2

I know that nginx is much safer than Apache for hidden services, but is there any additional configuration that needs/should/is recommended to be done to run a hidden service safely?

0

No, not really. In all cases - regardless of the actual web server - you need to use a FULL ISOLATION based on VM/LXC to run a webserver, so there will be NO technically possible way to determine an external IP address or it's traces. You don't use any NAT/IP-MASQUERADE, just a port-to-port tunneling. I do recommend to use a LXC+static-binaries, it will make a footprint almost-nothing and will minimize an overhead.

  • "so there will be NO technically possible way to determine an external IP address or it's traces" why not just VPN? – Samuel Shifterovich Oct 4 '16 at 15:02
  • it's about an in-code/in-handler "jailbreaking". A possible attack vector. It's a way simplier than VPN in implementation – Alexey Vesnin Oct 4 '16 at 15:07
  • Way simpler? Can't you just run openvpn and then start Tor? – Samuel Shifterovich Oct 4 '16 at 15:07
  • 1
    OpenVPN requires an external server. LXC does not – Alexey Vesnin Oct 4 '16 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.