Software Required to Host a Tor Hidden Service

Hosting a Tor hidden service, officially known as an onion service, allows you to host websites or network services anonymously without exposing your server’s public IP address. Setting up an onion service requires minimal specialized software: primarily a secure operating system, the official Tor daemon to manage the encrypted routing, and a standard web or application server to deliver your content.

1. The Tor Daemon

The most critical piece of software is the official Tor daemon (often packaged simply as tor). The daemon connects your server to the Tor network, creates your unique .onion cryptographic address, and manages virtual port forwarding. It routes incoming encrypted traffic from the Tor network to your local web server without requiring open inbound ports on your firewall or router. The Tor daemon is free, open-source, and available directly from the Tor Project repository for most major platforms.

2. Web or Application Server

Tor does not serve content on its own; it only provides the network routing. You need standard web server software to handle requests and serve your files or applications. Popular choices include:

• Nginx: Lightweight, high-performance, and easy to configure securely.
• Apache HTTP Server: Highly configurable with extensive module support.
• Lighttpd: Minimal footprint, ideal for low-resource environments.
• Custom Application Servers: Node.js, Python (Flask/Django), Go, or any service capable of binding to localhost.

To preserve anonymity, the web server must be strictly configured to listen only on 127.0.0.1 (localhost) rather than public-facing network interfaces.

3. Operating System

While Tor runs on multiple platforms, a Unix-like operating system is recommended for stability and security:

• Linux Distributions: Debian, Ubuntu Server, and Alpine Linux are the most widely used due to their robust package management and security support.
• Hardened Systems: For high-security environments, hardened distributions like Whonix (using a separate Gateway and Workstation setup) or OpenBSD offer enhanced protection against IP leaks and software exploits.
• Windows / macOS: Supported, but generally discouraged for production onion services due to greater resource overhead and higher risk of accidental data leaks.

4. Supporting Security and Utility Software

To maintain the integrity and privacy of your hidden service, the following utility software is strongly recommended:

• Firewalls (e.g., UFW or iptables): Used to block all direct incoming public traffic, ensuring that the web server can only be reached through the Tor loopback connection.
• Process Isolation Tools: Sandboxing software like AppArmor, SELinux, or container platforms like Docker to contain potential web application vulnerabilities.