There are some detailed instructions for setting up a Tor site at torproject.org1. It seems that it would be most secure to use a dedicated machine for this task if possible. I've read elsewhere that
thttpd might be preferable to Apache and its likely more secure to go with a GNI/Linux over Windows.
Any thoughts on this? Is there a "standard" distro and/or web-server that would be best-suited for this task? Or is that merely a matter of personal preference?
Also, what are appropriate and effective security practices, both technical and operational? What can we learn from the recent compromises of Freedom Hosting (perhaps the largest .onion hosting provider) and the Silk Road? According to Wired2, "the FBI yesterday acknowledged that it secretly took control of Freedom Hosting last July". The article notes that "[i]t’s not clear how the FBI took over the servers". However, the comment that "the bureau was temporarily thwarted when Marques somehow regained access and changed the passwords" is suggestive. As details come out in the trial, it would be prudent to identify relevant technical and/or operational failures.
In the case of the Silk Road, it's clear from the Maryland complaint3 that vulnerabilities in Tor were not instrumental in the site's compromise. Even so, did technical and/or operational failures contribute to the takedown, and how might they be corrected?
As new hidden service sites fill these market niches, at least some of the underlying technical and/or operational improvements may become public. There is much to learn about doing this right.