[tor-mirrors] Tor Mirror Security

[Taylor Hornby]

Hi,

I just set up an experimental Tor mirror here:

    https://defuse.ca/tor-mirror/

(Please don't include it in any mirror lists yet.)

I'm a little worried about security, though. The 'Configuring a Mirror'
page [1] has me cloning the Tor website via rsync, which isn't a secure
protocol. There are two specific risks here:

1. To the user of the mirror: A network attacker between my server and
   Tor could have replaced the Tor binaries with a malicious copy.

2. To the host of the mirror: A network attacker, or an evil sysadmin at
   Tor, could insert PHP scripts (or other things that Apache will
   execute) into my system, then execute by making a web request.

I worked around (2) by adding "php_flag engine off" to the Directory
entry in my Apache configuration, but I'm not certain that's good
enough. Can the .htaccess in the Tor mirror override it? Are there other
things that Apache will execute that I'm not aware of?

To solve (1), how about letting users submit an SSH public key so they
can rsync over SSH, or just have an account with a stupid password like
"tormirror", then publish the SSH fingerprint on torproject.org?

A Git repository with signed tags could be another solution.

[1] https://www.torproject.org/docs/running-a-mirror.html.en

Thanks,
-- 
Taylor Hornby