mirror
/
Enterprise-Onion-Toolkit
kopia lustrzana https://github.com/alecmuffett/eotk
1
0
Forkuj 0
Kod Zgłoszenia Projekty Wydania Wiki Aktywność
The Enterprise Onion Toolkit
849 Commity
2 Gałęzie
6 Tagi
4,7 MiB
Awk 40.1%
Shell 31.1%
Perl 20.3%
Raku 6.7%
Dockerfile 1%
Pozostałe 0.8%
 
 
 
 
 
 
Go to file
Alec Muffett 85f80e35d8 remove text noise created by stock openssl 2024-02-09 02:11:02 +00:00
demo.d commit: more docs 2022-03-05 18:49:28 +00:00
docs.d Tweaks in HOW-TO-INSTALL for HARICA. 2021-07-15 12:32:01 -07:00
lib.d remove text noise created by stock openssl 2024-02-09 02:11:02 +00:00
opt.d commit: bump tor version, fix a few checks, add helper script for renaming v3 secrets 2021-05-18 10:54:39 +00:00
templates.d doc nit 2022-03-06 00:36:47 +00:00
tools.d commit: fix and standardise permissions 2019-10-01 20:20:46 +01:00
.gitignore commit: first cut. 2021-05-17 21:20:54 +01:00
LICENSE Initial commit 2017-02-01 08:19:04 +00:00
Makefile commit: fix and standardise permissions 2019-10-01 20:20:46 +01:00
README.md and more warnings 2022-03-05 20:36:23 +00:00
eotk commit: work in progress is stable 2021-09-24 12:52:21 +01:00

README.md

The Enterprise Onion Toolkit

banner image

⚠️ Important HTTPS-related Annoucement: March 2022 ⚠️

I've landed a small breaking change in order to better-support HARICA as a certificate provider, but also for better usability; this change impacts any project with a multi-onion EV certificate from Digicert.

  • v3 onion addresses used in pathnames are now truncated at 20 chars of onion, rather than 30 overall, to make shorter pathnames for unix domain sockets
  • onion scratch-directory name changes:
    • was: projects.d/tweep.d/abcdefghijklmnopqrstuvwxyza-v3.d/port-80.sock
    • now: projects.d/tweep.d/abcdefghijklmnopqrst-v3.d/port-80.sock
    • ⚠️ this means that some scratch directories may be are remade, so a full restart is advisable after updating
  • https certificate path-name changes
    • was: HTTPS certificate files used the full onion address
    • now: onion HTTPS certificates are now expected to be installed in per-onion-truncated-at-20 pathnames: e.g. for each ONIONADDRESS in PROJECTNAME:
      • /projects.d/PROJECTNAME.d/ssl.d/ONIONADDRFIRST20CHAR-v3.onion.cert
      • /projects.d/PROJECTNAME.d/ssl.d/ONIONADDRFIRST20CHAR-v3.onion.pem
    • ⚠️ this means that you will need to rename pre-existing certificate cert and pem files after you update and reconfigure;
    • ⚠️ if you fail to do this you will experience "self-signed certificate" warnings
  • if you are using 'multi' certificates (such as some Digicert EV) where a single certificate contains all SubjectAltNames for 2+ onion addresses that are part of a single project:
    • ⚠️ do set ssl_cert_each_onion 0 in the configuration, to re-enable multi cert handling
    • ⚠️ the names of the certificate files must be changed:
      • was: filenames used to be projects.d/PROJECTNAME.d/ssl.d/PRIMARYONIONADDRESSWASHERE.{pem,cert}
      • now: multi-certificates now must be named with the more meaningful projects.d/PROJECTNAME.d/ssl.d/PROJECTNAME.{pem,cert}

If you have any issues, please reach out to @alecmuffett on Twitter, or log an issue above.

Primary Supported Platforms

  • Ubuntu 20.04LTS, Latest Updates
  • OSX Mojave with Homebrew, Latest Updates
  • Raspbian Stretch/Stretch-Lite, Latest Updates

Maillist / Group

General discussion mailllist: deployment, tweaks and tuning:

NB: bugs should be reported through Issues, above.

EOTK In the News

Introduction

EOTK provides a tool for deploying HTTP and HTTPS onion sites to provide official onion-networking presences for popular websites.

The result is essentially a "man in the middle" proxy; you should set them up only for your own sites, or for sites which do not require login credentials of any kind.

Installation

Please refer to the How To Install guide, and the other documents in that folder.

Help I'm Stuck!

Ping @alecmuffett on Twitter, or log an Issue, above.

Important Note About Anonymity

The presumed use-case of EOTK is that you have an already-public website and you wish to give it a corresponding Onion address.

A lot of people mistakenly believe that Tor Onion Networking is "all about anonymity" - which is incorrect, since it also includes:

  • extra privacy
  • identity/surety of to whom you are connected
  • freedom from oversight/network surveillance
  • anti-blocking, and...
  • enhanced integrity/tamperproofing

...none of which are the same as "anonymity", but all of which are valuable qualities to add to communications.

Further: setting up an Onion address can provide less contention, more speed & more bandwidth to people accessing your site than they would get by using Tor "Exit Nodes".

If you set up EOTK in its intended mode then your resulting site is almost certainly not going to be anonymous; for one thing your brand name (etc) will likely be plastered all over it.

If you want to set up a server which includes anonymity as well as all of the aforementioned qualities, you want to be reading an entirely different document, instead.

Acknowledgements

EOTK stands largely on the experience of work I led at Facebook to create www.facebookcorewwwi.onion, but it owes a huge debt to Mike Tigas's work at ProPublica to put their site into Onionspace through using NGINX as a rewriting proxy -- and that he wrote the whole experience up in great detail including sample config files.

Reading this prodded me to learn about NGINX and then aim to shrink & genericise the solution; so thanks, Mike!

Also, thanks go to Christopher Weatherhead for acting as a local NGINX sounding board :-)

And back in history: Michal Nánási, Matt Jones, Trevor Pottinger and the rest of the FB-over-Tor team. Hugs.