Skip to content

Build a comprehensible onionsite checklist/documentation

Tasks

Contents

Documentation might including topics like:

  • Setting up:
    • Example with Apache (and remark about UNIX sockets not being supported).
    • Example with NGINX (TCP and UNIX sockets).
    • Example with lighttpd (and note about UNIX sockets support).
    • Example with Caddy (does it support UNIX sockets?).
  • Best practices:
    • The slightly outdated but very good Riseup documentation about Hosting Onion Services.
    • Relay security checklist (if exists), since the Onion Service checklist could be built atop of more general checklists about running a Tor node (but with the warning that no relay should run along the Onion Service instance).
    • See existing and legacy docs like the legacy OperationalSecurity page.
    • Making sure the system clock is synchronized.
    • Setup the Onion Location header (for sites accessible also from outside the Tor network).
    • Encrypted backup of .onion keys.
    • Consider NOT to use single mode/non-anonymous Onion Services (HiddenServiceSingleHopMode and HiddenServiceNonAnonymousMode) if distinct sites are hosted in the same provider/virtual machine and if relating each other is a concern. Like, suppose many distinct sites have their onions at the same place. Using single mode would mean it's easy to determine that these sites have their .onions hosted in the same location. By default HiddenServiceSingleHopMode and HiddenServiceNonAnonymousMode are not set, but depending on the tooling used to deploy this might not be the case.
    • Where to put the onion service webserver socket.
  • Optional/Advanced:
    • Load balancing:
      • Introduction (reusing part of the existing Onionspray documentation about load balancing: introduction and topologies).
      • Setting up Onionbalance:
        • Consider that using Onionbalance is also a measure for protecting the main Onion Service keys, as compromised backends would not expose the main keys. Check upcoming security analysis for details.
    • Configure Vanguards on each backend.
    • Vanity address generation (using mkp224o or other compatible tools)?
    • Setup HTTPS with valid x509 certificates (and automatic HTTP -> HTTPS connection upgrade, like with automatic HTTP-to-HTTPS redirection and/or the HSTS header).
    • Setup Onion Names (HTTPS Everywhere patch, or whatever is on it's place).
    • Onion v3 auth (current unsupported by Onionbalance, see tpo/core/onionbalance#5).
    • Alt-Svc Header (as an alternative or compliment to the Onion-Location header).
  • Performance:
    • Assets: consider to provide image, video and other assets optimally compressed to alleviate bandwidth comsumption in the Onion Service. While this is a general recommendation for any site, this can be of special importance for Onion Services. It might be worth checking browser support for storage-efficient formats (see tpo/applications/tor-browser#41664 (closed) for a discussion example).
  • Hardening:
  • Risk analysis:
  • Metrics:
  • Tuning and Quality Assurance tips (moved from #12 (closed)):
Edited by Silvio Rhatto