5 ms·

What I think really needs to happen is for the Tor group to make setting up hidden services much simpler. Maybe I'm just stupid, but there didn't seem like an

What I think really needs to happen is for the Tor group to make setting up hidden services much simpler. Maybe I'm just stupid, but there didn't seem like an easy "type a command and we will set this all up for you" kind of way to do it. Getting it setup, getting it to run as a daemon, and getting the service to work on multiple ports (allowing you to serve :80 and :22 for web and ssh). It seemed like a nightmare to me. It's sad because I'm very interested in hosting a tor relay/service to make sure I can get to my important documents, even if I need to travel to another country that blocks services like dropbox and google docs.

petertodd 10y ago
The Tor control port protocol let's applications setup a hidden service automatically; Bitcoin Core recently released support for this, automatically using hidden services for incoming connection to your Bitcoin Core nodes.
- gravypod 10y ago
  That may work with a UI, but I'm running this on a server without X, without anything and I'd like to be able to manage it like I do ufw.
  - wfn 10y ago
    You may like https://stem.torproject.org/tutorials/over_the_river.html https://stem.torproject.org/tutorials/over_the_river.html , then! The sample code there can create permanent or ephemeral/short-lived hidden services. It uses the `stem` library (now named `nyx`, iirc).
  - nullc 10y ago
    Hm? Did you respond to the wrong comment? The functionality Peter Todd is talking about is totally transparent and involves no user interaction.
    - gravypod 10y ago
      I think I may have been confused, my bad. I probably didn't read it correctly when I first saw it.
atmosx 10y ago
Hm, the problem with this kind of tools is that if you're not willing to read the documentation to get a good understanding of what you're doing, you might end up thinking you're secure instead of being secure which is the worst case scenario.
- infogulch 10y ago
  Is there a way to configure the tool to not be secure? Why is the secure configuration not the default? Can a secure default be easier to set up?
  - ryukafalz 10y ago
    Because normally, the context here is that you're trying to set up an existing internet service over the Tor network. Your web server, for example, typically doesn't know anything about Tor, and will happily serve up pages to normal internet users unless you configure it not to. Services designed for Tor don't have this issue and can be secure by default. Ricochet[1], for example, advertises itself as a hidden service automatically and doesn't communicate outside the Tor network. 1: https://ricochet.im/ https://ricochet.im/
    - lazaroclapp 10y ago
      Sure, but you could always have something like a script that takes a Vagrant VM or a docker container and turns it into a hidden service on Tor. The script would take care of making sure the only access to the VM is through Tor and that the VM learns nothing (under normal operations, I am not even thinking about patching side-channel attacks and escalation-to-host attacks here) about the host's identity or location. I am thinking something like: vagrant up --provider=tor my-service Where my-service is any Vagrant node (a config file for setting up a generic VM with whatever software / conf you specify) and the vagrant command outputs the Tor hidden service address in the last line, after loading the VM locally on top of VirtualBox or similar.
zmanian 10y ago
At least on Debian based systems, running Tor as a daemon is trvial. There is even apt tor to fetch updates over Tor. There hidden service config is pretty simple as well. We should write more functionality for servers that let them setup hidden services via tor
ryanl0l 10y ago
The Tor hidden service setup process seems extremely simple to me. First google result I get for "tor hidden service instructions" is https://www.torproject.org/docs/tor-hidden-service.html.en https://www.torproject.org/docs/tor-hidden-service.html.en which explains the two config lines you need to add to create a hidden service Literally all you have to do is add this into your config file. HiddenServiceDir /hidden/service/path HiddenServicePort $EXTERNALPORT $INTERNALIP:$INTERNALPORT If you're hosting anything at all this shouldn't be even remotely difficult.
- gravypod 10y ago
  How do I setup multiple ports? How do I setup multiple services? How do I get multiple .oninon domains?
  - ryanl0l 10y ago
    By spending 5 seconds on google, or alternatively by using your intuition. Googling "hidden service multiple ports" instantly answers every single one of your questions, and the answers are rather obvious. Who would've thought that adding a new port is as easy as just adding another port definition? Honestly, if this is a problem you shouldn't be trying to host hidden services by yourself anyway. Even if Tor took literally one click to set up the other software will still fuck you, like apaches mod-status.
    - gravypod 10y ago
      That is rather hostile, but in any event that is only one of the things I asked. There are two other questions. How do I get multiple .onion domains and how do I back up my keys so I can keep my domain? Still, there are a lot of things that aren't very evident. It's just a bad experience in general. We can have obscure documentation only accessible on the tor website, or when you install tor you could get a nice command interface like something presented by UFW. One will lead to better configurations, the other will lead to mistakes and loss of data.
      - 10y ago
aftbit 10y ago
The real problem is that you _shouldn't_ be running bare Tor in front of a hidden service, at least not if you really want to be private. You need something like Whonix[1] to protect you from all kinds of server information leaks. 1: https://www.whonix.org/wiki/Hidden_Services https://www.whonix.org/wiki/Hidden_Services
belorn 10y ago
It would be useful if someone wrote a wizard that could install a personal disk server without the user needing to know what software is involved or how to install it. A single click where for example owncloud is installed, linked to tor hiden services address and given to the user and/or installing a usb stick with tor-browser and a bookmark to the service. It would be outside the scope of tor project, and more in line of a useful native debian package.

petertodd 10y ago

The Tor control port protocol let's applications setup a hidden service automatically; Bitcoin Core recently released support for this, automatically using hidden services for incoming connection to your Bitcoin Core nodes.

gravypod 10y ago
That may work with a UI, but I'm running this on a server without X, without anything and I'd like to be able to manage it like I do ufw.
- wfn 10y ago
  You may like https://stem.torproject.org/tutorials/over_the_river.html https://stem.torproject.org/tutorials/over_the_river.html , then! The sample code there can create permanent or ephemeral/short-lived hidden services. It uses the `stem` library (now named `nyx`, iirc).
- nullc 10y ago
  Hm? Did you respond to the wrong comment? The functionality Peter Todd is talking about is totally transparent and involves no user interaction.
  - gravypod 10y ago
    I think I may have been confused, my bad. I probably didn't read it correctly when I first saw it.

atmosx 10y ago

Hm, the problem with this kind of tools is that if you're not willing to read the documentation to get a good understanding of what you're doing, you might end up thinking you're secure instead of being secure which is the worst case scenario.

infogulch 10y ago
Is there a way to configure the tool to not be secure? Why is the secure configuration not the default? Can a secure default be easier to set up?
- ryukafalz 10y ago
  Because normally, the context here is that you're trying to set up an existing internet service over the Tor network. Your web server, for example, typically doesn't know anything about Tor, and will happily serve up pages to normal internet users unless you configure it not to. Services designed for Tor don't have this issue and can be secure by default. Ricochet[1], for example, advertises itself as a hidden service automatically and doesn't communicate outside the Tor network. 1: https://ricochet.im/ https://ricochet.im/
  - lazaroclapp 10y ago
    Sure, but you could always have something like a script that takes a Vagrant VM or a docker container and turns it into a hidden service on Tor. The script would take care of making sure the only access to the VM is through Tor and that the VM learns nothing (under normal operations, I am not even thinking about patching side-channel attacks and escalation-to-host attacks here) about the host's identity or location. I am thinking something like: vagrant up --provider=tor my-service Where my-service is any Vagrant node (a config file for setting up a generic VM with whatever software / conf you specify) and the vagrant command outputs the Tor hidden service address in the last line, after loading the VM locally on top of VirtualBox or similar.

zmanian 10y ago

At least on Debian based systems, running Tor as a daemon is trvial. There is even apt tor to fetch updates over Tor. There hidden service config is pretty simple as well. We should write more functionality for servers that let them setup hidden services via tor

ryanl0l 10y ago

The Tor hidden service setup process seems extremely simple to me. First google result I get for "tor hidden service instructions" is https://www.torproject.org/docs/tor-hidden-service.html.en https://www.torproject.org/docs/tor-hidden-service.html.en which explains the two config lines you need to add to create a hidden service Literally all you have to do is add this into your config file. HiddenServiceDir /hidden/service/path HiddenServicePort $EXTERNALPORT $INTERNALIP:$INTERNALPORT If you're hosting anything at all this shouldn't be even remotely difficult.

gravypod 10y ago
How do I setup multiple ports? How do I setup multiple services? How do I get multiple .oninon domains?
- ryanl0l 10y ago
  By spending 5 seconds on google, or alternatively by using your intuition. Googling "hidden service multiple ports" instantly answers every single one of your questions, and the answers are rather obvious. Who would've thought that adding a new port is as easy as just adding another port definition? Honestly, if this is a problem you shouldn't be trying to host hidden services by yourself anyway. Even if Tor took literally one click to set up the other software will still fuck you, like apaches mod-status.
  - gravypod 10y ago
    That is rather hostile, but in any event that is only one of the things I asked. There are two other questions. How do I get multiple .onion domains and how do I back up my keys so I can keep my domain? Still, there are a lot of things that aren't very evident. It's just a bad experience in general. We can have obscure documentation only accessible on the tor website, or when you install tor you could get a nice command interface like something presented by UFW. One will lead to better configurations, the other will lead to mistakes and loss of data.
    - 10y ago

aftbit 10y ago

The real problem is that you _shouldn't_ be running bare Tor in front of a hidden service, at least not if you really want to be private. You need something like Whonix[1] to protect you from all kinds of server information leaks. 1: https://www.whonix.org/wiki/Hidden_Services https://www.whonix.org/wiki/Hidden_Services

belorn 10y ago

It would be useful if someone wrote a wizard that could install a personal disk server without the user needing to know what software is involved or how to install it. A single click where for example owncloud is installed, linked to tor hiden services address and given to the user and/or installing a usb stick with tor-browser and a bookmark to the service. It would be outside the scope of tor project, and more in line of a useful native debian package.