Configuring a Tor server


The Tor network relies on volunteers to donate bandwidth. The more people who run servers, the faster the Tor network will be. If you have at least 20 kilobytes/s each way, please help out Tor by configuring your Tor to be a server too. We have many features that make Tor servers easy and convenient, including rate limiting for bandwidth, exit policies so you can limit your exposure to abuse complaints, and support for dynamic IP addresses.

Having servers in many different places on the Internet is what makes Tor users secure. You may also get stronger anonymity yourself, since remote sites can't know whether connections originated at your computer or were relayed from others.

Setting up a Tor server is easy and convenient:

You can run a Tor server on pretty much any operating system, but see this FAQ entry for advice about which ones work best and other problems you might encounter.


Step Zero: Download and Install Tor


Before you start, you need to make sure that Tor is up and running.

For Windows users, this means at least step one of the Windows Tor installation howto. Mac OS X users need to do at least step one of OS X Tor installation howto. Linux/BSD/Unix users should do at least step one of the Unix Tor installation howto.

If it's convenient, you might also want to use it as a client for a while to make sure it's actually working.


Step One: Set it up as a server


1. Verify that your clock is set correctly. If possible, synchronize your clock with public time servers.

2. Make sure name resolution works (that is, your computer can resolve addresses correctly).

3. Edit the bottom part of your torrc. (See this FAQ entry for help.) Make sure to define at least Nickname and ORPort. Create the DataDirectory if necessary, and make sure it's owned by the user that will be running tor. If you want to run more than one server that's great, but please set the MyFamily option in all your servers' configuration files.

4. If you are using a firewall, open a hole in your firewall so incoming connections can reach the ports you configured (ORPort, plus DirPort if you enabled it). Make sure you allow all outgoing connections, so your server can reach the other Tor servers.

5. Start your server: if you installed from source you can just run tor, whereas packages typically launch Tor from their initscripts or startup scripts. If it logs any warnings, address them. (By default Tor logs to stdout, but some packages log to /var/log/tor/ instead. You can edit your torrc to configure log locations.)

6. Subscribe to the or-announce mailing list. It is very low volume, and it will keep you informed of new stable releases. You might also consider subscribing to or-talk (higher volume), where new development releases are announced.

7. Have a look at the manual. The manual for the latest stable version provides detailed instructions for how to install and use Tor, including configuration of client and server options. If you are running the CVS version the manual is available here.

8. Read this document to get ideas how you can increase the security of your server.


Step Two: Make sure it's working


As soon as your server manages to connect to the network, it will try to determine whether the ports you configured are reachable from the outside. This may take up to 20 minutes. Look for a log entry like Self-testing indicates your ORPort is reachable from the outside. Excellent. If you don't see this message, it means that your server is not reachable from the outside -- you should re-check your firewalls, check that it's testing the IP and port you think it should be testing, etc.

When it decides that it's reachable, it will upload a "server descriptor" to the directories. This will let clients know what address, ports, keys, etc your server is using. You can load the directory manually and look through it to find the nickname you configured, to make sure it's there. You may need to wait a few seconds to give enough time for it to make a fresh directory.


Step Three: Register your nickname


Once you are convinced it's working (after a day or two maybe), you should register your server. This reserves your nickname so nobody else can take it, and lets us contact you if you need to upgrade or something goes wrong.

Send mail to tor-ops@freehaven.net with a subject of '[New Server] <your server's nickname>' and include the following information in the message:


Step Four: Once it's working


We recommend the following steps as well:

6. Decide what exit policy you want. By default your server allows access to many popular services, but we restrict some (such as port 25) due to abuse potential. You might want an exit policy that is less restrictive or more restrictive; edit your torrc appropriately. Read the FAQ entry on issues you might encounter if you use the default exit policy. If you choose a particularly open exit policy, you should make sure your ISP is ok with that choice.

7. Decide about rate limiting. Cable modem, DSL, and other users who have asymmetric bandwidth (e.g. more down than up) should rate limit to their slower bandwidth, to avoid congestion. See the rate limiting FAQ entry for details.

8. If you control the name servers for your domain, consider setting your hostname to 'anonymous' or 'proxy' or 'tor-proxy', so when other people see the address in their web logs, they will more quickly understand what's going on.

9. If your computer isn't running a webserver, please consider changing your ORPort to 443 and your DirPort to 80. Many Tor users are stuck behind firewalls that only let them browse the web, and this change will let them reach your Tor server. Win32 servers can simply change their ORPort and DirPort directly in their torrc and restart Tor. OS X or Unix servers can't bind directly to these ports (since they don't run as root), so they will need to set up some sort of port forwarding so connections can reach their Tor server. If you are using ports 80 and 443 already but still want to help out, other useful ports are 22, 110, and 143.

10. (Unix only). Make a separate user to run the server. If you installed the OS X package or the deb or the rpm, this is already done. Otherwise, you can do it by hand. (The Tor server doesn't need to be run as root, so it's good practice to not run it as root. Running as a 'tor' user avoids issues with identd and other services that detect user name. If you're the paranoid sort, feel free to put Tor into a chroot jail.)

11. (Unix only.) Your operating system probably limits the number of open file descriptors per process to 1024 (or even less). If you plan to be running a fast exit node, this is probably not enough. On Linux, you should add a line like "toruser hard nofile 8192" to your /etc/security/limits.conf file (where toruser is the user that runs the Tor process), and then restart Tor if it's installed as a package (or log out and log back in if you run it yourself). If that doesn't work, see this FAQ entry for other suggested ways to run "ulimit -n 8192" before you launch Tor.

12. If you installed Tor via some package or installer, it probably starts Tor for you automatically on boot. But if you installed from source, you may find the initscripts in contrib/tor.sh or contrib/torctl useful.

When you change your Tor configuration, be sure to restart Tor, and remember to verify that your server still works correctly after the change.

If you have suggestions for improving this document, please post them on our bugtracker in the website category. Thanks!

Webmaster - $Id$