8 ms·

So - how to do it correctly? The onion server should not be able to access the internet directly and should never know it's own IP-address. So putting it inside

by nisa 12y ago

So - how to do it correctly? The onion server should not be able to access the internet directly and should never know it's own IP-address. So putting it inside a virtual machine/container and redirecting outgoing traffic through Tor (on another VM) should fix that. As for the backend servers - if all machines are connected through OpenVPN with TLS-Auth they can use private IP space and are not accessible from outside. The OpenVPN tunnels are configured outside of the onion VM and Tor VM and the backend machines are also in a VM that pipes all outgoing traffic (except OpenVPN traffic) to the internet through Tor. This setup should at least omit the problem of leaking public IP addresses on compromise or did I overlook something? Let's ignore VM outbreak exploits (ksplice/unattenend-upgrades should help here if it's not the NSA). With TLS-Auth and a default DROP firewall rule all machines should not even appear in scans on the internet. So any outside contact to any machines is only possible if you know the OpenVPN TLS-Key + Certificates. An intruder would only see local IP addresses even if he manages to compromise a backend server. All created outgoing traffic to find the machines would be routed through Tor. As the Tor onion VM is separate from the webserver only a Tor remote exploit or a VM outbreak exploit would be critical. Maybe encryption can help here. Another point is using dedicated hardware with Full Disk Encryption and just enter the passphrase via the provider console. There are cold boot attacks but VPS servers allow to dump a memory image while running - that's not so easy with dedicated hardware.

waps 12y ago
Just making a tiny point here : advising criminals on how to avoid law enforcement is obviously illegal and carries prison sentences. Please don't do it. If you must, start an unrelated article or something. But don't explicitly try to help other criminals avoid capture. Frankly it is also immoral. This guy was selling drugs without caring about the consequences on people's lives, medical and otherwise and was organizing assassinations. This is not the FBI enforcing the letter of some stupid law, this is not some teenager getting in over his head, this guy needs to be punished.
- bruceb 12y ago
  Explaining how something works is not illegal in the US. Not sure why you think it is. Most people don't feel sorry for the guy but we don't want the country to turn in to a lawless place where law enforcement doesn't have to follow the law.
- praptak 12y ago
  Where I live it is required to be reasonably convinced that a specific person or persons exist that you are helping[1] commit a crime. If you just publish information that helps the general criminal public then the freedom of speech & information trumps the potential harm done to society. Plus, you're usually also helping the security community. If they know the criminals can do attack X, they can protect against X (no security from obscurity). [1] Although you don't have to know their identity.
- nisa 12y ago
  It's illegal already to explain to setup a secure hidden service on the Tor network? I don't think this discussion is only relevant to criminals. There are a lot of places on this planet where this information might be useful. I don't support the Silk Road - never used it - I don't even use Tor a lot by myself. But if someone is coming at me and tells me that this information is forbidden I'll get angry. It's not like there is a drug problem besides Silk Road already. It's likely safe to assume that illegal drugs are consumed in near distance to your and my place right now. I don't think the Silk Road is a good place but it's likely better than your shady dealer on the schoolyard. If you ask why people use drugs than take a look at society at large. What exactly is illegal here? I'm also not located in the US.
  - spacemanmatt 12y ago
    > take a look at society at large I think this is a precursor to a lot of drug use in the U.S. We see, we panic, we cope. (Ok, I am painting with a rather broad brush this morning...)
- vegardx 12y ago
  I'd love to see what laws you're breaking, as that would be at the level of "thought police". How do you know he's helping criminals, is Tor and hidden services just used by criminals in your mind? Yes - he broke the law, but that does not mean that the FBI should get a pass for doing something shady. If we start to accept that kind of behaviour from them, I can only imagine how it will be 20-30 years from now.
- Angostura 12y ago
  Just making a tiny point here. Setting up secure Tor-based servers is not only something that criminals need to do. Please don't suggest it is.
  - rplnt 12y ago
    This is very similar to what a lot of ISPs were doing in the past - blocking bittorrent traffic, claiming it's illegal.
- Multics 12y ago
  > Frankly it is also immoral. This guy was selling drugs without caring about the consequences on people's lives, medical and otherwise and was organizing assassinations. Frankly, the War on Drugs is immoral. The science doesn't back it up[1]. It's done without caring about the consequences on peoples' lives, medical and otherwise. > This is not the FBI enforcing the letter of some stupid law Debatable! The drug laws are 'stupid', if you take into account science and economics[2]. > and was organizing assassinations. This is unlikely to have happened under a system of legal drugs. I've never heard of Walmart -- where legal products are sold -- putting out hits on people. The drugs laws are broken. They create perverse incentives. --- [1] There are a number of drugs less harmful than alcohol & tobacco (I.e. less harmful than drugs already sanctioned): http://www.economist.com/blogs/dailychart/2010/11/drugs_cause_most_harm http://www.economist.com/blogs/dailychart/2010/11/drugs_caus... [2] The Economics Behind the U.S. Government's Unwinnable War on Drugs http://www.econlib.org/library/Columns/y2013/Powelldrugs.html http://www.econlib.org/library/Columns/y2013/Powelldrugs.htm...
  - jamespo 12y ago
    Well that's the weakest excuse for ordering someone to be murdered I've read today
    - NewHermes 12y ago
      Thr prohibition of drugs and organized crime are highly linked. Look at alchohol as an example. For all intents and purposes the war on drugs is a war against poor minoritites. All research has shown that it is not only innefectvie, but detrimental to families and communities.
      - pyre 12y ago
        You didn't respond to what your parent post said. You just opened up some canned rhetoric and dumped it onto the page. Are you in agreement that it's ok for people to commit drug-related murders just because the War on Drugs is "bad m'kay?" Or should people be held accountable for their actions? Just because there are incentives to become a drug lord due to immoral laws doesn't mean that it's all of the sudden moral to become a drug lord. You seem to want to use your "War on Drugs is bad" opinion as an excuse for the choices that people make.
- atlantic 12y ago
  When you get to a point where government agencies fabricate evidence in order to incriminate people that they "know" are guilty, they are acting as judge, jury and executioner, and undermining the whole system of justice on which our democratic societies are built. And that has much graver consequences than letting a few supposed criminals slip through the net.
  - cruisername 12y ago
    > undermining the whole system of justice on which our democratic societies are built That's cute. Our Societies are built on the labor of the underclass, on lies and deception and on violent turf wars. Talk about justice.
- mjklin 12y ago
  >advising criminals on how to avoid law enforcement is obviously illegal and carries prison sentences. Please see: 1st Amendment to the US Constitution.
  - spacemanmatt 12y ago
    Criminal is an opinion about a person, but a conviction is a fact. For people outside the U.S., it may help to understand that our constitution stipulates that a person is not to be considered or treated as guilty without a conviction. Not that we honor our constitution anymore.
- zo1 12y ago
  What about gun-manuals? How about teaching people to drive? Teaching them to use a knife? Makeup classes? Wig instruction manuals? Zipping files with encryption? SSL? The list goes on and on and on. All those things help criminals evade capture, or to commit some sort of crime. You've just drawn some arbitrary line (drivers education ok, tor setup advice bad) because you have absolutely no idea what makes one worse and the other not.
HongKong2782018 12y ago
Everyone upset at Nisa should realize that Nisa doesn't mention drugs once. Nisa's discussion is just as applicable to something like setting up underground forums for discussing democracy or organizing peaceful student protests.
tokenizerrr 12y ago
Say you have your own hardware, what would you need to access the display and keyboard securely remotely over the network? Are there such devices available? I imagine you can have the OS disable its display and keyboard input after boot for added security, and lock down the boot process, but it still seems like it's hard to do this securely. I'm trying to think of a scenario where you can have: 1) Full Disk Encryption 2) Two physical machines owned by you, perhaps stored in some basement 3) Be able to boot them back on without physical access (perhaps this is simply a Bad Idea?) 4) One machine with two NICs running Tor, exposing only Tor to one of the NICs 5) The other machine running a VM host with 1 VM for each of your services. The host is connected to the NIC of the first machine, thus only has access to the internet through Tor
- teddyh 12y ago
  > Full Disk Encryption […] > Be able to boot them back on without physical access (perhaps this is simply a Bad Idea?) This is exactly the problem which our project solves: http://www.recompile.se/mandos http://www.recompile.se/mandos Introduction: http://www.recompile.se/mandos/man/intro.8mandos http://www.recompile.se/mandos/man/intro.8mandos Summary: The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key; each client has one unique to it. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system, whereupon the computers can continue booting normally.
  - ryan-c 12y ago
    Mandos is pretty cool. Debian and Ubuntu can also embed dropbear into the initramfs so you can ssh in and unlock the disk.
    - teddyh 12y ago
      Dropbear (SSH access) still requires you to manually log in and unlock the disks; a primary feature of Mandos is that it can boot completely unattended (unless configured otherwise).
xamolxix 12y ago
> The onion server should not be able to access the internet directly and should never know it's own IP-address. I may be overly pedantic here but it should be "public IP address" as there is no TCP/IP without an IP address. The address may be in the private ranges, though.
- nisa 12y ago
  Yes. I wrote that in a hurry. I'm surprised the comment is on the top. This was purely theoretical speculation. I don't run a hidden service.
daeken 12y ago
If I were doing this, I would not use a VM for it. Running on bare metal has a significantly smaller (by several orders of magnitude) risk profile and is much simpler to do right. I'd have three boxes: webserver, Tor server, external exposure box. The webserver would connect solely to the Tor server, and would expose absolutely nothing other than HTTP. The Tor server would run the hidden service pieces and would expose nothing to either side, but would connect to the webserver and tunnel things accordingly, and would send its Tor connections through the external box. The external box would have a simple forwarder to tunnel connections to the Tor server. There are always going to be bugs, but this would very strongly isolate each of the risky components. Feeling even more paranoid? Put a strong network filter in place between each of the components to make sure that only the specific subset of TCP that's actually in use makes it through; that'll prevent network stack-level issues.

by nisa 12y ago

waps 12y ago

Just making a tiny point here : advising criminals on how to avoid law enforcement is obviously illegal and carries prison sentences. Please don't do it. If you must, start an unrelated article or something. But don't explicitly try to help other criminals avoid capture. Frankly it is also immoral. This guy was selling drugs without caring about the consequences on people's lives, medical and otherwise and was organizing assassinations. This is not the FBI enforcing the letter of some stupid law, this is not some teenager getting in over his head, this guy needs to be punished.

bruceb 12y ago
Explaining how something works is not illegal in the US. Not sure why you think it is. Most people don't feel sorry for the guy but we don't want the country to turn in to a lawless place where law enforcement doesn't have to follow the law.
praptak 12y ago
Where I live it is required to be reasonably convinced that a specific person or persons exist that you are helping[1] commit a crime. If you just publish information that helps the general criminal public then the freedom of speech & information trumps the potential harm done to society. Plus, you're usually also helping the security community. If they know the criminals can do attack X, they can protect against X (no security from obscurity). [1] Although you don't have to know their identity.
nisa 12y ago
It's illegal already to explain to setup a secure hidden service on the Tor network? I don't think this discussion is only relevant to criminals. There are a lot of places on this planet where this information might be useful. I don't support the Silk Road - never used it - I don't even use Tor a lot by myself. But if someone is coming at me and tells me that this information is forbidden I'll get angry. It's not like there is a drug problem besides Silk Road already. It's likely safe to assume that illegal drugs are consumed in near distance to your and my place right now. I don't think the Silk Road is a good place but it's likely better than your shady dealer on the schoolyard. If you ask why people use drugs than take a look at society at large. What exactly is illegal here? I'm also not located in the US.
- spacemanmatt 12y ago
  > take a look at society at large I think this is a precursor to a lot of drug use in the U.S. We see, we panic, we cope. (Ok, I am painting with a rather broad brush this morning...)
vegardx 12y ago
I'd love to see what laws you're breaking, as that would be at the level of "thought police". How do you know he's helping criminals, is Tor and hidden services just used by criminals in your mind? Yes - he broke the law, but that does not mean that the FBI should get a pass for doing something shady. If we start to accept that kind of behaviour from them, I can only imagine how it will be 20-30 years from now.
Angostura 12y ago
Just making a tiny point here. Setting up secure Tor-based servers is not only something that criminals need to do. Please don't suggest it is.
- rplnt 12y ago
  This is very similar to what a lot of ISPs were doing in the past - blocking bittorrent traffic, claiming it's illegal.
Multics 12y ago
> Frankly it is also immoral. This guy was selling drugs without caring about the consequences on people's lives, medical and otherwise and was organizing assassinations. Frankly, the War on Drugs is immoral. The science doesn't back it up[1]. It's done without caring about the consequences on peoples' lives, medical and otherwise. > This is not the FBI enforcing the letter of some stupid law Debatable! The drug laws are 'stupid', if you take into account science and economics[2]. > and was organizing assassinations. This is unlikely to have happened under a system of legal drugs. I've never heard of Walmart -- where legal products are sold -- putting out hits on people. The drugs laws are broken. They create perverse incentives. --- [1] There are a number of drugs less harmful than alcohol & tobacco (I.e. less harmful than drugs already sanctioned): http://www.economist.com/blogs/dailychart/2010/11/drugs_cause_most_harm http://www.economist.com/blogs/dailychart/2010/11/drugs_caus... [2] The Economics Behind the U.S. Government's Unwinnable War on Drugs http://www.econlib.org/library/Columns/y2013/Powelldrugs.html http://www.econlib.org/library/Columns/y2013/Powelldrugs.htm...
- jamespo 12y ago
  Well that's the weakest excuse for ordering someone to be murdered I've read today
  - NewHermes 12y ago
    Thr prohibition of drugs and organized crime are highly linked. Look at alchohol as an example. For all intents and purposes the war on drugs is a war against poor minoritites. All research has shown that it is not only innefectvie, but detrimental to families and communities.
    - pyre 12y ago
      You didn't respond to what your parent post said. You just opened up some canned rhetoric and dumped it onto the page. Are you in agreement that it's ok for people to commit drug-related murders just because the War on Drugs is "bad m'kay?" Or should people be held accountable for their actions? Just because there are incentives to become a drug lord due to immoral laws doesn't mean that it's all of the sudden moral to become a drug lord. You seem to want to use your "War on Drugs is bad" opinion as an excuse for the choices that people make.
atlantic 12y ago
When you get to a point where government agencies fabricate evidence in order to incriminate people that they "know" are guilty, they are acting as judge, jury and executioner, and undermining the whole system of justice on which our democratic societies are built. And that has much graver consequences than letting a few supposed criminals slip through the net.
- cruisername 12y ago
  > undermining the whole system of justice on which our democratic societies are built That's cute. Our Societies are built on the labor of the underclass, on lies and deception and on violent turf wars. Talk about justice.
mjklin 12y ago
>advising criminals on how to avoid law enforcement is obviously illegal and carries prison sentences. Please see: 1st Amendment to the US Constitution.
- spacemanmatt 12y ago
  Criminal is an opinion about a person, but a conviction is a fact. For people outside the U.S., it may help to understand that our constitution stipulates that a person is not to be considered or treated as guilty without a conviction. Not that we honor our constitution anymore.
zo1 12y ago
What about gun-manuals? How about teaching people to drive? Teaching them to use a knife? Makeup classes? Wig instruction manuals? Zipping files with encryption? SSL? The list goes on and on and on. All those things help criminals evade capture, or to commit some sort of crime. You've just drawn some arbitrary line (drivers education ok, tor setup advice bad) because you have absolutely no idea what makes one worse and the other not.

HongKong2782018 12y ago

Everyone upset at Nisa should realize that Nisa doesn't mention drugs once. Nisa's discussion is just as applicable to something like setting up underground forums for discussing democracy or organizing peaceful student protests.

tokenizerrr 12y ago

Say you have your own hardware, what would you need to access the display and keyboard securely remotely over the network? Are there such devices available? I imagine you can have the OS disable its display and keyboard input after boot for added security, and lock down the boot process, but it still seems like it's hard to do this securely. I'm trying to think of a scenario where you can have: 1) Full Disk Encryption 2) Two physical machines owned by you, perhaps stored in some basement 3) Be able to boot them back on without physical access (perhaps this is simply a Bad Idea?) 4) One machine with two NICs running Tor, exposing only Tor to one of the NICs 5) The other machine running a VM host with 1 VM for each of your services. The host is connected to the NIC of the first machine, thus only has access to the internet through Tor

teddyh 12y ago
> Full Disk Encryption […] > Be able to boot them back on without physical access (perhaps this is simply a Bad Idea?) This is exactly the problem which our project solves: http://www.recompile.se/mandos http://www.recompile.se/mandos Introduction: http://www.recompile.se/mandos/man/intro.8mandos http://www.recompile.se/mandos/man/intro.8mandos Summary: The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key; each client has one unique to it. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system, whereupon the computers can continue booting normally.
- ryan-c 12y ago
  Mandos is pretty cool. Debian and Ubuntu can also embed dropbear into the initramfs so you can ssh in and unlock the disk.
  - teddyh 12y ago
    Dropbear (SSH access) still requires you to manually log in and unlock the disks; a primary feature of Mandos is that it can boot completely unattended (unless configured otherwise).

xamolxix 12y ago

> The onion server should not be able to access the internet directly and should never know it's own IP-address. I may be overly pedantic here but it should be "public IP address" as there is no TCP/IP without an IP address. The address may be in the private ranges, though.

nisa 12y ago
Yes. I wrote that in a hurry. I'm surprised the comment is on the top. This was purely theoretical speculation. I don't run a hidden service.

daeken 12y ago

If I were doing this, I would not use a VM for it. Running on bare metal has a significantly smaller (by several orders of magnitude) risk profile and is much simpler to do right. I'd have three boxes: webserver, Tor server, external exposure box. The webserver would connect solely to the Tor server, and would expose absolutely nothing other than HTTP. The Tor server would run the hidden service pieces and would expose nothing to either side, but would connect to the webserver and tunnel things accordingly, and would send its Tor connections through the external box. The external box would have a simple forwarder to tunnel connections to the Tor server. There are always going to be bugs, but this would very strongly isolate each of the risky components. Feeling even more paranoid? Put a strong network filter in place between each of the components to make sure that only the specific subset of TCP that's actually in use makes it through; that'll prevent network stack-level issues.