doc/tor-doc-server.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
   2 "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
   3
   4 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   5 <head>
   6   <title>Tor Server Configuration Instructions</title>
   7   <meta name="Author" content="Roger Dingledine" />
   8   <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1" />
   9   <link rel="stylesheet" type="text/css" href="http://tor.eff.org/stylesheet.css" />
  10   <link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" />
  11 </head>
  12
  13 <body>
  14
  15 <!-- TITLE BAR & NAVIGATION -->
  16
  17 <table class="banner" border="0" cellpadding="0" cellspacing="0">
  18     <tr>
  19         <td class="banner-left"></td>
  20         <td class="banner-middle">
  21             <a href="/index.html">Home</a>
  22           | <a href="/howitworks.html">How It Works</a>
  23           | <a href="/download.html">Download</a>
  24           | <a href="/documentation.html">Docs</a>
  25           | <a href="/users.html">Users</a>
  26           | <a href="/faq.html">FAQs</a>
  27           | <a href="/volunteer.html">Volunteer</a>
  28           | <a href="/developers.html">Developers</a>
  29           | <a href="/research.html">Research</a>
  30           | <a href="/people.html">People</a>
  31         </td>
  32         <td class="banner-right"></td>
  33     </tr>
  34 </table>
  35
  36 <!-- END TITLE BAR & NAVIGATION -->
  37
  38 <div class="center">
  39
  40 <div class="main-column">
  41
  42 <h1>Configuring a <a href="http://tor.eff.org/">Tor</a> server</h1>
  43 <br />
  44
  45 The Tor network relies on volunteers to donate bandwidth. The more
  46 people who run servers, the faster the Tor network will be. If you have
  47 at least 20 kilobytes/s each way, please help out Tor by configuring your
  48 Tor to be a server too. We have many features that make Tor servers easy
  49 and convenient, including rate limiting for bandwidth, exit policies so
  50 you can limit your exposure to abuse complaints, and support for dynamic
  51 IP addresses.</p>
  52
  53 <p>Having servers in many different places on the Internet is what
  54 makes Tor users secure. You may also get stronger anonymity yourself,
  55 since remote sites can't know whether connections relayed through your
  56 computer originated at your computer or not.</p>
  57
  58 <p>Setting up a Tor server is easy and convenient:
  59 <ul>
  60 <li>Tor has built-in support for <a
  61 href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#LimitBandwidth">rate
  62 limiting</a>. Further, if you have a fast link
  63 but want to limit the number of bytes per day
  64 (or week or month) that you donate, check out the <a
  65 href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#Hibernation">hibernation
  66 feature</a>.
  67 </li>
  68 <li>Each Tor server has an <a
  69 href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#RunAServerBut">exit
  70 policy</a> that specifies what sort of outbound connections are allowed
  71 or refused from that server. If you are uncomfortable allowing people
  72 to exit from your server, you can set it up to only allow connections
  73 to other Tor servers.
  74 </li>
  75 <li>It's fine if the server goes offline sometimes. The directories
  76 notice this quickly and stop advertising the server. Just try to make
  77 sure it's not too often, since connections using the server when it
  78 disconnects will break.
  79 </li>
  80 <li>We can handle servers with dynamic IPs just fine, as long as the
  81 server itself knows its IP. Have a look at this
  82 <a href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#DynamicIP">
  83 entry in the FAQ</a>.
  84 </li>
  85 <li>If your server is behind a NAT and it doesn't know its public
  86 IP (e.g. it has an IP of 192.168.x.y), you'll need to set up port
  87 forwarding. Forwarding TCP connections is system dependent but <a
  88 href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#ServerForFirewalledCli
  89 ents">this FAQ entry</a> offers some examples on how to do this.
  90 </li>
  91 <li>Your server will passively estimate and advertise its recent
  92 bandwidth capacity, so high-bandwidth servers will attract more users than
  93 low-bandwidth ones. Therefore having low-bandwidth servers is useful too.
  94 </li>
  95 </ul>
  96
  97 <hr />
  98 <a id="zero"></a>
  99 <h2><a class="anchor" href="#zero">Step Zero: Download and Install Tor</a></h2>
 100 <br />
 101
 102 <p>Before you start, you need to make sure that Tor is up and running.
 103 </p>
 104
 105 <p>For Windows users, this means at least <a
 106 href="http://tor.eff.org/doc/tor-doc-win32.html#installing">step one</a>
 107 of the Windows Tor installation howto. Mac OS X users need to do at least
 108 <a href="http://tor.eff.org/doc/tor-doc-osx.html#installing">step one</a>
 109 of OS X Tor installation howto.  Linux/BSD/Unix users should do at least
 110 <a href="http://tor.eff.org/doc/tor-doc-unix.html#installing">step one</a>
 111 of the Unix Tor installation howto.
 112 </p>
 113
 114 <p>If it's convenient, you might also want to use it as a client for a
 115 while to make sure it's actually working.</p>
 116
 117 <hr />
 118 <a id="one"></a>
 119 <h2><a class="anchor" href="#one">Step One: Set it up as a server</a></h2>
 120 <br />
 121
 122 <p>
 123 1. Verify that your clock is set correctly. If possible, synchronize
 124 your clock with public time servers. Make sure name resolution works
 125 (that is, your computer can resolve addresses correctly).
 126 </p>
 127
 128 <p>2. Edit the bottom part of your torrc. (See <a
 129 href="http://wiki.noreply.org/wiki/TheOnionRouter/TorFAQ#torrc">this
 130 FAQ entry</a> for help.)
 131 Make sure to define at least Nickname and ORPort. Create the DataDirectory
 132 if necessary, and make sure it's owned by the user that will be running
 133 tor.
 134 </p>
 135
 136 <p>
 137 3. If you are using a firewall, open a hole in your firewall so
 138 incoming connections can reach the ports you configured (ORPort, plus
 139 DirPort if you enabled it). Make sure you allow all outgoing connections,
 140 so your server can reach the other Tor servers.
 141 </p>
 142
 143 <p>
 144 4. Start your server: if you installed from source you can just
 145 run <tt>tor</tt>, whereas packages typically launch Tor from their
 146 initscripts or startup scripts. If it logs any warnings, address them. (By
 147 default Tor logs to stdout, but some packages log to <tt>/var/log/tor/</tt>
 148 instead. You can edit your torrc to configure log locations.)
 149 </p>
 150
 151 <p>
 152 5. Subscribe to the <a
 153 href="http://archives.seul.org/or/announce/">or-announce</a>
 154 mailing list. It is very low volume, and it will keep you informed
 155 of new stable releases. You might also consider subscribing to <a
 156 href="http://archives.seul.org/or/talk/">or-talk</a> (higher volume),
 157 where new development releases are announced.
 158 </p>
 159
 160 <hr />
 161 <a id="two"></a>
 162 <h2><a class="anchor" href="#two">Step Two: Make sure it's working</a></h2>
 163 <br />
 164
 165 <p>As soon as your server manages to connect to the network, it will
 166 try to determine whether the ports you configured are reachable from
 167 the outside. This may take several minutes. The log entries will keep
 168 you informed of its progress.</p>
 169
 170 <p>When it decides that it's reachable, it will upload a "server
 171 descriptor" to the directories. This will let clients know
 172 what address, ports, keys, etc your server is using. You can <a
 173 href="http://belegost.seul.org/">load the directory manually</a> and
 174 look through it to find the nickname you configured, to make sure it's
 175 there. You may need to wait a few seconds to give enough time for it to
 176 make a fresh directory.</p>
 177
 178 <hr />
 179 <a id="three"></a>
 180 <h2><a class="anchor" href="#three">Step Three: Register your nickname</a></h2>
 181 <br />
 182
 183 <p>
 184 Once you are convinced it's working, you should register your server.
 185 This reserves your nickname so nobody else can take it, and lets us
 186 contact you if you need to upgrade or something goes wrong.
 187 </p>
 188
 189 <p>
 190 Send mail to <a
 191 href="mailto:tor-ops@freehaven.net">tor-ops@freehaven.net</a> with a
 192 subject of '[New Server] &lt;your server's nickname&gt;' and
 193 include the following information in the message:
 194 </p>
 195 <ul>
 196 <li>Your server's nickname</li>
 197 <li>The fingerprint for your server's key (the contents of the
 198 "fingerprint" file in your DataDirectory -- on Windows, look in
 199 \<i>username</i>\Application&nbsp;Data\tor\ or \Application&nbsp;Data\tor\;
 200 on OS X, look in /Library/Tor/var/lib/tor/; and on Linux/BSD/Unix,
 201 look in /var/lib/tor or ~/.tor)
 202 </li>
 203 <li>Who you are, so we know whom to contact if a problem arises</li>
 204 <li>What kind of connectivity the new server will have</li>
 205 </ul>
 206
 207 <hr />
 208 <a id="four"></a>
 209 <h2><a class="anchor" href="#four">Step Four: Once it's working</a></h2>
 210 <br />
 211
 212 <p>
 213 We recommend the following steps as well:
 214 </p>
 215
 216 <p>
 217 6. (Unix only). Make a separate user to run the server. If you
 218 installed the OS X package or the deb or the rpm, this is already
 219 done. Otherwise, you can do it by hand. (The Tor server doesn't need to
 220 be run as root, so it's good practice to not run it as root. Running
 221 as a 'tor' user avoids issues with identd and other services that
 222 detect user name. If you're the paranoid sort, feel free to <a
 223 href="http://wiki.noreply.org/wiki/TheOnionRouter/TorInChroot">put Tor
 224 into a chroot jail</a>.)
 225 </p>
 226
 227 <p>
 228 7. Decide what exit policy you want. By default your server allows
 229 access to many popular services, but we restrict some (such as port 25)
 230 due to abuse potential. You might want an exit policy that is
 231 less restrictive or more restrictive; edit your torrc appropriately.
 232 If you choose a particularly open exit policy, you might want to make
 233 sure your ISP is ok with that choice.
 234 </p>
 235
 236 <p>
 237 8. If you installed from source, you may find the initscripts in
 238 contrib/tor.sh or contrib/torctl useful if you want to set up Tor to
 239 start at boot.
 240 </p>
 241
 242 <p>
 243 9. If you control the name servers for your domain, consider setting
 244 your hostname to 'anonymous' or 'proxy' or 'tor-proxy', so when other
 245 people see the address in their web logs, they will more quickly
 246 understand what's going on.
 247 </p>
 248
 249 <p>
 250 10. If your computer isn't running a webserver, please consider
 251 changing your ORPort to 443 and your DirPort to 80. Many Tor
 252 users are stuck behind firewalls that only let them browse the
 253 web, and this change will let them reach your Tor server. Win32
 254 servers can simply change their ORPort and DirPort directly
 255 in their torrc and restart Tor. OS X or Unix servers can't bind
 256 directly to these ports (since they don't run as root), so they will
 257 need to set up some sort of <a
 258 href="http://wiki.noreply.org/wiki/TheOnionRouter/TorFAQ#ServerForFirewalledClients">
 259 port forwarding</a> so connections can reach their Tor server. If you are
 260 using ports 80 and 443 already but still want to help out, other useful
 261 ports are 22, 110, and 143.
 262 </p>
 263
 264 When you change your Tor configuration, be sure to restart Tor, and
 265 remember to verify that your server still works correctly after the
 266 change.
 267
 268 <hr />
 269
 270 <p>If you have suggestions for improving this document, please post
 271 them on <a href="http://bugs.noreply.org/tor">our bugtracker</a> in the
 272 website category. Thanks!</p>
 273
 274   </div><!-- #main -->
 275 </div>
 276   <div class="bottom" id="bottom">
 277      <i><a href="mailto:tor-webmaster@freehaven.net"
 278      class="smalllink">Webmaster</a></i> - $Id$
 279   </div>
 280 </body>
 281 </html>
 282