0

I've read that it's best to host Tor and your website service on separate machines and then point your torrc file to your web host (host where website files are stored). It's quite possible that my Tor machine and web host will be geographically separate. Assuming my web host has a public IP of say 41.14.44.11, I would change my Tor host machine settings to:

HiddenServiceDir /Library/Tor/var/lib/tor/hidden_service/
HiddenServicePort 80 41.14.44.11:8080

My question: Does this mean that my Tor machine will have to go out onto the clearnet to connect to my web host and then receive the data back from the host and then serve it to my visitors, essentially making it a sort of "exit node" to connect to my web host? This would be very bad for security and anonymity. The data between the Tor host and web host will also be plain text unless SSL is implemented between the two, correct? Or how would you ensure encryption for the data from the web host back into Tor?

Would it not be possible (and better) to also set up Tor on the web host machine and then point the Tor host machine to the .onion link of my web host, thus keeping all the traffic inside the Tor network and essentially turning the Tor machine into a sort of proxy while still making it secure so that if my Tor service was to be compromised my webhost would still be safe? Like so:

HiddenServiceDir /Library/Tor/var/lib/tor/hidden_service/
HiddenServicePort 80 xxxxxxxxxxxxxxxx.onion:8080
Improve this question

2 Answers 2

Reset to default
0

This is a terrible idea.

First of all, you're routing all plaintext HTTP requests and responses back and forth over the open internet. Absolutely everyone with network visibility can see the entire contents of every HTTP request. Even using HTTPS would result in people able to tie the requests to the .onion address due to TLS SNI.

Second of all, allowing the onion service direct access to the internet in the first place should be avoided. Most webserver hosting technologies are large and complex and were never designed with anonymity, privacy or proxy obedience in mind. They leak, and can be induced to make connections (in often unexpected ways) that can deanonymize them. I recently ran a scan of the entire Ahmia onion list and managed to cause approx. ~80 onions to perform DNS lookups, of my choosing, outside of Tor. If making connections across the internet to some remote host, then the simple ability to determine $_SERVER['REMOTE_ADDR'] or $_SERVER['SERVER_ADDR'] would be sufficient to discover the location of the server.

When people on the other ticket suggest running the web server and Tor on separate machines, they mean on a network that you control and only you have visibility of, be it a physical LAN or a virtual network undera hypervisor. By isolating the web server from direct internet access, you increase your resilience to exploitation or accidental leaks as a means of deanonymization.

[HTTPD] <--Local/Private Network--> [Tor Enforcment/Firewall] <--Tor Network--> [Attacker]

In the above scenario, an attacker who is able to exploit the HTTPD or web app is still unable to directly connect back to the internet without then also exploiting the Tor Enforcement/Firewall device, defeating many attackers and drastically increasing the cost and risk for others.

Setting this up properly is no simple task and comes with many of it's own caveats and potential pitfalls but if done right, it does have distinct advantages against sophisticated attackers.

However, in most cases simply using a local packet filter (e.g. iptables) to stop outbound connections outside of Tor and using 127.0.0.1 for your onion services would be sufficient (it would still require an additional privilege escalation exploit to bypass the network filter) to stop most attackers.

Improve this answer
2
  • Thank you for the detailed answer. I understand that going from tor to the clearnet and back to tor to retrieve data is bad. It brings me to the last part of my post of would it be possible to point the Tor service to the web host through Tor using the web host onion link, thus keeping it inside the Tor network. I know that hosting the machines on a local network would much better, but I'd be interested to know if this would work as a solution if the servers were geographically separate, like so: HiddenServicePort 80 xxxxxxxxx.onion:8080, instead of HiddenServicePort 80 192.168.1.10:8080
    – jaydoo
    Commented Dec 8, 2017 at 5:53
  • In theory, yes, but the steps required are a bit convulited and there's little to no real advantage and a large performance cost.
    – cacahuatl
    Commented Dec 8, 2017 at 12:24
0

Where did you read that advice? I know there's advice out there that suggests you don't run a Tor relay on the same machine as an onion service. But that's a different thing entirely. Unless you're enterprise-sized, it's best to run Tor on the same machine as the webserver.

Because, yes. A torrc with the following will send web traffic over the Internet unprotected. BAD.

HiddenServicePort 80 41.14.44.11:8080

The much more intelligent thing to do is run your webserver and Tor on the same machine and use localhost in the torrc instead.

HiddenServicePort 80 127.0.0.1:8080

I think you are confusing the Tor client you run on the machine in front of you in order to access the Tor network with the Tor client you need to run on a server somewhere in order to give your website a .onion address.

Improve this answer
4
  • There's no confusion. There are several sources online that recommend separating Tor and your web service to separate machines. See here: tor.stackexchange.com/questions/58/… "it's best to run Tor and the service in separate machines, or at least in separate VMs." This suggests to have the Tor and the service (a website?) split from each other since if your Tor service machine is compromised your service (website) will still be up and you'd just need to create a new machine and set up Tor on that new machine and point it back to your service.
    – jaydoo
    Commented Dec 7, 2017 at 14:12
  • Also, sorry for the double comment, but another quote from the link above suggesting this would be "Depending on your resources you may want to setup a box only for the purpose of running the Tor client and pointing the service ports to another box running your service.".
    – jaydoo
    Commented Dec 7, 2017 at 14:16
  • Well if you don't mind your users' web traffic hitting the Internet unprotected and you believe this physical separation is a good thing for your use case, then more power to you. If you're going to use VMs on the same physical host to get some isolation, be sure to use a private IP in the torrc.
    – pastly
    Commented Dec 7, 2017 at 23:11
  • Sorry if there might be confusion, but I'm not saying that going through the clearnet is at all a good solution. I know it's bad. Hence me asking if it would rather be possible to point the Tor service machine to the webhost using the web host's .onion link, thus keeping the traffic inside Tor even if the machines are geographically separate. Using private IPs would be the solution if they were on the same private LAN/network, but I'm not really interested in that at the moment. I want to test the separation of the machines.
    – jaydoo
    Commented Dec 8, 2017 at 5:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .