self hosting a tor service on a raspberry pi

lets say im hosting a tor service on my home network with a raspberry pi as long as i have no ports opened and im usint a decent service to put on my webserver with good permissions and apache i should be good right? can feds tell that im the site host with timing attacks? will i start to be investigated or put on a list by my isp for being connected to tor for over 3 months already? (i forgot about my pi in my basement lol) am i already fuarrrked? second main question is should i be restartiny tor every couple hour for a new circuit or should i just leave tor open as long as possible and never restart my session and stay on the same relay?

Feds monitor your ISP and all Internet traffic within country, of course they can do all sorts of traffic confirmation attacks if they suspect the server is hosted within the country. You can use obfuscated bridges or wrap around an encrypted tunnel (wiregaurd, openvpn, shadowsocks) to a virtual server in another country, you can also set up a private tor bridge which would do basically the same, however they can still test your server against denial attacks like Internet connection blackouts, electricity blackouts, and so on.

>>16556 but if im using tor and i restart the relay every hour how would they know what country my .onion is from?

>>16558 This is a mistake. Tor automatically rotates out rendezvous points, and clients rotate exits every 10min. Just leave Tor connected. Leaving Tor connected also doesnt allow feds to determine if site is up only when your connection is up. Tor isnt illegal in most western countries. Hosting a Darknet service isnt either, but Tor is designed to hide this fact. DNMs exist. Your service is safe.

>>16574 thank you so much

>>16555 Tor does not do enough to guard against timing attacks, though I admit that hidden services are much more protected. They will continuously DoS you anon. On a net that doesn't have small amounts of cover traffic or added latency, you're in trouble here. If you became a relay, perhaps you could allow general Tor traffic to act as cover, but you're really out in the open if they attack you for long enough.

>>16581 To add, it may take months, or even longer... but if you're not employing additional methods of security, you're going to have problems. Do as much as you can to host in and route through foreign countries, use bridges when administering your site, etc. As for having Tor on for so long, bridges are great. I would suggest snowflake proxies due to their diversity of locations, but they may be slow and/or unreliable. One thing to note is to take care for the "God's Eye" view of the internet backbone in the 14 eyes countries and wherever they have influence- they may be able tell that you are using Tor, depending on where your bridge is, since they know that the bridge is connecting to Tor.

>>16581 would a program like noisy.py runnng on my py at the same time as well as routing my traffic through a proxy outside the 14 eyes be enough? i dont run a large service yet only sub 50 people

>>16583 first off cant i just moderate the site through my LAN? there are some url redirect issues but i might shut down the site on the user permission end. what sort of constant security updates are we talking about here? ill have to look into bridges as ive never used one before for both hosting my service and browsing with tor either. finding a proxy outsite the 14 eyes shouldnt be an issue. as for the security updates i really dont want to use a cdn for ddos protection as that could comprimise both my users and i if i was searched which is almost inevitable at this point so do you have any alternatives? im currently looking into using pgp verification at registration to keep out feddies although that make deter some more novice users. ill look into different anti ddosing solutions as well thank you for the detailed reponse

>>16589 Hosting on your LAN means that you have full control, but also that the site's operations can be tied to you (not proveable, of course). PGP is great, since things expire- this means that even if your soykaf is seized, anyone who knows what's going on knows that you are compromised. I suggested routing (or hosting in) through foreign countries as much as possible due to the decreased capacity of our western global adversary to do dragnet there. You should be fine with FDE, PGP, bridges, proxies, whatever. Make sure your keys for this soykaf are very secure, make sure that you KNOW when someone tampers (one anon suggested a pressure chamber LOL, even a tripwire or motion sensor would work).

>>16594 Oh, and as I mentioned before, if you had started up a Tor relay yourself then they would not have known that you are hosting a HS. However that ship has sailed, and hosting a Tor relay is known to be relatively expensive.

>>16583 >Do as much as you can to host in and route through foreign countries This is what stock Tor already does. By trying to force certain hops, you just make your traffic more identifiable. Check out the gruhq on VPNs and Tor. >>16589 DDOS wont deanonymize your site. Market DNMs DOS each other all the time. No one has been identified by this technique. >im currently looking into using pgp verification at registration to keep out feddies This will not deter law enforcement. Unless you already have some kind of pre-existing web of trust. If your going to let anyone register (which is a normal thing), you will not be able to identify who is LE or not. LE will gladly use PGP, Tor, VPNs, w/e and tell you w/e you want to hear, or w/e lie is convinent if they are investigating you. >>16595 >if you had started up a Tor relay yourself then they would not have known that you are hosting a HS. You guys litterally just make soykaf up. The Tor Project advises against hosting Hidden Service on a Relay b/c most relays are bandwidth limited, and when relay goes out, if HS goes down, then you know. If you have ever run a Tor Relay and HS you would have seen the warning in the logs. >, and hosting a Tor relay is known to be relatively expensive. Its actually incredibly cheap. A Low end VPS for $5 USD/ mo. can run a Tor relay. You should try it.

>>16596 >>This is what stock Tor already does. By trying to force certain hops, you just make your traffic more identifiable. but.... i dont think you understand what i meant anon i meant my isp and gov can ser that im hosting a service if i was using a proxy to soykafhole country with no laws then they would only know im using a proxy ofc if they seize the soykafhole server which i doubt will happen since im certain my service wont grow exponentially then it would help overall >>This will not deter law enforcement. Unless you already have some kind of pre-existing web of trust. If your going to let anyone register right now its completly open and im certain im safe but ill be making it invite only soon to help also it could deter my countries feddies as they are pretty stupid from what ive been able to gather off previos cases also i dont plan on hosting a relay anytime in forseeable future

>>16594 as far as keys go would decrypting/encrypting be ok on my main/daily OS thats somehwat security optimized as long as i disabled all network connections/outboud connections and a usb? or should i just stick to a tails boot and store my keys on a seperate usb as well?

>>16594 as far as knowing if my soykafs been tampered with i might need some aid for digital tampering lol they physical tampering shouldnt be as difficult as i have a secure locked area for storing where i keep my key holder

>>16598 >meant my isp and gov can ser that im hosting a service Nope. Tor is designed to conceal this. >if i was using a proxy to soykafhole country with no laws then they would only know im using a proxy Nope. If you reverse proxy from an IP to yours, no Tor, all the traffic, or at least patterns, may be visible, and your server is clearly associated with the IP. If you use Tor, forcing a specific hop is just pattern of life and gives more information about you. Tor hosts DNMs. If the security margin is high enough for DNMs, dont mess with the recipe unless you realllllly no what your doing, or you dont care about security.

>>16596 >By trying to force certain hops, you just make your traffic more identifiable. No no, I know that. You misread. Tor itself counts as a method of forcing your packets to route various countries. I was saying that if they have VPS services in countries with no reason to answer their feds, they should consider hosting bridges there, or using proxies there. >No one has been identified by this technique. Why are you so sure? Are you the NSA? >You guys litterally just make soykaf up. Prove that a relay is hosting a hidden service. You will have a hard fuarrrking time, since the whole network's traffic and associations will be acting as your cover in terms of bandwidth overhead, latency overhead, making timing attacks much harder.

>>16626 >Nope. Tor is designed to conceal this. No, it can't really conceal this long-term. What kind of entity has a sustained connection to the Tor network 24/7 for months at a time? This is characteristic of a server.

>>16628 this isnt op lol but thank you >>16626

>>16629 this is what i was thinking (op here)

so should i use a proxy on my pi to route all traffic through (other than ssh) especially while connecting to tor or not?

I really hope nym will not turn out to be a cryptoscam

>>16633 what the fuarrrk are you talking about? wrong thread maybe?

>>16633 I highly doubt it will be. The crypto is only for incentives- you don't need to engage in it to host a relay. Plus, the crypto is based in something that has value.

>>16632 http://tv54samlti22655ohq3oaswm64cwf7ulp6wzkjcvdla2hagqcu7uokid.onion/posts/vpn-tor-not-mRikAa4h/

>>16641 It won't open the site

Do you guys have any pdfs on server hosting for newbies and tor? I would appreciate that greatly

>>16650 There is no secret. https://2019.www.torproject.org/docs/tor-onion-service

should i consider hosting my service on nym net when it comes out or i2p for now instead of tor?

>>16732 Use I2P for now. It has quite a few advantages over Tor.

!WARN! Problem with self-hosting hidden services: Imagine that someone is trying to deanonymize your hidden service and for some reason they've come to suspect that you're hosting it at home. They can quickly confirm this by DDoS of your home network!

>>16753 yes but cant i just limit connections a lot and have a decent firewall set up?