4

Which configuration file do I change in Apache to run it through Tor? I know you use:

Listen 127.0.0.1:8080;
Server_name 127.0.0.1:8080;

I think, but I don't have much experience with web hosting, I know how to use Linux, but a little new to this area and I also heard that Apache can leak out info, any one have any documentation I may read or give some help on preventing that?

  • I have found the answer to this question in /etc/apache2/sites-available/default. If anybody else have similar question, she may refer to the above mentioned site for reference. – mr pickles Feb 12 '15 at 2:20
4

Apache doesn't run through Tor. It is a service that listens on the ip address(es) and port(s) you specify in its config file. If you want to configure Apache to host only hidden services, then you limit your listening IP address to 127.0.0.1:

Listen 127.0.0.1:80

After that, in the VirtualHost block, you put the onion address in the ServerName. For example:

ServerName ctygdx55hgoleuht.onion

and you assign to DocumentRoot the public html folder of your onion site.

Don't forget to configure your hidden service(s) in your torrc file, and specify 127.0.0.1, not the server real IP, in HiddenServicePort there. For example:

HiddenServiceDir /path/to/hidden/service/private/key/dir
HiddenServicePort 80 127.0.0.1:80

Read this page for more information about this topic.

Another important step is to minimize/stop your Apache leakage of webserver info that makes it identifiable. Edit /etc/apache2/conf.d/security by adding/modifying two parameters like the following:

ServerTokens Prod
ServerSignature Off
  • And do not make a mistake with 127.0.0.1!! Use 127.0.0.2 or something, but NOT 127.0.0.1!! It increases your security greatly. – Alexey Vesnin Jan 5 '16 at 4:58
  • Is it necessary to change the ServerName to the onion address? – Geremia Jun 29 '17 at 2:56
  • @AlexeyVesnin How so? It's only for port 80. – Geremia Jun 29 '17 at 3:03
  • yes, but you can elaborate any other port(s) - just add a corresponding lines 'HiddenServicePort` and Listen to their configs. SSL works fine as well – Alexey Vesnin Jun 29 '17 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.