doc/tor-doc-server.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
   2 "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
   3
   4 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   5 <head>
   6   <title>Tor Server Configuration Instructions</title>
   7   <meta name="Author" content="Roger Dingledine" />
   8   <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1" />
   9   <link rel="stylesheet" type="text/css" href="stylesheet.css" />
  10   <link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" />
  11 </head>
  12
  13 <body>
  14
  15 <!-- TITLE BAR & NAVIGATION -->
  16
  17 <table class="banner" border="0" cellpadding="0" cellspacing="0">
  18     <tr>
  19         <td class="banner-left"></td>
  20         <td class="banner-middle">
  21             <a href="/index.html">Home</a>
  22           | <a href="/howitworks.html">How It Works</a>
  23           | <a href="/download.html">Download</a>
  24           | <a href="/documentation.html">Docs</a>
  25           | <a href="/users.html">Users</a>
  26           | <a href="/faq.html">FAQs</a>
  27           | <a href="/volunteer.html">Volunteer</a>
  28           | <a href="/developers.html">Developers</a>
  29           | <a href="/research.html">Research</a>
  30           | <a href="/people.html">People</a>
  31         </td>
  32         <td class="banner-right"></td>
  33     </tr>
  34 </table>
  35
  36 <!-- END TITLE BAR & NAVIGATION -->
  37
  38 <div class="center">
  39
  40 <div class="main-column">
  41
  42 <h1>Configuring a <a href="http://tor.eff.org/">Tor</a> server</h1>
  43 <br />
  44
  45 <p>
  46 The Tor network relies on volunteers to donate bandwidth. The more
  47 people who run servers, the faster the Tor network will be. If you have
  48 at least 20 kilobytes/s each way, please help out Tor by configuring your
  49 Tor to be a server too. We have many features that make Tor servers easy
  50 and convenient, including rate limiting for bandwidth, exit policies so
  51 you can limit your exposure to abuse complaints, and support for dynamic
  52 IP addresses.</p>
  53
  54 <p>Having servers in many different places on the Internet is what
  55 makes Tor users secure. You may also get stronger anonymity yourself,
  56 since remote sites can't know whether connections originated at your
  57 computer or were relayed from others.</p>
  58
  59 <p>Setting up a Tor server is easy and convenient:
  60 <ul>
  61 <li>Tor has built-in support for <a
  62 href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#LimitBandwidth">rate
  63 limiting</a>. Further, if you have a fast link
  64 but want to limit the number of bytes per day
  65 (or week or month) that you donate, check out the <a
  66 href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#Hibernation">hibernation
  67 feature</a>.
  68 </li>
  69 <li>Each Tor server has an <a
  70 href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#RunAServerBut">exit
  71 policy</a> that specifies what sort of outbound connections are allowed
  72 or refused from that server. If you are uncomfortable allowing people
  73 to exit from your server, you can set it up to only allow connections
  74 to other Tor servers.
  75 </li>
  76 <li>It's fine if the server goes offline sometimes. The directories
  77 notice this quickly and stop advertising the server. Just try to make
  78 sure it's not too often, since connections using the server when it
  79 disconnects will break.
  80 </li>
  81 <li>We can handle servers with dynamic IPs just fine, as long as the
  82 server itself knows its IP. Have a look at this
  83 <a href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#DynamicIP">
  84 entry in the FAQ</a>.
  85 </li>
  86 <li>If your server is behind a NAT and it doesn't know its public
  87 IP (e.g. it has an IP of 192.168.x.y), you'll need to set up port
  88 forwarding. Forwarding TCP connections is system dependent but <a
  89 href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#ServerForFirewalledCli
  90 ents">this FAQ entry</a> offers some examples on how to do this.
  91 </li>
  92 <li>Your server will passively estimate and advertise its recent
  93 bandwidth capacity, so high-bandwidth servers will attract more users than
  94 low-bandwidth ones. Therefore having low-bandwidth servers is useful too.
  95 </li>
  96 </ul>
  97
  98 <p>You can run a Tor server on
  99 pretty much any operating system, but see <a
 100 href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#ServerOS">this
 101 FAQ entry</a> for advice about which ones work best and other problems
 102 you might encounter.</p>
 103
 104 <hr />
 105 <a id="zero"></a>
 106 <h2><a class="anchor" href="#zero">Step Zero: Download and Install Tor</a></h2>
 107 <br />
 108
 109 <p>Before you start, you need to make sure that Tor is up and running.
 110 </p>
 111
 112 <p>For Windows users, this means at least <a
 113 href="http://tor.eff.org/doc/tor-doc-win32.html#installing">step one</a>
 114 of the Windows Tor installation howto. Mac OS X users need to do at least
 115 <a href="http://tor.eff.org/doc/tor-doc-osx.html#installing">step one</a>
 116 of OS X Tor installation howto.  Linux/BSD/Unix users should do at least
 117 <a href="http://tor.eff.org/doc/tor-doc-unix.html#installing">step one</a>
 118 of the Unix Tor installation howto.
 119 </p>
 120
 121 <p>If it's convenient, you might also want to use it as a client for a
 122 while to make sure it's actually working.</p>
 123
 124 <hr />
 125 <a id="one"></a>
 126 <h2><a class="anchor" href="#one">Step One: Set it up as a server</a></h2>
 127 <br />
 128
 129 <p>
 130 1. Verify that your clock is set correctly. If possible, synchronize
 131 your clock with public time servers.
 132 </p>
 133
 134 <p>
 135 2. Make sure name resolution works (that is, your computer can resolve addresses correctly).
 136 </p>
 137
 138 <p>
 139 3. Edit the bottom part of your torrc. (See <a
 140 href="http://wiki.noreply.org/wiki/TheOnionRouter/TorFAQ#torrc">this
 141 FAQ entry</a> for help.)
 142 Make sure to define at least Nickname and ORPort. Create the DataDirectory
 143 if necessary, and make sure it's owned by the user that will be running
 144 tor. <em>If you want to run more than one server that's great, but
 145 please set <a href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#MultipleServers">the
 146 MyFamily option</a> in all your servers' configuration files.</em>
 147 </p>
 148
 149 <p>
 150 4. If you are using a firewall, open a hole in your firewall so
 151 incoming connections can reach the ports you configured (ORPort, plus
 152 DirPort if you enabled it). Make sure you allow all outgoing connections,
 153 so your server can reach the other Tor servers.
 154 </p>
 155
 156 <p>
 157 5. Start your server: if you installed from source you can just
 158 run <tt>tor</tt>, whereas packages typically launch Tor from their
 159 initscripts or startup scripts. If it logs any warnings, address them. (By
 160 default Tor logs to stdout, but some packages log to <tt>/var/log/tor/</tt>
 161 instead. You can edit your torrc to configure log locations.)
 162 </p>
 163
 164 <p>
 165 6. Subscribe to the <a
 166 href="http://archives.seul.org/or/announce/">or-announce</a>
 167 mailing list. It is very low volume, and it will keep you informed
 168 of new stable releases. You might also consider subscribing to <a
 169 href="http://archives.seul.org/or/talk/">or-talk</a> (higher volume),
 170 where new development releases are announced.
 171 </p>
 172
 173 <p>
 174 7. Have a look at the manual.
 175 The <a href="http://tor.eff.org/tor-manual.html.en">manual</a> for the
 176 latest stable version provides detailed instructions for how to install
 177 and use Tor, including configuration of client and server options.
 178 If you are running the CVS version the manual is available
 179 <a href="http://tor.eff.org/tor-manual-cvs.html.en">here</a>.
 180 </p>
 181
 182 <p>
 183 8. Read
 184 <a href="http://wiki.noreply.org/noreply/TheOnionRouter/OperationalSecurity">this document</a>
 185 to get ideas how you can increase the security of your server.
 186 <hr />
 187 <a id="two"></a>
 188 <h2><a class="anchor" href="#two">Step Two: Make sure it's working</a></h2>
 189 <br />
 190
 191 <p>As soon as your server manages to connect to the network, it will
 192 try to determine whether the ports you configured are reachable from
 193 the outside. This may take up to 20 minutes. Look for a log entry like
 194 <tt>Self-testing indicates your ORPort is reachable from the outside. Excellent.</tt>
 195 If you don't see this message, it means that your server is not reachable
 196 from the outside -- you should re-check your firewalls, check that it's
 197 testing the IP and port you think it should be testing, etc.
 198 </p>
 199
 200 <p>When it decides that it's reachable, it will upload a "server
 201 descriptor" to the directories. This will let clients know
 202 what address, ports, keys, etc your server is using. You can <a
 203 href="http://belegost.seul.org/">load the directory manually</a> and
 204 look through it to find the nickname you configured, to make sure it's
 205 there. You may need to wait a few seconds to give enough time for it to
 206 make a fresh directory.</p>
 207
 208 <hr />
 209 <a id="three"></a>
 210 <h2><a class="anchor" href="#three">Step Three: Register your nickname</a></h2>
 211 <br />
 212
 213 <p>
 214 Once you are convinced it's working (after a day or two maybe), you should
 215 register your server.
 216 This reserves your nickname so nobody else can take it, and lets us
 217 contact you if you need to upgrade or something goes wrong.
 218 </p>
 219
 220 <p>
 221 Send mail to <a
 222 href="mailto:tor-ops@freehaven.net">tor-ops@freehaven.net</a> with a
 223 subject of '[New Server] &lt;your server's nickname&gt;' and
 224 include the following information in the message:
 225 </p>
 226 <ul>
 227 <li>Your server's nickname</li>
 228 <li>The fingerprint for your server's key (the contents of the
 229 "fingerprint" file in your DataDirectory -- on Windows, look in
 230 \<i>username</i>\Application&nbsp;Data\tor\ or \Application&nbsp;Data\tor\;
 231 on OS X, look in /Library/Tor/var/lib/tor/; and on Linux/BSD/Unix,
 232 look in /var/lib/tor or ~/.tor)
 233 </li>
 234 <li>Who you are, so we know whom to contact if a problem arises</li>
 235 <li>What kind of connectivity the new server will have</li>
 236 </ul>
 237
 238 <hr />
 239 <a id="four"></a>
 240 <h2><a class="anchor" href="#four">Step Four: Once it's working</a></h2>
 241 <br />
 242
 243 <p>
 244 We recommend the following steps as well:
 245 </p>
 246
 247 <p>
 248 6. Decide what exit policy you want. By default your server allows
 249 access to many popular services, but we restrict some (such as port 25)
 250 due to abuse potential. You might want an exit policy that is
 251 less restrictive or more restrictive; edit your torrc appropriately.
 252 Read the FAQ entry on <a
 253 href="http://tor.eff.org/faq-abuse.html#TypicalAbuses">issues you might
 254 encounter if you use the default exit policy</a>.
 255 If you choose a particularly open exit policy, you should make
 256 sure your ISP is ok with that choice.
 257 </p>
 258
 259 <p>
 260 7. Decide about rate limiting. Cable modem, DSL, and other users
 261 who have asymmetric bandwidth (e.g. more down than up) should
 262 rate limit to their slower bandwidth, to avoid congestion. See the <a
 263 href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#LimitBandwidth">rate
 264 limiting FAQ entry</a> for details.
 265 </p>
 266
 267 <p>
 268 8. If you control the name servers for your domain, consider setting
 269 your hostname to 'anonymous' or 'proxy' or 'tor-proxy', so when other
 270 people see the address in their web logs, they will more quickly
 271 understand what's going on.
 272 </p>
 273
 274 <p>
 275 9. If your computer isn't running a webserver, please consider
 276 changing your ORPort to 443 and your DirPort to 80. Many Tor
 277 users are stuck behind firewalls that only let them browse the
 278 web, and this change will let them reach your Tor server. Win32
 279 servers can simply change their ORPort and DirPort directly
 280 in their torrc and restart Tor. OS X or Unix servers can't bind
 281 directly to these ports (since they don't run as root), so they will
 282 need to set up some sort of <a
 283 href="http://wiki.noreply.org/wiki/TheOnionRouter/TorFAQ#ServerForFirewalledClients">
 284 port forwarding</a> so connections can reach their Tor server. If you are
 285 using ports 80 and 443 already but still want to help out, other useful
 286 ports are 22, 110, and 143.
 287 </p>
 288
 289 <p>
 290 10. (Unix only). Make a separate user to run the server. If you
 291 installed the OS X package or the deb or the rpm, this is already
 292 done. Otherwise, you can do it by hand. (The Tor server doesn't need to
 293 be run as root, so it's good practice to not run it as root. Running
 294 as a 'tor' user avoids issues with identd and other services that
 295 detect user name. If you're the paranoid sort, feel free to <a
 296 href="http://wiki.noreply.org/wiki/TheOnionRouter/TorInChroot">put Tor
 297 into a chroot jail</a>.)
 298 </p>
 299
 300 <p>
 301 11. (Unix only.) Your operating system probably limits the number
 302 of open file descriptors per process to 1024 (or even less). If you
 303 plan to be running a fast exit node, this is probably not enough. On
 304 Linux, you should add a line like "toruser hard nofile 8192" to your
 305 /etc/security/limits.conf file (where toruser is the user that runs the
 306 Tor process), and then restart Tor if it's installed as a package (or log
 307 out and log back in if you run it yourself). If that doesn't work, see <a
 308 href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#FileDescriptors">this
 309 FAQ entry</a> for other suggested ways to run "ulimit -n 8192" before
 310 you launch Tor.
 311 </p>
 312
 313 <p>
 314 12. If you installed Tor via some package or installer, it probably starts
 315 Tor for you automatically on boot. But if you installed from source,
 316 you may find the initscripts in contrib/tor.sh or contrib/torctl useful.
 317 </p>
 318
 319 When you change your Tor configuration, be sure to restart Tor, and
 320 remember to verify that your server still works correctly after the
 321 change.
 322
 323 <hr />
 324
 325 <p>If you have suggestions for improving this document, please post
 326 them on <a href="http://bugs.noreply.org/tor">our bugtracker</a> in the
 327 website category. Thanks!</p>
 328
 329   </div><!-- #main -->
 330 </div>
 331   <div class="bottom" id="bottom">
 332      <i><a href="mailto:tor-webmaster@freehaven.net"
 333      class="smalllink">Webmaster</a></i> - $Id$
 334   </div>
 335 </body>
 336 </html>
 337