- tor-onions - lists.torproject.org

Protect against ddos in tor
by Flipchan 09 Feb '16

09 Feb '16

Hi all! Great with a new mailing list :) anyhow i was wondering IF anyone have any tips on some good ddos defense for .onion sites , take care -- Sincerly Flipchan

4 3

Trasfer onions site from one host to an other
by Xonumi 08 Feb '16

08 Feb '16

Hi, i need to tranfer my onion site from one host to an other... i setup a new debian with tor, all fine and i copy the old hostname and privat key to the new debian. web server runs fine, tor log is fine but i cant visit my onion web site .... whats wrong? need a hint! Thank you!

3 10

Announcing Onion-Website with x-onion response-header?
by MacLemon 07 Feb '16

07 Feb '16

Hi! Just an idea: What about announcing that your site is also available via onion-service by sending an x-onion HTTP response header on your HTTPS website? For example: The clearweb site https://www.torproject.org/ could send a header like this: x-onion:http://examplefoobarbaz.onion/ Or in case you can actually provide a valid TLS certificate for your Onion: x-onion:https://examplefoobarbaz.onion/ Another idea would be to also provide the fingerprint of the to-be-expected TLS certificate. This could look like so: x-onion:cert-sha256="1h89m/yelEy6l1poFiXZQbJ1s6BkrOquBl7Fd+0EOO0="; https://examplefoobarbaz.onion/ Similar to what is done with HPKP headers, but without pinning. Follow up question: How could this be done with non-HTTP services? (XMPP, SMTP, etc.) Best regards @MacLemon

6 5

Random Onion Tip
by Alec Muffett 05 Feb '16

05 Feb '16

Happy Friday! Obligatory Onion tip: if you are running a public/onion hybrid site, you probably want to block Tor2web. This may sound weird ("zomg block!") but since you are already on both networks then there is risk and isn't much benefit to being accessible via Tor2web. We actually worked with Fabio/naif from Tor2web to achieve this, to keep people safer: https://github.com/globaleaks/Tor2web/issues/162 <https://github.com/globaleaks/Tor2web/issues/162> The block is simple: deny (with a helpful message) Onion requests which contain a 'X-Tor2web' header; see the SecureDrop discussion at https://github.com/freedomofpress/securedrop/issues/43 <https://github.com/freedomofpress/securedrop/issues/43> for more context. Whether your message issues or offers a redirect link is a matter of taste. We chose not to. The block is reinforced by those sites which are able to obtain an EV Onion certificate, which hampers use from uncertificated domains. -a

1 0

IRC Idea
by Alec Muffett 04 Feb '16

04 Feb '16

#tor-onions on OFTC?

5 4

Onion Mirrors
by Jonathan Marquardt 01 Feb '16

01 Feb '16

Hello onions! I just wanted to tell you about a new Onion Service I set up. Onion Mirrors is a project dedicated to setting up file mirrors as Onion Services. URL: http://onionmirors63y7c.onion/ Right now, since the project just started, there's only a Debian archive mirror. Please tell me what you think about this and use the mirror as you please. :) Parckwart

1 0

Gitlab as a HS
by spriver 31 Jan '16

31 Jan '16

Hi, yesterday I tried to setup Gitlab Community Edition as a hidden service. Nearly almost worked until I tested the functionality of pushing back into the online repo - gitlab's shell told me first this error: Failed to connect to internal API <POST http://http://gitlab.agsdcxdr6z2wbjf5.onion/api/v3/internal/allowed>: #<SocketError: getaddrinfo: Name or service not known> So i configured my server to relay .onion addresses to the Tor DNS port. But after that I'm getting the following error: [2016-01-31T17:24:43.071616 #1219] WARN -- : Failed to connect to internal API <POST http://gitlab.agsdcxdr6z2wbjf5.onion/api/v3/internal/allowed>: #<Errno::EINVAL: Invalid argument - connect(2) for "gitlab.agsdcxdr6z2wbjf5.onion" port 80> I'm out of ideas for now, does anybody has a clue what can be done now to resolve this? Cheers! spriver

2 1

Automatic "Onionification" of existing websites
by Fabio Pietrosanti (naif) - lists 31 Jan '16

31 Jan '16

Hello, i've been considering that nowLetsencrypt let you automate setup of TLS certificate, for existing websites that does not have HTTPS. What's about thinking about "automations" and "improvement to existing webserver software" to facilitate the automatic "Onionification" of existing websites? >From a "sysadmin point of view" it would be a cool thing, if it's somehow easy and automated to do. It shall be a mod_tor of apache2 or something similar. I'm just firing the discussion, but if we want thousands of onion sites, then we need to facilitate the deployment on the existing configured websites, without requiring a sysadmin to do a lot of hackish stuff. -- Fabio Pietrosanti (naif) HERMES - Center for Transparency and Digital Human Rights http://logioshermes.org - https://globaleaks.org - https://tor2web.org - https://ahmia.fi

4 5

If you run a Tor hidden service for an Apache server, make sure you disable mod_status
by Alec Muffett 31 Jan '16

31 Jan '16

A word for the wise... https://wireflaw.net/blog/apache-hidden-service-vuln.html Tor hidden service operators: your default Apache install is probably vulnerable TL;DR If you run a Tor hidden service for an Apache server, make sure you disable mod_status with: $ a2dismod status On most distributions, Apache ships with a handy feature called mod_status enabled. It's a page located at /server-status that displays some statistics, like uptime, resource usage, total traffic, enabled virtual hosts, and active HTTP requests. For security reasons, it's only accessible from localhost by default. This seems fairly reasonable, until you realize the Tor daemon runs on localhost. Consequently, any hidden service using Apache's default config has /server-status exposed to the world. What could a malicious actor do in that case? They could spy on potentially sensitive requests. They could deduce the server's approximate longitude if the timezone is set. They could even determine its IP address if a clearnet Virtual Host is present. But this shouldn't be too much of a problem. Surely people who have taken the time to install an advanced web server and configure a hidden service for it have thoroughly read the documentation and disabled the offending module. Or not. [continues...] -- http://dropsafe.crypticide.com/aboutalecm

4 5

Ansible: Automated Tor Hiddenservice Setup
by shadow 29 Jan '16

29 Jan '16

Hello fellows, we wrote an ansible role(http://www.ansible.com/) to automate the setup, configuration and maintenance, of hiddenservices with ansible on a debian system. https://github.com/systemli/ansible-role-hidden-service Maybe it's usefull for you too. shadow // systemli.org -- best regards | viele Gruesse, shadow(a)systemli.org receive my key: gpg --keyserver zimmermann.mayfirst.org --recv-keys 0x5C6B6ED4248C1F32

1 1