Host a Secure Tor Hidden Service on Raspberry Pi

Running a Tor hidden service (also known as an Onion Service) on a Raspberry Pi is an accessible, power-efficient, and practical way to host private websites, SSH interfaces, or chat servers. While the Raspberry Pi’s hardware is more than capable of running the Tor protocol smoothly, achieving true security requires systematic hardening of the operating system, network configuration, and web server to prevent IP address leaks and unauthorized access.

Why the Raspberry Pi Is Well-Suited for Tor

A Raspberry Pi functions as a dedicated, low-power server that can run continuously without significant electricity costs. Using a dedicated single-board computer provides physical and operational isolation from your daily workstations, reducing the risk that a compromise of your personal computer affects your hidden service, or vice versa.

1. Operating System Hardening

Security begins with the underlying operating system:

• Use a Minimal Distribution: Install Raspberry Pi OS Lite (64-bit) or standard Debian minimal to minimize unnecessary background services, packages, and attack surfaces.
• Update the System Regularly: Keep all packages up to date using sudo apt update && sudo apt upgrade -y. Enable unattended security upgrades if possible.
• Secure SSH Access: Disable root login, disable password authentication entirely, and enforce the use of strong SSH key pairs. If possible, only access SSH via Tor itself or over a local management network.
• Configure a Firewall: Install and enable a firewall such as ufw. Because Tor operates by creating outbound connections to the Tor network, no inbound router ports or firewall openings are required. Deny all incoming traffic by default.

2. Installing and Configuring the Tor Service

Install Tor using the official repositories to ensure you have the latest stable release:

sudo apt install tor -y

To configure the hidden service, edit the main Tor configuration file located at /etc/tor/torrc. Add the following lines to map your service:

HiddenServiceDir /var/lib/tor/my_hidden_service/
HiddenServicePort 80 127.0.0.1:8080

This configuration tells Tor to route incoming requests directed at port 80 of your .onion address to port 8080 on the local loopback interface (127.0.0.1).

Restart the Tor daemon to generate your service keys and hostname:

sudo systemctl restart tor
sudo cat /var/lib/tor/my_hidden_service/hostname

Protect the /var/lib/tor/ directory permissions to ensure that only the debian-tor user can read the private keys.

3. Web Server Configuration and IP Leak Prevention

Application-layer misconfigurations are the most common cause of hidden service deanonymization. When configuring a web server like Nginx or Lighttpd:

• Bind to Localhost Only: Ensure the web server listens strictly on 127.0.0.1 (e.g., listen 127.0.0.1:8080;), never on 0.0.0.0 or your local LAN IP address.
• Disable Identifying Headers: Turn off server signatures and version numbers (such as server_tokens off; in Nginx) to reduce software fingerprinting.
• Eliminate External Asset Calls: Ensure web pages do not load fonts, scripts, or images from clearnet CDNs. External requests made by visitors can compromise their anonymity, while server-side fetch requests can inadvertently leak the server’s real IP address.
• Disable Unnecessary Features: Turn off CGI scripts, server status pages, directory listings, and database interfaces unless strictly required.

4. Critical Best Practices for Ongoing Security

• Do Not Port Forward on Your Router: A Tor Onion Service does not require open inbound ports. Opening ports on your home router creates an unnecessary exposure to the public internet.
• Isolate on the Local Network: Place the Raspberry Pi on an isolated VLAN or a guest network to prevent an attacker from pivoting to other local devices if the service is compromised.
• Back Up Your Private Key Securely: Store an encrypted offline backup of your hs_ed25519_secret_key file. If the Raspberry Pi’s SD card corrupts, this key is required to restore your existing .onion address.
• Implement Physical Security: Encrypt sensitive storage where applicable and keep the physical device in a secure location to prevent physical tampering or extraction of the MicroSD card.