1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
|
Over the River and Through the Wood
===================================
`Hidden services <https://www.torproject.org/docs/hidden-services.html.en>`_
give you a way of providing a service without exposing your address. These
services are only accessible through Tor or `Tor2web <https://tor2web.org/>`_,
and useful for a surprising number of things...
* **Hosting an anonymized site**. This is usually the first thing that comes to
mind, and something we'll demonstrate in a sec.
* Providing an **endpoint Tor users can reach** without exiting the Tor
network. This eliminates the risk of an unreliable or malicious exit getting
in the way. Great examples of this are `Facebook
<http://arstechnica.com/security/2014/10/facebook-offers-hidden-service-to-tor-users/>`_
(*facebookcorewwwi.onion*) and `DuckDuckGo
<https://lists.torproject.org/pipermail/tor-talk/2010-August/003095.html>`_
(*3g2upl4pq6kufc4m.onion*).
* **Personal services**. For instance you can host your home SSH server as a
hidden service to prevent eavesdroppers from knowing where you live while
traveling abroad.
`Tor2web <https://tor2web.org/>`_ provides a quick and easy way of seeing if
your hidden service is working. To use it simply replace the **.onion** of
your address with **.tor2web.org**...
.. image:: /_static/duck_duck_go_hidden_service.png
:target: https://3g2upl4pq6kufc4m.tor2web.org/
.. _running-a-hidden-service:
Running a hidden service
------------------------
Hidden services can be `configured through your torrc
<https://www.torproject.org/docs/tor-manual.html.en#_hidden_service_options>`_,
but Stem also provides some methods to easily work with them...
* :func:`~stem.control.Controller.create_hidden_service`
* :func:`~stem.control.Controller.remove_hidden_service`
* :func:`~stem.control.Controller.get_hidden_service_conf`
* :func:`~stem.control.Controller.set_hidden_service_conf`
The main threat to your anonymity when running a hidden service is the service
itself. Debug information for instance might leak your real address,
undermining what Tor provides. This includes the following example, **do not
rely on it not to leak**.
But with that out of the way lets take a look at a simple `Flask
<http://flask.pocoo.org/>`_ example based on one by `Jordan Wright
<https://jordan-wright.github.io/blog/2014/10/06/creating-tor-hidden-services-with-python/>`_...
.. literalinclude:: /_static/example/running_hidden_service.py
:language: python
Now if we run this...
::
% python example.py
* Connecting to tor
* Creating our hidden service in /home/atagar/.tor/hello_world
* Our service is available at uxiuaxejc3sxrb6i.onion, press ctrl+c to quit
* Running on http://127.0.0.1:5000/
127.0.0.1 - - [15/Dec/2014 13:05:43] "GET / HTTP/1.1" 200 -
* Shutting down our hidden service
... we'll have a service we can visit via the `Tor Browser Bundle <https://www.torproject.org/download/download-easy.html.en>`_...
.. image:: /_static/hidden_service.png
.. _hidden-service-authentication:
Hidden service authentication
-----------------------------
Hidden services you create can restrict their access, requiring in essence a
password...
::
>>> from stem.control import Controller
>>> controller = Controller.from_port()
>>> controller.authenticate()
>>> response = controller.create_ephemeral_hidden_service({80: 8080}, await_publication=True, basic_auth={'bob': None, 'alice': None})
>>> response.service_id, response.client_auth
('l3lnorirzn7hrjnw', {'alice': 'I6AMKiay+UkM5MfrvdnF2A', 'bob': 'VLsbrSGyrb5JYEvZmQ3tMg'})
To access this service users simply provide this credential to tor via their
torrc or SETCONF prior to visiting it...
::
>>> controller.set_conf('HidServAuth', 'l3lnorirzn7hrjnw.onion I6AMKiay+UkM5MfrvdnF2A')
.. _ephemeral-hidden-services:
Ephemeral hidden services
-------------------------
In the above example you may have noticed the note that said...
::
# The hostname is only available when we can read the hidden service
# directory. This requires us to be running with the same user as tor.
This has been a limitation of hidden services for years. However, as of version
0.2.7.1 Tor offers another style for making services called **ephemeral hidden
services**.
Ephemeral services can only be created through the controller, and only exist
as long as your controller is attached unless you provide the **detached**
flag. Controllers can only see their own ephemeral services, and ephemeral
services that are detached. In other words, attached ephemeral services can
only be managed by their own controller.
Stem provides three methods to work with ephemeral hidden services...
* :func:`~stem.control.Controller.list_ephemeral_hidden_services`
* :func:`~stem.control.Controller.create_ephemeral_hidden_service`
* :func:`~stem.control.Controller.remove_ephemeral_hidden_service`
For example, with a ephemeral service our earlier example becomes as simple as...
.. literalinclude:: /_static/example/ephemeral_hidden_services.py
:language: python
Ephemeral hidden services do not touch disk, and as such are easier to work
with but require you to persist your service's private key yourself if you want
to reuse a '.onion' address...
.. literalinclude:: /_static/example/resuming_ephemeral_hidden_service.py
:language: python
.. _hidden-service-descriptors:
Hidden service descriptors
--------------------------
Like relays, hidden services publish documents about themselves called **hidden
service descriptors**. These contain low level details for establishing
connections. Hidden service descriptors are available from the tor process via
its :func:`~stem.control.Controller.get_hidden_service_descriptor` method...
.. literalinclude:: /_static/example/get_hidden_service_descriptor.py
:language: python
::
% python print_duck_duck_go_descriptor.py
rendezvous-service-descriptor e5dkwgp6vt7axoozixrbgjymyof7ab6u
version 2
permanent-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBAJ/SzzgrXPxTlFrKVhXh3buCWv2QfcNgncUpDpKouLn3AtPH5Ocys0jE
aZSKdvaiQ62md2gOwj4x61cFNdi05tdQjS+2thHKEm/KsB9BGLSLBNJYY356bupg
I5gQozM65ENelfxYlysBjJ52xSDBd8C4f/p9umdzaaaCmzXG/nhzAgMBAAE=
-----END RSA PUBLIC KEY-----
secret-id-part bmsctib2pzirgo7cltlxdm5fxqcitt5e
publication-time 2015-05-11 20:00:00
protocol-versions 2,3
introduction-points
-----BEGIN MESSAGE-----
aW50cm9kdWN0aW9uLXBvaW50IHZzcm4ycGNtdzNvZ21mNGo3dGpxeHptdml1Y2Rr
NGtpCmlwLWFkZHJlc3MgMTc2LjkuNTkuMTcxCm9uaW9uLXBvcnQgOTAwMQpvbmlv
... etc...
A hidden service's introduction points are a base64 encoded field that's
possibly encrypted. These can be decoded (and decrypted if necessary) with the
descriptor's
:func:`~stem.descriptor.hidden_service.HiddenServiceDescriptor.introduction_points`
method.
.. literalinclude:: /_static/example/introduction_points.py
:language: python
::
% python print_duck_duck_go_introduction_points.py
DuckDuckGo's introduction points are...
176.9.59.171:9001 => vsrn2pcmw3ogmf4j7tjqxzmviucdk4ki
104.131.106.181:9001 => gcl2kpqx5qnkpgxjf6x7ulqncoqj7ghh
188.166.58.218:443 => jeymnbhs2d6l2oib7jjvweavg45m6gju
|
