Posted inSecurity

Setting Up a Tor Onion Service with Nginx: ‘Stealth’ Your Website on Linux

Security tutorial - IT technology blog
Security tutorial - IT technology blog

Background: When Traditional SSL Isn’t Enough

Not long ago, I handled a challenging case: deploying an internal portal for an organization requiring absolute anonymity. Even the Infrastructure Service Provider (ISP) wasn’t allowed to know the server existed. With standard HTTPS, the ISP can still see which IP you’re connecting to. To solve this once and for all, a Tor Onion Service (.onion website) was the only solution I trusted.

After auditing over 10 security systems, I found the most common mistake is leaking the real IP due to sloppy Nginx configurations. Running a .onion website is easy, but running it without “blowing your cover” is an art. This article goes straight into the standard setup techniques on Linux.

Step 1: Installing Nginx and Tor

First, we need a web server (Nginx) and the Tor service to create the tunnel. I recommend using Ubuntu or Debian because their packages are very stable and well-updated.

sudo apt update
sudo apt install nginx tor -y

Once installed, check the service status. At this point, Tor is only running as a standard client; no Hidden Service has been activated yet.

sudo systemctl status tor

Step 2: Configuring Nginx – Blocking IP Leaks

This is the Achilles’ heel for many sysadmins. By default, Nginx listens on 0.0.0.0 (all interfaces). If left as is, an attacker using tools like Shodan could scan and find your server via its public IP. From there, they can cross-reference the content and confirm you are the owner of that .onion site.

Force Nginx to listen only on localhost (127.0.0.1).

sudo nano /etc/nginx/sites-available/default

Edit the server block as follows:

server {
    listen 127.0.0.1:8080;
    server_name localhost;

    root /var/www/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    # Hide Nginx version to prevent CVE-based exploits
    server_tokens off;
}

I use port 8080 to completely separate it from regular web traffic. Restart Nginx to apply the changes:

sudo systemctl restart nginx

Step 3: Activating the Tor Onion Service

Now, we will open the door for the Tor world to find the server. You need to modify the torrc file.

sudo nano /etc/tor/torrc

Find the “Hidden Services” section and add the following two lines:

HiddenServiceDir /var/lib/tor/my_onion_site/
HiddenServicePort 80 127.0.0.1:8080

Important notes:

  • HiddenServiceDir: Where the private key is stored. Losing this file means losing your .onion address forever.
  • HiddenServicePort: Tor receives traffic from port 80 of the anonymous network and forwards it to the internal port 8080.

Restart Tor so the system can automatically generate the identity address:

sudo systemctl restart tor

Step 4: Retrieving the .onion Address

Tor will automatically create a dedicated directory with very strict permissions. You need root privileges to read the file containing the domain name.

sudo cat /var/lib/tor/my_onion_site/hostname

The result will be a long string of characters like vww6ybal4bd7szmgncyruucpgfkqahzddiqe.onion. Copy it into the Tor Browser. If the Nginx page appears, you’ve succeeded.

Step 5: Hardening – Reinforcing the Fortress

Being online is one thing; staying resilient against scans is another. Many servers are “unmasked” through redundant HTTP headers.

Stripping Header Traces

Nginx often sends X-Powered-By or other backend information. Use the following directives to remove them:

# Add to the Nginx server block
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options "SAMEORIGIN";
proxy_hide_header X-Powered-By;

Configuring Anonymous Logs

To protect users, it’s best not to store access logs. If the server is compromised, the attacker will have no data to analyze user behavior.

access_log off;
error_log /var/log/nginx/error.log crit;

Monitoring with Nyx

Want to know how much bandwidth the server is consuming or how many circuits are connected? Use nyx.

sudo apt install nyx
sudo -u debian-tor nyx

Survival Principles (OPSEC)

Correct technique only fulfills 50% of the requirements. The other 50% lies in operational mindset:

  1. Service Isolation: Absolutely do not run a Mail server or Database with outbound connections on this same server. A small slip-up from another service can leak your real IP instantly.
  2. Metadata is the Enemy: Photos you upload to the web often contain GPS coordinates or device information (EXIF). Use tools to strip metadata before publishing.
  3. Prioritize Static Content: JavaScript is a double-edged sword. It can be exploited to force a user’s browser to make unintended queries to reveal their true identity.

Deploying a Tor Onion Service isn’t just for sensitive purposes. It is a powerful tool for protecting privacy in a world where personal data is being over-exploited. I hope this guide helps you build a safe and secure digital space.

Share:
Tags: