Hello everyone,
I'm currently looking for some advice related to hosting a .onion service. I don't really want to host a website right now but I want to gain some knowledge about it.
I have some knowledge about programming, linux, basic cybersecurity etc but not really in that practical topic.
Is there a kind of bible or detailed guide about webhosting in Tor ? I know ofc how to host a website but not really the cybersecurity protections and OPSEC that are required to have a stable service and to be protected.
Thanks for you help
/d/OnionDev, general hidden service development
/d/programming, also includes hidden service development
/d/EndGame, great DDoS protection built by the same guys who built tforum
/d/newmarkets, to see newly launched markets
/d/Expose, to see hidden services/markets exposed by pentesters and hackers
I'm not sure if there's a onion hosting "bible" but there is a lot of useful resources here on tforum. On the Tor Project website you can find the basics of hosting an onion service.
/d/programming, also includes hidden service development
/d/EndGame, great DDoS protection built by the same guys who built tforum
/d/newmarkets, to see newly launched markets
/d/Expose, to see hidden services/markets exposed by pentesters and hackers
I'm not sure if there's a onion hosting "bible" but there is a lot of useful resources here on tforum. On the Tor Project website you can find the basics of hosting an onion service.
Just focus on a static website first.
Then focus on firewall rules.
Then install Nginx Reverse Proxy.
Then focus on a WAF.
Do this all on your own machine.
Then practice SSH.
sudo apt-get install torsocks socat -y
You do not need to open any ports.
Then focus on firewall rules.
Then install Nginx Reverse Proxy.
Then focus on a WAF.
Do this all on your own machine.
Then practice SSH.
sudo apt-get install torsocks socat -y
You do not need to open any ports.
It's a fairly simple thing to host an onion site. You can find any tutorial and follow it. Contrary to popular opinion having an onion site does not mean you are doing something illegal. I personally use it to connect to the PC at my home whenever I am travelling. I would say it's a better way to connect to remote devices than Wireguard/Tailscale.
Ofc it's simple and I know how to do it, but I think that with a hidden service more than with anything it means that me and my network are exposed to attacks etc. What I was searching is resources to learn advanced ways to protect my server and to setup some OPSEC protocols.
No single bible, but here's the short list:
Read first:
Riseup's "Tor Hidden Services Best Practices"
Whonix Onion Services docs
Run OnionScan before going live
Key opsec:
Never host on a Tor relay
Use Whonix (IP leaks are too easy)
Skip Apache use micro-httpd or nginx
Enable Tor's built-in PoW defenses
Consider Vanguards for guard node protection
Quick start:
Try TorServ (hardened static server) or HiddenForge (Docker setup). Both handle the boring security stuff for you.
Start with Whonix + Riseup guide + OnionScan. That'll keep you safe while you learn.
Good luck
Read first:
Riseup's "Tor Hidden Services Best Practices"
Whonix Onion Services docs
Run OnionScan before going live
Key opsec:
Never host on a Tor relay
Use Whonix (IP leaks are too easy)
Skip Apache use micro-httpd or nginx
Enable Tor's built-in PoW defenses
Consider Vanguards for guard node protection
Quick start:
Try TorServ (hardened static server) or HiddenForge (Docker setup). Both handle the boring security stuff for you.
Start with Whonix + Riseup guide + OnionScan. That'll keep you safe while you learn.
Good luck