January 2016 - tor-onions - lists.torproject.org

Protect against ddos in tor
by Flipchan 09 Feb '16

09 Feb '16

Hi all! Great with a new mailing list :) anyhow i was wondering IF anyone have any tips on some good ddos defense for .onion sites , take care -- Sincerly Flipchan

4 3

IRC Idea
by Alec Muffett 04 Feb '16

04 Feb '16

#tor-onions on OFTC?

5 4

Gitlab as a HS
by spriver 31 Jan '16

31 Jan '16

Hi, yesterday I tried to setup Gitlab Community Edition as a hidden service. Nearly almost worked until I tested the functionality of pushing back into the online repo - gitlab's shell told me first this error: Failed to connect to internal API <POST http://http://gitlab.agsdcxdr6z2wbjf5.onion/api/v3/internal/allowed>: #<SocketError: getaddrinfo: Name or service not known> So i configured my server to relay .onion addresses to the Tor DNS port. But after that I'm getting the following error: [2016-01-31T17:24:43.071616 #1219] WARN -- : Failed to connect to internal API <POST http://gitlab.agsdcxdr6z2wbjf5.onion/api/v3/internal/allowed>: #<Errno::EINVAL: Invalid argument - connect(2) for "gitlab.agsdcxdr6z2wbjf5.onion" port 80> I'm out of ideas for now, does anybody has a clue what can be done now to resolve this? Cheers! spriver

2 1

Automatic "Onionification" of existing websites
by Fabio Pietrosanti (naif) - lists 31 Jan '16

31 Jan '16

Hello, i've been considering that nowLetsencrypt let you automate setup of TLS certificate, for existing websites that does not have HTTPS. What's about thinking about "automations" and "improvement to existing webserver software" to facilitate the automatic "Onionification" of existing websites? >From a "sysadmin point of view" it would be a cool thing, if it's somehow easy and automated to do. It shall be a mod_tor of apache2 or something similar. I'm just firing the discussion, but if we want thousands of onion sites, then we need to facilitate the deployment on the existing configured websites, without requiring a sysadmin to do a lot of hackish stuff. -- Fabio Pietrosanti (naif) HERMES - Center for Transparency and Digital Human Rights http://logioshermes.org - https://globaleaks.org - https://tor2web.org - https://ahmia.fi

4 5

If you run a Tor hidden service for an Apache server, make sure you disable mod_status
by Alec Muffett 31 Jan '16

31 Jan '16

A word for the wise... https://wireflaw.net/blog/apache-hidden-service-vuln.html Tor hidden service operators: your default Apache install is probably vulnerable TL;DR If you run a Tor hidden service for an Apache server, make sure you disable mod_status with: $ a2dismod status On most distributions, Apache ships with a handy feature called mod_status enabled. It's a page located at /server-status that displays some statistics, like uptime, resource usage, total traffic, enabled virtual hosts, and active HTTP requests. For security reasons, it's only accessible from localhost by default. This seems fairly reasonable, until you realize the Tor daemon runs on localhost. Consequently, any hidden service using Apache's default config has /server-status exposed to the world. What could a malicious actor do in that case? They could spy on potentially sensitive requests. They could deduce the server's approximate longitude if the timezone is set. They could even determine its IP address if a clearnet Virtual Host is present. But this shouldn't be too much of a problem. Surely people who have taken the time to install an advanced web server and configure a hidden service for it have thoroughly read the documentation and disabled the offending module. Or not. [continues...] -- http://dropsafe.crypticide.com/aboutalecm

4 5

Ansible: Automated Tor Hiddenservice Setup
by shadow 29 Jan '16

29 Jan '16

Hello fellows, we wrote an ansible role(http://www.ansible.com/) to automate the setup, configuration and maintenance, of hiddenservices with ansible on a debian system. https://github.com/systemli/ansible-role-hidden-service Maybe it's usefull for you too. shadow // systemli.org -- best regards | viele Gruesse, shadow(a)systemli.org receive my key: gpg --keyserver zimmermann.mayfirst.org --recv-keys 0x5C6B6ED4248C1F32

1 1

[rt.torproject.org #63908] Onion Services & External Resources Hosted On Them
by Wilton Gorske 29 Jan '16

29 Jan '16

-------- Forwarded Message -------- Subject: [rt.torproject.org #63908] Onion Services & External Resources Hosted On Them Date: Fri, 29 Jan 02016 02:19:11 +0000 From: mk via RT <help(a)rt.torproject.org> Reply-To: help(a)rt.torproject.org To: wilton(a)riseup.net I think you might want to try it on our new ML: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-onions. On 02016-01-27 23:34:47, wilton(a)riseup.net wrote: > Hello Tor, > > I have a question about Onion Services hosting external resources. > > If there's a webserver hosted as an Onion Service, with an external > resource coded (for instance, a Flickr image on the home page), which > 'node' in the rendezvous points system calls that resource? The client? > The hidden service? The rendezvous? > > It's obviously clear how this works with an exit node on the clearnet, > but not so (to me) with Onion Services. I guess it's the hidden service, > but that means someone watching the network connection of the service > could see it calling the resources for a client every time it was > requested. Right? > > Thanks in advance, > Wilton -- m.k.

2 1

web service onionification
by Andreas Krey 28 Jan '16

28 Jan '16

Hi all, I'm looking for a guide how to take an existing service, and convert it into an .onion-too service (what facebook and propublica did). Problem: Webservices tend to respond to a single URL only (like http://clearservice.com/) and won't deal gracefully with requests to http://onionservie.onion/) i.e. they might redirect to the clearservice address. propublica has published their nginx setup to deal with this, but this looks a bit scary. For one, they don't seem to rewrite protocol-relative URLs like href="//sub.clearservice.com/". And then there generally is the question of ensuring that no clearnet URL escapes the rewriting. I guess for that, you'd need to implement a more thorough link checker and not just some ngnix filter rules. Thoughts on that? (It also occurred to me that you don't actually need to be the clearservice org to be able to set up an onion for them, as long as there is no https enforced/needed on the onion side.) Andreas -- "Totally trivial. Famous last words." From: Linus Torvalds <torvalds(a)*.org> Date: Fri, 22 Jan 2010 07:29:21 -0800

5 5

Prioritising Onion Service Features
by Tim Wilson-Brown - teor 28 Jan '16

28 Jan '16

Hi All, As onion (hidden) service operators, what features would you like to see in release 0.2.8? I want to find out what will help onion service operators the most. I think I might be able to finish Rendezvous Single Onion Services, or help finish Rendezvous Handoff, but not both. A Rendezvous Single Onion Service (RSOS) is an onion service that connects directly to the introduction and rendezvous points. For services that don't need to hide their location, it provides better connection latency, and likely better throughput. (And a large RSOS puts less load on the Tor network than a large HS.) See proposal #260 for more information: https://gitweb.torproject.org/torspec.git/tree/proposals/260-rend-single-on… And for the remaining tasks: https://trac.torproject.org/projects/tor/ticket/17178#childtickets Rendezvous Handoff allows Hidden Services and Rendezvous Single Onion Services to perform the introduction in one tor process, and then handoff the rendezvous to a separate tor process. This allows services to scale beyond the number of rendezvous connections (clients) that a single tor process can handle. We suspect that's about 100 at this point. See proposal #255 for more information: https://gitweb.torproject.org/torspec.git/tree/proposals/255-hs-load-balanc… And for the draft implementation: https://trac.torproject.org/projects/tor/ticket/17254 And the issue it's trying to solve: https://trac.torproject.org/projects/tor/ticket/8902 Some personal background: I have about a week to a month of development time left before I have to start some other work. At this point, it's unclear whether I will be working on Tor or not. So I'd like to maximise the impact of my remaining Tor development time. It would be great if you could help me work out how to do that! Thanks Tim Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP 968F094B teor at blah dot im OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F

4 4

Welcome to !
by George Kadianakis 27 Jan '16

27 Jan '16

Hello there, we welcome you to the [tor-onions] mailing list, a place to discuss anything about operating and administrating hidden services. For example, it's a fine venue for questions about setting up hidden services at scale, or embedding them in applications and the mobile, or figuring out why your hidden service authentication does not work. It is strictly a technical mailing list in the sense that discussing the content of hidden services is considered out of scope. You can think of it as [tor-relays] but for hidden services instead of relays. Finally, if you want to ask a question or make a comment about how to use tor, please consider using the [tor-talk] list instead. Alternatively, if you want to discuss tor development, please consider using the [tor-dev] list. Enjoy!

1 0