Security: Can an exit node be set up with an encrypted connection to the service?

Question

So far it seems that all exit note-to-server connections are communicated in plaintext.

Is there a way to add something to a Linux or Windows server so that very last hop is encrypted?

Or alternately, is there a way to run the services directly on what looks to Tor as an exit node directly>

Answer 1

So far it seems that all exit note-to-server connections are communicated in plaintext.

They're communicated as they're sent, I.E. Tor doesn't add or remove any encryption that was already applied to the application traffic. If it was using HTTPS and was encrypted to the service before entering the Tor network, it will leave the Tor network still encrypted.

For a helpful interative infographic to help illustrate this, see The EFF's page on Tor and HTTPS.

Is there a way to add something to a Linux or Windows server so that very last hop is encrypted?

Yes, use an end-to-end encrypted transport, like HTTPS, SSH, TLS or one of many other options.

Or alternately, is there a way to run the services directly on what looks to Tor as an exit node directly>

You seem to be describing an onion (or hidden) service, where the site to be contacted is run directly at, or close, where the traffic leaves the Tor network.

In this case, the connection is encrypted between the clients Tor process and the services Tor process, allowing for the potential of end-to-end encryption over Tor without any extra transport encryption.