I'm trying to set up a hidden service, but I'm primarily a web developer and not a security guy. I know quite a bit about computer security and I think I could probably configure Tor and iptables correctly, but it's not my primary focus so I'm afraid I might make a mistake and would love it if I could have a guide to follow as I set things up.

  • I would love to see this. There are two key differences between normal web servers and those for hidden services. First, servers must have no Internet connectivity except through Tor. It's best to have the Tor process and web server in separate machines, or at least in separate VMs. Second, the web server accesses Tor through a proxy port on the Tor gateway. Given that, I believe that the emphasis should be on hardening the web server, in the same way as you'd do normally. If you need a complex backend, putting each component in a separate VM would be prudent. – mirimir Apr 25 '14 at 4:50

Look into Whonix - it seems to be the closest option to a turnkey linux platform to securely host a hidden service.

  • and it is designed to do that (so it is not by happy accident that it is good for running a hidden service). – Ole Tange Aug 22 '14 at 7:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.