Bulletproof VPS for Tor Onion Services: Setup and Security Guide

Setting up a Tor hidden service on AnubizHost Linux VPS:

Install Tor:
apt install tor

Configure /etc/tor/torrc:
HiddenServiceDir /var/lib/tor/hidden_service/
HiddenServicePort 80 127.0.0.1:80

Start Tor:
systemctl restart tor

Get your .onion address:
cat /var/lib/tor/hidden_service/hostname

Run web server locally: Nginx or Apache listening on 127.0.0.1:80 only. Never expose your actual web server port to the public internet - route all traffic through Tor.

Generate vanity .onion address (optional): Use mkp224o to generate a .onion address with a specific prefix. Computational cost: approximately 1 hour to generate a 6-character prefix on modern hardware.

Security measures for hidden service operators:

• No clearnet exposure: Ensure your web server only listens on 127.0.0.1, not 0.0.0.0. A misconfigured server exposing port 80 to the internet deanonymizes the hidden service.
• Firewall rules: UFW rules blocking all inbound traffic except SSH (from specific admin IP). All web traffic should go through Tor onion routing only.
• Application security: Standard web application security applies to .onion sites. OWASP Top 10 vulnerabilities (SQL injection, XSS) can deanonymize operations through application-layer mistakes.
• Traffic correlation resistance: High-volume .onion sites can be deanonymized through traffic analysis. For maximum security, use multiple servers with load balancing across different circuits.