Requirements:
-A vps
-Some basic Linux knowledge
This guide will use:
-Nginx
-Debian
-Tor (duh)
That's basically it.
Setting up a site is not too complicated, doing it securely however is a whole different matter.
A vps provider can be found on the list /u/femboy_destroyer69 or /u/headjanitor has made
/post/db55d693f9c0fd8a88a6
/post/cedc0f1054d73128e8e2
After getting a vps server you will first want to connect and make sure everything is up to date.
To do this you will need to connect using ssh, and update everything use apt.
ssh username@server_ip
sudo apt-get update && sudo apt-get upgrade -y
Installing tor and nginx can also be done using apt:
sudo apt-get install tor
sudo apt-get install nginx
Now that everything has been done, you can check if tor is running by entering
service tor status
With that being done, We can continue on to setting up the rest of our hidden service.
Open up the torrc file located in /etc/tor/torrc and look for the section about location-hidden services.
Uncomment the first HiddenServiceDir and HiddenServicePort lines by removing the "#".
After that has been done, restart tor by entering the command
"service tor restart" and check if a file has been created in /var/lib/tor/hidden_service called "hostname"
this will be the onion address of your hidden service!
A good practice to avoid leaking an Onion Service to a local network, is to run Onion services over Unix sockets instead of a tcp socket.
You will need to change the HiddenServicePort line to:
HiddenServicePort 80 unix:/var/run/tor/my-website.sock
Now let's continue on to configuring nginx to actually display our site.
First create a directory in /var/www/ called hidden_service and put your website's files there.
Then create the basic nginx config in /etc/nginx/sites-available/hidden_service
You can name this config file whatever you want it to be.
Put this configuration inside said file
server {
listen unix:/var/run/tor/my-website.sock;
root /var/www/hidden_service;
index index.html;
server_name [Your onion address];
location / {
try_files $uri $uri/ =404;
}
}
Now you need to tell nginx that this site is enabled by creating a symbolic link to /etc/nginx/sites-enabled/
You do this by using this command:
sudo ln -s /etc/nginx/sites-available/hidden_service/ /etc/nginx/sites-enabled
After testing the configuration for syntax errors by using sudo nginx -t you can reload the service to apply the configuration
sydo systemctl reload nginx
This should be it! Your tor hidden service is up and running! Very well done.
I'm proud of you :)
some notes
1) Backup your keys. An administrator's worst nightmare is losing access to the domain.
2) Consider running the onion service inside a virtual machine on your VPS. This way you can more easily compartimentalize everything and monitor the traffic coming in and out more easily.
3) Consider using onionscan to scan for potential security vulnerabilities in your hidden service.
4) Don't run a relay at the same time, This allows for traffic correlation and fingerprinting.
5) Don't connect to your vps using clearnet. In the case the clearnet IP of your service leaks, you are still hidden behind tor.
6) Monitor the availability of your onion service.