1

I have set up a hidden service site on Tor and haven't had issues. I decided to add a forum section to the site to allow discussion. I figured the easiest option would be to use phpbb with the LEMP stack. Meaning I have ubuntu server, nginx, mysql, and php5-fpm installed. When I open the site through firefox I can open the bulletin board no problem but when I try and open it through the Tor browser it tries to download a file instead. Is this an issue with using php or do I need to do something else to get it to work on the Tor browser?

I hope I explained my issue well enough.

Thanks.

  • 2
    Tor is totally agnostic to the data sent over it, this is a server configuration problem. PHP is executed at the server side, before the data is sent over the network, so it won't matter. – cacahuatl Nov 16 '16 at 7:31
  • Thanks, I had a feeling it was a config problem but didn't want to keep messing around with it and wasting my time if that wasn't the case. I just thought it was weird it opened in Firefox but not the TOR browser but I guess that is a hint to what my config issue is since Firefox was accessing through my local network and TOR wasn't I believe. – F4F Nov 16 '16 at 14:19
  • 1
    Check that both vhosts are treated equally. – cacahuatl Nov 16 '16 at 21:45
1

The problem was configuration of the server and had nothing to do with the Tor browser. I had server information in the nginx.conf file and also in the virtual host configurations. I just commented out the server information in the nginx.conf file and now everything works fine.

0

You should have all your dot-onions to be forward-and-back resolvable via DNS/resolver on your NGinx machine. Use /etc/hosts and 127.0.0.[2-xxx] addresses for it on dedicated localhost/loopback interfaces. It's simple, secure and very fuckup-proof. I can provide you with configs if you need.

UPDATE: config files and HOWTO

in /etc/network/interfaces you should replace lo loopback string with this block:

auto lo lo:0 lo:1 lo:2
iface lo inet loopback

iface lo:0 inet static
    address 127.0.0.2
    netmask 255.0.0.0

iface lo:1 inet static
    address 127.0.0.3
    netmask 255.0.0.0

iface lo:2 inet static
    address 127.0.0.4
    netmask 255.0.0.0

you can add more if you wish. Next, in /etc/hosts use :

127.0.0.1 localhost
127.0.0.2 hs1.onion
127.0.0.3 hs2.onion
127.0.0.4 hs3.onion

and use your webserver to bind by-ip and by dedicated-per-vhost user your HS virtual hosts. In firewall use any kind of stuff you prefer to block by IP and by user any communications except 127.0.0.1 <-> 127.0.0.X to prevent any network leaks possible.

If you're using non-local HS setup - it's OK and it's quite obvious in case of opening "an entry point" for existing server in Tor network(like Facebook did it for it's website) - then you can consider using local ISC Bind setup with reverse and forward lookups. The purpose is *to make sure that hs1.onion resolves via system libs, not the cmdline tools you're used to lookup, because they're using DNS queries explicitly. The desired result is like this:

  • perl -MSocket -le '$a=shift; $x=gethostbyname $a; print inet_ntoa($x);' hs1.onion into 127.0.0.2
  • perl -MSocket -le '$a=inet_aton(shift); $_=gethostbyaddr $a, AF_INET; print' 127.0.0.2 returns ns1.onion.

Some checklist for localhost-names:

  • Check NSS switch like this: cat /etc/nsswitch.conf | grep "^hosts:" and make sure files is set first. If not, edit it and in line starting with "hosts:" put it on a first place.
  • Fix/check host.conf like this cat /etc/host.conf and add string order hosts,bind if missing or put hosts at the first place right after the order. It's one string too.
  • Thanks for the input. Sounds pretty complicated to me though. I'll be honest I don't really know what I am doing. I have just been pulling stuff from forums or using default settings and managed to get things working. Probably not a very secure setup but I am not that worried about it. Though I do want to learn more about it so I will look into what you said. If you can provide those config files it would be a helpful start. – F4F Nov 17 '16 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.