- tor-onions - lists.torproject.org

ucspi-onion
by Taylor R Campbell 06 Feb '17

06 Feb '17

I wrote a little ucspi-onion program, along the lines of ucspi-tcp and friends, to configure an onion service and serve it with any program that follows the UCSPI. Hg repository: https://mumble.net/~campbell/hg/ucspi-onion/ (The UCSPI is the `Unix client-server program interface', created for various djb tools: <https://cr.yp.to/proto/ucspi.txt>. It can also usually run any connection-oriented programs designed for inetd.) This can be combined with programs following the UCSPI, such as publicfile, to dynamically configure onions slightly more easily than <https://trac.torproject.org/projects/tor/wiki/doc/Publicfile>. This also avoids the TCP/IP stack altogether so that you can use Unix file system permissions to control access and limit leaks. This was an evening hack which I have not used in anger yet. If you feel inclined to try it and find it useful or encounter problems with it, I would be curious to hear. (I don't have a securedrop set up for you to post anonymous feedback, though, sorry!)

1 0

Onion Enterprise Toolkit - ALPHA
by Alec Muffett 04 Feb '17

04 Feb '17

Hi All, Yesterday I pushed this out to the world: https://github.com/alecmuffett/eotk - The Enterprise Onion Toolkit - currently EOTK works on OSX and could probably be coerced to run on various Linux but I have not documented nor tested that yet. The aim is that a site administrator can edit a very simple config file: # default project hardmap secrets.d/s2kpvtwjbawr3mx3.key aclu.org hardmap secrets.d/77bytc6x3bqdf7s6.key liberty-human-rights.org.uk # topical project set project digital-rights hardmap secrets.d/oh7b6dpvd3kgchfb.key openrightsgroup.org hardmap secrets.d/zbboaoeo6ruhqnu2.key eff.org hardmap secrets.d/m4x6zoaflrjez7dh.key accessnow.org hardmap secrets.d/wn74m5ts4r5xe4r4.key digitalrights.ie ...and run a couple of simple commands, and immediate get onion sites which do bidirectional rewriting of requests and responses between the given onion address and the given DNS domain. SSL support is afforded by automatically-generated self-signed certificates - an ugly hack, but it means that site owners can prototype an onion offering, and (eventually) put it into production with an equivalent EV cert. I am working on amendments to make EOTK very onionbalance-friendly; the eventual goal is to provide a filetree of NGINX + Tor configurations which can be rsync'd to a cloud of machines, and the onion-addresses thereby created get scraped for Onionbalance to publish. This will offer linear scalability for Enterprise Tor Onions. More users? Add more machines! And less "heavy" deployments can just use a single config without Onionbalance. There's a lot of work still to be done, but I thought I would mention it here in case folk would like to experiment and provide feedback so far. -a -- http://dropsafe.crypticide.com/aboutalecm

4 5

Monitoring .onion performance
by Tom Ritter 02 Feb '17

02 Feb '17

If I set up OnionBalance, and have two backend onion servers - how would I know if I need to add another onion server and balance it further? I can easily monitor the CPU/Memory usage of the onion servers, but does that tell the whole story? I assume there's potentially other ways connection failures can occur... -tom

4 3

tor-onions Archives.
by Jörg Hager 20 Dec '16

20 Dec '16

Dear Sirs, please conform list above in my account. Many thanks. Kind regards Jörg Hager

1 0

(no subject)
by Javier Casas 20 Dec '16

20 Dec '16

1 0

Anyone running single onion service?
by David Goulet 14 Dec '16

14 Dec '16

Hi everyone! Tor 0.2.9 stable will be release this month and we want to make a blog post about the Single Onion Service feature. We are wondering if anyone here is running one serving "many users" (for some values of many) and if there is any feedback you can give us or some "quote" that would bring some *zing* to our blog post as an incentive to run one? Thanks! David

4 3

Tor Services not working with higher number ports
by J. S. Evans 23 Nov '16

23 Nov '16

Previously, I had set my my ssh port to 12222 instead of port 22 so that it would be a little harder to find and that worked OK. This week I started adding this port to my onion service so that I could log into ssh via tor and I continuously received this kind of error: Ncat: Error: Connection refused. ssh_exchange_identification: Connection closed by remote host I worked on this for two days and this morning I decided to change sshd back to the standard port 22 and updated torrc accordingly and voilà it works. My question is, is this a bug or a known limitation of the tor software? Best Regards, Jason

2 1

(no subject)
by Brandykins 19 Nov '16

19 Nov '16

Sent on the go with Vodafone

1 0

Limits on Next-Gen Hidden Services
by teor 18 Nov '16

18 Nov '16

Hi, asn has done some great design work on next-generation hidden services, and has arrived at some size limits: "- I feel that the max settings imposed by the 50k max size limit, will satisfy most crazy hidden service use cases that someone might have wrt scalability or number of authed clients. It can support up to 350 authed clients, and 20 intro points. We should increase the max size limit, if we want to support more advanced use cases. - I also feel the configurations that fit in the default descriptor (of 10k bytes blob) will probably satisfy most hidden service use cases out there as it can support up to 80 authed clients, and up to 11 intro points. The anonymity set of those hidden services descriptors will be good wrt snooping HSDirs - Giant hidden service descriptors will stand out and their anonymity set will likely be small. I think such giant hidden services should perhaps split their info to multiple descriptors using some sort of stealth-auth mechanism (where they give different onion address to different clients). Alternatively, we should change our padding rules, or always pad to max descriptor size." asn has also made the maximum size a consensus parameter, so it can be changed if needed. Please reply to asn's tor-dev email: https://lists.torproject.org/pipermail/tor-dev/2016-November/011658.html T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------

1 0

Testing 0.2.9 (and Single Onion Services)
by teor 09 Nov '16

09 Nov '16

Hi, We recently put out a call for testing Tor 0.2.9, which includes the Single Onion Service feature. https://lists.torproject.org/pipermail/tor-dev/2016-October/011541.html To use this feature, put the following lines in your torrc: HiddenServiceSingleHopMode 1 HiddenServiceNonAnonymousMode 1 Tim T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------------

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

tor-onions