- tor-commits - lists.torproject.org

[translation/mat-gui_completed] https://gitweb.torproject.org/translation.git/commit/?h=mat-gui_completed
by translation＠torproject.org 02 Jun '20

02 Jun '20

commit bc0cadb48346ab82ea9ecd6c3b20c96e1dbf2b16 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Jun 2 10:16:49 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=mat-gui_completed --- hr.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hr.po b/hr.po index 07d9c94124..44201629c8 100644 --- a/hr.po +++ b/hr.po @@ -3,7 +3,7 @@ # This file is distributed under the same license as the PACKAGE package. # # Translators: -# Milo Ivir <mail(a)milotype.de>, 2020 +# milotype <mail(a)milotype.de>, 2020 # Vlado V. <vlays(a)mail.com>, 2015 msgid "" msgstr "" @@ -11,7 +11,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2016-02-10 23:06+0100\n" "PO-Revision-Date: 2020-04-10 13:15+0000\n" -"Last-Translator: Milo Ivir <mail(a)milotype.de>\n" +"Last-Translator: milotype <mail(a)milotype.de>\n" "Language-Team: Croatian (http://www.transifex.com/otf/torproject/language/hr/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n"

1 0

[translation/liveusb-creator_completed] https://gitweb.torproject.org/translation.git/commit/?h=liveusb-creator_completed
by translation＠torproject.org 02 Jun '20

02 Jun '20

commit dbfa3e673edbf8cfd11fbac4fdd524dcf47f8ca1 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Jun 2 10:16:31 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=liveusb-creator_com… --- hr/hr.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hr/hr.po b/hr/hr.po index 2e61efde74..8f15aa6c9e 100644 --- a/hr/hr.po +++ b/hr/hr.po @@ -4,7 +4,7 @@ # # Translators: # Emma Peel, 2019 -# Milo Ivir <mail(a)milotype.de>, 2020 +# milotype <mail(a)milotype.de>, 2020 # Niksa Makitan <onionbrain80(a)protonmail.com>, 2018 # Nives Miletic <nives.miletic(a)gmail.com>, 2018 # Vlado V. <vlays(a)mail.com>, 2015 @@ -14,7 +14,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2019-10-21 09:03+0200\n" "PO-Revision-Date: 2020-04-09 22:33+0000\n" -"Last-Translator: Milo Ivir <mail(a)milotype.de>\n" +"Last-Translator: milotype <mail(a)milotype.de>\n" "Language-Team: Croatian (http://www.transifex.com/otf/torproject/language/hr/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n"

1 0

[translation/communitytpo-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-contentspot
by translation＠torproject.org 02 Jun '20

02 Jun '20

commit 276eea1837b5a91d0ccd1456aad36fbc08363168 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Jun 2 10:15:28 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-conten… --- contents+hr.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/contents+hr.po b/contents+hr.po index 3265da1587..161d903b0e 100644 --- a/contents+hr.po +++ b/contents+hr.po @@ -3,7 +3,7 @@ # Karlo Prikratki <karlo(a)karloprikratki.com>, 2019 # erinm, 2019 # Emma Peel, 2019 -# Milo Ivir <mail(a)milotype.de>, 2020 +# milotype <mail(a)milotype.de>, 2020 # msgid "" msgstr "" @@ -11,7 +11,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2019-12-11 12:15+CET\n" "PO-Revision-Date: 2019-12-11 10:50+0000\n" -"Last-Translator: Milo Ivir <mail(a)milotype.de>, 2020\n" +"Last-Translator: milotype <mail(a)milotype.de>, 2020\n" "Language-Team: Croatian (https://www.transifex.com/otf/teams/1519/hr/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n"

1 0

[translation/tor_animation] https://gitweb.torproject.org/translation.git/commit/?h=tor_animation
by translation＠torproject.org 02 Jun '20

02 Jun '20

commit c61faf6c78707b6f00616e48ee76ac18024a578d Author: Translation commit bot <translation(a)torproject.org> Date: Tue Jun 2 02:50:45 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tor_animation --- hi.srt | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/hi.srt b/hi.srt index 0bea3c14bb..4dbbdd44e2 100644 --- a/hi.srt +++ b/hi.srt @@ -25,32 +25,30 @@ about ourselves and our private lives: 7 00:00:18,060 --> 00:00:22,480 -they'll see your real identity, -precise location, operating system, +वो आपकी असली पहचान, आपकी लोकैशन, ऑपरेटिंग सिस्टम 8 00:00:22,800 --> 00:00:26,500 -all the sites you've visited, -the browser you use to surf the web, +वो सारी साइट जो आपने खोली होंगी, +आप जो ब्राउजर रोज इस्तेमाल करते है, 9 00:00:26,700 --> 00:00:29,140 -and so much more information -about you and your life +और बहुत सारी ऐसी जानकारी +आपके और आपकी ज़िंदगी के बारे मे 10 00:00:29,200 --> 00:00:31,500 -which you probably didn't mean -to share with unknown strangers, +जो आप शायद कभि भी +अनजान लोगों को नहीं बताना चाहते थे, 11 00:00:31,700 --> 00:00:34,000 -who could easily use this data -to exploit you. +वो सब आपके खिलाफ इस्तेमाल करके आपको फसा सकते है। 12 00:00:34,500 --> 00:00:37,000 -But not if you're using Tor! +लेकिन अगर आप टॉर इस्तेमाल करते है, तो आप इससे बच सकते है! 13 00:00:37,140 --> 00:00:40,840 @@ -160,5 +158,5 @@ like activists, journalists and bloggers. 35 00:02:02,000 --> 00:02:07,000 -Download and use Tor! Or run a relay! +टॉर डाउनलोड करे और उसका इस्तेमाल करे! या अपने लैपटॉप पे रीले चलाये!

1 0

[translation/tor_animation] https://gitweb.torproject.org/translation.git/commit/?h=tor_animation
by translation＠torproject.org 02 Jun '20

02 Jun '20

commit 917c97d8d47cf9a8262ffe82846d9e9f008d86b9 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Jun 2 02:20:52 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tor_animation --- hi.srt | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/hi.srt b/hi.srt index 0e6056a979..0bea3c14bb 100644 --- a/hi.srt +++ b/hi.srt @@ -1,6 +1,6 @@ 1 00:00:00,660 --> 00:00:02,780 -We've gotten very used to the Internet. +हम आजकल इंटर्नेट बहुत इस्तमाल करते है। 2 00:00:03,120 --> 00:00:07,700 @@ -9,20 +9,19 @@ about ourselves and our private lives: 3 00:00:08,000 --> 00:00:09,960 -food we eat, people we meet, +जो खाना हम खाते है, जिन लोगों से हम मिलते है, 4 00:00:10,180 --> 00:00:12,480 -places we go, and the stuff we read. +जहां हम जाते है, और जो हम पढ़ते है। 5 00:00:13,280 --> 00:00:14,640 -Let me explain it better. +और अच्छे से समझाये तो ये कह सकते है के 6 00:00:14,920 --> 00:00:17,740 -Right at this moment, -if someone attempts to look you up, +अभि इसी वक्त कोई आपके बारे मैं पता करने की कोशिश करे तो, 7 00:00:18,060 --> 00:00:22,480

1 0

[tpo/master] Update content
by antonela＠torproject.org 01 Jun '20

01 Jun '20

commit 8bf0e1b0bd349dd10d7c33f00ca695790d4355f2 Author: Antonela <hola(a)antonela.me> Date: Mon Jun 1 17:40:15 2020 -0300 Update content --- content/releases/tor-browser-95/contents.lr | 24 +++++++++++++++++++----- templates/release.html | 2 +- 2 files changed, 20 insertions(+), 6 deletions(-) diff --git a/content/releases/tor-browser-95/contents.lr b/content/releases/tor-browser-95/contents.lr index 6297ade1..74f51ee0 100644 --- a/content/releases/tor-browser-95/contents.lr +++ b/content/releases/tor-browser-95/contents.lr @@ -10,6 +10,7 @@ body: ## This new Tor Browser release is focused on helping users understand onion services. + Tor's onion routing remains the best way to achieve end-to-end anonymous communication on the Internet. With onion services (.onion addresses), website administrators can provide their users with anonymous connections that are metadata-free or that hide metadata from any third party. Onion services are also one of the few censorship circumvention technologies that allow users to route around censorship while simultaneously protecting their privacy and identity. For the first time, Tor Browser users will be able to opt-in for using onion sites automatically whenever the website makes them available. For years, some websites have invisibly used onion services with alternative services, and this continues to be an excellent choice. Now, there is also an option for websites that want their users to know about their onion service to invite them to opt-in to use their .onion address. @@ -20,30 +21,43 @@ For the first time, Tor Browser users will be able to opt-in for using onion sit Website publishers now can advertise their onion service to Tor users by adding an HTTP header. When visiting a website that has both an .onion address and Onion Location enabled via Tor Browser, users will be prompted about the onion service version of the site and will be asked to opt-in to upgrade to the onion service on their first use. -![Tor Browser 9.5 Onion Location](https://blog.torproject.org/sites/default/files/styles/full_width… +<img class="w-100" src="/static/images/tb95/onion-location-propublica(a)2x.png" alt="Tor Browser 9.5 Onion Location"/> + **Onion Authentication** -Onion services administrators who want to add an extra layer of security to their website can now set a pair of keys for access control and authentication. Tor Browser users can save keys and manage them via about:preferences#privacy in the Onion Services Authentication section. +Onion services administrators who want to add an extra layer of security to their website can now set a pair of keys for access control and authentication. + +<img class="w-100" src="/static/images/tb95/onion-auth(a)2x.png" alt="Tor Browser 9.5 Onion Authentication"/> + +Tor Browser users can save keys and manage them via about:preferences#privacy in the Onion Services Authentication section. + +<img class="w-100" src="/static/images/tb95/onion-auth2(a)2x.png" alt="Tor Browser 9.5 Onion Authentication"/> + **Improved URL Bar Security Indicators** Browsers traditionally rendered sites delivered via a secure transport protocol with a green lock icon. But in mid-2019, the formerly green lock icon became gray, intending to de-emphasize the default (safe) connection state and instead of putting more emphasis on broken or insecure connections. Major browsers as Firefox and Chrome understood that it is a benefit for the entire user base if they deploy familiar experiences for both users. We are following Firefox on this decision, and have we updated Tor Browser security indicators to make it easier for users to understand when they are visiting an non-secure website. +<img class="w-100" src="/static/images/tb95/onion-url-bar-update(a)2x.png" alt="Tor Browser 9.5 URL Bar Security Indicators"/> + + **Error pages for onion services** Sometimes users have a hard time reaching onion sites. In previous version of Tor Browser, when there was an error connecting to an onion service, users received a standard Firefox error message, with no information about why they were unable to connect to the onion site. In this release, we have improved the way Tor Browser communicates with users about service-, client-, and network-side errors that might happpen when they are trying to visit an onion service. Tor Browser now displays a simplified diagram of the connection and shows where the error occured. We want these messages to be clear and informative without being overwhelming. +<img class="w-100" src="/static/images/tb95/onion-error(a)2x.png" alt="Tor Browser 9.5 Error Pages for Onionsites"/> + + **Onion Names** Because of cryptographic protections, onion service URLs are not easy for humans to remember (ie, torproject.org vs. expyuzz4wqqyqhjn.onion). This makes it hard for users to discover or return to an onion site. We found that organically, developers have approached this problem in different ways, mostly with solutions tailored for their service. Given that there is no solution that works perfectly for all our user groups, we also approached this problem from a broad angle. For this release, we partnered with the [Freedom of the Press Foundation](https://freedom.press/) and [HTTPS Everywhere](https://www.eff.org/https-everywhere) to develop the first proof-of-concept for human-memorable names for onion services addresses. -**Known Issues** - -Tor Browser 9.5 comes with a number of known issues. The most important ones are: +<img class="w-100" src="/static/images/tb95/onion-names(a)2x.png" alt="Tor Browser 9.5 Onion Names"/> + **Give Feedback** If you find a bug or have a suggestion for how we could improve this release, please let us know. Thanks to all of the teams across Tor, and the many volunteers, who contributed to this release. diff --git a/templates/release.html b/templates/release.html index 9200ebd4..c1ad2f2e 100644 --- a/templates/release.html +++ b/templates/release.html @@ -6,7 +6,7 @@ {% set locale = bag('alternatives', this.alt) %} <main role="main" class="mx-auto col-12 {{ locale.order }} {{ locale.direction }}"> - <div class="container py-3 mt-5 content"> + <div class="container py-3 mt-5"> <div class="col-sm-9"> {% block body %}

1 0

[tpo/master] Add images
by antonela＠torproject.org 01 Jun '20

01 Jun '20

commit 4b489ee22782bfaf3ab1b3030c192e206ccdde14 Author: Antonela <hola(a)antonela.me> Date: Mon Jun 1 17:00:44 2020 -0300 Add images --- assets/static/images/tb95/onion-auth.png | Bin 0 -> 52389 bytes assets/static/images/tb95/onion-auth2.png | Bin 0 -> 79194 bytes assets/static/images/tb95/onion-auth2(a)2x.png | Bin 0 -> 270354 bytes assets/static/images/tb95/onion-auth(a)2x.png | Bin 0 -> 192867 bytes assets/static/images/tb95/onion-error.png | Bin 0 -> 86735 bytes assets/static/images/tb95/onion-error(a)2x.png | Bin 0 -> 305169 bytes .../static/images/tb95/onion-location-propublica.png | Bin 0 -> 195783 bytes .../static/images/tb95/onion-location-propublica2.png | Bin 0 -> 84147 bytes .../images/tb95/onion-location-propublica2(a)2x.png | Bin 0 -> 295176 bytes .../images/tb95/onion-location-propublica(a)2x.png | Bin 0 -> 659848 bytes assets/static/images/tb95/onion-location-riseup.png | Bin 0 -> 152691 bytes assets/static/images/tb95/onion-location-riseup(a)2x.png | Bin 0 -> 471532 bytes assets/static/images/tb95/onion-names.png | Bin 0 -> 89241 bytes assets/static/images/tb95/onion-names(a)2x.png | Bin 0 -> 306049 bytes assets/static/images/tb95/onion-url-bar-update.png | Bin 0 -> 39914 bytes assets/static/images/tb95/onion-url-bar-update(a)2x.png | Bin 0 -> 108234 bytes content/releases/tor-browser-95/contents.lr | 6 +++--- 17 files changed, 3 insertions(+), 3 deletions(-) diff --git a/assets/static/images/tb95/onion-auth.png b/assets/static/images/tb95/onion-auth.png new file mode 100644 index 00000000..28bad7e5 Binary files /dev/null and b/assets/static/images/tb95/onion-auth.png differ diff --git a/assets/static/images/tb95/onion-auth2.png b/assets/static/images/tb95/onion-auth2.png new file mode 100644 index 00000000..dbd2fe8e Binary files /dev/null and b/assets/static/images/tb95/onion-auth2.png differ diff --git a/assets/static/images/tb95/onion-auth2(a)2x.png b/assets/static/images/tb95/onion-auth2(a)2x.png new file mode 100644 index 00000000..13a920fc Binary files /dev/null and b/assets/static/images/tb95/onion-auth2(a)2x.png differ diff --git a/assets/static/images/tb95/onion-auth(a)2x.png b/assets/static/images/tb95/onion-auth(a)2x.png new file mode 100644 index 00000000..c044a1ab Binary files /dev/null and b/assets/static/images/tb95/onion-auth(a)2x.png differ diff --git a/assets/static/images/tb95/onion-error.png b/assets/static/images/tb95/onion-error.png new file mode 100644 index 00000000..484bbdd6 Binary files /dev/null and b/assets/static/images/tb95/onion-error.png differ diff --git a/assets/static/images/tb95/onion-error(a)2x.png b/assets/static/images/tb95/onion-error(a)2x.png new file mode 100644 index 00000000..c43fcb92 Binary files /dev/null and b/assets/static/images/tb95/onion-error(a)2x.png differ diff --git a/assets/static/images/tb95/onion-location-propublica.png b/assets/static/images/tb95/onion-location-propublica.png new file mode 100644 index 00000000..f694b820 Binary files /dev/null and b/assets/static/images/tb95/onion-location-propublica.png differ diff --git a/assets/static/images/tb95/onion-location-propublica2.png b/assets/static/images/tb95/onion-location-propublica2.png new file mode 100644 index 00000000..8f63278f Binary files /dev/null and b/assets/static/images/tb95/onion-location-propublica2.png differ diff --git a/assets/static/images/tb95/onion-location-propublica2(a)2x.png b/assets/static/images/tb95/onion-location-propublica2(a)2x.png new file mode 100644 index 00000000..6237f68f Binary files /dev/null and b/assets/static/images/tb95/onion-location-propublica2(a)2x.png differ diff --git a/assets/static/images/tb95/onion-location-propublica(a)2x.png b/assets/static/images/tb95/onion-location-propublica(a)2x.png new file mode 100644 index 00000000..c6ef759e Binary files /dev/null and b/assets/static/images/tb95/onion-location-propublica(a)2x.png differ diff --git a/assets/static/images/tb95/onion-location-riseup.png b/assets/static/images/tb95/onion-location-riseup.png new file mode 100644 index 00000000..ae56cf62 Binary files /dev/null and b/assets/static/images/tb95/onion-location-riseup.png differ diff --git a/assets/static/images/tb95/onion-location-riseup(a)2x.png b/assets/static/images/tb95/onion-location-riseup(a)2x.png new file mode 100644 index 00000000..813f2668 Binary files /dev/null and b/assets/static/images/tb95/onion-location-riseup(a)2x.png differ diff --git a/assets/static/images/tb95/onion-names.png b/assets/static/images/tb95/onion-names.png new file mode 100644 index 00000000..ae25af0f Binary files /dev/null and b/assets/static/images/tb95/onion-names.png differ diff --git a/assets/static/images/tb95/onion-names(a)2x.png b/assets/static/images/tb95/onion-names(a)2x.png new file mode 100644 index 00000000..6066ef5f Binary files /dev/null and b/assets/static/images/tb95/onion-names(a)2x.png differ diff --git a/assets/static/images/tb95/onion-url-bar-update.png b/assets/static/images/tb95/onion-url-bar-update.png new file mode 100644 index 00000000..0aa897dc Binary files /dev/null and b/assets/static/images/tb95/onion-url-bar-update.png differ diff --git a/assets/static/images/tb95/onion-url-bar-update(a)2x.png b/assets/static/images/tb95/onion-url-bar-update(a)2x.png new file mode 100644 index 00000000..fc4c9ea3 Binary files /dev/null and b/assets/static/images/tb95/onion-url-bar-update(a)2x.png differ diff --git a/content/releases/tor-browser-95/contents.lr b/content/releases/tor-browser-95/contents.lr index 83c5713a..6297ade1 100644 --- a/content/releases/tor-browser-95/contents.lr +++ b/content/releases/tor-browser-95/contents.lr @@ -8,9 +8,7 @@ title: Tor Browser 9.5 --- body: -## Tor Browser 9.5 is now available from the Tor Browser download page and from our distribution directory. The Android version is also available from Google Play and should be available from F-Droid within the next day. - -This new Tor Browser release is focused on helping users understand onion services. +## This new Tor Browser release is focused on helping users understand onion services. Tor's onion routing remains the best way to achieve end-to-end anonymous communication on the Internet. With onion services (.onion addresses), website administrators can provide their users with anonymous connections that are metadata-free or that hide metadata from any third party. Onion services are also one of the few censorship circumvention technologies that allow users to route around censorship while simultaneously protecting their privacy and identity. @@ -22,6 +20,8 @@ For the first time, Tor Browser users will be able to opt-in for using onion sit Website publishers now can advertise their onion service to Tor users by adding an HTTP header. When visiting a website that has both an .onion address and Onion Location enabled via Tor Browser, users will be prompted about the onion service version of the site and will be asked to opt-in to upgrade to the onion service on their first use. +![Tor Browser 9.5 Onion Location](https://blog.torproject.org/sites/default/files/styles/full_width… + **Onion Authentication** Onion services administrators who want to add an extra layer of security to their website can now set a pair of keys for access control and authentication. Tor Browser users can save keys and manage them via about:preferences#privacy in the Onion Services Authentication section.

1 0

[tpo/master] Fix content hierarchy
by antonela＠torproject.org 01 Jun '20

01 Jun '20

commit 4066d8eb60398535d56ac151562577aba95fa48a Author: Antonela <hola(a)antonela.me> Date: Mon Jun 1 15:52:46 2020 -0300 Fix content hierarchy --- content/releases/{tor-browser => }/tor-browser-95/contents.lr | 0 content/releases/tor-browser/contents.lr | 11 ----------- 2 files changed, 11 deletions(-) diff --git a/content/releases/tor-browser/tor-browser-95/contents.lr b/content/releases/tor-browser-95/contents.lr similarity index 100% rename from content/releases/tor-browser/tor-browser-95/contents.lr rename to content/releases/tor-browser-95/contents.lr diff --git a/content/releases/tor-browser/contents.lr b/content/releases/tor-browser/contents.lr deleted file mode 100644 index b85e3323..00000000 --- a/content/releases/tor-browser/contents.lr +++ /dev/null @@ -1,11 +0,0 @@ -section: What is new ---- -template: layout.html ---- -html: releases.html ---- -color: primary ---- -title: Tor Browser Releases ---- -body:

1 0

[community/master] Create Advanced settings section: Onion-Location, Client authorization and Opsec tips
by gus＠torproject.org 01 Jun '20

01 Jun '20

commit a96be5d44ce37f14d9f6b2be9c2e9b5aeb6f4235 Author: gus <gus(a)torproject.org> Date: Wed May 27 23:37:27 2020 -0400 Create Advanced settings section: Onion-Location, Client authorization and Opsec tips --- .../advanced/client-auth/contents.lr | 125 ++++++++++++++++++ content/onion-services/advanced/contents.lr | 19 +++ .../advanced/onion-location/contents.lr | 147 +++++++++++++++++++++ content/onion-services/advanced/opsec/contents.lr | 32 +++++ 4 files changed, 323 insertions(+) diff --git a/content/onion-services/advanced/client-auth/contents.lr b/content/onion-services/advanced/client-auth/contents.lr new file mode 100644 index 0000000..071a8e7 --- /dev/null +++ b/content/onion-services/advanced/client-auth/contents.lr @@ -0,0 +1,125 @@ +_section: Advanced settings +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: Client Authorization +--- +subtitle: Learn how to set up client authorization for your onion services. +--- +key: 2 +--- +html: two-columns-page.html +--- +body: + +Client authorization is a method to make an onion service private and authenticated. +It requires Tor clients to provide an authentication credential in order to connect to the onion service. +In version 3 Onion services, this method works with a pair of keys (a public and a private). +The service side will be configured with a public key and the client can only access with a private key. + +**Note:** Once you've configured client authorization, anyone else with the address won't be able to access it from this point on. +If no authorization is configured, the service will be accessible to anyone with the onion address. + +## Configuring version 3 Onion service + +### Service side + +To configure client authorization on the service side, the `<HiddenServiceDir>/authorized_clients/` directory needs to exist. Following the instructions described in the section [Setup](https://community.torproject.org/onion-services/setup/) will automatically create this directory. +Client authorization will only be enabled for the service if tor successfully loads at least one authorization file. + +At the moment you need to create the keys yourself with a script (like these written in [Bash](https://gist.github.com/mtigas/9c2386adf65345be34045dace134140b), [Rust](https://github.com/haxxpop/torkeygen) or [Python](https://github.com/pastly/python-snippits/blob/master/src/tor/x2551…) or manually. + +To manually generate the keys, you need to install `openssl` version 1.1+ and `basez`. + +**Step 1.** Generate a key using the algorithm x25519: + + $ openssl genpkey -algorithm x25519 -out /tmp/k1.prv.pem + +If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. + +**Step 2.** Format the keys into base32: + +**Private key** + +``` +$ cat /tmp/k1.prv.pem | grep -v " PRIVATE KEY" | base64pem -d | tail --bytes=32 | base32 | sed 's/=//g' > /tmp/k1.prv.key +``` + +**Public key** + +``` +$ openssl pkey -in /tmp/k1.prv.pem -pubout | grep -v " PUBLIC KEY" | base64pem -d | tail --bytes=32 | base32 | sed 's/=//g' > /tmp/k1.pub.key +``` + +**Step 3.** Copy the public key: + + $ cat /tmp/k1.pub.key + +**Step 4.** Create an authorized client file + +Format the client authentication and create a new file in `<HiddenServiceDir>/authorized_clients/` directory. +Each file in that directory should be suffixed with ".auth" (i.e. "alice.auth"; the file name is irrelevant) and its content format must be: + + <auth-type>:<key-type>:<base32-encoded-public-key> + +The supported `<auth-type>` are: "descriptor". + +The supported `<key-type>` are:"x25519". + +The `<base32-encoded-public-key>` is the base32 representation of the raw key bytes only (32 bytes for x25519). + +For example, the file `/var/lib/tor/hidden_service/authorized_clients/alice.auth` should look like: + + descriptor:x25519:N2NU7BSRL6YODZCYPN4CREB54TYLKGIE2KYOQWLFYC23ZJVCE5DQ + +If you're planning to have more authenticated clients, each file must contain one line only. Any malformed file will be ignored. + +**Step 5.** Restart the tor service + + $ sudo systemctl reload tor + +If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. + +**Important:** Revoking a client can be done by removing their ".auth" file, however the revocation will be in effect only after the tor process gets restarted. + +### Client side + +To access a version 3 onion service with client authorization as a client, make sure you have `ClientOnionAuthDir` set in your torrc. +For example, add this line to `/etc/tor/torrc`: + + ClientOnionAuthDir /var/lib/tor/onion_auth + +Then, in the `<ClientOnionAuthDir>` directory, create an `.auth_private` file for the onion service corresponding to this key (i.e. 'bob_onion.auth_private'). +The contents of the `<ClientOnionAuthDir>/<user>.auth_private` file should look like: + + <56-char-onion-addr-without-.onion-part>:descriptor:x25519:<x25519 private key in base32> + +For example: + + rh5d6reakhpvuxe2t3next6um6iiq4jf43m7gmdrphfhopfpnoglzcyd:descriptor:x25519:ZDUVQQ7IKBXSGR2WWOBNM3VP5ELNOYSSINDK7CAUN2WD7A3EKZWQ + +If you manually generated the key pair following the instructions in this page, you can copy and use the private key created in **Step 2**. +Then restart `tor` and you should be able to connect to the onion service address. + +If you're generating a private key for an onionsite, the user doesn't necessarily need to edit Tor Browser's torrc. It's possible to enter the private key directly in [Tor Browser](https://tb-manual.torproject.org/onion-services/) interface. + +For more information about client authentication, please see [Tor manual](https://2019.www.torproject.org/docs/tor-onion-service.html.en#Clie…. + +## Configuring version 2 Onion service + +To set up Cookie Authentication for **v2** services see the entries for the [HidServAuth](https://2019.www.torproject.org/docs/tor-manual.html.en#HidSer… and [HiddenServiceAuthorizeClient](https://2019.www.torproject.org/docs/tor-manu… options in the tor manual. +First add the following line to the [torrc](https://2019.www.torproject.org/docs/faq.html.en#torrc) file of your onion service: + + HiddenServiceAuthorizeClient [auth-type] [service-name] + +Restart tor and read the cookie from the hostname file of your onion service, for example in +`/var/lib/tor/hidden_service_path/hostname`. +To access it with a tor client add following line to torrc and restart tor: + + HidServAuth [onion-address] [auth-cookie] [service-name] + +You are now able to connect to the onion service address. diff --git a/content/onion-services/advanced/contents.lr b/content/onion-services/advanced/contents.lr new file mode 100644 index 0000000..a17e990 --- /dev/null +++ b/content/onion-services/advanced/contents.lr @@ -0,0 +1,19 @@ +_section: onion services +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: Advanced settings +--- +subtitle: Learn more about how to configure client authentication, Onion-Location and more tips to secure your onion service. +--- +key: 3 +--- +html: two-columns-page.html +--- +body: + +In this section you will find how to configure your onion service to enable client authorization, Onion-Location and tips to make your onion service more secure. diff --git a/content/onion-services/advanced/onion-location/contents.lr b/content/onion-services/advanced/onion-location/contents.lr new file mode 100644 index 0000000..caf7d5f --- /dev/null +++ b/content/onion-services/advanced/onion-location/contents.lr @@ -0,0 +1,147 @@ +_section: advanced configuration +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: Onion-Location +--- +subtitle: Learn how to set up Onion-Location for your onionsite. +--- +key: 1 +--- +html: two-columns-page.html +--- +body: + +Onion-Location is an easy way to advertise an onionsite to the users. +You can either configure a web server to show an Onion-Location Header or add an HTML meta attibute in the website. + +For the header to be valid the following conditions need to be fulfilled: + + * The Onion-Location value must be a valid URL with http: or https: protocol and a .onion hostname. + * The webpage defining the Onion-Location header must be served over HTTPS. + * The webpage defining the Onion-Location header must not be an onionsite. + +In this page, the commands to restart the web server are based on Debian-like operating systems and may differ on other systems. +Check your web server and operating system documentation. + +### Apache + +To configure this header in Apache 2.2 or above, you will need to enable a few modules and edit the website Virtual Host file. + +**Step 1.** Enable headers and rewrite modules and restart Apache2 + + $ sudo a2enmod headers rewrite + + $ sudo systemctl restart apache2 + +If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. + +**Step 2.** Add the Onion-Location header to your Virtual Host configuration file + +``` +Header set Onion-Location "http://your-onion-address.onion%{REQUEST_URI}s" +``` + +Where `your-onion-address.onion` is the onion service address you want to redirect and `{REQUEST_URI}` is the [path component of the requested URI](https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html), such as "/index.html". + +Virtual Host example: + +``` + <VirtualHost *:443> + ServerName your-website.tld + DocumentRoot /var/www/html + Header set Onion-Location "http://rh5d6reakhpvuxe2t3next6um6iiq4jf43m7gmdrphfhopfpnoglzcyd%{REQUEST_UR…" + </VirtualHost> +``` + +**Step 3.** Reload Apache + +Reload the apache2 service so your configuration changes take effect: + + $ sudo systemctl reload apache2 + +If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. + +**Step 4.** Testing your Onion-Location + +To test if Onion-Location is working, fetch the website HTTP headers, for example: + + $ wget --server-response --spider your-website.tld + +Look for the `onion-location` entry and the onion service address. + +Or open the website in Tor Browser and a purple pill will appear in the address bar. + +### Nginx + +To configure Onion-Location header, you will need to edit Nginx website configuration file. + +**Step 1.** Edit website configuration file + +In `/etc/nginx/conf.d/<your-website.conf` add the new Onion-Location header and the onion service address. +For example: + +``` + location / { + add_header Onion-Location http://rh5d6reakhpvuxe2t3next6um6iiq4jf43m7gmdrphfhopfpnoglzcyd.onion$reque…; + } +``` + +The configuration file with Onion-Location should look like: + +``` +server { + listen 443; + + root /var/www/your-website/html; + index index.html index.htm; + + server_name your-website.tld; + + location / { + try_files $uri $uri/ =404; + add_header Onion-Location http://rh5d6reakhpvuxe2t3next6um6iiq4jf43m7gmdrphfhopfpnoglzcyd.onion$reque…; + } +} +``` + +**Step 2.** Test website configuration + + $ sudo nginx -t + +The web server should confirm that the new syntax is working: + +``` +nginx: the configuration file /etc/nginx/nginx.conf syntax is ok +nginx: configuration file /etc/nginx/nginx.conf test is successful +``` + +**Step 3.** Restart nginx + + $ sudo nginx -s reload + +If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. + +**Step 4.** Testing your Onion-Location + +To test if Onion-Location is working, fetch the website HTTP headers, for example: + + $ wget --server-response --spider your-website.tld + +Look for the `onion-location` entry and the onion service address. + +Or open the website in Tor Browser and a purple pill will appear in the address bar. + +### Using an HTML `<meta>` attribute + +The identical behaviour of Onion-Location and a Refresh header (with 0 seconds timeout) includes the option of defining it as a HTML `<meta>` http-equiv attribute. +This may be used by websites that prefer (or need) to define Onion-Location by modifying the served HTML content instead of adding a new HTTP header. +The Onion-Location header would be equivalent to a `<meta http-equiv="onion-location" content="http://<your-onion-service-address>.onion" />` added in the HTML head element of the webpage. Replace `<your-onion-service-address.onion>` with the onion service that you want to redirect. + +### More information + +Read the [Onion-Location spec](https://gitweb.torproject.org/tor-browser-spec.git/tree/proposals/100…. diff --git a/content/onion-services/advanced/opsec/contents.lr b/content/onion-services/advanced/opsec/contents.lr new file mode 100644 index 0000000..6debce0 --- /dev/null +++ b/content/onion-services/advanced/opsec/contents.lr @@ -0,0 +1,32 @@ +_section: onion services +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: Operational Security +--- +subtitle: Learn more tips to secure your Onion Services. +--- +key: 3 +--- +html: two-columns-page.html +--- +body: + +Onion services operators need to practice proper [operational security](https://trac.torproject.org/projects/tor/wiki/doc/OperationalSecu… and system administration to maintain security. +For some security suggestions please make sure you read over Riseup's ["Tor Hidden (Onion) Services Best Practices" document](https://riseup.net/en/security/network-security/tor/onionservices…. +Also, here are some more anonymity issues you should keep in mind: + + - As mentioned [here](https://community.torproject.org/onion-services/setup/), be careful of letting your web server reveal identifying information about you, your computer, or your location. +For example, readers can probably determine whether it's thttpd or Apache, and learn something about your operating system. + - If your computer isn't online all the time, your onion service won't be either. +This leaks information to an observant adversary. + - It is generally a better idea to host onion services on a Tor client rather than a Tor relay, since relay uptime and other properties are publicly visible. + - The longer an onion service is online, the higher the risk that its location is discovered. +The most prominent attacks are building a profile of the onion service's availability and matching induced traffic patterns. + - Another common issue is whether to use HTTPS on your onionsite or not. +Have a look at [this post](https://blog.torproject.org/blog/facebook-hidden-services-and-https-c… on the Tor Blog to learn more about these issues. + - To protect your onion service from advanced attacks you should use [Vanguards addon](https://github.com/mikeperry-tor/vanguards), read [Tor blog about Vanguards](https://blog.torproject.org/announcing-vanguards-add-onion-servi… and [Vanguards' Security README](https://github.com/mikeperry-tor/vanguards/blob/master/README_SECUR….

1 0

[community/master] Move some advanced tips and references to a new section
by gus＠torproject.org 01 Jun '20

01 Jun '20

commit f8e411b13c4c412c923513c58f94f35857e2ccda Author: gus <gus(a)torproject.org> Date: Wed May 27 23:36:12 2020 -0400 Move some advanced tips and references to a new section --- content/onion-services/setup/contents.lr | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/content/onion-services/setup/contents.lr b/content/onion-services/setup/contents.lr index 7b46041..464596f 100644 --- a/content/onion-services/setup/contents.lr +++ b/content/onion-services/setup/contents.lr @@ -75,14 +75,21 @@ If your keys leak, other people can impersonate your onion service, deeming it c Now you can connect to your onion service using Tor Browser, and you should get the html page you setup back in step 1. If it doesn't work, look in your logs for some hints, and keep playing with it until it works. -## Step 5: More advanced tips +## Step 5: More tips -The above guide is just a baseline to setup an onion service. -In this section we will offer more resources to better configure and protect your onion service: +If you plan to keep your service available for a long time, you might want to make a backup copy of the `private_key` file somewhere. -- Best practices for onion services -https://riseup.net/en/security/network-security/tor/onionservices-best-practices -- More advanced tips for onion services -https://2019.www.torproject.org/docs/tor-onion-service.html.en#three -- Advanced onion service security -https://blog.torproject.org/announcing-vanguards-add-onion-services +If you want to forward multiple virtual ports for a single onion service, just add more `HiddenServicePort` lines. If you want to run multiple onion services from the same Tor client, just add another `HiddenServiceDir` line. All the following `HiddenServicePort` lines refer to this `HiddenServiceDir` line, until you add another `HiddenServiceDir` line: + + HiddenServiceDir /usr/local/etc/tor/hidden_service/ + HiddenServicePort 80 127.0.0.1:8080 + + HiddenServiceDir /usr/local/etc/tor/other_hidden_service/ + HiddenServicePort 6667 127.0.0.1:6667 + HiddenServicePort 22 127.0.0.1:22 + + +You can use [stem](https://stem.torproject.org/) to [automate the management of your onion services](https://stem.torproject.org/tutorials/over_the_river.html). + + * To set up an Onion Service on Raspbian have a look at Alec Muffett's [Enterprise Onion Toolkit](https://github.com/alecmuffett/eotk). + * [Onion services best practices](https://riseup.net/en/security/network-security/tor/onionservice… by Riseup Collective.

1 0