hi i was wondering what best security settings you guys could share and how do i setup for my webserver. running window 2008 r2. i do not want any leaking if possible. i understand windows vps is not a good choice. but at least "Try" to have a reasonable defense. how do i know whether my web server is not leaking information about you, your computer, or your location. For example, readers can probably determine whether it's thttpd or Apache, and learn something about your operating system.

i am using port 8080. is it good? or is it too common?

the funny question is why am i still able to access my http://localhost:8080 on clearnet?


Some points:

  1. The port you're running it on is irrelevant for most cases but in the case of apache there are bugs you can use to reveal the "real" port it's listening on. What is very important is that the port is not accessible from the outside world. I have seen masscans of the internet that try to cross-request .onion addresses by connecting to the external IP and sending an HTTP request for the .onion vhost. This would link a real IP to the site. You should only listen on the localhost port, or some purely internal facing port is you have some kind of an internal network. It should never be internet routable if the onion is there to protect the server.

  2. There are numerous things that can reveal things about the server that you're running, not all of them obvious and not all of them fixable. I would strongly recommend against running Windows, you should run a ubuntu or debian server with nginx. There are a few reasons why:

    • Windows has no automated update mechanisms, keeping your software up to date and patched will be not a fun experience, this will both make your server vulnerable and more obviously different from any others.
    • Ubuntu and Debian are amongst the most common distros in publicly known onion websites, you will have a bigger crowd to hide in. They are well tested, they have means to apply automatic updates.
    • If you're running Ubuntu or Debian your main httpd choices are nginx and apache and never apache. Lighter weight httpds are available and are probably file if you just want to serve static files but are less well tested.
    • Cthulhu has written a guide for setting up nginx on debian with a view to use in onion services, it is targeted at wheezy (the last stable version of Debian) but it should be applicable to the current stable Debian release.

So remember:

  • Never Windows
  • Never Apache

Not the answer you're looking for? Browse other questions tagged or ask your own question.