Hello all,
alec you raised an important point.
I think the problem is the example config a tor hiddenservices which suggests to use 127.0.0.1:80.
Apache is not the only software out there which may leaks metadata due to this "misconfiguration".
Those folks of riseup did a good write up: https://help.riseup.net/en/security/network-security/tor/onionservices-best-...
For some monitoring tools, for example munin, mod_status is essential.
To fix this problem in an apache setup and keep mod_status enabled, I did the following
I did the following:
Only allow 127.0.0.1 to request server-status in mod_status
Map the HiddenService on another IP (here: the internal IP of the machine)
Force Apache to Listen on the internal IP and port
setup a virtual host for IP and port
#/etc/apache2/mods-enabled/status.conf
Require ip 127.0.0.1
# /etc/tor/torrc HiddenServiceDir /var/lib/tor/hidden_service/ HiddenServicePort 80 192.168.2.4:8888
# /etc/apache2/ports.conf #ListenOnHsPorts Listen 192.168.2.4:8888
<VirtualHost 192.168.2.4:8888>
ServerName fooou4vhdb26iks.onion DocumentRoot /var/www/mysite.org/www
snip --- 8< ----
</VirtualHost>
On 30.01.2016 08:46, Alec Muffett wrote:
A word for the wise...
https://wireflaw.net/blog/apache-hidden-service-vuln.html
Tor hidden service operators: your default Apache install is probably vulnerable
TL;DR If you run a Tor hidden service for an Apache server, make sure you disable mod_status with: $ a2dismod status
On most distributions, Apache ships with a handy feature called mod_status enabled. It's a page located at /server-status that displays some statistics, like uptime, resource usage, total traffic, enabled virtual hosts, and active HTTP requests. For security reasons, it's only accessible from localhost by default.
This seems fairly reasonable, until you realize the Tor daemon runs on localhost. Consequently, any hidden service using Apache's default config has /server-status exposed to the world. What could a malicious actor do in that case? They could spy on potentially sensitive requests. They could deduce the server's approximate longitude if the timezone is set. They could even determine its IP address if a clearnet Virtual Host is present.
But this shouldn't be too much of a problem. Surely people who have taken the time to install an advanced web server and configure a hidden service for it have thoroughly read the documentation and disabled the offending module.
Or not.
[continues...]
-- http://dropsafe.crypticide.com/aboutalecm
tor-onions mailing list tor-onions@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-onions