65ecaeb3204652ed682d86d780931c0e0df6ab58
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

1) ## translation metadata
Roger Dingledine looks like we never set the...

Roger Dingledine authored 13 years ago

2) # Revision: $Revision$
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

3) # Translation-Priority: 3-low
4) 
5) #include "head.wmi" TITLE="Tor Project: Hidden Service Configuration Instructions" CHARSET="UTF-8"
6) <div id="content" class="clearfix">
7)   <div id="breadcrumbs">
Andrew Lewman change all of the breadcrum...

Andrew Lewman authored 14 years ago

8)     <a href="<page index>">Home &raquo; </a>
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

9)     <a href="<page docs/documentation>">Documentation &raquo; </a>
10)     <a href="<page docs/tor-hidden-service>">Tor Hidden Service</a>
11)   </div>
12)   <div id="maincol">
Andrew Lewman change all of the breadcrum...

Andrew Lewman authored 14 years ago

13)     <h1>Configuring Hidden Services for <a href="<page index>">Tor</a></h1>
Sebastian Hahn We decided to go with HTML...

Sebastian Hahn authored 14 years ago

14)     <hr>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

15) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

16)     <p>Tor allows clients and relays to offer hidden services. That is,
17)     you can offer a web server, SSH server, etc., without revealing your
18)     IP address to its users. In fact, because you don't use any public address,
19)     you can run a hidden service from behind your firewall.
20)     </p>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

21) 
Roger Dingledine put back one, since it does...

Roger Dingledine authored 10 years ago

22)     <p>If you have Tor installed, you can see hidden services in action
23)     by visiting this <a href="http://duskgytldkxiuqc6.onion/">sample
24)     site</a>.
25)     </p>
26) 
Andrew Lewman update hidden service examp...

Andrew Lewman authored 12 years ago

27)     <p>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

28)     This page describes the steps for setting up your own hidden service
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

29)     website. For the technical details of how the hidden service protocol
Andrew Lewman update hidden service examp...

Andrew Lewman authored 12 years ago

30)     works, see our <a href="<page docs/hidden-services>">hidden service
31)     protocol</a> page.
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

32)     </p>
Andrew Lewman update hidden service examp...

Andrew Lewman authored 12 years ago

33) 
Sebastian Hahn We decided to go with HTML...

Sebastian Hahn authored 14 years ago

34)     <hr>
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

35)     <a id="zero"></a>
36)     <h2><a class="anchor" href="#zero">Step Zero: Get Tor working</a></h2>
Sebastian Hahn We decided to go with HTML...

Sebastian Hahn authored 14 years ago

37)     <br>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

38) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

39)     <p>Before you start, you need to make sure:</p>
40)     <ol>
41)     <li>Tor is up and running,</li>
42)     <li>You actually set it up correctly.</li>
43)     </ol>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

44) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

45)     <p>Windows users should follow the <a
46)     href="<page docs/tor-doc-windows>">Windows
47)     howto</a>, OS X users should follow the <a
48)     href="<page docs/tor-doc-osx>">OS
49)     X howto</a>, and Linux/BSD/Unix users should follow the <a
50)     href="<page docs/tor-doc-unix>">Unix howto</a>.
51)     </p>
Andrew Lewman update hidden service examp...

Andrew Lewman authored 12 years ago

52) 
Sebastian Hahn We decided to go with HTML...

Sebastian Hahn authored 14 years ago

53)     <hr>
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

54)     <a id="one"></a>
55)     <h2><a class="anchor" href="#one">Step One: Install a web server locally</a></h2>
Sebastian Hahn We decided to go with HTML...

Sebastian Hahn authored 14 years ago

56)     <br>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

57) 
Andrew Lewman update hidden service examp...

Andrew Lewman authored 12 years ago

58)     <p>
59)     First, you need to set up a web server locally. Setting up a web
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

60)     server can be complex. We're not going to cover how to setup a web
61)     server here. If you get stuck or want to do more, find a friend who
62)     can help you. We recommend you install a new separate web server for
Andrew Lewman update hidden service examp...

Andrew Lewman authored 12 years ago

63)     your hidden service, since even if you already have one installed,
Moritz Bartl HS websites are also actual...

Moritz Bartl authored 11 years ago

64)     you may be using it (or want to use it later) for a normal website.
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

65)     </p>
Andrew Lewman update hidden service examp...

Andrew Lewman authored 12 years ago

66) 
Roger Dingledine finish the process of not r...

Roger Dingledine authored 12 years ago

67)     <p>
68)     You need to configure your web server so it doesn't give away any
69)     information about you, your computer, or your location. Be sure to
70)     bind the web server only to localhost (if people could get to it
71)     directly, they could confirm that your computer is the one offering
72)     the hidden service). Be sure that its error messages don't list
73)     your hostname or other hints. Consider putting the web server in a
74)     sandbox or VM to limit the damage from code vulnerabilities.
75)     </p>
76) 
Andrew Lewman update hidden service examp...

Andrew Lewman authored 12 years ago

77)     <p>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

78)     Once your web server is set up, make
Andrew Lewman update hidden service examp...

Andrew Lewman authored 12 years ago

79)     sure it works: open your browser and go to <a
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

80)     href="http://localhost:8080/">http://localhost:8080/</a>, where
81)     8080 is the webserver port you chose during setup (you can choose any
82)     port, 8080 is just an example). Then try putting a file in the main
83)     html directory, and make sure it shows up when you access the site.
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

84)     </p>
Andrew Lewman update hidden service examp...

Andrew Lewman authored 12 years ago

85) 
Sebastian Hahn We decided to go with HTML...

Sebastian Hahn authored 14 years ago

86)     <hr>
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

87)     <a id="two"></a>
88)     <h2><a class="anchor" href="#two">Step Two: Configure your hidden service</a></h2>
Sebastian Hahn We decided to go with HTML...

Sebastian Hahn authored 14 years ago

89)     <br>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

90) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

91)     <p>Next, you need to configure your hidden service to point to your
92)     local web server.
93)     </p>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

94) 
95)     <p>First, open your torrc file in your favorite text editor. (See
96)     <a href="<page docs/faq>#torrc">the torrc FAQ entry</a> to learn
97)     what this means.) Go to the middle section and look for the line</p>
98) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

99)     <pre>
100)     \############### This section is just for location-hidden services ###
101)     </pre>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

102) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

103)     <p>
104)     This section of the file consists of groups of lines, each representing
105)     one hidden service. Right now they are all commented out (the lines
106)     start with #), so hidden services are disabled. Each group of lines
107)     consists of one <var>HiddenServiceDir</var> line, and one or more
108)     <var>HiddenServicePort</var> lines:</p>
109)     <ul>
110)     <li><var>HiddenServiceDir</var> is a directory where Tor will store information
111)     about that hidden service.  In particular, Tor will create a file here named
112)     <var>hostname</var> which will tell you the onion URL.  You don't need to
113)     add any files to this directory. Make sure this is not the same directory
114)     as the hidserv directory you created when setting up thttpd, as your
115)     HiddenServiceDir contains secret information!</li>
116)     <li><var>HiddenServicePort</var> lets you specify a virtual port (that is, what
117)     port people accessing the hidden service will think they're using) and an
118)     IP address and port for redirecting connections to this virtual port.</li>
119)     </ul>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

120) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

121)     <p>Add the following lines to your torrc:
122)     </p>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

123) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

124)     <pre>
125)     HiddenServiceDir /Library/Tor/var/lib/tor/hidden_service/
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

126)     HiddenServicePort 80 127.0.0.1:8080
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

127)     </pre>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

128) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

129)     <p>You're going to want to change the <var>HiddenServiceDir</var> line, so it points
130)     to an actual directory that is readable/writeable by the user that will
131)     be running Tor. The above line should work if you're using the OS X Tor
132)     package. On Unix, try "/home/username/hidden_service/" and fill in your own
133)     username in place of "username". On Windows you might pick:</p>
134)     <pre>
Sebastian Hahn Remove backslash from Windo...

Sebastian Hahn authored 12 years ago

135)     HiddenServiceDir C:\Users\username\Documents\tor\hidden_service
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

136)     HiddenServicePort 80 127.0.0.1:8080
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

137)     </pre>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

138) 
139)     <p>Now save the torrc and restart your tor.</p>
140) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

141)     <p>If Tor starts up again, great. Otherwise, something is wrong. First look at
142)     your logfiles for hints. It will print some warnings or error messages. That
143)     should give you an idea what went wrong. Typically there are typos in the torrc
Roger Dingledine revise #Logs entry. fix sev...

Roger Dingledine authored 13 years ago

144)     or wrong directory permissions (See <a href="<page docs/faq>#Logs">the
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

145)     logging FAQ entry</a> if you don't know how to enable or find your
146)     log file.)
147)     </p>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

148) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

149)     <p>When Tor starts, it will automatically create the <var>HiddenServiceDir</var>
150)     that you specified (if necessary), and it will create two files there.</p>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

151) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

152)     <dl>
153)     <dt><var>private_key</var></dt>
154)     <dd>First, Tor will generate a new public/private keypair for your hidden
155)     service. It is written into a file called "private_key". Don't share this key
156)     with others -- if you do they will be able to impersonate your hidden
157)     service.</dd>
158)     <dt><var>hostname</var></dt>
159)     <dd>The other file Tor will create is called "hostname". This contains
160)     a short summary of your public key -- it will look something like
161)     <tt>duskgytldkxiuqc6.onion</tt>. This is the public name for your service,
162)     and you can tell it to people, publish it on websites, put it on business
163)     cards, etc.</dd>
164)     </dl>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

165) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

166)     <p>If Tor runs as a different user than you, for example on
167)     OS X, Debian, or Red Hat, then you may need to become root to be able
168)     to view these files.</p>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

169) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

170)     <p>Now that you've restarted Tor, it is busy picking introduction points
171)     in the Tor network, and generating a <em>hidden service
172)     descriptor</em>. This is a signed list of introduction points along with
173)     the service's full public key. It anonymously publishes this descriptor
174)     to the directory servers, and other people anonymously fetch it from the
175)     directory servers when they're trying to access your service.
176)     </p>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

177) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

178)     <p>Try it now: paste the contents of the hostname file into your web
179)     browser. If it works, you'll get the html page you set up in step one.
180)     If it doesn't work, look in your logs for some hints, and keep playing
181)     with it until it works.
182)     </p>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

183) 
Sebastian Hahn We decided to go with HTML...

Sebastian Hahn authored 14 years ago

184)     <hr>
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

185)     <a id="three"></a>
186)     <h2><a class="anchor" href="#three">Step Three: More advanced tips</a></h2>
Sebastian Hahn We decided to go with HTML...

Sebastian Hahn authored 14 years ago

187)     <br>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

188) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

189)     <p>If you plan to keep your service available for a long time, you might
190)     want to make a backup copy of the <var>private_key</var> file somewhere.
191)     </p>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

192) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

193)     <p>If you want to forward multiple virtual ports for a single hidden
194)     service, just add more <var>HiddenServicePort</var> lines.
195)     If you want to run multiple hidden services from the same Tor
196)     client, just add another <var>HiddenServiceDir</var> line. All the following
197)     <var>HiddenServicePort</var> lines refer to this <var>HiddenServiceDir</var> line, until
198)     you add another <var>HiddenServiceDir</var> line:
199)     </p>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

200) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

201)     <pre>
202)     HiddenServiceDir /usr/local/etc/tor/hidden_service/
203)     HiddenServicePort 80 127.0.0.1:8080
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

204) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

205)     HiddenServiceDir /usr/local/etc/tor/other_hidden_service/
206)     HiddenServicePort 6667 127.0.0.1:6667
207)     HiddenServicePort 22 127.0.0.1:22
208)     </pre>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

209) 
George Kadianakis HS configuration page: Ment...

George Kadianakis authored 8 years ago

210)     <p>Hidden services operators need to practice proper operational security
211)     and system administration to maintain security. For some security
212)     suggestions please make sure you read over Riseup's <a
213)     href="https://help.riseup.net/en/security/network-security/tor/onionservices-best-practices">"Tor
214)     hidden services best practices" document</a>. Also, here are some more
215)     anonymity issues you should keep in mind:
216) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

217)     </p>
218)     <ul>
219)     <li>As mentioned above, be careful of letting your web server reveal
220)     identifying information about you, your computer, or your location.
221)     For example, readers can probably determine whether it's thttpd or
222)     Apache, and learn something about your operating system.</li>
223)     <li>If your computer isn't online all the time, your hidden service
224)     won't be either. This leaks information to an observant adversary.</li>
Sebastian Hahn Link to blog post to docume...

Sebastian Hahn authored 9 years ago

225)     <li>It is generally a better idea to host hidden services on a Tor client
Moritz Bartl recommend hosting HS on tor...

Moritz Bartl authored 11 years ago

226)     rather than a Tor relay, since relay uptime and other properties are
227)     publicly visible.</li>
Sebastian Hahn Link to blog post to docume...

Sebastian Hahn authored 9 years ago

228)     <li>The longer a hidden is online, the higher the risk that its
229)     location is discovered. The most prominent attacks are building a
230)     profile of the hidden service's availability and matching induced
231)     traffic patterns.</li>
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

232)     </ul>
Andrew Lewman clean up the directions som...

Andrew Lewman authored 12 years ago

233) 
Sebastian Hahn Link to blog post to docume...

Sebastian Hahn authored 9 years ago

234)     <p>Another common issue is whether to use HTTPS on your relay or
235)     not. Have a look at this <a
236)     href="https://blog.torproject.org/blog/facebook-hidden-services-and-https-certs">post</a>
237)     on the Tor Blog to learn more about these issues.
238)     </p>
George Kadianakis HS configuration page: Ment...

George Kadianakis authored 8 years ago

239) 
240)     <p>Finally, feel free to use the <a
241)     href="https://lists.torproject.org/pipermail/tor-onions/">[tor-onions]
242)     mailing list</a> to discuss the secure administration and operation of
243)     Tor hidden services.</p>
244) 
Andrew Lewman first cut of the new, shiny...

Andrew Lewman authored 14 years ago

245)   </div>
246)   <!-- END MAINCOL -->
247)   <div id = "sidecol">
248) #include "side.wmi"
249) #include "info.wmi"
250)   </div>
251)   <!-- END SIDECOL -->
252) </div>
253) <!-- END CONTENT -->