{"id":30432834,"url":"https://github.com/catsec/tor","last_synced_at":"2025-09-04T07:06:55.808Z","repository":{"id":310485473,"uuid":"1039970803","full_name":"catsec/tor","owner":"catsec","description":"tor safe server on ubuntu","archived":false,"fork":false,"pushed_at":"2025-08-18T12:11:52.000Z","size":42,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-08-18T13:11:33.990Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/catsec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-08-18T09:05:44.000Z","updated_at":"2025-08-18T12:11:55.000Z","dependencies_parsed_at":"2025-08-18T13:11:35.400Z","dependency_job_id":"7f9f281c-3bcd-4ea2-85b2-f72619265b16","html_url":"https://github.com/catsec/tor","commit_stats":null,"previous_names":["catsec/tor"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/catsec/tor","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/catsec%2Ftor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/catsec%2Ftor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/catsec%2Ftor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/catsec%2Ftor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/catsec","download_url":"https://codeload.github.com/catsec/tor/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/catsec%2Ftor/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":271704102,"owners_count":24806532,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-22T02:00:08.480Z","response_time":65,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-08-22T21:36:50.768Z","updated_at":"2025-08-22T21:36:53.390Z","avatar_url":"https://github.com/catsec.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Tor-Only XMPP Server Setup\r\n\r\n```\r\n███╗   ██╗ ██████╗     ██╗      ██████╗  ██████╗ ███████╗\r\n████╗  ██║██╔═══██╗    ██║     ██╔═══██╗██╔════╝ ██╔════╝\r\n██╔██╗ ██║██║   ██║    ██║     ██║   ██║██║  ███╗███████╗\r\n██║╚██╗██║██║   ██║    ██║     ██║   ██║██║   ██║╚════██║\r\n██║ ╚████║╚██████╔╝    ███████╗╚██████╔╝╚██████╔╝███████║\r\n╚═╝  ╚═══╝ ╚═════╝     ╚══════╝ ╚═════╝  ╚═════╝ ╚══════╝\r\n```\r\n\r\n## ZERO LOGGING POLICY\r\n**THIS SYSTEM LOGS ABSOLUTELY NOTHING. NO TRACES. NO RECORDS. MAXIMUM PRIVACY.**\r\n\r\nA fully automated script to deploy a secure, privacy-focused XMPP server accessible only via Tor hidden services on Ubuntu 24.04.3 LTS.\r\n\r\n## Features\r\n\r\n- **Complete Tor Integration** - All services accessible only via .onion addresses\r\n- **XMPP with OMEMO** - End-to-end encrypted messaging with modern XMPP features\r\n- **Zero Logging** - Maximum privacy with no stored logs or traces\r\n- **Command Line Admin** - Secure server management via prosodyctl\r\n- **File Transfers** - Secure file sharing via SOCKS5 proxy\r\n- **Service Isolation** - Three separate .onion addresses for security compartmentalization\r\n- **Idempotent Setup** - Safe to rerun, uses stamp files to track progress\r\n\r\n## Architecture\r\n\r\nThe script creates three isolated hidden services:\r\n\r\n| Service | Purpose | Access |\r\n|---------|---------|--------|\r\n| SSH | Server administration | `ssh123abc.onion:22` |\r\n| Web Demo | Public landing page | `http://web456def.onion/` |\r\n| XMPP | Messaging \u0026 file transfer | `xmpp789ghi.onion:5222/5269` |\r\n\r\n## Quick Start\r\n\r\n### Prerequisites\r\n\r\n- Fresh Ubuntu 24.04.3 LTS server (minimal install) **with full disk encryption**\r\n- Root access\r\n- SSH client on your local machine (Linux/macOS/Windows)\r\n\r\n**WARNING CRITICAL: Install Ubuntu with full disk encryption (LUKS) during setup. The script will warn if disk encryption is missing.**\r\n\r\n### Installation\r\n\r\n**Option 1: Run directly from GitHub**\r\n```bash\r\ncurl -fsSL https://raw.githubusercontent.com/catsec/tor/refs/heads/main/setup.sh | sudo bash\r\n```\r\n\r\n**Option 2: Download and run**\r\n```bash\r\nwget https://raw.githubusercontent.com/catsec/tor/refs/heads/main/setup.sh\r\nsudo bash setup.sh\r\n```\r\n\r\n**Option 3: Clone the repository**\r\n```bash\r\ngit clone https://github.com/catsec/tor.git\r\ncd tor\r\nsudo bash setup.sh\r\n```\r\n\r\n**Follow the prompts:**\r\n- Enter your non-root username for SSH access\r\n- Select your operating system (Linux/macOS/Windows) for SSH key generation instructions\r\n- Generate SSH key pair on your local machine and paste the public key\r\n- Choose enhanced anonymity options (Tor bridges)\r\n- Choose whether to continue via SSH after initial setup\r\n\r\n## Setup Process\r\n\r\nThe script performs these steps automatically:\r\n\r\n1. **System Updates** - Updates packages and installs dependencies\r\n2. **SSH Setup** - Configures SSH and guides you through secure key generation\r\n3. **SSH Key Upload** - Interactive setup to add your public SSH key securely\r\n4. **Tor Setup** - Configures hidden services for all components\r\n5. **Nginx Setup** - Deploys dark web landing page\r\n6. **Prosody Installation** - Installs and configures XMPP server\r\n7. **OMEMO Configuration** - Enables end-to-end encryption\r\n8. **SSL Certificates** - Generates certificates for .onion domains\r\n9. **Admin User Creation** - Creates admin account with random password\r\n10. **System Hardening** - Tor-only networking, APT proxy, service isolation\r\n11. **Zero Logging** - Disables all system and service logging\r\n12. **Firewall Setup** - Configures UFW for Tor-only access\r\n\r\n## SSH Key Setup\r\n\r\nThe script now includes an interactive SSH key setup that eliminates the need for GitHub accounts:\r\n\r\n### Supported Platforms\r\n- **Linux** - Uses standard `ssh-keygen` command\r\n- **macOS** - Uses standard `ssh-keygen` command  \r\n- **Windows** - Supports both built-in SSH client and PuTTY\r\n\r\n### Process\r\n1. Select your operating system\r\n2. Follow platform-specific instructions to generate an Ed25519 key pair\r\n3. Copy your public key and paste it into the script\r\n4. Script validates and installs the key securely\r\n\r\n### Privacy Benefits\r\n- **No GitHub dependency** - Your identity isn't linked to public repositories\r\n- **Local key generation** - Keys never leave your machine until you explicitly provide them\r\n- **Validation** - Script ensures key format is correct before proceeding\r\n\r\n## Disk Encryption Requirements\r\n\r\n### **Why Full Disk Encryption is Critical**\r\n\r\nWithout full disk encryption, your Tor server provides **zero privacy protection**:\r\n\r\n- UNENCRYPTED **SSH private keys** can be recovered from disk\r\n- UNENCRYPTED **.onion private keys** are exposed to anyone with disk access  \r\n- UNENCRYPTED **XMPP conversations** may be recoverable from swap/temp files\r\n- UNENCRYPTED **Server compromise** exposes all historical data\r\n\r\n### **Ubuntu Installation with Encryption**\r\n\r\n**During Ubuntu 24.04.3 installation:**\r\n\r\n1. **Choose \"Advanced installation\"** \r\n2. **Enable \"Encrypt the new Ubuntu installation\"**\r\n3. **Choose a strong passphrase** (20+ characters recommended)\r\n4. **Complete normal installation**\r\n\r\n**Alternative: Manual LUKS setup:**\r\n```bash\r\n# Example for advanced users (DESTRUCTIVE - backup first!)\r\ncryptsetup luksFormat /dev/sda2\r\ncryptsetup luksOpen /dev/sda2 ubuntu-encrypted\r\nmkfs.ext4 /dev/mapper/ubuntu-encrypted\r\n# Install Ubuntu to /dev/mapper/ubuntu-encrypted\r\n```\r\n\r\n### **Post-Installation Verification**\r\n\r\nThe script automatically checks disk encryption and will show:\r\n\r\n```\r\n[9] Disk Encryption Status:\r\n  Root filesystem: OK LUKS encrypted  \r\n  Swap: OK Encrypted\r\n```\r\n\r\n**If you see encryption warnings:**\r\n- CRITICAL **Stop immediately** - Your privacy is compromised\r\n- BACKUP **Back up .onion keys**: `sudo cp -r /var/lib/tor /backup/location`\r\n- RESTORE **Reinstall with encryption** following the guide above\r\n- **Restore .onion keys** using backup/restore feature\r\n\r\n### **What the Script Does for Disk Security**\r\n\r\n1. **Detects** LUKS/dm-crypt on root filesystem\r\n2. **Encrypts swap** with random keys (if unencrypted)\r\n3. **Removes** unencrypted swap files\r\n4. **Creates encrypted tmpfs** for /tmp, /var/tmp, /dev/shm\r\n5. **Secures** temporary file handling\r\n6. **Warns** about any unencrypted storage\r\n\r\n## Configuration\r\n\r\n### XMPP Features\r\n\r\n- **OMEMO Encryption** - Modern E2EE with forward secrecy\r\n- **Multi-User Chat** - Group messaging support\r\n- **File Transfers** - Secure file sharing via proxy65\r\n- **Message Archive Management** - Optional message history\r\n- **Command Line Administration** - Secure user and server management\r\n\r\n### Security Features\r\n\r\n- **Complete Network Isolation** - All services bind only to localhost (127.0.0.1)\r\n- **Tor-Only Networking** - APT configured to use Tor SOCKS proxy for updates\r\n- **Enhanced Anonymity** - Optional Tor bridge support for restrictive networks\r\n- **Outbound Connection Blocking** - UFW blocks all outbound except Tor network\r\n- **IPv6 Disabled** - Complete IPv6 stack disabled for reduced attack surface\r\n- **Kernel Hardening** - KASLR, ASLR, syscall restrictions, memory protections\r\n- **MAC Randomization** - Network interface MAC addresses randomized\r\n- **Automatic Monitoring** - 5-minute health checks with alerting\r\n- **Configuration Validation** - Built-in validation for all services\r\n- **Disk Security** - Full encryption detection, encrypted swap, secure tmpfs\r\n- **Secure Backups** - AES-256-GCM encrypted backups with integrity verification\r\n- **Emergency Wipe** - Secure data destruction for compromised systems\r\n- **Automatic Log Purging** - Hourly cleanup of any log files\r\n- **SSH Hardening** - Key-only authentication, localhost binding, root disabled\r\n- **Service Isolation** - Each service uses separate .onion address\r\n- **DNS Hardening** - systemd-resolved configured for localhost only\r\n- **Endpoint Detection \u0026 Response** - OSSEC HIDS with custom Tor server rules\r\n- **Malicious Activity Alerts** - Real-time security notifications via XMPP\r\n- **File Integrity Monitoring** - Real-time monitoring of critical Tor files\r\n- **Rootkit Detection** - Advanced malware detection and system compromise alerts\r\n- **Service Leak Prevention** - Blocks 15+ Ubuntu services that bypass proxy settings\r\n- **Network Leak Detection** - Built-in testing for services that might contact internet directly\r\n- **Ubuntu Telemetry Blocking** - Disables Ubuntu Advantage, snap store, crash reporting, MOTD ads\r\n- **Automatic Time Synchronization** - Daily time sync via Tor to prevent clock drift issues\r\n- **Comprehensive Leak Testing** - 8-point verification system for zero-leak operation\r\n- **Time Drift Monitoring** - Real-time monitoring of clock accuracy (critical for Tor)\r\n\r\n## After Installation\r\n\r\nThe script provides connection details for all services:\r\n\r\n```\r\nSSH via Tor:  torsocks ssh -p 22 username@ssh123abc.onion\r\nWeb (Tor):    http://web456def.onion/\r\n\r\n==== XMPP Server Ready ====\r\nAdmin account created:\r\nJID: admin@xmpp789ghi.onion\r\nPassword: [automatically generated 22-character password]\r\n\r\nIMPORTANT: Credentials are stored at: /var/lib/torstack-setup/admin_credentials.txt\r\nTo view credentials later: sudo cat /var/lib/torstack-setup/admin_credentials.txt\r\n\r\nXMPP Connection (separate .onion):\r\n   Server: xmpp789ghi.onion\r\n   Port: 5222\r\n   OMEMO encryption: Supported\r\n   Use Tor proxy (SOCKS5: 127.0.0.1:9050)\r\n\r\nAdmin Interface:\r\n   Command Line: prosodyctl (recommended)\r\n   Telnet: telnet 127.0.0.1 5582 (from server console)\r\n   Note: Web admin disabled for security\r\n```\r\n\r\n## 👥 User Management\r\n\r\n### Retrieving All Information\r\n```bash\r\n# Quick access to everything (installed by setup script)\r\ninfo\r\n\r\n# Shows all onion addresses, admin credentials, and XMPP management commands\r\n```\r\n\r\n### Creating Users\r\n```bash\r\n# Add new user\r\nprosodyctl adduser username@xmpp789ghi.onion\r\n\r\n# Change user password\r\nprosodyctl passwd username@xmpp789ghi.onion\r\n\r\n# Delete user\r\nprosodyctl deluser username@xmpp789ghi.onion\r\n\r\n# List all users\r\nprosodyctl list users\r\n\r\n# Check server status\r\nprosodyctl status\r\n```\r\n\r\n### XMPP Client Setup\r\n\r\nConfigure any OMEMO-capable XMPP client:\r\n- **Server:** Your XMPP .onion address\r\n- **Port:** 5222\r\n- **Encryption:** OMEMO (recommended)\r\n- **Proxy:** SOCKS5 127.0.0.1:9050 (Tor)\r\n\r\n## Advanced Usage\r\n\r\n### Rerunning the Script\r\n```bash\r\n# Force reinstall all components\r\nsudo bash setup.sh --force\r\n\r\n# Redo specific step\r\nsudo bash setup.sh --redo prosody\r\n```\r\n\r\n### Available Steps\r\n- `prompts` - User input and validation\r\n- `packages` - System package installation\r\n- `early_ssh` - Initial SSH setup with connection prompt\r\n- `sshd` - Final SSH hardening\r\n- `tor` - Tor and hidden services configuration\r\n- `nginx` - Web server and demo page\r\n- `prosody` - XMPP server installation\r\n- `prosody_config` - Basic XMPP configuration\r\n- `prosody_onion` - .onion domain and SSL setup\r\n- `help_script` - Install info script with credentials and admin commands\r\n- `system_hardening` - Complete Tor-only system isolation and hardening\r\n- `ufw` - Firewall configuration\r\n- `nologs` - Zero logging setup\r\n- `unattended` - Automatic updates\r\n- `cleanup` - Remove unnecessary services\r\n\r\n### Quick Access\r\n```bash\r\n# Show all credentials and XMPP admin commands\r\ninfo\r\n\r\n# Or use full path\r\n/usr/local/bin/info.sh\r\n```\r\n\r\n### Server Administration\r\n```bash\r\n# User management\r\nprosodyctl adduser newuser@your-xmpp-onion.onion\r\nprosodyctl passwd user@your-xmpp-onion.onion\r\nprosodyctl deluser user@your-xmpp-onion.onion\r\n\r\n# Server management\r\nprosodyctl status\r\nprosodyctl start/stop/restart\r\nprosodyctl reload\r\n\r\n# Interactive admin console (from server)\r\ntelnet 127.0.0.1 5582\r\n```\r\n\r\n### Logs and Debugging\r\n```bash\r\n# Setup log (only log that exists)\r\ntail -f /var/lib/torstack-setup/setup.log\r\n\r\n# Check service status\r\nsystemctl status tor prosody nginx ssh\r\n\r\n# View .onion addresses\r\ncat /var/lib/tor/*/hostname\r\n```\r\n\r\n## Security Considerations\r\n\r\n### What This Script Does for Privacy\r\n- YES **No external connectivity** - Services only accessible via Tor\r\n- YES **Zero logging** - No traces left on the system\r\n- YES **Service isolation** - Each service on separate .onion\r\n- YES **Strong encryption** - OMEMO for messages, TLS for transport\r\n- YES **Automatic updates** - Security patches applied automatically\r\n\r\n### What You Should Do\r\n- SSH **Secure your SSH keys** - Keep private keys safe\r\n- MOBILE **Use secure clients** - Choose OMEMO-capable XMPP apps\r\n- RESTORE **Regular backups** - Backup .onion private keys if needed\r\n- **User management** - Only create accounts for trusted users\r\n- MONITOR **Monitor usage** - Use prosodyctl to check server status and logs\r\n\r\n## Disclaimer\r\n\r\nThis software is provided for educational and privacy purposes. Users are responsible for:\r\n- Complying with local laws and regulations\r\n- Securing their systems and maintaining operational security\r\n- Understanding the risks of running Tor hidden services\r\n- Keeping software updated and monitoring for security issues\r\n\r\nThe authors are not responsible for misuse or legal consequences.\r\n\r\n## Contributing\r\n\r\nContributions are welcome! Please:\r\n1. Fork the repository\r\n2. Create a feature branch\r\n3. Test your changes thoroughly\r\n4. Submit a pull request\r\n\r\n## License\r\n\r\nThis project is licensed under the MIT License - see the LICENSE file for details.\r\n\r\n## Management \u0026 Monitoring\r\n\r\n### **Built-in Tools**\r\n```bash\r\n# Test all connectivity (includes XMPP port testing)\r\nsudo bash setup.sh --test-connectivity\r\n\r\n# Validate all configuration files\r\nsudo bash setup.sh --verify-config\r\n\r\n# Emergency secure data wipe (DESTRUCTIVE)\r\nsudo bash setup.sh --wipe-data\r\n\r\n# View system information and credentials\r\ninfo\r\n\r\n# Check system health manually\r\ntor-monitor.sh\r\n\r\n# View system alerts\r\ncat /var/lib/torstack-setup/alerts.txt\r\n\r\n# Check monitoring status\r\nsystemctl status tor-monitor.timer\r\n```\r\n\r\n### **Backup \u0026 Recovery**\r\nThe script automatically creates encrypted backups of your .onion private keys:\r\n\r\n```bash\r\n# Backup location\r\n/var/lib/torstack-setup/onion-keys-backup.tar.gz.enc\r\n\r\n# View backup password\r\nsudo cat /var/lib/torstack-setup/backup-password.txt\r\n\r\n# Restore from backup (if system is rebuilt)\r\nsudo bash setup.sh --restore-backup \u003cpassword\u003e\r\n```\r\n\r\n**WARNING CRITICAL:** Save the backup password in a secure location. Without it, you cannot restore your .onion addresses.\r\n\r\n### **Troubleshooting**\r\n\r\n**SSH Access Issues:**\r\n```bash\r\n# Re-setup SSH keys\r\nsudo bash setup.sh --redo early_ssh\r\n\r\n# Check SSH status\r\nsystemctl status ssh\r\n```\r\n\r\n**Tor Connectivity Problems:**\r\n```bash\r\n# Restart Tor service\r\nsystemctl restart tor\r\n\r\n# Check Tor status\r\nsystemctl status tor\r\n\r\n# Test connectivity\r\ncurl --socks5-hostname 127.0.0.1:9050 http://check.torproject.org\r\n```\r\n\r\n**Service Failures:**\r\n```bash\r\n# Check all services\r\nsudo bash setup.sh --test-connectivity\r\n\r\n# Restart specific service\r\nsystemctl restart [tor|ssh|nginx|prosody]\r\n\r\n# Re-run specific setup step\r\nsudo bash setup.sh --redo \u003cstep_name\u003e\r\n```\r\n\r\n**Nginx Custom Page Issues:**\r\n```bash\r\n# Diagnose why default nginx page is showing\r\nsudo bash setup.sh --diagnose-nginx\r\n\r\n# Fix nginx configuration\r\nsudo bash setup.sh --redo nginx\r\n\r\n# Manual fixes if needed\r\nsudo rm -f /etc/nginx/sites-enabled/default*\r\nsudo systemctl restart nginx\r\n```\r\n\r\n**Time Synchronization Issues:**\r\n```bash\r\n# Check if time drift is causing Tor failures\r\ntor-time-sync.sh\r\n\r\n# Manual time sync if automatic sync fails\r\nsudo date -s \"$(curl -s --socks5-hostname 127.0.0.1:9050 http://worldtimeapi.org/api/timezone/UTC | grep -o '\"datetime\":\"[^\"]*' | cut -d'\"' -f4)\"\r\n\r\n# Restart Tor after time correction\r\nsudo systemctl restart tor\r\n\r\n# Check time sync cron jobs\r\ncat /etc/crontab | grep time-sync\r\n\r\n# Common time-related Tor errors to watch for:\r\nsudo journalctl -u tor | grep -i \"time\\|clock\\|consensus\"\r\n```\r\n\r\n**Network Leak Detection:**\r\n```bash\r\n# Test for services bypassing Tor\r\nsudo bash setup.sh --test-leaks\r\n\r\n# Shows comprehensive report of:\r\n# - Active external connections\r\n# - Services listening on external interfaces  \r\n# - Problematic systemd services\r\n# - DNS configuration issues\r\n# - APT proxy settings\r\n# - Snap packages (bypass proxy)\r\n# - Time sync services\r\n# - Ubuntu telemetry services\r\n```\r\n\r\n**Time Synchronization Management:**\r\n```bash\r\n# Check current time drift\r\ntor-time-sync.sh\r\n\r\n# Force time synchronization via Tor\r\ntor-time-sync.sh --force\r\n\r\n# View time sync logs\r\ntail -f /var/log/tor-time-sync.log\r\n\r\n# Time sync runs automatically:\r\n# - Daily at 3 AM (checks drift, syncs if needed)\r\n# - Weekly at 4 AM Sunday (forced sync)\r\n```\r\n\r\n## Endpoint Detection \u0026 Response (EDR)\r\n\r\nThe script automatically installs and configures OSSEC HIDS for advanced threat detection:\r\n\r\n### **Automatic Detection**\r\n- **File Integrity Monitoring** - Real-time monitoring of Tor keys, configuration files, and system directories\r\n- **Rootkit Detection** - Scans for malware, trojans, and system compromises  \r\n- **Process Monitoring** - Detects suspicious processes and unauthorized access attempts\r\n- **Custom Rules** - Tor server-specific detection rules for privacy threats\r\n\r\n### **XMPP Security Alerts**\r\nGet real-time security notifications via XMPP for critical events:\r\n\r\n```bash\r\n# Configure XMPP alerts\r\nsudo nano /var/lib/torstack-setup/xmpp-alerts.conf\r\n\r\n# Example configuration:\r\nenabled=true\r\nserver=your-xmpp-onion.onion\r\nusername=alerts@your-xmpp-onion.onion  \r\npassword=your-alert-bot-password\r\nrecipient=admin@your-xmpp-onion.onion\r\nuse_tor=true\r\n```\r\n\r\n**Enable alerts after configuration:**\r\n```bash\r\n# Restart alert service\r\nsudo systemctl restart ossec-xmpp-alerts.timer\r\n\r\n# Test alert system\r\nsudo /usr/local/bin/ossec-xmpp-alert.py\r\n\r\n# Check alert status\r\nsystemctl status ossec-xmpp-alerts.timer\r\n```\r\n\r\n### **Threat Detection Rules**\r\nThe EDR system includes custom rules for:\r\n- CRITICAL **Critical**: Tor private key access attempts\r\n- CRITICAL **Critical**: Tor daemon termination  \r\n- CRITICAL **Critical**: SSH brute force attacks\r\n- WARNING **Warning**: Configuration file modifications\r\n- WARNING **Warning**: New user account creation\r\n- CRITICAL **Critical**: Services listening on external interfaces\r\n- CRITICAL **Critical**: Suspicious process execution\r\n\r\n### **EDR Management**\r\n```bash\r\n# Check EDR status\r\nsudo /var/ossec/bin/ossec-control status\r\n\r\n# View security alerts\r\ncat /var/lib/torstack-setup/alerts.txt\r\n\r\n# Manual alert processing\r\nsudo /usr/local/bin/ossec-xmpp-alert.py\r\n\r\n# View OSSEC logs\r\nsudo tail -f /var/ossec/logs/alerts/alerts.log\r\n\r\n# Restart EDR services\r\nsudo systemctl restart ossec ossec-xmpp-alerts.timer\r\n```\r\n\r\n## Important Caveats \u0026 Limitations\r\n\r\n### **Time Synchronization**\r\n- **No NTP services** - All time sync services are disabled to prevent leaks\r\n- **Manual time management** - System relies on daily Tor-based time sync\r\n- **Clock drift impact** - Tor fails with \u003e5 minutes drift, becomes unreliable with \u003e1 minute\r\n- **Automatic solution** - Daily cron jobs sync time via Tor APIs\r\n\r\n### **System Updates**\r\n- **Manual updates only** - Automatic updates disabled for security\r\n- **APT via Tor** - All package updates go through Tor (slower but private)\r\n- **Regular maintenance required** - Run `apt update \u0026\u0026 apt upgrade` monthly\r\n\r\n### **Performance Considerations**  \r\n- **Tor latency** - All connections 3-10x slower than direct\r\n- **Limited bandwidth** - Tor network capacity constraints\r\n- **CPU overhead** - Tor encryption uses additional CPU resources\r\n\r\n### **Emergency Recovery**\r\n- **Physical access may be required** - If Tor fails, SSH becomes unreachable\r\n- **No remote monitoring** - External uptime services cannot be used\r\n- **Time-sensitive issues** - Clock drift can cause complete connectivity loss\r\n\r\n### **Zero-Leak Design**\r\n- **15+ services disabled** - Ubuntu telemetry, updates, error reporting blocked\r\n- **Tor-only networking** - Firewall blocks all direct internet access  \r\n- **No backup services** - System designed for ephemeral operation\r\n- **Verification tools** - Built-in leak detection tests all traffic paths\r\n\r\n## Command Reference\r\n\r\n### **Setup \u0026 Maintenance**\r\n```bash\r\nsudo bash setup.sh                      # Full installation\r\nsudo bash setup.sh --force              # Force reinstall all components\r\nsudo bash setup.sh --redo \u003cstep\u003e        # Reinstall specific step\r\nsudo bash setup.sh --help               # Show all options\r\n```\r\n\r\n### **Diagnostic \u0026 Testing**\r\n```bash\r\nsudo bash setup.sh --test-connectivity  # Test Tor and service connectivity\r\nsudo bash setup.sh --test-leaks         # Comprehensive leak detection\r\nsudo bash setup.sh --diagnose-nginx     # Debug custom page issues\r\nsudo bash setup.sh --verify-config      # Validate configurations\r\n```\r\n\r\n### **System Information**\r\n```bash\r\ninfo                                     # Show all server info and credentials\r\ntor-monitor.sh                          # Manual health check\r\ntor-time-sync.sh                        # Check/sync time via Tor\r\ncat /var/lib/torstack-setup/alerts.txt  # View security alerts\r\n```\r\n\r\n### **XMPP Management**\r\n```bash\r\nprosodyctl adduser user@your-onion.onion # Add XMPP user\r\nprosodyctl passwd user@your-onion.onion  # Change user password\r\nprosodyctl deluser user@your-onion.onion # Delete user\r\nprosodyctl status                        # Check XMPP server status\r\n```\r\n\r\n### **Emergency Commands**\r\n```bash\r\nsudo bash setup.sh --wipe-data          # Secure data wipe (DESTRUCTIVE)\r\nsudo bash setup.sh --restore-backup     # Restore from encrypted backup\r\nsystemctl status tor ssh nginx prosody  # Check service status\r\n```\r\n\r\n## Support\r\n\r\n- **Issues:** Use GitHub Issues for bug reports\r\n- **Security:** Report security issues privately via email\r\n- **Documentation:** Check the wiki for additional guides\r\n- **Recovery:** Use built-in backup/restore system for .onion keys\r\n\r\n---\r\n\r\n**WARNING Remember:** This creates a Tor-only server. All access requires Tor Browser or proper SOCKS5 proxy configuration.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcatsec%2Ftor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcatsec%2Ftor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcatsec%2Ftor/lists"}