Setting up a Tor hidden service - Revision history

NotATether: clarify that Tor Expert Bundle also works on non-windows platforms

2023-12-31T08:41:59Z

clarify that Tor Expert Bundle also works on non-windows platforms

← Older revision		Revision as of 08:41, 31 December 2023
Line 5:		Line 5:
	=== Prerequisites ===		=== Prerequisites ===

	These instructions are for Linux. It is possible to do on Windows~~, the~~ instructions are presented at the end.		These instructions are for Linux. It is possible to do on other platforms such as Windows and macOS. The instructions for Windows are presented at the end.

	You need Tor (at least version 0.2.7.1). Figure out where your <tt>torrc</tt> file is (<tt>/etc/tor/torrc</tt> is one possibility). This guide assumes default Tor settings. This guide assumes that Tor is running under the user and group <tt>tor</tt>, which will usually be the case if you install Tor using your distro's package manager. Note that since version 22.0 Bitcoin '''does not''' support Tor hidden service version 2 (ie. short onion addresses), only support Tor version 3 hidden services (Tor v3, ie. long onion addresses).		You need Tor (at least version 0.2.7.1). Figure out where your <tt>torrc</tt> file is (<tt>/etc/tor/torrc</tt> is one possibility). This guide assumes default Tor settings. This guide assumes that Tor is running under the user and group <tt>tor</tt>, which will usually be the case if you install Tor using your distro's package manager. Note that since version 22.0 Bitcoin '''does not''' support Tor hidden service version 2 (ie. short onion addresses), only support Tor version 3 hidden services (Tor v3, ie. long onion addresses).
Line 77:		Line 77:
	=== Windows ===		=== Windows ===

	First you need to '''download''' Tor, we recommend the '''Tor Expert Bundle''' (intended for developers who need to bundle tor with their applications), it contains only the tor and pluggable transports binaries, bridge strings, and geoip data. The latest version for Windows 64bits (x86_64) or Windows 32bits (i686) is located [https://www.torproject.org/download/tor/ here on torproject.org].		First you need to '''download''' Tor, we recommend the '''Tor Expert Bundle''' (intended for developers who need to bundle tor with their applications), it contains only the tor and pluggable transports binaries, bridge strings, and geoip data. The latest version for Windows 64bits (x86_64) or Windows 32bits (i686) is located [https://www.torproject.org/download/tor/ here on torproject.org]. The Tor Expert Bundle is also available for macOS, Linux, and Android, and setup on these platforms is similar to the Windows instructions.

	Then '''extract the contents on a folder''' in a place that your user can access, like ''%UserProfile%''.		Then '''extract the contents on a folder''' in a place that your user can access, like ''%UserProfile%''.

NotATether: Make note about user accounts

2023-12-31T08:36:52Z

Make note about user accounts

← Older revision		Revision as of 08:36, 31 December 2023
Line 21:		Line 21:
	CookieAuthFileGroupReadable 1</pre>		CookieAuthFileGroupReadable 1</pre>

	You need to figure out what user bitcoind or bitcoin-qt is running as. Run the following command while Bitcoin is running:		You need to figure out what user bitcoind or bitcoin-qt is running as. Usually it is the same as the currently logged-in user, but in some setups, it may be different. Run the following command while Bitcoin is running:
	<pre>ps -eo user,group,comm \|egrep 'bitcoind\|bitcoin-qt' \|awk '{print "Bitcoin user: " $1}'</pre>		<pre>ps -eo user,group,comm \|egrep 'bitcoind\|bitcoin-qt' \|awk '{print "Bitcoin user: " $1}'</pre>
	Write down the reported user.		Write down the reported user.

NotATether: fix double click on italics button

2023-12-31T08:35:09Z

fix double click on italics button

← Older revision		Revision as of 08:35, 31 December 2023
Line 34:		Line 34:
	bind=127.0.0.1</pre>		bind=127.0.0.1</pre>

	Note that port 9051 is the ''''ControlPort''''. This is the port used to control the Tor service. It is not the port Bitcoin Core uses - port 9050 is the SOCKS proxy for tunneling Bitcoin Core's traffic via Tor.		Note that port 9051 is the ''ControlPort''. This is the port used to control the Tor service. It is not the port Bitcoin Core uses - port 9050 is the SOCKS proxy for tunneling Bitcoin Core's traffic via Tor.

	If you additionally want Bitcoin Core to only connect out to Tor ''hidden services'', also add this line (not particularly recommended):		If you additionally want Bitcoin Core to only connect out to Tor ''hidden services'', also add this line (not particularly recommended):

NotATether: Add info about tor ports

2023-12-31T08:34:36Z

Add info about tor ports

← Older revision		Revision as of 08:34, 31 December 2023
Line 33:		Line 33:
	listen=1		listen=1
	bind=127.0.0.1</pre>		bind=127.0.0.1</pre>

			Note that port 9051 is the ''''ControlPort''''. This is the port used to control the Tor service. It is not the port Bitcoin Core uses - port 9050 is the SOCKS proxy for tunneling Bitcoin Core's traffic via Tor.

	If you additionally want Bitcoin Core to only connect out to Tor ''hidden services'', also add this line (not particularly recommended):		If you additionally want Bitcoin Core to only connect out to Tor ''hidden services'', also add this line (not particularly recommended):

Manu: /* Windows */ Adding more info and details

2023-05-08T18:10:41Z

Windows: Adding more info and details

← Older revision		Revision as of 18:10, 8 May 2023
Line 75:		Line 75:
	=== Windows ===		=== Windows ===

	First you need to download Tor, we recommend the ~~Windows~~ Expert Bundle ~~that~~ contains ~~just Tor~~ and ~~nothing else~~. ~~This~~ version~~, without the browser,~~ is located [https://www.torproject.org/download/tor/ here on torproject.org].		First you need to '''download''' Tor, we recommend the '''Tor Expert Bundle''' (intended for developers who need to bundle tor with their applications), it contains only the tor and pluggable transports binaries, bridge strings, and geoip data. The latest version for Windows 64bits (x86_64) or Windows 32bits (i686) is located [https://www.torproject.org/download/tor/ here on torproject.org].

	Then extract the contents on a folder in a place that your user can access, like ''%UserProfile%''.		Then '''extract the contents on a folder''' in a place that your user can access, like ''%UserProfile%''.

	On your Windows Explorer go to that folder and create a file called ''torrc''. Open it with Notepad, type the content below and save ~~the file~~:		On your Windows Explorer go to that folder and '''create a file called ''torrc'''''. Open it with Notepad, type the content below and save:
	<pre>ControlPort 9051		<pre>ControlPort 9051
	CookieAuthentication 1</pre>		CookieAuthentication 1</pre>

	Open Windows PowerShell ~~and~~ navigate to the extracted folder (ex.: ''cd C:\Users\MyUserName\torExpertBundle''), and ~~access~~ the folder ''Tor'' (ie.: ''cd Tor''). Type ''dir'' you should see some files and ''tor.exe'' among them. So type the code below (remember to change the folder accordingly to where you extracted)		'''Open Windows PowerShell''' (maybe you will need to ''Open as Administrator''), navigate to the extracted folder (ex.: ''cd C:\Users\MyUserName\torExpertBundle''), and enter the folder ''Tor'' (ie.: ''cd Tor''). Type ''dir'' you should see some files and ''tor.exe'' among them. So type the code below (remember to change the folder accordingly to where you extracted)

	<pre>tor.exe --service install -options -f "C:\Users\MyUserName\torExpertBundle\Tor\torrc"</pre>		<pre>tor.exe --service install -options -f "C:\Users\MyUserName\torExpertBundle\Tor\torrc"</pre>

	~~This~~ will ~~create an~~ entry at Windows Services. Access Windows Services by pressing the Windows button and typing ''services'' then enter. You should see ''Tor Win32 Service (Provides an anonymous Internet communication system)'' on the list. Check if the status is ''Running'' and initialization type is ''Automatic''. To verify if it Tor is really working as a service, open Windows PowerShell then type:		If the code succeeds it will say something related to the creation of a new entry on Windows Services. Access Windows Services by pressing the Windows button and typing ''services'' then enter. You should see ''Tor Win32 Service (Provides an anonymous Internet communication system)'' on the list. Check if the status is ''Running'' and initialization type is ''Automatic''. To verify if Tor is really working as a service, open Windows PowerShell then type:
	<pre>netstat -aon \| findstr ":9050"</pre>		<pre>netstat -aon \| findstr ":9050"</pre>

	You should see '':9050 LISTENING'':		You should see something like '':9050 LISTENING'':
	<pre> TCP 127.0.0.1:9050 0.0.0.0:0 LISTENING 4000</pre>		<pre> TCP 127.0.0.1:9050 0.0.0.0:0 LISTENING 4000</pre>

Line 96:		Line 96:
	<pre>netstat -aon \| findstr ":9051"</pre>		<pre>netstat -aon \| findstr ":9051"</pre>

	You should see '':9051 LISTENING'':		You should see something like '':9051 LISTENING'':
	<pre> TCP 127.0.0.1:9051 0.0.0.0:0 LISTENING 4000</pre>		<pre> TCP 127.0.0.1:9051 0.0.0.0:0 LISTENING 4000</pre>

	If you don't see ~~these then the~~ Tor service is not working properly and this issue may be related to Windows permissions on the folder you extracted. To fix it go to where you extracted the Tor Expert Bundle and check the top folder ''Properties > Security > Advanced'' and verify if in the Permissions tab you have ''SERVICE'' with ''Full Control'', if not click ''Add'', click on the link ''Select a Secure Entity and type ''SERVICE'' (all letters in UPPERCASE) then hit enter and select ''Full Control'' (Try to start the Tor service again in Windows Services, if it doesn't work, try adding ''SYSTEM'' and ''LOCAL SERVICE'' with ''Full Control'' on folder permissions and repeat the tests above).		If you don't see any ''LISTENING'' output, it means that Tor service is not working properly and this issue may be related to Windows permissions on the folder you extracted. To fix it go to where you extracted the Tor Expert Bundle and check the top folder ''Properties > Security > Advanced'' and verify if in the Permissions tab you have ''SERVICE'' with ''Full Control'', if not click ''Add'', click on the link ''Select a Secure Entity and type ''SERVICE'' (all letters in UPPERCASE) then hit enter and select ''Full Control'' (Try to start the Tor service again in Windows Services, if it doesn't work, try adding ''SYSTEM'' and ''LOCAL SERVICE'' with ''Full Control'' on folder permissions and repeat the tests above).

	~~If you want to see on~~ BitcoinCore ''debug.log'' file what is happening on the communication with the Tor service, edit your ''bitcoin.conf'' file and add this line at the end ''debug=tor'', then restart BitcoinCore. If everything is ok, you should see something like that:		See BitcoinCore ''debug.log'' file what is happening on the communication with the Tor service, edit your ''bitcoin.conf'' file and add this line at the end ''debug=tor'', then restart BitcoinCore. If everything is ok, you should see something like that:
	<pre>2022-06-13T21:45:32Z Config file arg: debug="tor"		<pre>2022-06-13T21:45:32Z Config file arg: debug="tor"
	2022-06-13T21:45:44Z torcontrol thread start		2022-06-13T21:45:44Z torcontrol thread start
Line 114:		Line 114:
	2022-06-13T21:45:44Z tor: AUTHCHALLENGE ServerHash xxxxx ServerNonce xxxxx		2022-06-13T21:45:44Z tor: AUTHCHALLENGE ServerHash xxxxx ServerNonce xxxxx
	2022-06-13T21:45:44Z tor: Authentication successful</pre>		2022-06-13T21:45:44Z tor: Authentication successful</pre>

			If you get ''tor: Authentication cookie C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\tor\control_auth_cookie could not be opened (check permissions)'' on Bitcoin ''debug.log'' this means that you need to navigate to the folder ''C:\Windows\ServiceProfiles\LocalService'' and enter ''Properties > Security > Advanced'' to verify if in the Permissions tab you have ''SERVICE'' with ''Full Control'', if not click ''Add'', click on the link ''Select a Secure Entity and type ''SERVICE'' (all letters in UPPERCASE) then hit enter and select ''Full Control'' (Try to start BitcoinCore again, if it doesn't work, try adding ''SYSTEM'' and ''LOCAL SERVICE'' with ''Full Control'' on folder permissions and repeat the tests above... you may need to add ''All Application Packages'', ''NETWORK SERVICE'', ''USERS'', or other security groups, with at least "Read & execute" in order to work).

	== Related Resources ==		== Related Resources ==

Manu: added Related Resources

2022-06-21T00:24:37Z

added Related Resources

← Older revision		Revision as of 00:24, 21 June 2022
Line 118:		Line 118:

	* [https://www.keepitsimplebitcoin.com/how-to-install-tor/ KeepItSimpleBitcoin How To Install Tor (Mac OS, Linux, Windows)] - text and video instructions including Bitcoin Core config.		* [https://www.keepitsimplebitcoin.com/how-to-install-tor/ KeepItSimpleBitcoin How To Install Tor (Mac OS, Linux, Windows)] - text and video instructions including Bitcoin Core config.
			* [https://bitcoincoredocs.com/tor.html Bitcoin Core Docs Tor] - Explanation of the Bitcoin Core configs related to Tor.

	[[Category:Guides]]		[[Category:Guides]]
	[[Category:Privacy]]		[[Category:Privacy]]

Manu: Adding related resources and category

2022-06-21T00:20:09Z

Adding related resources and category

← Older revision		Revision as of 00:20, 21 June 2022
Line 114:		Line 114:
	2022-06-13T21:45:44Z tor: AUTHCHALLENGE ServerHash xxxxx ServerNonce xxxxx		2022-06-13T21:45:44Z tor: AUTHCHALLENGE ServerHash xxxxx ServerNonce xxxxx
	2022-06-13T21:45:44Z tor: Authentication successful</pre>		2022-06-13T21:45:44Z tor: Authentication successful</pre>

			== Related Resources ==

			* [https://www.keepitsimplebitcoin.com/how-to-install-tor/ KeepItSimpleBitcoin How To Install Tor (Mac OS, Linux, Windows)] - text and video instructions including Bitcoin Core config.

	[[Category:Guides]]		[[Category:Guides]]
			[[Category:Privacy]]

Manu: Adding link to bitcoin.conf

2022-06-17T21:20:29Z

Adding link to bitcoin.conf

← Older revision		Revision as of 21:20, 17 June 2022
Line 28:		Line 28:
	<pre>usermod -a -G tor BITCOIN_USER</pre>		<pre>usermod -a -G tor BITCOIN_USER</pre>

	At this point your node will work over Tor without further configuartion. Bitcoin Core v0.12 and later automatically tries to connect to Tor via the ControlPort if <tt>listen=1</tt> is set in <tt>bitcoin.conf</tt>. By default Bitcoin Core will usually connect over the regular Internet as well as allow connections to and from the Tor hidden service. This will help other users who wish to submit transactions to the bitcoin network securely and obscurely, but transactions you submit could theoretically be traced back to your ip address. If you want Bitcoin Core to only connect via Tor (for anonymity), add these lines to bitcoin.conf:		At this point your node will work over Tor without further configuartion. Bitcoin Core v0.12 and later automatically tries to connect to Tor via the ControlPort if <tt>listen=1</tt> is set in <tt>bitcoin.conf</tt>. By default Bitcoin Core will usually connect over the regular Internet as well as allow connections to and from the Tor hidden service. This will help other users who wish to submit transactions to the bitcoin network securely and obscurely, but transactions you submit could theoretically be traced back to your ip address. If you want Bitcoin Core to only connect via Tor (for anonymity), add these lines to [[Running_Bitcoin#Bitcoin.conf_Configuration_File\|bitcoin.conf]]:

	<pre>proxy=127.0.0.1:9050		<pre>proxy=127.0.0.1:9050

Manu: Specifying Linux sessions

2022-06-17T21:03:07Z

Specifying Linux sessions

← Older revision		Revision as of 21:03, 17 June 2022
Line 11:		Line 11:
	You need Bitcoin Core (or similar). For method 1, you need at least version 0.12.0. Find <tt>bitcoin.conf</tt> in your [[data directory]].		You need Bitcoin Core (or similar). For method 1, you need at least version 0.12.0. Find <tt>bitcoin.conf</tt> in your [[data directory]].

	=== Method 1 (recommended) ===		=== Linux Method 1 (recommended) ===

	This sets up an automatic hidden service that is initiated by Bitcoin Core. On the first startup of <tt>bitcoind</tt> after configuring Bitcoin Core to use Tor ControlPort as follows, Bitcoin Core will generate a file called <tt>onion_private_key</tt> in the [[data directory]]. The file <tt>onion_private_key</tt> contains the private key needed to generate your unique <tt>XXXXXXX.onion</tt> address. KEEP THIS SAFE. If someone copies this file they can run a server with your .onion address. Also, if you delete this file, the next time bitcoind loads it will generate a new key file and <tt>xxxxxxxx.onion</tt> address. Note that while a malicious party cannot necessarily associate the server with you as a person, as long as your server has the same xxxx.onion address they will know it is run by the same person. For absolute security delete <tt>onion_private_key</tt> at each reboot or some frequent interval.		This sets up an automatic hidden service that is initiated by Bitcoin Core. On the first startup of <tt>bitcoind</tt> after configuring Bitcoin Core to use Tor ControlPort as follows, Bitcoin Core will generate a file called <tt>onion_private_key</tt> in the [[data directory]]. The file <tt>onion_private_key</tt> contains the private key needed to generate your unique <tt>XXXXXXX.onion</tt> address. KEEP THIS SAFE. If someone copies this file they can run a server with your .onion address. Also, if you delete this file, the next time bitcoind loads it will generate a new key file and <tt>xxxxxxxx.onion</tt> address. Note that while a malicious party cannot necessarily associate the server with you as a person, as long as your server has the same xxxx.onion address they will know it is run by the same person. For absolute security delete <tt>onion_private_key</tt> at each reboot or some frequent interval.
Line 43:		Line 43:
	<pre>tor: Got service ID XXXXXXXXXXX, advertising service XXXXXXXXXXX.onion:8333</pre> This is the .onion address of your server. You should eventually get incoming connections via the hidden service.		<pre>tor: Got service ID XXXXXXXXXXX, advertising service XXXXXXXXXXX.onion:8333</pre> This is the .onion address of your server. You should eventually get incoming connections via the hidden service.

	=== Method 2 ===		=== Linux Method 2 ===

	This sets up a manual hidden service controlled by the tor daemon. The hidden service address (xxxx.onion). Note that as in method 1, your xxxxx.onion address will stay the same until you delete your key file. Someone tracking you can't necessarily associate the xxxx.onion with you, but they will know it is run by the same person or entity.		This sets up a manual hidden service controlled by the tor daemon. The hidden service address (xxxx.onion). Note that as in method 1, your xxxxx.onion address will stay the same until you delete your key file. Someone tracking you can't necessarily associate the xxxx.onion with you, but they will know it is run by the same person or entity.

Manu: Adding Windows instructions

2022-06-17T20:52:22Z

Adding Windows instructions

@@ Line 5: / Line 5: @@
 === Prerequisites ===
-These instructions are for Linux. It is possible to do on Windows, but the instructions would be rather different. (If you've done it on Windows, consider adding the instructions to this page.)
+These instructions are for Linux. It is possible to do on Windows, the instructions are presented at the end.
 You need Tor (at least version 0.2.7.1). Figure out where your <tt>torrc</tt> file is (<tt>/etc/tor/torrc</tt> is one possibility). This guide assumes default Tor settings. This guide assumes that Tor is running under the user and group <tt>tor</tt>, which will usually be the case if you install Tor using your distro's package manager. Note that since version 22.0 Bitcoin '''does not''' support Tor hidden service version 2 (ie. short onion addresses), only support Tor version 3 hidden services (Tor v3, ie. long onion addresses).
@@ Line 72: / Line 72: @@
 Now restart Bitcoin Core. You should eventually get incoming connections via your hidden service.
 [[Category:Guides]]