whoops, i missed a whole document (4d90c83af) - tor-webwml.git

...	...	@@ -0,0 +1,276 @@
	1	+## translation metadata
	2	+# Revision: $Revision$
	3	+
	4	+#include "head.wmi" TITLE="Tor Hidden Service Configuration Instructions"
	5	+
	6	+<div class="center">
	7	+
	8	+<div class="main-column">
	9	+
	10	+<h1>Configuring Hidden Services for <a href="<page index>">Tor</a></h1>
	11	+<hr />
	12	+
	13	+<p>Tor allows clients and servers to offer hidden services. That is,
	14	+you can offer a web server, SSH server, etc., without revealing your
	15	+IP to its users. In fact, because you don't use any public address,
	16	+you can run a hidden service from behind your firewall.
	17	+</p>
	18	+
	19	+<p>If you have Tor and Privoxy installed, you can see hidden services
	20	+in action by visiting <a href="http://6sxoyfb3h2nvok2d.onion/">the
	21	+hidden wiki</a>.
	22	+</p>
	23	+
	24	+<p>This howto describes the steps for setting up your own hidden service
	25	+website.
	26	+</p>
	27	+
	28	+<hr />
	29	+<a id="zero"></a>
	30	+<h2><a class="anchor" href="#zero">Step Zero: Get Tor and Privoxy working</a></h2>
	31	+<br />
	32	+
	33	+<p>Before you start, you need to make sure 1) Tor is up and running,
	34	+2) Privoxy is up and running, 3) Privoxy is configured to point
	35	+to Tor, and 4) You actually set it up correctly.</p>
	36	+
	37	+<p>Windows users should follow the <a
	38	+href="<page docs/tor-doc-win32>">Windows
	39	+howto</a>, OS X users should follow the <a
	40	+href="<page docs/tor-doc-osx>">OS
	41	+X howto</a>, and Linux/BSD/Unix users should follow the <a
	42	+href="<page docs/tor-doc-unix>">Unix howto</a>.
	43	+</p>
	44	+
	45	+<p>Once you've got Tor and Privoxy installed and configured,
	46	+you can see hidden services in action by following this link to <a
	47	+href="http://6sxoyfb3h2nvok2d.onion/">the hidden wiki</a>.
	48	+It will typically take 10-60 seconds to load
	49	+(or to decide that it is currently unreachable). If it fails
	50	+immediately and your browser pops up an alert saying that
	51	+"www.6sxoyfb3h2nvok2d.onion could not be found, please check the name and
	52	+try again" then you haven't configured Tor and Privoxy correctly; see <a
	53	+href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#ItDoesntWork">this
	54	+FAQ entry</a> for some help.
	55	+</p>
	56	+
	57	+<hr />
	58	+<a id="one"></a>
	59	+<h2><a class="anchor" href="#one">Step One: Configure an example hidden service</a></h2>
	60	+<br />
	61	+
	62	+<p>In this step, you're going to configure a hidden service that points
	63	+to www.google.com. This way we can make sure you have this step
	64	+working before we start thinking about setting up a web server locally.
	65	+</p>
	66	+
	67	+<p>First, open your torrc file in your favorite text editor. (See <a
	68	+href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#torrc">this
	69	+FAQ entry</a> to learn what this means.) Go to the middle section and
	70	+look for the line</p>
	71	+
	72	+<pre>
	73	+############### This section is just for location-hidden services ###
	74	+</pre>
	75	+
	76	+<p>
	77	+This section of the file consists of groups of lines, each representing
	78	+one hidden service. Right now they are all commented out (the lines
	79	+start with #), so hidden services are disabled. Each group of lines
	80	+consists of one HiddenServiceDir line, and one or more HiddenServicePort
	81	+lines:</p>
	82	+<ul>
	83	+<li><b>HiddenServiceDir</b> is a directory where Tor will store information
	84	+about that hidden service. In particular, Tor will create a file here named
	85	+<i>hostname</i> which will tell you the onion URL. You don't need to add any
	86	+files to this directory.</li>
	87	+<li><b>HiddenServicePort</b> lets you specify a virtual port (that is, what
	88	+port people accessing the hidden service will think they're using) and an
	89	+IP address and port for redirecting connections to this virtual port.</li>
	90	+</ul>
	91	+
	92	+<p>In this example, we're going to set up a hidden service that points to
	93	+Google. So add the following lines to your torrc:
	94	+</p>
	95	+
	96	+<pre>
	97	+HiddenServiceDir /Library/Tor/var/lib/tor/hidden_service/
	98	+HiddenServicePort 80 www.google.com:80
	99	+</pre>
	100	+
	101	+<p>You're going to want to change the HiddenServiceDir line, so it points
	102	+to an actual directory that is readable/writeable by the user that will
	103	+be running Tor. The above line should work if you're using the OS X Tor
	104	+package. On Unix, try "/home/username/hidserv/" and fill in your own
	105	+username in place of "username". On Windows you might pick:</p>
	106	+<pre>
	107	+HiddenServiceDir C:\Documents and Settings\username\Application Data\hidden_service\
	108	+HiddenServicePort 80 www.google.com:80
	109	+</pre>
	110	+
	111	+<p>Now save the torrc, shut down
	112	+your Tor, and then start it again. (See <a
	113	+href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#Restarting">this
	114	+FAQ entry</a> for tips on restarting Tor.)
	115	+</p>
	116	+
	117	+<p>If Tor starts up again, great. Otherwise, something is wrong. Look
	118	+at your torrc for obvious mistakes like typos. Then double-check
	119	+that the directory you picked is writeable by you. If it's still
	120	+not working, you should look at the Tor logs for hints. (See <a
	121	+href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#Logs">this
	122	+FAQ entry</a> if you don't know how to enable or find your log file.)
	123	+</p>
	124	+
	125	+<p>When Tor starts, it will automatically create the HiddenServiceDir
	126	+that you specified (if necessary), and it will create two files there.
	127	+First, it will generate a new
	128	+public/private keypair for your hidden service, and write it into a
	129	+file called "private_key". Don't share this key with others -- if you
	130	+do they will be able to impersonate your hidden service.
	131	+</p>
	132	+
	133	+<p>The other file it will create is called "hostname". This contains
	134	+a short summary of your public key -- it will look something like
	135	+<tt>6sxoyfb3h2nvok2d.onion</tt>. This is the public name for your service,
	136	+and you can tell it to people, publish it on websites, put it on business
	137	+cards, etc. (If Tor runs as a different user than you, for example on
	138	+OS X, Debian, or Red Hat, then you may need to become root to be able
	139	+to view these files.)
	140	+</p>
	141	+
	142	+<p>Now that you've restarted Tor, it is busy picking introduction points
	143	+in the Tor network, and generating what's called a "hidden service
	144	+descriptor", which is a signed list of introduction points along with
	145	+the service's full public key. It anonymously publishes this descriptor
	146	+to the directory servers, and other people anonymously fetch it from the
	147	+directory servers when they're trying to access your service.
	148	+</p>
	149	+
	150	+<p>Try it now: paste the contents of the hostname file into your web
	151	+browser. If it works, you'll get the google frontpage, but the URL in your
	152	+browser's window will be your hidden service hostname. If it doesn't work,
	153	+look in your logs for some hints, and keep playing with it until it works.
	154	+</p>
	155	+
	156	+<hr />
	157	+<a id="two"></a>
	158	+<h2><a class="anchor" href="#two">Step Two: Now install a web server locally</a></h2>
	159	+<br />
	160	+
	161	+<p>Now that you have hidden services working on Tor, you need to
	162	+set up your web server locally. Setting up a web server is tricky,
	163	+so we're just going to go over a few basics here. If you get stuck
	164	+or want to do more, find a friend who can help you. We recommend you
	165	+install a new separate web server for your hidden service, since even
	166	+if you already have one installed, you may be using it (or want to use
	167	+it later) for an actual website.
	168	+</p>
	169	+
	170	+<p>If you're on Unix or OS X and you're comfortable with
	171	+the command-line, by far the best way to go is to install <a
	172	+href="http://www.acme.com/software/thttpd/">thttpd</a>. Just grab the
	173	+latest tarball, untar it (it will create its own directory), and run
	174	+./configure && make. Then mkdir hidserv, cd hidserv, and run
	175	+"../thttpd -p 5222 -h localhost". It will give you back your prompt,
	176	+and now you're running a webserver on port 5222. You can put files to
	177	+serve in the hidserv directory.
	178	+</p>
	179	+
	180	+<p>If you're on Windows, ...what should we suggest here? Is there
	181	+a good simple <a href="http://www.fsf.org/">free software</a> (not
	182	+just "freeware") web server for Windows? Please
	183	+let me know what we should say here. In the meantime,
	184	+check out <a href="http://httpd.apache.org/">apache</a>,
	185	+and be sure to
	186	+configure it to bind only to localhost. You should also figure out
	187	+what port you're listening on, because you'll use it below.
	188	+</p>
	189	+
	190	+<p>(The reason we bind the web server only to localhost is to make
	191	+sure it isn't publically accessible. If people could get to it directly,
	192	+they could confirm that your computer is the one offering the hidden
	193	+service.)
	194	+</p>
	195	+
	196	+<p>Once you've got your web server set up, make sure it works: open your
	197	+browser and go to <a
	198	+href="http://localhost:5222/">http://localhost:5222/</a>. Then
	199	+try putting a file
	200	+in the main html directory, and make sure it shows up when you access
	201	+the site.
	202	+</p>
	203	+
	204	+<hr />
	205	+<a id="three"></a>
	206	+<h2><a class="anchor" href="#three">Step Three: Connect your web server to your hidden service</a></h2>
	207	+<br />
	208	+
	209	+<p>This part is very simple. Open up your torrc again, and change the
	210	+HiddenServicePort line from "www.google.com:80" to "localhost:5222".
	211	+Then <a
	212	+href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#Restarting">restart
	213	+Tor</a>. Make sure that it's working by reloading your hidden
	214	+service hostname in your browser.
	215	+</p>
	216	+
	217	+<hr />
	218	+<a id="four"></a>
	219	+<h2><a class="anchor" href="#four">Step Four: More advanced tips</a></h2>
	220	+<br />
	221	+
	222	+<p>If you plan to keep your service available for a long time, you might
	223	+want to make a backup copy of the private_key file somewhere.
	224	+</p>
	225	+
	226	+<p>We avoided recommending Apache above, a) because many people might
	227	+already be running it for a public web server on their computer, and b)
	228	+because it's big
	229	+and has lots of places where it might reveal your IP address or other
	230	+identifying information, for example in 404 pages. For people who need
	231	+more functionality, though, Apache may be the right answer. Can
	232	+somebody make us a checklist of ways to lock down your Apache when you're
	233	+using it as a hidden service?
	234	+</p>
	235	+
	236	+<p>If you want to forward multiple virtual ports for a single hidden
	237	+service, just add more HiddenServicePort lines.
	238	+If you want to run multiple hidden services from the same Tor
	239	+client, just add another HiddenServiceDir line. All the following
	240	+HiddenServicePort lines refer to this HiddenServiceDir line, until
	241	+you add another HiddenServiceDir line:
	242	+</p>
	243	+
	244	+<pre>
	245	+HiddenServiceDir /usr/local/etc/tor/hidden_service/
	246	+HiddenServicePort 80 127.0.0.1:8080
	247	+
	248	+HiddenServiceDir /usr/local/etc/tor/other_hidden_service/
	249	+HiddenServicePort 6667 127.0.0.1:6667
	250	+HiddenServicePort 22 127.0.0.1:22
	251	+</pre>
	252	+
	253	+<p>There are some anonymity issues you should keep in mind too:
	254	+</p>
	255	+<ul>
	256	+<li>As mentioned above, be careful of letting your web server reveal
	257	+identifying information about you, your computer, or your location.
	258	+For example, readers can probably determine whether it's thttpd or
	259	+Apache, and learn something about your operating system.</li>
	260	+<li>If your computer isn't online all the time, your hidden service
	261	+won't be either. This leaks information to an observant adversary.</li>
	262	+<!-- increased risks over time -->
	263	+</ul>
	264	+
	265	+
	266	+
	267	+<hr />
	268	+
	269	+<p>If you have suggestions for improving this document, please <a
	270	+href="/contact">send them to us</a>. Thanks!</p>
	271	+
	272	+ </div><!-- #main -->
	273	+</div>
	274	+
	275	+#include <foot.wmi>
	276	+
0	277