| blob | 25f5390c0a57f09e47394b2f547309d4187c1e40 |
1 <html>
2 <head>
8 </head>
10 <body>
14 <p>The simple version: Tor provides a distributed network of servers
15 ("onion routers"). Users bounce their TCP streams (web traffic, FTP, SSH,
16 etc.) around the routers. This makes it hard for recipients, observers, and
17 even the onion routers themselves to track the source of the stream.</p>
19 <p>The complex version: Onion Routing is a connection-oriented anonymizing
20 communication service. Users choose a source-routed path through a set of
21 nodes, and negotiate a "virtual circuit" through the network, in which
22 each node knows its predecessor and successor, but no others. Traffic
23 flowing down the circuit is unwrapped by a symmetric key at each node,
24 which reveals the downstream node.</p>
29 <p>Individuals need Tor for privacy:
30 <ul>
31 <li>Privacy in web browsing -- both from the remote website (so it can't
32 track and sell your behavior), and similarly from your local ISP.
33 <li>Safety in web browsing: if your local government doesn't approve
34 of its citizens visiting certain websites, they may monitor the sites
35 and put readers on a list of suspicious persons.
36 <li>Circumvention of local censorship: connect to resources (news
37 sites, instant messaging, etc) that are restricted from your
38 ISP/school/company/government.
39 <li>Socially sensitive communication: chat rooms and web forums for
40 rape and abuse survivors, or people with illnesses.
41 </ul>
43 <p>Journalists and NGOs need Tor for safety:
44 <ul>
45 <li>Allowing dissidents and whistleblowers to communicate more safely.
46 <li>Censorship-resistant publication, such as making available your
48 service</a>; and reading, e.g. of news sites not permitted in some
49 countries.
50 <li>Allowing your workers to check back with your home website while
51 they're in a foreign country, without notifying everybody nearby that
52 they're working with your organization.
53 </ul>
55 <p>Companies need Tor for business security:
56 <ul>
57 <li>Competitive analysis: browse the competition's website safely.
58 <li>Protecting collaborations of sensitive business units or partners.
59 <li>Protecting procurement suppliers or patterns.
61 amount and frequency of communication. Which locations have employees
62 working late? Which locations have employees consulting job-hunting
63 websites? Which research groups are communicating with your company's
64 patent lawyers?
65 </ul>
67 <p>Governments need Tor for traffic-analysis-resistant communication:
68 <ul>
69 <li>Open source intelligence gathering (hiding individual analysts is
70 not enough -- the organization itself may be sensitive).
72 with a million users (even if they're all cleared) can't be made safe just
73 by hardening them to external threat.
74 <li>Dynamic and semi-trusted international coalitions: the network can
75 be shared without revealing the existence or amount of communication
76 between all parties.
77 <li>Networks partially under known hostile control: to block
78 communications, the enemy must take down the whole network.
79 <li>Politically sensitive negotiations.
80 <li>Road warriors.
81 <li>Protecting procurement patterns.
82 <li>Anonymous tips.
83 </ul>
85 <p>Law enforcement needs Tor for safety:
86 <ul>
87 <li>Allowing anonymous tips or crime reporting
88 <li>Allowing agents to observe websites without notifying them that
89 they're being observed (or, more broadly, without having it be an
90 official visit from law enforcement).
91 <li>Surveillance and honeypots (sting operations)
92 </ul>
94 <p>Does the idea of sharing the Tor network with
95 all of these groups bother you? It shouldn't -- <a
102 <p>You can run Tor in either client mode or server mode. By default,
104 anybody but yourself.</p>
107 a client. Otherwise, please consider being a server, to help out the
109 per month; but that may go up.)</p>
111 <p>Note that you can be a server without allowing users to make
112 connections from your computer to the outside world. This is called being
113 a middleman server.</p>
115 <p> Benefits of running a server include:
116 <ul>
118 or receive as much traffic as they want.
119 <li>You may get stronger anonymity, since your destination can't know
120 whether connections relayed through your computer originated at your
121 computer or not.
122 <li>You can also get stronger anonymity by configuring your Tor clients
123 to use your Tor server for entry or for exit.
124 <li>You're helping me with development and scalability testing.
125 <li>You're helping your fellow Internet users by providing a larger
126 network. Also, having servers in many different pieces of the Internet
127 gives users more robustness against curious telcos and brute force
128 attacks.
129 </ul>
131 <p>You can read more about setting up Tor as a
145 <p>If you got Tor from the Win32 .exe file, you
146 can just click-click it (you may need to install <a
149 libeay32.dll.) You might also want to run Tor in a dos window,
150 so you can see its logs, and see its error messages if it
151 crashes. If you don't want the default configuration, fetch the <a
158 package</a>), these steps are already done for you, and you may
159 even already have Tor started in the background (logging to
160 /var/log/something).</p>
163 you've got it running.</p>
168 <p>Tor comes configured as a client by default. It uses a built-in
169 default configuration file, and most people won't need to change any of
170 the settings.</p>
173 By default, your Tor client only listens for applications that connect
174 from localhost. Connections from other computers are refused. If you
175 want to torify applications on different computers than the Tor client,
176 you should copy torrc.sample to torrc (it's installed by default
177 to /usr/local/etc/tor/), change the SocksBindAddress line to
180 <p>To test if it's working, point your browser
181 to socks4 or socks5 proxy at localhost port 9050. In
182 Mozilla, this is in edit|preferences|advanced|proxies. Go to <a
183 href="http://www.junkbusters.com/cgi-bin/privacy">http://www.junkbusters.com/cgi-bin/privacy</a>
184 and see what IP it says you're coming from. (If you have a personal
185 firewall, be sure to allow local connections to port 9050. If your
186 firewall blocks outgoing connections, punch a hole so it can connect to
188 keep in mind that OS X before 10.3 claims to support socks but does
189 not.)</p>
193 proxy that integrates well with Tor. Add the line <br>
195 (don't forget the dot) to its config file (you can just add it to the
196 top). Then change your mozilla to http proxy at localhost port 8118
197 (and no socks proxy). You should also set your SSL proxy to the same
198 thing, to hide your https traffic. Using privoxy is necessary because
200 DNS requests when it uses a socks proxy directly</a>. Privoxy also gives
201 you good html scrubbing.</p>
203 <p>You might want to use Tor with an application that doesn't
204 support socks directly. In this case, you should look at
206 to dynamically replace the system calls in your program to
207 route through Tor. If you want to use socks4a, consider using <a
212 <p>(Windows doesn't have tsocks; instead, you can try
213 <a
216 SOCKS client.)</p>
221 <p>We're looking for people with reasonably reliable Internet connections,
222 that have at least 1Mbit each way. Currently we don't use all of that,
223 but we want it available for burst traffic.</p>
225 <p>(The Tor server doesn't need to be run as root, and doesn't
226 need any special system permissions or kernel mods. You should probably
227 run it as its own user though, especially if you run an identd service
228 too. If you're the paranoid sort, feel free to <a
232 <p>First, copy torrc.sample to torrc (in the default configuration this
233 means copy /usr/local/etc/tor/torrc.sample to /usr/local/etc/tor/torrc),
234 and edit the middle part. Create the DataDirectory,
235 and make sure it's owned by the uid/gid that will be running tor. Fix your system
236 clock so it's not too far off. Make sure name resolution works. Make sure
237 each process can get to 1024 file descriptors (this should be already
238 done for everybody but the BSD folks). Open a hole in your firewall so
239 outsiders can connect to your ORPort.</p>
242 in your DataDirectory is your 'fingerprint' file. Mail it to
243 tor-ops@freehaven.net.</p>
245 <p>In that mail, be sure to tell us who you are, so we know whom to contact
246 if there's any problem. Also describe what kind of connectivity the new
247 server will have. If possible, PGP sign your mail.</p>
252 running-routers line to see if your server is part of the network.</p>
254 <p>You may find the initscript in contrib/tor.sh useful if you
255 want to set up Tor to start at boot.</p>
261 is, you can offer an apache, sshd, etc, without revealing your IP to its
262 users. This works via Tor's rendezvous point design: both sides build
263 a Tor circuit out, and they meet in the middle.</p>
267 to see hidden services in action.</p>
269 <p>To set up a hidden service, copy torrc.sample to torrc (by default it's
270 in /usr/local/etc/tor/), and edit the bottom part. Then run Tor. It will
271 create each HiddenServiceDir you have configured, and it will create a
272 'hostname' file which specifies the url (xyz.onion) for that service. You
273 can tell people the url, and they can connect to it via their Tor client,
274 assuming they're using a proxy (such as Privoxy) that speaks socks4a.</p>
279 <p>
280 If you want to experiment locally with your own network, or you're cut
281 off from the Internet and want to be able to mess with Tor still, then
282 you may want to set up your own separate Tor network.
284 <p>
285 To set up your own Tor network, you need to run your own directory
286 servers, and you need to change the tarball so it points to your directory
287 servers rather than the default ones.
289 <ul>
292 <ul>
295 defined. Set "AuthoritativeDirectory 1".
297 versions of the code for clients and servers to be running (see step
298 4c below).
301 specify one. This will generate your keys and output a fingerprint
302 line.
303 </ul>
308 dirservers. For each fingerprint, add a line like<br>
310 to the torrc of each client and server who will be using your network.
312 of each directory server. Collect the 'fingerprint' lines from
313 each server (including directory servers), and include them (one per
314 line) in each approved-routers file. You can hup the tor process for
315 each directory server to reload the approved-routers file (so you don't
316 have to restart the process).
317 </ul>
319 <!--<h2>Other doc resources</h2>
321 <ul>
322 <li>Design paper
323 <li>Spec and rend-spec
324 <li>others
325 </ul> -->
327 </body>
328 </html>