Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am thinking about installing Tor on my server (running CentOS) but I read it has some vulnerabilities that could be exploited remotely.

Could someone tell me how to configure it for maximum security? and how to make it never work as relay and accept local connections only (like from php scripts using curl).

share|improve this question

closed as off-topic by Magellan, HBruijn, Ward, dawud, Jenny D Jul 12 at 8:05

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – Magellan, HBruijn, Ward, dawud, Jenny D
If this question can be reworded to fit the rules in the help center, please edit the question.

add comment

3 Answers 3

Even if there are no known vulnerabilities in a piece of software that doesn't mean there are no vulnerabilities in that piece of software. There's no magic answer to the dilemma, treasmix, if you want tor (or any other software) on your server then you have to balance the strength of the risk vs. the strength of your need.

If you look at the release notes / security history of a product and a certain type of vulnerability crops up over and over again then this might be an indicator that the app is a higher risk in certain areas and that the coders won't (or can't) re-write the code to make exploiting it more difficult. But even the absence of a poor security history doesn't mean there is no risk. Sooner or later it comes down to subscribing to their security mailing list/rss feed/twatter feed and hoping for the best.

share|improve this answer
    
also take note about what language the service is written with. I'd trust java applications a little more than C/C++. Okay some java software is poorly written, but at least you avoid some buffer overflow conditions. I'm not sure their is a java client for tor. –  The Unix Janitor Sep 13 '10 at 14:21
add comment

Here's a link to the tor documentation - it will answer all your questions.

do you know if there is any vulnerability in the latest release i should be aware of?

Sorry, perhaps I was wrong - looks like you would need to browse around a bit at torproject.org to find the tor bug tracker and wiki.

Short of monitoring hundreds of security-related sites, the tor project's own bug tracker will be the best place to see known bugs (though monitoring a site like linuxsecurity.com's RSS feeds can't hurt).

share|improve this answer
    
do you know if there is any vulnerability in the latest release i should be aware of? –  treasmx Sep 13 '10 at 4:28
add comment

You would be wise to simply assume that it is vulnerable, or will be vulnerable. Run it in the most restrictive container available to you.

In order:

  1. A virtual machine (Xen, KVM, VirtualBox)
  2. An LXC container (pretty safe)
  3. A chroot jail (least safe)
share|improve this answer
add comment