Project

General

Profile

Feature #5688

Tails Server: Self-hosted services behind Tails-powered onion services

Added by Tails about 5 years ago. Updated 22 days ago.

Status:
Confirmed
Priority:
Normal
Assignee:
Category:
-
Target version:
-
Start date:
04/03/2016
Due date:
% Done:

29%

QA Check:
Feature Branch:
feature/5688-tails-server
Type of work:
Code
Starter:
Affected tool:
Server


Subtasks

Feature #11313: Design the GUI of Tails ServerResolvedsegfault

Feature #11314: Implement a Tails Server prototypeResolvedsegfault

Feature #11551: Install the mumble VoIP clientConfirmedsegfault

Feature #12230: Release Tails Server BetaIn Progressanonym

Feature #12226: Initial review of Tails Server implementationIn Progresssegfault

Bug #12232: Base feature/5688-tails-server on feature/stretchResolvedsegfault

Feature #12235: Remove client authentication support from Tails ServerResolvedsegfault

Feature #12237: Reduce apt update time during first start of Tails ServerResolved

Feature #12478: Add a chat service (XMPP or IRC) to Tails ServerResolved

Feature #12479: Write Tails Server beta release announcementConfirmedsegfault

Feature #12231: Write Tails Server Design DocumentationConfirmedsegfault

Bug #12253: Use persistence.conf in Tails ServerConfirmedsegfault

Feature #12255: Use polkit with Tails ServerConfirmedsegfault

Bug #12297: Make Tails Server compatible with Wayland Confirmedsegfault

Feature #14456: Finish documenting Tails ServerConfirmedspriver

Feature #15034: Create apparmor rules for Tails Server servicesConfirmedsegfault

Feature #15299: Restrict access to onionkit via D-BusConfirmedsegfault

Feature #15300: Redesign Tails Server GUIConfirmed

Feature #15301: Run Tails Server services in containersIn Progresssegfault

Feature #15343: Add schleuder list to Tails ServerConfirmedsegfault

Feature #15348: Have an icon for the Tais Server GUIConfirmed

Feature #15899: Rethink goals of Tails ServerConfirmedsegfault


Related issues

Related to Tails - Feature #7879: Document how to serve files over HTTP behind a Tor Hidden Service Rejected 09/07/2014
Related to Tails - Feature #12236: Add more services to Tails Server Confirmed 01/16/2018
Related to Tails - Feature #15035: Use systemd security features for Tails Server services Confirmed 12/10/2017
Related to Tails - Feature #15181: Help create Debian packages for Tails Server Confirmed 01/17/2018
Related to Tails - Feature #6333: firewall exceptions for user-run local services Confirmed 10/04/2013

History

#1 Updated by intrigeri about 5 years ago

  • Type of work set to Code

Type of work: Code

#2 Updated by segfault over 3 years ago

I wrote a script to start a hidden web server on Tails. This is a very simple solution without any of the many features planned in the blueprint. It just installs apache (could be any other web server), binds the persistent hidden_service directory to /var/lib/tor, configures Tor to use the hidden service and adds a rule to iptables allowing Tor to access the webserver.

I can try to figure out how to integrate this into Tails if you think this is useful in any way.

#3 Updated by segfault over 3 years ago

Attaching the files doesn't work, progress bar just states 'error', so I'll just paste them here:

setup.sh:

#!/bin/bash

echo "Installing apache." 
apt-get install apache2

echo "Configuring tor hidden service." 
./configure_hidden_service.sh

echo "Adding iptables rules." 
./add_iptables_rules.sh

configure_hidden_service.sh::

#!/bin/bash

# bind hidden service dir
sudo mount --bind ./hidden_service /var/lib/tor/hidden_service

# add hidden service to torrc
TORRC=/usr/share/tor/tor-service-defaults-torrc
echo HiddenServiceDir /var/lib/tor/hidden_service >> $TORRC
echo HiddenServicePort 80 127.0.0.1:80 >> $TORRC

# reload tor
sudo service tor restart

add_iptables_rules.sh:

#!/bin/bash

### Allow access to web server on lo ###

# allow user tor (hidden service)
iptables -I OUTPUT -d 127.0.0.1/32 -o lo -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -m owner --uid-owner debian-tor -j ACCEPT

# allow user root
#iptables -I OUTPUT -d 127.0.0.1/32 -o lo -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -m owner --uid-owner root -j ACCEPT

# allow unsafe browser
#iptables -I OUTPUT -d 127.0.0.1/32 -o lo -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -m owner --uid-owner clearnet -j ACCEPT

#4 Updated by intrigeri over 3 years ago

  • Related to Feature #7879: Document how to serve files over HTTP behind a Tor Hidden Service added

#5 Updated by intrigeri over 3 years ago

I wrote a script to start a hidden web server on Tails.

Great! It's work in progress on #7879 => please report about your own version there.

#6 Updated by anonym about 2 years ago

#7 Updated by anonym about 2 years ago

#8 Updated by anonym about 2 years ago

#9 Updated by Dr_Whax about 2 years ago

  • Description updated (diff)
  • Assignee set to segfault
  • Target version set to 2017

#10 Updated by segfault over 1 year ago

  • Blueprint changed from https://tails.boum.org/blueprint/server_edition to https://tails.boum.org/blueprint/tails_server

#11 Updated by segfault over 1 year ago

  • Related to Feature #12237: Reduce apt update time during first start of Tails Server added

#12 Updated by segfault over 1 year ago

#13 Updated by segfault over 1 year ago

  • Related to Bug #12232: Base feature/5688-tails-server on feature/stretch added

#14 Updated by segfault over 1 year ago

  • Related to Feature #12231: Write Tails Server Design Documentation added

#15 Updated by segfault over 1 year ago

#17 Updated by segfault over 1 year ago

  • Target version changed from 2017 to Tails_3.2
  • Feature Branch set to feature/5688-tails-server

We plan to release Tails Server with the first point release after the release of the next-generation onion services (scheduled for August 2017). This will be Tails 3.2, scheduled for 10/03/2017.

#18 Updated by segfault over 1 year ago

  • Related to deleted (Bug #12232: Base feature/5688-tails-server on feature/stretch)

#19 Updated by segfault over 1 year ago

  • Blocked by Bug #12232: Base feature/5688-tails-server on feature/stretch added

#20 Updated by segfault over 1 year ago

  • Related to deleted (Feature #12231: Write Tails Server Design Documentation)

#21 Updated by segfault over 1 year ago

  • Blocked by Feature #12231: Write Tails Server Design Documentation added

#22 Updated by segfault over 1 year ago

#23 Updated by segfault over 1 year ago

#24 Updated by segfault over 1 year ago

  • Affected tool set to Server

#25 Updated by segfault over 1 year ago

  • Subject changed from Tails server: Self-hosted services behind Tails-powered Tor hidden services to Tails Server: Self-hosted services behind Tails-powered onion services

#26 Updated by segfault over 1 year ago

#27 Updated by segfault over 1 year ago

  • Blocked by deleted (Bug #12232: Base feature/5688-tails-server on feature/stretch)

#28 Updated by segfault over 1 year ago

  • Blocked by deleted (Feature #12231: Write Tails Server Design Documentation)

#29 Updated by segfault over 1 year ago

#30 Updated by BitingBird about 1 year ago

  • Description updated (diff)

#31 Updated by intrigeri about 1 year ago

  • Target version changed from Tails_3.2 to Tails_3.5

It didn't make it into 3.2 so best case it'll be for 3.4, if your new job (VeraCrypt! :) leaves you enough spare time.

#32 Updated by segfault 10 months ago

  • Related to Feature #15035: Use systemd security features for Tails Server services added

#33 Updated by segfault 10 months ago

  • Related to Feature #15034: Create apparmor rules for Tails Server services added

#34 Updated by u 8 months ago

What's the current release plan? You said that you are waiting for next-generation onion services, and Torproject said they released a beta in November 2017: https://blog.torproject.org/tors-fall-harvest-next-generation-onion-services. Do we know more about their release schedule (just so that we can track this on this ticket / on our side)?

#35 Updated by segfault 8 months ago

  • Target version changed from Tails_3.5 to Tails_3.8

What's the current release plan?

Ok, a little overdue update: I worked a lot on this in the last months. I redesigned and rewrote a lot of code, and plan to make Debian packages with the names onionkit for the backend and onionservices (if I don't find something better) for the GUI. It's not finished yet, I still have quite some work to do, and I would also like to redesign the GUI to fit the new GNOME Settings design. But I have to focus on other projects with hard deadlines in the next weeks, so this will have to wait some more. I will set the target version 3.8 for now, as I don't think 3.6 is realistic.

You said that you are waiting for next-generation onion services, and Torproject said they released a beta in November 2017: https://blog.torproject.org/tors-fall-harvest-next-generation-onion-services. Do we know more about their release schedule (just so that we can track this on this ticket / on our side)?

The next-gen onions were the main blocker before the redesign, but they actually already got released in the latest stable release, so they are not a blocker anymore. And I hope that they will also be supported in Stem by the time I finished everything else.

#36 Updated by u 8 months ago

  • Target version changed from Tails_3.8 to Tails_3.9

I'm setting 3.9 as target as this will be the next major release (3.9~rc1 is planned for 2018-08-17).

#37 Updated by u 8 months ago

segfault wrote:

What's the current release plan?

Ok, a little overdue update: I worked a lot on this in the last months. I redesigned and rewrote a lot of code, and plan to make Debian packages with the names onionkit for the backend and onionservices (if I don't find something better) for the GUI.

Wow, that's really awesome!

I'd like to help with debianizing these two pieces of code: Will add a ticket for this.

Concerning the names, I think you might want to send an email to tails-dev (?) and ask for comments. I'm unsure if these names correctly reflect what the software does.
Maybe: onionservices & onionservices-gui would be more appropriate? or onionservices-client or something.

#38 Updated by u 8 months ago

  • Related to Feature #15181: Help create Debian packages for Tails Server added

#39 Updated by segfault 8 months ago

  • Related to Bug #12297: Make Tails Server compatible with Wayland added

#40 Updated by segfault 7 months ago

  • Description updated (diff)

#41 Updated by bertagaz 6 months ago

It would be great to update the FAQ once this is out

#42 Updated by segfault about 2 months ago

  • Target version deleted (Tails_3.9)

It's unclear when Tails Server will get its review, so I'm unsetting the target version.

#43 Updated by u about 1 month ago

  • Related to Feature #6333: firewall exceptions for user-run local services added

Also available in: Atom PDF