| blob | 787dafc91f8bdd1200aaa82331759a4ae4f0ef64 |
1 <html>
2 <head>
8 </head>
10 <body>
15 bounce their communications (web requests, IM, IRC, SSH, etc.) around
16 the routers. This makes it hard for recipients, observers, and even the
17 onion routers themselves to track the source of the stream.</p>
22 <p>Individuals need Tor for privacy:
23 <ul>
24 <li>Privacy in web browsing -- both from the remote website (so it can't
25 track and sell your behavior), and similarly from your local ISP.
26 <li>Safety in web browsing: if your local government doesn't approve
27 of its citizens visiting certain websites, they may monitor the sites
28 and put readers on a list of suspicious persons.
29 <li>Circumvention of local censorship: connect to resources (news
30 sites, instant messaging, etc) that are restricted from your
31 ISP/school/company/government.
32 <li>Socially sensitive communication: chat rooms and web forums for
33 rape and abuse survivors, or people with illnesses.
34 </ul>
36 <p>Journalists and NGOs need Tor for safety:
37 <ul>
38 <li>Allowing dissidents and whistleblowers to communicate more safely.
39 <li>Censorship-resistant publication, such as making available your
41 service</a>; and reading, e.g. of news sites not permitted in some
42 countries.
43 <li>Allowing your workers to check back with your home website while
44 they're in a foreign country, without notifying everybody nearby that
45 they're working with your organization.
46 </ul>
48 <p>Companies need Tor for business security:
49 <ul>
50 <li>Competitive analysis: browse the competition's website safely.
51 <li>Protecting collaborations of sensitive business units or partners.
52 <li>Protecting procurement suppliers or patterns.
54 amount and frequency of communication. Which locations have employees
55 working late? Which locations have employees consulting job-hunting
56 websites? Which research groups are communicating with your company's
57 patent lawyers?
58 </ul>
60 <p>Governments need Tor for traffic-analysis-resistant communication:
61 <ul>
62 <li>Open source intelligence gathering (hiding individual analysts is
63 not enough -- the organization itself may be sensitive).
65 with a million users (even if they're all cleared) can't be made safe just
66 by hardening them to external threat.
67 <li>Dynamic and semi-trusted international coalitions: the network can
68 be shared without revealing the existence or amount of communication
69 between all parties.
70 <li>Networks partially under known hostile control: to block
71 communications, the enemy must take down the whole network.
72 <li>Politically sensitive negotiations.
73 <li>Road warriors.
74 <li>Protecting procurement patterns.
75 <li>Anonymous tips.
76 </ul>
78 <p>Law enforcement needs Tor for safety:
79 <ul>
80 <li>Allowing anonymous tips or crime reporting
81 <li>Allowing agents to observe websites without notifying them that
82 they're being observed (or, more broadly, without having it be an
83 official visit from law enforcement).
84 <li>Surveillance and honeypots (sting operations)
85 </ul>
87 <p>Does the idea of sharing the Tor network with
88 all of these groups bother you? It shouldn't -- <a
95 <p>You can run Tor in either client mode or server mode. By default,
97 anybody but yourself.</p>
99 <p>If your computer doesn't have a routable IP address or you're using
100 a modem, you should stay a client. Otherwise, please consider being
102 gigabytes of traffic per month, depending on its capacity and its rate
103 limiting configuration.)</p>
105 <p>Note that you can be a server without allowing users to make
106 connections from your computer to the outside world. This is called being
107 a middleman server.</p>
109 <p> Benefits of running a server include:
110 <ul>
111 <li>You may get stronger anonymity, since your destination can't know
112 whether connections relayed through your computer originated at your
113 computer or not.
114 <li>You can also get stronger anonymity by configuring your Tor clients
115 to use your Tor server for entry or for exit.
116 <li>You're helping the Tor staff with development and scalability testing.
117 <li>You're helping your fellow Internet users by providing a larger
118 network. Also, having servers in many different pieces of the Internet
119 gives users more robustness against curious telcos and brute force
120 attacks.
121 </ul>
123 <p>Other things to note:
124 <ul>
125 <li>Tor has built-in support for rate limiting; see BandwidthRate
126 and BandwidthBurst config options. Further, if you have
127 lots of capacity but don't want to spend that many bytes per
128 month, check out the Accounting and Hibernation features. See <a
130 for details.</li>
131 <li>It's fine if the server goes offline sometimes. The directories
132 notice this quickly and stop advertising the server. Just try to make
133 sure it's not too often, since connections using the server when it
134 disconnects will break.</li>
135 <li>We can handle servers with dynamic IPs just fine, as long as the
136 server itself knows its IP. If your server is behind a NAT and it doesn't
137 know its public IP (e.g. it has an IP of 192.168.x.y), then we can't use it
138 as a server yet. (If you want to port forward and set your Address
139 config option to use dyndns DNS voodoo to get around this, feel free. If
142 <li>Your server will passively estimate and advertise its recent
143 bandwidth capacity.
144 Clients choose paths weighted by this capacity, so high-bandwidth
145 servers will attract more paths than low-bandwidth ones. That's why
146 having even low-bandwidth servers is useful too.</li>
147 </ul>
148 </p>
150 <p>You can read more about setting up Tor as a
156 <p>We have installers for Windows and Mac OS X. For help with installing,
157 configuring, and using Tor on these operating systems, consult the
160 </p>
169 Otherwise, if you got it prepackaged (e.g. in the <a
172 package</a>), these steps are already done for you, and you may
173 even already have Tor started in the background (logging to
174 /var/log/something).</p>
178 the source for the latest version
187 <p>Tor comes configured as a client by default. It uses a built-in
188 default configuration file, and most people won't need to change any of
189 the settings.</p>
193 proxy that integrates well with Tor. Add the line <br>
195 (don't forget the dot) to privoxy's config file (you can just add it to the
196 top). Then change your browser to http proxy at localhost port 8118.
197 (In Mozilla, this is in Edit|Preferences|Advanced|Proxies.)
198 You should also set your SSL proxy to the same
201 DNS requests when it uses a SOCKS proxy directly</a>. Privoxy also gives
202 you good html scrubbing.</p>
204 <p>To test if it's working, go to
205 <!--<a href="http://peertech.org/privacy-knoppix/">peertech</a>, -->
209 and see what IP it says you're coming from.
210 </p>
212 <p>
213 If you have a personal firewall that limits your computer's ability
214 to connect to itself, be sure to allow connections from your local
215 applications to
218 <!--If you're
219 using Safari as your browser, keep in mind that OS X before 10.3 claims
220 to support SOCKS but does not. -->
221 For more troubleshooting suggestions, see <a
223 </p>
225 <p>To Torify an application that supports http, just point it at Privoxy
226 (that is, localhost port 8118). To use SOCKS directly (for example, for
227 instant messaging, Jabber, IRC, etc), point your application directly at
228 Tor (localhost port 9050). For applications that support neither SOCKS
229 nor http, you should look at
231 to dynamically replace the system calls in your program to
237 <p>(Windows doesn't have tsocks; see the bottom of the
239 </p>
244 <p>We're looking for people with reasonably reliable Internet connections,
245 that have at least 20 kilobytes/s each way. If you frequently have a
246 lot of packet loss or really high latency, we can't handle your server
247 yet. Otherwise, please help out!
248 </p>
250 <p>
251 To read more about whether you should be a server, check out <a
253 </p>
255 <p>To set up a Tor server, do the following steps after installing Tor.
256 (These instructions are Unix-centric; but Tor 0.0.9.5 is running as a
257 server on Windows now as well.)
258 </p>
260 <ul>
262 you will need to copy torrc.sample to torrc first. Look for them in
263 /usr/local/etc/tor/ on Unix). If you installed a package, you should look
264 for torrc:
269 on Windows.</li>
270 </ul>
271 Create the DataDirectory if necessary, and make
272 sure it's owned by the user that will be running tor. Fix your system
273 clock so it's not too far off. Make sure name resolution works.
275 incoming connections can reach the ports you configured (i.e. ORPort,
276 plus DirPort if you enabled it). Make sure you allow outgoing connections,
277 to get to other onion routers plus any other addresses or ports your
278 exit policy allows.
281 initscripts or startup scripts. If it logs any warnings, address them. (By
283 instead. You can edit your torrc to configure log locations.)
286 following information:
287 <ul>
288 <li>The fingerprint for your server's key (the contents of the
289 "fingerprint" file in your DataDirectory -- look in /usr/local/var/lib/tor
290 or /var/lib/tor on many platforms)</li>
291 <li>Who you are, so we know whom to contact if a problem arises,
292 and</li>
294 </ul>
295 If possible, sign your mail using PGP.
297 href=http://archives.seul.org/or/announce/">or-announce</a>
298 mailing list. It is very low volume, and it will keep you informed
299 of new stable releases. You might also consider subscribing to <a
301 where new development releases are announced.</li>
302 </ul>
303 </p>
305 <p>Here's where Tor puts its files on many common platforms:</p>
307 <tr><th></th><th>Unix</th><th>Windows</th><th>Mac OS X</th></tr>
308 <tr><th>Configuration</th>
309 <td><tt>/etc/torrc</tt> <br />or <tt>/usr/local/etc/torrc</tt></td>
310 <td><tt>\Application Data\</tt><i>username</i><tt>\tor\torrc</tt> <br />or
311 <tt>\Application Data\tor\torrc</tt></td>
312 <td><tt>/Library/Tor/torrc</tt></td></tr>
313 <tr><th>Fingerprint</th>
314 <td><tt>/var/lib/tor/fingerprint</tt>
315 or <tt>/usr/local/var/lib/tor/fingerprint</tt></td>
316 <td><tt>\Application Data\</tt><i>username</i><tt>\tor\fingerprint</tt>
317 or <tt>\Application Data\tor\fingerprint</tt></td>
318 <td><tt>/Library/Tor/var/lib/tor/fingerprint</tt></td></tr>
319 <tr><th>Logs</th>
320 <td><tt>/var/log/tor</tt>
321 or <tt>/usr/local/var/log/tor</tt></td>
322 <td><tt>\Application Data\</tt><i>username</i><tt>\tor\log</tt>
323 or <tt>\Application Data\tor\log</tt></td>
324 <td><tt>/var/log/tor</tt></td></tr>
325 </table>
328 <p>
329 Optionally, we recommend the following steps as well:
330 </p>
332 <ul>
333 <li>(Unix only) 5. Make a separate user to run the server. If you
334 installed the deb or the rpm, this is already done. Otherwise,
335 you can do it by hand. (The Tor server doesn't need to be run as
336 root, so it's good practice to not run it as root. Running as a
337 'tor' user avoids issues with identd and other services that
338 detect user name. If you're the paranoid sort, feel free to <a
340 into a chroot jail</a>.)
341 <li>6. Decide what exit policy you want. By default your server allows
342 access to many popular services, but we restrict some (such as port 25)
343 due to abuse potential. You might want an exit policy that is
344 less restrictive or more restrictive; edit your torrc appropriately.
345 If you choose a particularly open exit policy, you might want to make
346 sure your upstream or ISP is ok with that choice.
347 <li>7. If you installed from source, you may find the initscripts in
348 contrib/tor.sh or contrib/torctl useful if you want to set up Tor to
349 start at boot.
350 <li>8. Consider setting your hostname to 'anonymous' or
351 'proxy' or 'tor-proxy' if you can, so when other people see the address
352 in their web logs or whatever, they will more quickly understand what's
353 going on.
354 <li>9. If you're not running anything else on port 80 or port 443,
355 please consider setting up port-forwarding and advertising these
356 low-numbered ports as your Tor server. This will help allow users behind
357 particularly restrictive firewalls to access the Tor network. Win32
358 servers can simply set their ORPort and DirPort directly. Other servers
359 need to rig some sort of port forwarding; see <a
361 FAQ</a> for details of how to set this up.
362 </ul>
366 line to see if your server is part of the network. It will be listed by
367 nickname once we have added your server to the list of known servers;
368 otherwise it is listed only by its fingerprint.</p>
371 <h2>Configuring a hidden service</h2>
373 <p>Tor allows clients and servers to offer <em>hidden services</em>. That
374 is, you can offer an apache, sshd, etc, without revealing your IP to its
375 users. This works via Tor's rendezvous point design: both sides build
376 a Tor circuit out, and they meet in the middle.</p>
380 to see hidden services in action.</p>
382 <p>To set up a hidden service, copy torrc.sample to torrc (by default it's
383 in /usr/local/etc/tor/), and edit the middle part. Then run Tor. It will
384 create each HiddenServiceDir you have configured, and it will create a
385 'hostname' file which specifies the url (xyz.onion) for that service. You
386 can tell people the url, and they can connect to it via their Tor client,
387 assuming they're using a proxy (such as Privoxy) that speaks SOCKS 4A.</p>
390 <h2>Setting up your own network</h2>
392 <p>
393 If you want to experiment locally with your own network, or you're cut
394 off from the Internet and want to be able to mess with Tor still, then
395 you may want to set up your own separate Tor network.
397 <p>
398 To set up your own Tor network, you need to run your own directory
399 servers, and you need to configure each client and server so it knows
400 about your directory servers rather than the default ones.
402 <ul>
403 <li>1: Grab the latest release. Use at least 0.0.9.5.
404 <li>2: For each directory server you want,
405 <ul>
407 server"</a> above), with a least ORPort, DirPort, DataDirectory, and Nickname
410 versions of the code for clients and servers to be running.
411 <li>2c: Run it: <tt>tor --list-fingerprint</tt> if your torrc is in
412 the default place, or <tt>tor -f torrc --list-fingerprint</tt> to
413 specify one. This will generate your keys and output a fingerprint
414 line.
415 </ul>
416 <li>3: Now you need to teach clients and servers to use the new
417 dirservers. For each fingerprint, add a line like<br>
418 <tt>DirServer 18.244.0.114:80 719B E45D E224 B607 C537 07D0 E214 3E2D 423E 74CF</tt><br>
419 to the torrc of each client and server who will be using your network.
420 <li>4: Create a file called approved-routers in the DataDirectory
421 of each directory server. Collect the 'fingerprint' lines from
422 each server (including directory servers), and include them (one per
423 line) in each approved-routers file. You can hup the tor process for
424 each directory server to reload the approved-routers file (so you don't
425 have to restart the process).
426 </ul>
428 <!--<h2>Other doc resources</h2>
430 <ul>
431 <li>Design paper
432 <li>Spec and rend-spec
433 <li>others
434 </ul> -->
436 </body>
437 </html>