7

I run a small web hotel. I would like to give all my customers a .onion address to access their website - primarily to promote the use of Tor to my customers.

So in my torrc I put:

HiddenServiceDir /var/lib/tor/hidden/example.org
HiddenServicePort 80 example.org:80

for the 2500 websites, and set up apache to respond for the hostnames generated in /var/lib/tor/hidden/*/hostname

but it seems Tor is unhappy about that. I get 1000s of these:

Jun 25 19:09:21.000 [warn] Error launching circuit to node [scrubbed] for service [scrubbed].

and a few of these:

Jun 25 19:02:18.000 [warn] Your system clock just jumped 148 seconds forward; assuming established circuits no longer work.

It works if I only run a few hidden services.

Should this be done differently?

Improve this question
5
  • 2
    Running 2500 hidden services through one Tor process is pushing it, no? Also, are all 2500 "example.org:80" reachable from the machine that's running Tor?
    – mirimir
    Jun 29, 2014 at 4:42
  • 2
    Please elaborate why it is pushing it to run 2500 hidden services. The same host has no problem running 2500 different domains (both web and mail - these are not high traffic sites). Most of the users will probably never use the Tor address, so it will likely be 2490 hidden services sitting idle, while maybe 10 are being used once in a blue moon.
    – Ole Tange
    Jun 29, 2014 at 12:09
  • 1
    Even if only ten of those 2500 hidden services will ever get used, the Tor network still needs to configure them all to be ready for use. Your problems point to something being overloaded. Perhaps it's the local Tor process. Or perhaps it's your entry guards.
    – mirimir
    Jun 30, 2014 at 1:23
  • How can I find out what is being stressed?
    – Ole Tange
    Aug 21, 2014 at 14:08
  • 1
    Look at both process activity (htop in Linux) and network activity (ntop in Linux) as a function of the number of hidden services. Look at the tor process. Is it pinned at 100%? The "system clock just jumped" error suggests that the tor process stalled. Also see how many guard nodes are active. Given that you've already configured all 2500 hidden services in torrc, comment out all but 10 for the first test. Then repeat the test with 20, 50, 100, 200, 500, 1000 and 2000 hidden services uncommented (active).
    – mirimir
    Aug 21, 2014 at 21:46

1 Answer 1

Reset to default
6

There are known scaling problems with running more than a few dozen hidden services in a single Tor process.

I think the 100% CPU load comes either from constantly generating and signing new hidden service descriptors (since each hidden service tries to maintain three introduction point circuits, and any time any of them change that means publishing a new descriptor), or from internal inefficiencies like linearly walking a list many times.

So yes, the short answer is "don't do that".

If somebody is looking for a fun development task, set up a private chutney or shadow Tor network, configure a bunch of hidden services on one of the clients, and then try to sort out where the bottlenecks are in practice.

You might also enjoy How many hidden services can I run on a single Tor instance? as a related question here.

And lastly, see also https://blog.torproject.org/blog/hidden-services-need-some-love

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .