1

So I have a onion website and I start it by using php -S 127.0.0.1:8080 and sudo -u debian-tor tor to start the website. I wonder if there is any solution to add a subdomain like www.mysubdomain.xxxxxxxxxxxxxxxx.onion and not just one, but many different subdomains.

I have seen many websites in the Tor network with subdomains, and I want that and I'm open to any possible solution.

Thanks

1 Answer 1

0

There's no way to do that directly: Tor does not support this. It seems to be lame from the classical point of view, but keep in mind what the onion domain is - it's a derivative of the key data, so there can be only one, you know ;)

UPDATE: I saw your clarification request, so I'll answer it.

This will work on a local host, but in a remote case scenario - when you have two different machines - the nature of how DNS resolution for names is working will break things up.

Case 1: You're using SOCKS5 with DNS resolution on the client machine. The request will be forwarded to Tor's binary and it will try to query a name given - an onion subdomain address containing a dot - and will find none, because the onion name is a derivative of the hidden service's public key. Server not found

Case 2: You're using Tor's DNSPort's resolver - but it will hit exactly the same workflow, just with a different entry point, technically speaking

Case 3: You're using Tor's transparent proxy as a router, the most secure case. But to map an address to the local subnet provided you have to resolve it first - so if the onion address is known and alive - it will be mapped to the IP address in a virtual subnet, not before!

And the crowning jewel is - it was actually a riddle for me personally, for a start - why don't they implemented any helper for this kind of situations? It would be a great piece of functionality! The answer lays deep inside the nature of Tor - it's a STunnel-like mapper that does not care about anything else to be invulnerable to the hidden service's protocol attacks! Go to stunnel.org and get that software and play with it - you will understand it all... I used to use it a long time ago before Tor - so it was quick for me, if you haven't used it - a day will be enough to make all the experimentation imaginable.

Is there any workaround physically possible? No. The root of this is the flawed, abuseable and insecure nature of the DNS protocol itself

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .