Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am thinking about installing Tor on my server (running CentOS) but I read it has some vulnerabilities that could be exploited remotely.

Could someone tell me how to configure it for maximum security? and how to make it never work as relay and accept local connections only (like from php scripts using curl).

share|improve this question
add comment

2 Answers

Here's a link to the tor documentation - it will answer all your questions.

do you know if there is any vulnerability in the latest release i should be aware of?

Sorry, perhaps I was wrong - looks like you would need to browse around a bit at torproject.org to find the tor bug tracker and wiki.

Short of monitoring hundreds of security-related sites, the tor project's own bug tracker will be the best place to see known bugs (though monitoring a site like linuxsecurity.com's RSS feeds can't hurt).

share|improve this answer
    
do you know if there is any vulnerability in the latest release i should be aware of? –  treasmx Sep 13 '10 at 4:28
add comment

Even if there are no known vulnerabilities in a piece of software that doesn't mean there are no vulnerabilities in that piece of software. There's no magic answer to the dilemma, treasmix, if you want tor (or any other software) on your server then you have to balance the strength of the risk vs. the strength of your need.

If you look at the release notes / security history of a product and a certain type of vulnerability crops up over and over again then this might be an indicator that the app is a higher risk in certain areas and that the coders won't (or can't) re-write the code to make exploiting it more difficult. But even the absence of a poor security history doesn't mean there is no risk. Sooner or later it comes down to subscribing to their security mailing list/rss feed/twatter feed and hoping for the best.

share|improve this answer
    
also take note about what language the service is written with. I'd trust java applications a little more than C/C++. Okay some java software is poorly written, but at least you avoid some buffer overflow conditions. I'm not sure their is a java client for tor. –  The Unix Janitor Sep 13 '10 at 14:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.