On two machines with different public ip I host two hidden services. Both hidden services are wordpress blogs. Both services can be accessed by their respective .onion addresses with a tor-browser. Funnily enough I can browse to one service with firefox using the public ip address of its machine. I get as far as the intro page, the subsequent pages do not work because firefox would not enumerate the onion addresses. But even so having the first page of the wordpress site visible by its ip from clearnet seems to me to pose a security risk regarding anonymity. So what have I to do to stop the access from clearnet?
1 Answer
It's happening because your webserver is listening at 0.0.0.0 (IPv4) or [::] (IPv6), change 0.0.0.0 to 127.0.0.1 and [::] to [::1] (these are loopback addresses and are not supposed to be accessed outside the host).
-
So to have it clear: apache is my webserver, serving wordpressCMS via PHP. This setup is identical on both VPS. Obviously one - the "nasty" one is listening at 0:0:0:0 and spilling it's guts e.g. the first page of my hidden service. Now what have I to do to stop apache from listening at 0:0:0:0? Anyway Thanks for answering– PeterCommented Dec 21, 2022 at 14:47
-
Yes, change 0.0.0.0 to 127.0.0.1 and change the address to 127.0.0.1 if needed. Also, remembering, choose a port lower than 1024 because it's better to run your webserver as an unprivileged user. Commented Dec 21, 2022 at 23:07