Then, in the `<ClientOnionAuthDir>` directory, create an `.auth_private` file for the onion service corresponding to this key (i.e. 'bob_onion.auth_private'). -The contents of the `<ClientOnionAuthDir>/<user>.auth_private` file should look like: +The content of the `<ClientOnionAuthDir>/<user>.auth_private` file should look like this: <56-char-onion-addr-without-.onion-part>:descriptor:x25519:<x25519 private key in base32> @@ -105,21 +105,21 @@ For example: If you manually generated the key pair following the instructions in this page, you can copy and use the private key created in **Step 2**. Then restart `tor` and you should be able to connect to the onion service address. -If you're generating a private key for an onionsite, the user doesn't necessarily need to edit Tor Browser's torrc. It's possible to enter the private key directly in [Tor Browser](https://tb-manual.torproject.org/onion-services/) interface. +If you are generating a private key for an onion site, the user does not necessarily need to edit Tor Browser's torrc. It is possible to enter the private key directly in the [Tor Browser](https://tb-manual.torproject.org/onion-services/) interface. For more information about client authentication, please see [Tor manual](https://2019.www.torproject.org/docs/tor-onion-service.html.en#Clie…. -## Configuring version 2 Onion service +## Configuring Onion service version 2 -To set up Cookie Authentication for **v2** services see the entries for the [HidServAuth](https://2019.www.torproject.org/docs/tor-manual.html.en#HidSer… and [HiddenServiceAuthorizeClient](https://2019.www.torproject.org/docs/tor-manu… options in the tor manual. +To set up Cookie Authentication for **v2** services, see the entries for the [HidServAuth](https://2019.www.torproject.org/docs/tor-manual.html.en#HidSer… and [HiddenServiceAuthorizeClient](https://2019.www.torproject.org/docs/tor-manu… options in the tor manual. First add the following line to the [torrc](https://2019.www.torproject.org/docs/faq.html.en#torrc) file of your onion service: HiddenServiceAuthorizeClient [auth-type] [service-name] Restart tor and read the cookie from the hostname file of your onion service, for example in `/var/lib/tor/hidden_service_path/hostname`. -To access it with a tor client add following line to torrc and restart tor: +To access it with a tor client, add following line to torrc and restart tor: HidServAuth [onion-address] [auth-cookie] [service-name] -You are now able to connect to the onion service address. +You can connect now to the onion service address. diff --git a/content/onion-services/advanced/onion-location/contents.lr b/content/onion-services/advanced/onion-location/contents.lr index 4796554..3c373a9 100644 --- a/content/onion-services/advanced/onion-location/contents.lr +++ b/content/onion-services/advanced/onion-location/contents.lr @@ -8,7 +8,7 @@ _template: layout.html --- title: Onion-Location --- -subtitle: Learn how to set up Onion-Location for your onionsite. +subtitle: Learn how to set up an Onion-Location for your onion site. --- key: 1 --- @@ -16,16 +16,16 @@ html: two-columns-page.html --- body: -Onion-Location is an easy way to advertise an onionsite to the users. +Onion-Location is an easy way to advertise an onion site to the users. You can either configure a web server to show an Onion-Location Header or add an HTML meta attibute in the website. For the header to be valid the following conditions need to be fulfilled: * The Onion-Location value must be a valid URL with http: or https: protocol and a .onion hostname. * The webpage defining the Onion-Location header must be served over HTTPS. - * The webpage defining the Onion-Location header must not be an onionsite. + * The webpage defining the Onion-Location header must not be an onion site. -In this page, the commands to manage the web server are based on Debian-like operating systems and may differ on other systems. +In this page, the commands to manage the web server are based Debian-like operating systems and may differ from other systems. Check your web server and operating system documentation. ### Apache @@ -65,7 +65,7 @@ Virtual Host example: **Step 3.** Reload Apache -Reload the apache2 service so your configuration changes take effect: +Reload the apache2 service, so your configuration changes take effect: $ sudo systemctl reload apache2 @@ -94,7 +94,7 @@ For example: ``` -The configuration file with Onion-Location should look like: +The configuration file with the Onion-Location should look like this: ``` server { @@ -159,17 +159,17 @@ If you get an error message, something has gone wrong and you cannot continue un **Step 4.** Testing your Onion-Location -To test if Onion-Location is working, fetch the website HTTP headers, for example: +To test if the Onion-Location is working, fetch the web site HTTP headers, for example: $ wget --server-response --spider your-website.tld Look for `onion-location` entry and the onion service address. -Or open the website in Tor Browser and a purple pill will appear in the address bar. +Or, open the web site in Tor Browser and a purple pill will appear in the address bar. ### Using an HTML `<meta>` attribute -The identical behaviour of Onion-Location and a Refresh header (with 0 seconds timeout) includes the option of defining it as a HTML `<meta>` http-equiv attribute. -This may be used by websites that prefer (or need) to define Onion-Location by modifying the served HTML content instead of adding a new HTTP header. +The identical behaviour of Onion-Location includes the option of defining it as a HTML `<meta>` http-equiv attribute. +This may be used by websites that prefer (or need) to define an Onion-Location by modifying the served HTML content instead of adding a new HTTP header. The Onion-Location header would be equivalent to a `<meta http-equiv="onion-location" content="http://<your-onion-service-address>.onion" />` added in the HTML head element of the webpage. Replace `<your-onion-service-address.onion>` with the onion service that you want to redirect. ### More information

1 0

[community/staging] Create Advanced settings section: Onion-Location, Client authorization and Opsec tips
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit a96be5d44ce37f14d9f6b2be9c2e9b5aeb6f4235 Author: gus <gus(a)torproject.org> Date: Wed May 27 23:37:27 2020 -0400 Create Advanced settings section: Onion-Location, Client authorization and Opsec tips --- .../advanced/client-auth/contents.lr | 125 ++++++++++++++++++ content/onion-services/advanced/contents.lr | 19 +++ .../advanced/onion-location/contents.lr | 147 +++++++++++++++++++++ content/onion-services/advanced/opsec/contents.lr | 32 +++++ 4 files changed, 323 insertions(+) diff --git a/content/onion-services/advanced/client-auth/contents.lr b/content/onion-services/advanced/client-auth/contents.lr new file mode 100644 index 0000000..071a8e7 --- /dev/null +++ b/content/onion-services/advanced/client-auth/contents.lr @@ -0,0 +1,125 @@ +_section: Advanced settings +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: Client Authorization +--- +subtitle: Learn how to set up client authorization for your onion services. +--- +key: 2 +--- +html: two-columns-page.html +--- +body: + +Client authorization is a method to make an onion service private and authenticated. +It requires Tor clients to provide an authentication credential in order to connect to the onion service. +In version 3 Onion services, this method works with a pair of keys (a public and a private). +The service side will be configured with a public key and the client can only access with a private key. + +**Note:** Once you've configured client authorization, anyone else with the address won't be able to access it from this point on. +If no authorization is configured, the service will be accessible to anyone with the onion address. + +## Configuring version 3 Onion service + +### Service side + +To configure client authorization on the service side, the `<HiddenServiceDir>/authorized_clients/` directory needs to exist. Following the instructions described in the section [Setup](https://community.torproject.org/onion-services/setup/) will automatically create this directory. +Client authorization will only be enabled for the service if tor successfully loads at least one authorization file. + +At the moment you need to create the keys yourself with a script (like these written in [Bash](https://gist.github.com/mtigas/9c2386adf65345be34045dace134140b), [Rust](https://github.com/haxxpop/torkeygen) or [Python](https://github.com/pastly/python-snippits/blob/master/src/tor/x2551…) or manually. + +To manually generate the keys, you need to install `openssl` version 1.1+ and `basez`. + +**Step 1.** Generate a key using the algorithm x25519: + + $ openssl genpkey -algorithm x25519 -out /tmp/k1.prv.pem + +If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. + +**Step 2.** Format the keys into base32: + +**Private key** + +``` +$ cat /tmp/k1.prv.pem | grep -v " PRIVATE KEY" | base64pem -d | tail --bytes=32 | base32 | sed 's/=//g' > /tmp/k1.prv.key +``` + +**Public key** + +``` +$ openssl pkey -in /tmp/k1.prv.pem -pubout | grep -v " PUBLIC KEY" | base64pem -d | tail --bytes=32 | base32 | sed 's/=//g' > /tmp/k1.pub.key +``` + +**Step 3.** Copy the public key: + + $ cat /tmp/k1.pub.key + +**Step 4.** Create an authorized client file + +Format the client authentication and create a new file in `<HiddenServiceDir>/authorized_clients/` directory. +Each file in that directory should be suffixed with ".auth" (i.e. "alice.auth"; the file name is irrelevant) and its content format must be: + + <auth-type>:<key-type>:<base32-encoded-public-key> + +The supported `<auth-type>` are: "descriptor". + +The supported `<key-type>` are:"x25519". + +The `<base32-encoded-public-key>` is the base32 representation of the raw key bytes only (32 bytes for x25519). + +For example, the file `/var/lib/tor/hidden_service/authorized_clients/alice.auth` should look like: + + descriptor:x25519:N2NU7BSRL6YODZCYPN4CREB54TYLKGIE2KYOQWLFYC23ZJVCE5DQ + +If you're planning to have more authenticated clients, each file must contain one line only. Any malformed file will be ignored. + +**Step 5.** Restart the tor service + + $ sudo systemctl reload tor + +If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. + +**Important:** Revoking a client can be done by removing their ".auth" file, however the revocation will be in effect only after the tor process gets restarted. + +### Client side + +To access a version 3 onion service with client authorization as a client, make sure you have `ClientOnionAuthDir` set in your torrc. +For example, add this line to `/etc/tor/torrc`: + + ClientOnionAuthDir /var/lib/tor/onion_auth + +Then, in the `<ClientOnionAuthDir>` directory, create an `.auth_private` file for the onion service corresponding to this key (i.e. 'bob_onion.auth_private'). +The contents of the `<ClientOnionAuthDir>/<user>.auth_private` file should look like: + + <56-char-onion-addr-without-.onion-part>:descriptor:x25519:<x25519 private key in base32> + +For example: + + rh5d6reakhpvuxe2t3next6um6iiq4jf43m7gmdrphfhopfpnoglzcyd:descriptor:x25519:ZDUVQQ7IKBXSGR2WWOBNM3VP5ELNOYSSINDK7CAUN2WD7A3EKZWQ + +If you manually generated the key pair following the instructions in this page, you can copy and use the private key created in **Step 2**. +Then restart `tor` and you should be able to connect to the onion service address. + +If you're generating a private key for an onionsite, the user doesn't necessarily need to edit Tor Browser's torrc. It's possible to enter the private key directly in [Tor Browser](https://tb-manual.torproject.org/onion-services/) interface. + +For more information about client authentication, please see [Tor manual](https://2019.www.torproject.org/docs/tor-onion-service.html.en#Clie…. + +## Configuring version 2 Onion service + +To set up Cookie Authentication for **v2** services see the entries for the [HidServAuth](https://2019.www.torproject.org/docs/tor-manual.html.en#HidSer… and [HiddenServiceAuthorizeClient](https://2019.www.torproject.org/docs/tor-manu… options in the tor manual. +First add the following line to the [torrc](https://2019.www.torproject.org/docs/faq.html.en#torrc) file of your onion service: + + HiddenServiceAuthorizeClient [auth-type] [service-name] + +Restart tor and read the cookie from the hostname file of your onion service, for example in +`/var/lib/tor/hidden_service_path/hostname`. +To access it with a tor client add following line to torrc and restart tor: + + HidServAuth [onion-address] [auth-cookie] [service-name] + +You are now able to connect to the onion service address. diff --git a/content/onion-services/advanced/contents.lr b/content/onion-services/advanced/contents.lr new file mode 100644 index 0000000..a17e990 --- /dev/null +++ b/content/onion-services/advanced/contents.lr @@ -0,0 +1,19 @@ +_section: onion services +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: Advanced settings +--- +subtitle: Learn more about how to configure client authentication, Onion-Location and more tips to secure your onion service. +--- +key: 3 +--- +html: two-columns-page.html +--- +body: + +In this section you will find how to configure your onion service to enable client authorization, Onion-Location and tips to make your onion service more secure. diff --git a/content/onion-services/advanced/onion-location/contents.lr b/content/onion-services/advanced/onion-location/contents.lr new file mode 100644 index 0000000..caf7d5f --- /dev/null +++ b/content/onion-services/advanced/onion-location/contents.lr @@ -0,0 +1,147 @@ +_section: advanced configuration +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: Onion-Location +--- +subtitle: Learn how to set up Onion-Location for your onionsite. +--- +key: 1 +--- +html: two-columns-page.html +--- +body: + +Onion-Location is an easy way to advertise an onionsite to the users. +You can either configure a web server to show an Onion-Location Header or add an HTML meta attibute in the website. + +For the header to be valid the following conditions need to be fulfilled: + + * The Onion-Location value must be a valid URL with http: or https: protocol and a .onion hostname. + * The webpage defining the Onion-Location header must be served over HTTPS. + * The webpage defining the Onion-Location header must not be an onionsite. + +In this page, the commands to restart the web server are based on Debian-like operating systems and may differ on other systems. +Check your web server and operating system documentation. + +### Apache + +To configure this header in Apache 2.2 or above, you will need to enable a few modules and edit the website Virtual Host file. + +**Step 1.** Enable headers and rewrite modules and restart Apache2 + + $ sudo a2enmod headers rewrite + + $ sudo systemctl restart apache2 + +If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. + +**Step 2.** Add the Onion-Location header to your Virtual Host configuration file + +``` +Header set Onion-Location "http://your-onion-address.onion%{REQUEST_URI}s" +``` + +Where `your-onion-address.onion` is the onion service address you want to redirect and `{REQUEST_URI}` is the [path component of the requested URI](https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html), such as "/index.html". + +Virtual Host example: + +``` + <VirtualHost *:443> + ServerName your-website.tld + DocumentRoot /var/www/html + Header set Onion-Location "http://rh5d6reakhpvuxe2t3next6um6iiq4jf43m7gmdrphfhopfpnoglzcyd%{REQUEST_UR…" + </VirtualHost> +``` + +**Step 3.** Reload Apache + +Reload the apache2 service so your configuration changes take effect: + + $ sudo systemctl reload apache2 + +If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. + +**Step 4.** Testing your Onion-Location + +To test if Onion-Location is working, fetch the website HTTP headers, for example: + + $ wget --server-response --spider your-website.tld + +Look for the `onion-location` entry and the onion service address. + +Or open the website in Tor Browser and a purple pill will appear in the address bar. + +### Nginx + +To configure Onion-Location header, you will need to edit Nginx website configuration file. + +**Step 1.** Edit website configuration file + +In `/etc/nginx/conf.d/<your-website.conf` add the new Onion-Location header and the onion service address. +For example: + +``` + location / { + add_header Onion-Location http://rh5d6reakhpvuxe2t3next6um6iiq4jf43m7gmdrphfhopfpnoglzcyd.onion$reque…; + } +``` + +The configuration file with Onion-Location should look like: + +``` +server { + listen 443; + + root /var/www/your-website/html; + index index.html index.htm; + + server_name your-website.tld; + + location / { + try_files $uri $uri/ =404; + add_header Onion-Location http://rh5d6reakhpvuxe2t3next6um6iiq4jf43m7gmdrphfhopfpnoglzcyd.onion$reque…; + } +} +``` + +**Step 2.** Test website configuration + + $ sudo nginx -t + +The web server should confirm that the new syntax is working: + +``` +nginx: the configuration file /etc/nginx/nginx.conf syntax is ok +nginx: configuration file /etc/nginx/nginx.conf test is successful +``` + +**Step 3.** Restart nginx + + $ sudo nginx -s reload + +If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. + +**Step 4.** Testing your Onion-Location + +To test if Onion-Location is working, fetch the website HTTP headers, for example: + + $ wget --server-response --spider your-website.tld + +Look for the `onion-location` entry and the onion service address. + +Or open the website in Tor Browser and a purple pill will appear in the address bar. + +### Using an HTML `<meta>` attribute + +The identical behaviour of Onion-Location and a Refresh header (with 0 seconds timeout) includes the option of defining it as a HTML `<meta>` http-equiv attribute. +This may be used by websites that prefer (or need) to define Onion-Location by modifying the served HTML content instead of adding a new HTTP header. +The Onion-Location header would be equivalent to a `<meta http-equiv="onion-location" content="http://<your-onion-service-address>.onion" />` added in the HTML head element of the webpage. Replace `<your-onion-service-address.onion>` with the onion service that you want to redirect. + +### More information + +Read the [Onion-Location spec](https://gitweb.torproject.org/tor-browser-spec.git/tree/proposals/100…. diff --git a/content/onion-services/advanced/opsec/contents.lr b/content/onion-services/advanced/opsec/contents.lr new file mode 100644 index 0000000..6debce0 --- /dev/null +++ b/content/onion-services/advanced/opsec/contents.lr @@ -0,0 +1,32 @@ +_section: onion services +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: Operational Security +--- +subtitle: Learn more tips to secure your Onion Services. +--- +key: 3 +--- +html: two-columns-page.html +--- +body: + +Onion services operators need to practice proper [operational security](https://trac.torproject.org/projects/tor/wiki/doc/OperationalSecu… and system administration to maintain security. +For some security suggestions please make sure you read over Riseup's ["Tor Hidden (Onion) Services Best Practices" document](https://riseup.net/en/security/network-security/tor/onionservices…. +Also, here are some more anonymity issues you should keep in mind: + + - As mentioned [here](https://community.torproject.org/onion-services/setup/), be careful of letting your web server reveal identifying information about you, your computer, or your location. +For example, readers can probably determine whether it's thttpd or Apache, and learn something about your operating system. + - If your computer isn't online all the time, your onion service won't be either. +This leaks information to an observant adversary. + - It is generally a better idea to host onion services on a Tor client rather than a Tor relay, since relay uptime and other properties are publicly visible. + - The longer an onion service is online, the higher the risk that its location is discovered. +The most prominent attacks are building a profile of the onion service's availability and matching induced traffic patterns. + - Another common issue is whether to use HTTPS on your onionsite or not. +Have a look at [this post](https://blog.torproject.org/blog/facebook-hidden-services-and-https-c… on the Tor Blog to learn more about these issues. + - To protect your onion service from advanced attacks you should use [Vanguards addon](https://github.com/mikeperry-tor/vanguards), read [Tor blog about Vanguards](https://blog.torproject.org/announcing-vanguards-add-onion-servi… and [Vanguards' Security README](https://github.com/mikeperry-tor/vanguards/blob/master/README_SECUR….

1 0

[community/staging] Update Onion-Locatio nginx example and torrc with unix socket
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 785f8968011f2b1f8746324f98eba4b77778a2f4 Author: gus <gus(a)torproject.org> Date: Tue Jun 2 12:35:52 2020 -0400 Update Onion-Locatio nginx example and torrc with unix socket --- .../advanced/onion-location/contents.lr | 32 +++++++++++++++++----- 1 file changed, 25 insertions(+), 7 deletions(-) diff --git a/content/onion-services/advanced/onion-location/contents.lr b/content/onion-services/advanced/onion-location/contents.lr index 3c373a9..74664ab 100644 --- a/content/onion-services/advanced/onion-location/contents.lr +++ b/content/onion-services/advanced/onion-location/contents.lr @@ -82,9 +82,17 @@ Or open the website in Tor Browser and a purple pill will appear in the address ### Nginx -To configure Onion-Location header, you will need to edit nginx website configuration file. +To configure an Onion-Location header, the service operator should first configure an Onion service. -**Step 1.** Edit website configuration file +**Step 1.** Create an Onion service by setting the following in `torrc`: + +``` +HiddenServiceDir /var/lib/tor/hs-my-website/ +HiddenServiceVersion 3 +HiddenServicePort 80 unix:/var/run/tor-hs-my-website.sock +``` + +**Step 2.** Edit website configuration file In `/etc/nginx/conf.d/<your-website>.conf` add the Onion-Location header and the onion service address. For example: @@ -113,7 +121,7 @@ server { listen 443 ssl http2; listen [::]:443 ssl http2; - server_name <your-website.tld> <your-onion-address.onion>; + server_name <your-website.tld>; # managed by Certbot - https://certbot.eff.org/ ssl_certificate /etc/letsencrypt/live/<hostname>/fullchain.pem; @@ -125,7 +133,6 @@ server { add_header Onion-Location http://<your-onion-address>.onion$request_uri; # managed by Certbot - include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; @@ -138,9 +145,20 @@ server { try_files $uri $uri/ =404; } } + +server { + listen unix:/var/run/tor-hs-my-website.sock; + + server_name <your-onion-address>.onion; + + access_log /var/log/nginx/hs-my-website.log; + + index index.html; + root /path/to/htdocs; +} ``` -**Step 2.** Test website configuration +**Step 3.** Test website configuration $ sudo nginx -t @@ -151,13 +169,13 @@ nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful ``` -**Step 3.** Restart nginx +**Step 4.** Restart nginx $ sudo nginx -s reload If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. -**Step 4.** Testing your Onion-Location +**Step 5.** Testing your Onion-Location To test if the Onion-Location is working, fetch the web site HTTP headers, for example:

1 0

[community/staging] Fix typo
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 46365e296007fabaeffbde22d2ed1211e82609db Author: Amin Shah Gilani <amin(a)gilani.me> Date: Mon Jul 13 15:21:10 2020 +0500 Fix typo --- content/onion-services/advanced/onion-location/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/onion-services/advanced/onion-location/contents.lr b/content/onion-services/advanced/onion-location/contents.lr index 74664ab..efd5e0c 100644 --- a/content/onion-services/advanced/onion-location/contents.lr +++ b/content/onion-services/advanced/onion-location/contents.lr @@ -17,7 +17,7 @@ html: two-columns-page.html body: Onion-Location is an easy way to advertise an onion site to the users. -You can either configure a web server to show an Onion-Location Header or add an HTML meta attibute in the website. +You can either configure a web server to show an Onion-Location Header or add an HTML meta attribute in the website. For the header to be valid the following conditions need to be fulfilled:

1 0

[community/staging] Clean up a few phrases
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 45ac51b0e3d00b456604123885a7b6f1ff6af646 Author: null pointer exception <57326449+deathgrippin(a)users.noreply.github.com> Date: Fri Jun 5 19:06:53 2020 +0000 Clean up a few phrases - Change language from "onion service version X" to "vX onion service" to fit in with other pages - Reword a few phrases to make them less awkward to read - Add missing spaces and colons --- content/onion-services/advanced/client-auth/contents.lr | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/content/onion-services/advanced/client-auth/contents.lr b/content/onion-services/advanced/client-auth/contents.lr index 18be426..24cb573 100644 --- a/content/onion-services/advanced/client-auth/contents.lr +++ b/content/onion-services/advanced/client-auth/contents.lr @@ -18,13 +18,13 @@ body: Client authorization is a method to make an onion service private and authenticated. It requires Tor clients to provide an authentication credential in order to connect to the onion service. -In Onion services version 3, this method works with a pair of keys (a public and a private). +For v3 onion services, this method works with a pair of keys (a public and a private). The service side is configured with a public key and the client can only access it with a private key. **Note:** Once you have configured client authorization, anyone with the address will not be able to access it from this point on. If no authorization is configured, the service will be accessible to anyone with the onion address. -## Configuring Onion service version 3 +## Configuring v3 Onion Services ### Service side @@ -59,16 +59,16 @@ $ openssl pkey -in /tmp/k1.prv.pem -pubout | grep -v " PUBLIC KEY" | base64pem - $ cat /tmp/k1.pub.key -**Step 4.** Create an authorized client file +**Step 4.** Create an authorized client file: Format the client authentication and create a new file in `<HiddenServiceDir>/authorized_clients/` directory. Each file in that directory should be suffixed with ".auth" (i.e. "alice.auth"; the file name is irrelevant) and its content format must be: <auth-type>:<key-type>:<base32-encoded-public-key> -The supported `<auth-type>` are: "descriptor". +The supported values for `<auth-type>` are: "descriptor". -The supported `<key-type>` are:"x25519". +The supported values for `<key-type>` are: "x25519". The `<base32-encoded-public-key>` is the base32 representation of the raw key bytes only (32 bytes for x25519). @@ -78,7 +78,7 @@ For example, the file `/var/lib/tor/hidden_service/authorized_clients/alice.auth If you are planning to have more authenticated clients, each file must contain one line only. Any malformed file will be ignored. -**Step 5.** Restart the tor service +**Step 5.** Restart the tor service: $ sudo systemctl reload tor @@ -109,7 +109,7 @@ If you are generating a private key for an onion site, the user does not necessa For more information about client authentication, please see [Tor manual](https://2019.www.torproject.org/docs/tor-onion-service.html.en#Clie…. -## Configuring Onion service version 2 +## Configuring v2 Onion Services To set up Cookie Authentication for **v2** services, see the entries for the [HidServAuth](https://2019.www.torproject.org/docs/tor-manual.html.en#HidSer… and [HiddenServiceAuthorizeClient](https://2019.www.torproject.org/docs/tor-manu… options in the tor manual. First add the following line to the [torrc](https://2019.www.torproject.org/docs/faq.html.en#torrc) file of your onion service: @@ -122,4 +122,4 @@ To access it with a tor client, add following line to torrc and restart tor: HidServAuth [onion-address] [auth-cookie] [service-name] -You can connect now to the onion service address. +You can now connect to the onion service address.

1 0

[community/staging] Merge branch 'patch-1'
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 131b697da073e21645a50a28685fb645093a7fcc Merge: 46365e2 1e6a6db Author: gus <gus(a)torproject.org> Date: Mon Jul 13 08:15:31 2020 -0400 Merge branch 'patch-1' content/relay-operations/technical-setup/post-install/contents.lr | 1 + 1 file changed, 1 insertion(+)

1 0

[community/staging] Add keys folder location Fedora
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 1e6a6db50ae322c9e69240d9d48c025c0c8afd66 Author: Devices <devices(a)autistici.org> Date: Thu Jul 2 18:35:43 2020 +0000 Add keys folder location Fedora Added another operating system and its keys location. --- content/relay-operations/technical-setup/post-install/contents.lr | 1 + 1 file changed, 1 insertion(+) diff --git a/content/relay-operations/technical-setup/post-install/contents.lr b/content/relay-operations/technical-setup/post-install/contents.lr index 5105e69..f7ee53c 100644 --- a/content/relay-operations/technical-setup/post-install/contents.lr +++ b/content/relay-operations/technical-setup/post-install/contents.lr @@ -119,6 +119,7 @@ Default locations of the keys folder: * Debian/Ubuntu: `/var/lib/tor/keys` * FreeBSD: `/var/db/tor/keys` +* Fedora: `/var/lib/tor/keys` ## Subscribe to the tor-announce mailing list

1 0

[community/staging] Merge branch 'windows-bridge' of github.com:nicoleiocana/community into windows-bridge
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 7a69881b47c74f796806b153343129d51cfa7249 Merge: 6ce05bb ec8fbba Author: Philipp Winter <phw(a)nymity.ch> Date: Thu Jul 9 10:58:52 2020 -0700 Merge branch 'windows-bridge' of github.com:nicoleiocana/community into windows-bridge .../technical-setup/bridge/windows/contents.lr | 107 +++++++++++++++++++++ 1 file changed, 107 insertions(+)

1 0