|
1782
|
1 #summary s2s to Tor hidden services
|
|
|
2 #labels Stage-Alpha
|
|
|
3
|
|
|
4 = Introduction =
|
|
|
5
|
|
|
6 This plugin allows Prosody to connect to other servers that are running as a Tor hidden service. Running Prosody on a hidden service works without this module, this module is only necessary to allow Prosody to federate to hidden XMPP servers.
|
|
|
7
|
|
|
8 For general info about creating a hidden service, see https://www.torproject.org/docs/tor-hidden-service.html.en.
|
|
|
9
|
|
|
10 = Usage =
|
|
|
11 This module depends on the bit32 Lua library.
|
|
|
12
|
|
|
13 To create a hidden service that can federate with other hidden XMPP servers, first add a hidden serivce to Tor. It should listen on port 5269 and optionally also on 5222 (if c2s connections to the hidden service should be allowed).
|
|
|
14
|
|
|
15 Use the hostname that Tor gives with a virtualhost:
|
|
|
16
|
|
|
17 {{{
|
|
|
18 VirtualHost "555abcdefhijklmn.onion"
|
|
|
19 modules_enabled = { "onions" };
|
|
|
20 }}}
|
|
|
21
|
|
|
22 = Configuration =
|
|
|
23 || *Name* || *Description* || *Type* || *Default value* ||
|
|
|
24 || onions_socks5_host || the host to connect to for Tor's SOCKS5 proxy || string || "127.0.0.1" ||
|
|
|
25 || onions_socks5_port || the port to connect to for Tor's SOCKS5 proxy || integer || 9050 ||
|
|
|
26 || onions_only || forbid all connection attempts to non-onion servers || boolean || false ||
|
|
|
27 || onions_tor_all || pass all s2s connections through Tor || boolean || false ||
|
|
|
28 || onions_map || override the address for a host || table || {} ||
|
|
|
29
|
|
|
30 By setting {{{onions_map}}}, it is possible to override the address used to connect to a given host with the address of a hidden service. The configuration of {{{onions_map}}} works as follows:
|
|
|
31
|
|
|
32 {{{
|
|
|
33 onions_map = {
|
|
|
34 ["jabber.calyxinstitute.org"] = "ijeeynrc6x2uy5ob.onion";
|
|
|
35 }
|
|
|
36 }}}
|
|
|
37
|
|
|
38 or, to also specify a port:
|
|
|
39
|
|
|
40 {{{
|
|
|
41 onions_map = {
|
|
|
42 ["jabber.calyxinstitute.org"] = { host = "ijeeynrc6x2uy5ob.onion", port = 5269 };
|
|
|
43 }
|
|
|
44 }}}
|
|
|
45
|
|
|
46 = Compatibility =
|
|
|
47 ||0.8||Doesn't work||
|
|
|
48 ||0.9||Works||
|
|
|
49
|
|
|
50 = Notes =
|
|
|
51
|
|
|
52 * {{{onions_tor_all}}} does not look up SRV records first. Therefore it will fail for many servers.
|
|
|
53 * mod_onions currently does not support connecting to {{{.onion}}} entries in SRV records.
|
|
|
54
|
|
|
55 = Security considerations =
|
|
|
56 * Running a hidden service on a server together with a normal server might expose the hidden service.
|
|
|
57 * A hidden service that wants to remain hidden should either disallow s2s to non-hidden servers or pass all s2s traffic through Tor (setting either {{{onions_only}}} or {{{onions_tor_all}}}). |
