Hacker News Reader

Comment by gravypod | Hacker News Reader

What I think really needs to happen is for the Tor group to make setting up hidden services much simpler.

Maybe I'm just stupid, but there didn't seem like an easy "type a command and we will set this all up for you" kind of way to do it.

Getting it setup, getting it to run as a daemon, and getting the service to work on multiple ports (allowing you to serve :80 and :22 for web and ssh). It seemed like a nightmare to me.

It's sad because I'm very interested in hosting a tor relay/service to make sure I can get to my important documents, even if I need to travel to another country that blocks services like dropbox and google docs.

View on HN

Hm, the problem with this kind of tools is that if you're not willing to read the documentation to get a good understanding of what you're doing, you might end up thinking you're secure instead of being secure which is the worst case scenario.

Is there a way to configure the tool to not be secure? Why is the secure configuration not the default? Can a secure default be easier to set up?

Because normally, the context here is that you're trying to set up an existing internet service over the Tor network. Your web server, for example, typically doesn't know anything about Tor, and will happily serve up pages to normal internet users unless you configure it not to.

Services designed for Tor don't have this issue and can be secure by default. Ricochet[1], for example, advertises itself as a hidden service automatically and doesn't communicate outside the Tor network.

1: https://ricochet.im/

Sure, but you could always have something like a script that takes a Vagrant VM or a docker container and turns it into a hidden service on Tor. The script would take care of making sure the only access to the VM is through Tor and that the VM learns nothing (under normal operations, I am not even thinking about patching side-channel attacks and escalation-to-host attacks here) about the host's identity or location. I am thinking something like:

vagrant up --provider=tor my-service

Where my-service is any Vagrant node (a config file for setting up a generic VM with whatever software / conf you specify) and the vagrant command outputs the Tor hidden service address in the last line, after loading the VM locally on top of VirtualBox or similar.

The Tor control port protocol let's applications setup a hidden service automatically; Bitcoin Core recently released support for this, automatically using hidden services for incoming connection to your Bitcoin Core nodes.

That may work with a UI, but I'm running this on a server without X, without anything and I'd like to be able to manage it like I do ufw.

You may like https://stem.torproject.org/tutorials/over_the_river.html , then! The sample code there can create permanent or ephemeral/short-lived hidden services. It uses the `stem` library (now named `nyx`, iirc).

Hm? Did you respond to the wrong comment?

The functionality Peter Todd is talking about is totally transparent and involves no user interaction.

I think I may have been confused, my bad. I probably didn't read it correctly when I first saw it.

The real problem is that you _shouldn't_ be running bare Tor in front of a hidden service, at least not if you really want to be private. You need something like Whonix[1] to protect you from all kinds of server information leaks.

1: https://www.whonix.org/wiki/Hidden_Services

At least on Debian based systems, running Tor as a daemon is trvial.

There is even apt tor to fetch updates over Tor.

There hidden service config is pretty simple as well.

We should write more functionality for servers that let them setup hidden services via tor

It would be useful if someone wrote a wizard that could install a personal disk server without the user needing to know what software is involved or how to install it. A single click where for example owncloud is installed, linked to tor hiden services address and given to the user and/or installing a usb stick with tor-browser and a bookmark to the service. It would be outside the scope of tor project, and more in line of a useful native debian package.

The Tor hidden service setup process seems extremely simple to me.

First google result I get for "tor hidden service instructions" is https://www.torproject.org/docs/tor-hidden-service.html.en which explains the two config lines you need to add to create a hidden service

Literally all you have to do is add this into your config file.

  HiddenServiceDir /hidden/service/path
  HiddenServicePort $EXTERNALPORT $INTERNALIP:$INTERNALPORT

If you're hosting anything at all this shouldn't be even remotely difficult.

How do I setup multiple ports? How do I setup multiple services? How do I get multiple .oninon domains?

By spending 5 seconds on google, or alternatively by using your intuition.

Googling "hidden service multiple ports" instantly answers every single one of your questions, and the answers are rather obvious.

Who would've thought that adding a new port is as easy as just adding another port definition?

Honestly, if this is a problem you shouldn't be trying to host hidden services by yourself anyway. Even if Tor took literally one click to set up the other software will still fuck you, like apaches mod-status.

That is rather hostile, but in any event that is only one of the things I asked. There are two other questions.

How do I get multiple .onion domains and how do I back up my keys so I can keep my domain?

Still, there are a lot of things that aren't very evident. It's just a bad experience in general.

We can have obscure documentation only accessible on the tor website, or when you install tor you could get a nice command interface like something presented by UFW.

One will lead to better configurations, the other will lead to mistakes and loss of data.

> How do I get multiple .onion domains

Repeat HiddenServiceDir

> how do I back up my keys so I can keep my domain?

Backup the contents of HiddenServiceDir

What you are saying is "it techs 5 minutes to somebody who knows what he is doing", which is precisely what's OP would like to change. You want more less tech saavy people to be able to create those nodes.

No, it's all very well and clearly explained in the official Tor Project documentation, in the section on hidden services. That link was already posted in this thread, yet the original poster still complains about insufficient documentation. His subsequent question about multiple ports was also clearly answered in the same place.

I think the problem here is simply that some people refuse to read documentation, even after they are provided with a direct link to it. Sounds about right from my personal experience with online tech communities.

When you use VLC, OpenOffice or Firefox, you don't read the documentation. I think that's what OP targets.

Talk for yourself, I've read VLC and LibreOffice documentation...

Setting up hidden services should not be that easy, unless it's the application itself doing it.

Making these things too easy results in very real damage when somewhat clueless people think they're capable of operating these things by themselves.

No, I'm not saying it takes 5 minutes. I'm saying it takes 5 seconds.

You google "hidden service multiple ports" (sans quotes), and the very first result answers every single one of his questions.

You only need to scroll down the page to see the super self explanatory config examples.

  HiddenServiceDir /usr/local/etc/tor/hidden_service/
  HiddenServicePort 80 127.0.0.1:8080

  HiddenServiceDir /usr/local/etc/tor/other_hidden_service/
  HiddenServicePort 6667 127.0.0.1:6667
  HiddenServicePort 22 127.0.0.1:22

If that doesn't tell you how to set up multiple hidden services and multiple ports, you should seriously get someone else to set up the hidden service for you. Some people just aren't competent enough to do it, just as not all of us are heart surgeons.

If you can't configure Tor, you certainly won't be able to sufficiently harden the applications that you're trying to hide.

Reply on news.ycombinator.com