Some say that it is not very difficult to find the real IP of a onion website if you are a decent enough Networking Professional. However, I don't think it is that easy. So, I am guessing the truth is somewhere in between. I understand that the server configuration plays an important part in this as well. So, if that is the case which configs of let's say Apache would need to be covered to maintain a fair degree of Anonymity?
There are four methods of finding an Onion service's IP address:
- Controlling all the relays in a circuit between the onion service and an introduction or a rendezvous point.
- Through information leaks.
- Hacking the server.
- Analyzing the traffic of the suspected server while sending a request or performing a Denial of Service attack.
The first method, although not impossible, is highly unlikely, as its difficulty grows proportionally to the number of nodes in the network. Nevertheless, the Vanguards add-on has been developed to reduce that risk even further.
The second method implies that the Onion service administrator has left identifying information that could be compared and/or indexed both on the darknet and the clearnet: if you find an Onion service with the same SSH fingerprint as a public server then they're most likely the same machine.
The third one is very similar to the second: once the attacker controls the server, he can get its MAC addresses, PCI serial numbers, etc. and track down who bought it or even find the administrator's IP address in the SSH access logs if he made a direct connection to it.
The traffic analysis deanonymization could be mitigated by using Multitor and/or OnionBalance to distribute the requests through different servers in diferent locations and through different guard nodes, and using a pluggable transport protocol that alters the number of sent bytes among them like OBFS4.
If the configuration and operation of an onion service is done "properly", then it is extremely difficult, and requires very significant resources, to determine that onion site's IP address and network/physical location. The configuration of the web server is only one small part of the picture of ensuring the anonymity of an onion service, and providing sufficient detail for a non-trivial example is far beyond what is suitable for a Q&A site, however the "Operational security" section of the Tor onion service setup guide provides useful information, and links to more detailed advice, which will be of use.