wiki:doc/OperationalSecurity

Version 27 (modified by trac, 9 years ago) (diff)

--

##language:en

How to Run a Secure Tor Server

Encrypt Storage and Swap Space

Make sure that any sensitive files are stored on an encrypted filesystem and that file permissions are set correctly. With a Tor server, the only sensitive information is the server's private key (located in /usr/local/etc/tor/keys on Unix/Linux platforms; readable only by owner).

Additionally, swap space on the machine should be encrypted if your operating system has such an option. On some operating systems, it is possible to have swap space be a file on an encrypted filesystem.

TODO: Give instructions on setting up encrypted filesystems and swap on
various OSs (hopefully including OS X and Windows).

Follow all Security Updates for Your Operating System

This is probably one of easiest, and most important, things you can do.

Also, if your operating system has support for signed updates, you should make sure that you enable it.

Physical Security

Make sure that the machine running your Tor server is physically secure. If it is in a cabinet or rack in a colocation facility, make sure the door(s) is/are locked. If it is in a machine room in your office, make sure the do to the machine room is locked.

Additionally, make sure your backup media are physically secure. For example, you might keep backup tapes in a safe deposit box at your bank.

Eliminate All Unnecessary Services and User Accounts

Ensure that your Tor server is not running any unnecessary services. Many (well, most) operating systems come out of the box with extraneous services running by default. Turn them off. Ideally, your Tor server would run on a dedicated machine with no user accounts and no services other than Tor itself.

If you must run other services, lock them down to the extent possible. For example, you can set OpenSSH to allow only certain user accounts to connect, or you can firewall your system such that only certain IP addresses are allowed to connect to the SSH service on your server. The same applies for most HTTP servers.

Reliability

Make sure your Tor server has good, battery-backed power and reliable network connectivity. Make sure to use stable operating system software and good quality hardware, so that the system does not suffer from undue crashes or other failures.

Minimize Data Retention

Audit your server's logging configuration and reduce the amount of information logged as much as possible. Set your log rotation software to delete logs after as short a time as you can manage.

If possible, keep no logs.

TODO: Point to EFF's best practices document?

Install Tor and Other Software Carefully

Tor, and many other software packages, are released along with digital signatures. These signatures allow you to verify the integrity and authorship of the software. Download the signatures and verify them!

If possible, read and audit the source code to applications you install, including Tor.

Operating System Paranoia

Some operating systems come in "high security" flavors, such as Security Enhanced Linux, TrustedBSD and OpenBSD. These systems offer advanced security mechanisms such as mandatory access control (MAC), application sandboxing, resource management knobs, and so on. Consider using them if they exist on your system and would help.

Run Tor and Other Services in a Restricted Environment

See Steven J Murdoch's guide to [:TheOnionRouter/TorInChroot: running Tor in a chroot].

TODO: discuss chroot, jail, systrace

Other Resources

TODO: Links to other "how to lock down a server" documents.

Credits

  • First version by Chris Palmer based on IRC conversation with Roger Dingledine.
  • Wikified and mildly edited by Nick Mathewson.