🧅 FT_ONION - Tor Hidden Service Project

A fully functional Tor hidden service with Nginx web server, fortified SSH access, and interactive visualization - 42 Cybersecurity Piscine Final Project

📋 Table of Contents

• About
• What is Tor?
• Features
• Architecture
• Prerequisites
• Installation
• Usage
• Accessing Services
• Project Structure
• Security Features
• Bonuses Implemented
• Technical Details
• Troubleshooting
• Evaluation
• License

---

🎯 About

This project demonstrates the creation of a Tor hidden service (.onion website) with enhanced security features. It's a comprehensive implementation that goes beyond basic requirements, achieving a perfect score of 125/100 at 42 Beirut's Cybersecurity Piscine.

The project showcases:

• Deep understanding of Tor network architecture
• Secure server configuration practices
• Docker containerization and orchestration
• Interactive web development
• SSH hardening techniques

---

🌐 What is Tor?

Tor (The Onion Router) is a free, open-source software that enables anonymous communication over the internet. It works by routing traffic through a worldwide volunteer network of relays to conceal user location and usage from network surveillance or traffic analysis.

How Tor Works

Client → Entry Node → Middle Relay → Exit Node → Destination
   🔓         🔐           🔐            🔐         🌐

1. Entry Node: First layer of encryption
2. Middle Relay: Adds another layer, hides the connection
3. Exit Node: Final decryption before reaching destination

Hidden Services (.onion)

Hidden services are websites hosted on the Tor network that:

• Are only accessible through Tor Browser
• Hide the server's IP address and location
• Provide end-to-end encryption
• Use .onion addresses (e.g., xxxxxxxxxxxxxxxxx.onion)

---

✨ Features

Core Requirements ✅

• ✅ Static Web Page: Custom interactive HTML page
• ✅ Nginx Server: Configured to serve content on port 80
• ✅ SSH Access: Available on custom port 4242
• ✅ Tor Hidden Service: Accessible via .onion URL
• ✅ No Port Exposure: Services only accessible through Tor network
• ✅ Docker Containerization: Complete multi-container setup

Bonus Features ⭐

• ✅ SSH Fortification:

  • Public key authentication only
  • Disabled root login
  • No password authentication
  • Disabled X11 forwarding and TCP forwarding
  • Connection timeout controls

• ✅ Interactive Application:

  • Animated network visualization
  • Real-time packet routing simulation
  • Layer activation controls
  • Responsive design
  • Visual effects and animations

---

🏗️ Architecture

┌────────────────────────────────────────────────────┐
│                  Docker Network                    │
│                    (onionnet)                      │
│                                                    │
│  ┌──────────┐    ┌──────────┐      ┌──────────┐    │
│  │  Nginx   │    │   SSH    │      │   Tor    │    │
│  │  :80     │◄───│  :4242   │      │  Proxy   │    │
│  │          │    │          │      │          │    │
│  └──────────┘    └──────────┘      └────┬─────┘    │
│       │                                 │          │
└───────┼─────────────────────────────────┼──────────┘
        │                                 │
        └────────────────┬────────────────┘
                         │
                    Tor Network
                         │
                  .onion Address
                         │
                    Tor Browser

Container Communication

1. Nginx Container (ft_nginx):

   • Serves static content
   • Listens on port 80 (internal)
   • Isolated in onionnet bridge network

2. SSH Container (ft_ssh):

   • Hardened SSH server
   • Listens on port 4242 (internal)
   • Alpine-based with minimal footprint

3. Tor Container (ft_tor):

   • Tor daemon
   • Routes traffic to Nginx
   • Manages .onion address
   • Persistent volume for hidden service keys

---

🔧 Prerequisites

• Docker (v20.10+)
• Docker Compose (v2.0+)
• Tor Browser (for accessing .onion site)
• Git (for cloning)

Installation Links

• Docker Desktop
• Tor Browser

---

📦 Installation

1. Clone the Repository

git clone https://github.com/yourusername/ft_onion.git
cd ft_onion

2. Build and Start Services

docker-compose up --build -d

3. Wait for Tor to Generate .onion Address

# Monitor logs
docker-compose logs -f tor

# Wait for "Bootstrapped 100%" message

4. Retrieve Your .onion Address

docker exec ft_tor cat /var/lib/tor/hidden_service/hostname

Example output:

a1b2c3d4e5f6g7h8.onion

---

🚀 Usage

Starting Services

# Start all services
docker-compose up -d

# Check status
docker-compose ps

# View logs
docker-compose logs -f

Stopping Services

# Stop all services
docker-compose down

# Stop and remove volumes (resets .onion address)
docker-compose down -v

Rebuilding After Changes

docker-compose up --build -d

---

🔐 Accessing Services

Web Interface (HTTP)

1. Install Tor Browser
2. Get your .onion address:

   docker exec ft_tor cat /var/lib/tor/hidden_service/hostname

3. Open Tor Browser and navigate to: http://your-address.onion

SSH Access

Initial Setup - Generate SSH Keys

# On your local machine
ssh-keygen -t ed25519 -f ~/.ssh/ft_onion_key -C "ft_onion"

Add Public Key to Container

# Copy your public key
cat ~/.ssh/ft_onion_key.pub

# Access the container
docker exec -it ft_ssh sh

# Add key to authorized_keys
mkdir -p /home/ftuser/.ssh
echo "your-public-key-here" >> /home/ftuser/.ssh/authorized_keys
chmod 700 /home/ftuser/.ssh
chmod 600 /home/ftuser/.ssh/authorized_keys
chown -R ftuser:ftuser /home/ftuser/.ssh
exit

Connect via SSH through Tor

# Using torify (if installed)
torify ssh -i ~/.ssh/ft_onion_key -p 4242 ftuser@your-address.onion

# Or configure SSH to use Tor SOCKS proxy
ssh -i ~/.ssh/ft_onion_key \
    -o ProxyCommand="nc -X 5 -x 127.0.0.1:9050 %h %p" \
    -p 4242 ftuser@your-address.onion

---

📁 Project Structure

ft_onion/
│
├── docker-compose.yml          # Orchestrates all containers
│
├── nginx/                      # Web server configuration
│   ├── index.html             # Interactive webpage
│   └── nginx.conf             # Nginx configuration
│
├── ssh/                        # SSH server setup
│   ├── Dockerfile             # Alpine + OpenSSH
│   └── sshd_config            # Hardened SSH configuration
│
├── tor/                        # Tor hidden service
│   ├── Dockerfile             # Alpine + Tor
│   └── torrc                  # Tor configuration
│
└── README.md                   # This file

---

🛡️ Security Features

SSH Hardening

Our sshd_config implements multiple security layers:

Feature	Setting	Security Benefit
Custom Port	4242	Reduces automated attacks
Root Login	PermitRootLogin no	Prevents root compromise
Password Auth	PasswordAuthentication no	Only key-based access
Public Key Auth	PubkeyAuthentication yes	Cryptographic authentication
X11 Forwarding	X11Forwarding no	Prevents GUI-based attacks
TCP Forwarding	AllowTcpForwarding no	Blocks tunnel creation
Connection Timeout	ClientAliveInterval 300	Terminates idle sessions

Tor Network Benefits

• Anonymity: Server location completely hidden
• Encryption: Multi-layer encryption by default
• No DNS Leaks: .onion addresses resolved internally
• Censorship Resistance: Bypass geographical restrictions

Docker Isolation

• Network Isolation: Custom bridge network onionnet
• No Port Exposure: Services not accessible from host
• Minimal Attack Surface: Alpine Linux base images
• Resource Constraints: Container resource limits

---

🌟 Bonuses Implemented

1. SSH Fortification ⭐

Complete SSH hardening following industry best practices:

• ✅ Public key authentication only
• ✅ Disabled password authentication
• ✅ Disabled root login
• ✅ Custom port (4242)
• ✅ Disabled X11 forwarding
• ✅ Disabled TCP forwarding
• ✅ Connection timeout controls
• ✅ Minimal privilege user (ftuser)

2. Interactive Web Application ⭐

Advanced frontend implementation featuring:

• ✅ Animated Network Visualization: Canvas-based particle system
• ✅ Real-time Packet Simulation: Visual data flow through layers
• ✅ Interactive Controls: Toggle encryption, network visibility
• ✅ Layer Selection: Click to activate individual Tor layers
• ✅ Responsive Design: Mobile and desktop compatible
• ✅ Modern UI: Gradient effects, animations, smooth transitions
• ✅ Educational Value: Demonstrates Tor routing principles

Technical Stack:

• Pure JavaScript (no frameworks)
• HTML5 Canvas for animations
• CSS3 animations and transitions
• Responsive grid layout

---

🔍 Technical Details

Docker Compose Configuration

services:
  nginx:    # Web server
  ssh:      # SSH access
  tor:      # Hidden service proxy

networks:
  onionnet: # Isolated bridge network

volumes:
  tor_data: # Persistent .onion keys

Nginx Configuration Highlights

• Single-page application served on port 80
• Optimized MIME type handling
• Sendfile enabled for performance
• Clean URL routing with fallback

Tor Configuration

HiddenServiceDir /var/lib/tor/hidden_service/
HiddenServicePort 80 ft_nginx:80

• Routes port 80 traffic to Nginx container
• Persists keys in Docker volume
• Logs to stdout for monitoring

SSH Configuration Philosophy

Following the principle of least privilege:

• Only necessary features enabled
• Strong authentication required
• Minimal user permissions
• Connection lifecycle management

---

🐛 Troubleshooting

Issue: Can't access .onion address

Solution:

# Check if Tor is fully bootstrapped
docker-compose logs tor | grep "Bootstrapped 100%"

# Verify .onion address exists
docker exec ft_tor cat /var/lib/tor/hidden_service/hostname

# Restart Tor service
docker-compose restart tor

Issue: SSH connection refused

Solution:

# Verify SSH is running
docker-compose ps ssh

# Check SSH logs
docker-compose logs ssh

# Ensure you're using the correct key
ssh -i ~/.ssh/ft_onion_key -vvv ftuser@address.onion -p 4242

Issue: Page not loading

Solution:

# Check Nginx status
docker-compose logs nginx

# Verify network connectivity
docker exec ft_tor ping ft_nginx

# Rebuild containers
docker-compose down && docker-compose up --build -d

Issue: .onion address changes on restart

Explanation: This happens when the tor_data volume is deleted.

Solution:

# Always use 'down' without -v to preserve volumes
docker-compose down

# Never use:
# docker-compose down -v  # This deletes volumes!

---

📊 Evaluation

Project Score: 125/100 🏆

Mandatory Part (100 points)

• ✅ Hidden Service Setup (25 pts)
• ✅ Nginx Configuration (25 pts)
• ✅ SSH Access (25 pts)
• ✅ Documentation (15 pts)
• ✅ Defense (10 pts)

Bonus Part (25 points)

• ✅ SSH Fortification (15 pts)
• ✅ Interactive Application (10 pts)

Evaluation Checklist

• Docker containers start without errors
• .onion address is accessible via Tor Browser
• Webpage loads and displays correctly
• Interactive features work (animations, buttons)
• SSH connection works on port 4242
• Password authentication is disabled
• Root login is disabled
• Project structure matches requirements
• All configuration files are present
• Student can explain Tor architecture

---

📚 Resources

Learning Materials

• Tor Project Official Docs
• Nginx Documentation
• OpenSSH Security Guide
• Docker Best Practices

Tools Used

• Docker: Container orchestration
• Alpine Linux: Minimal base image
• Nginx: High-performance web server
• Tor: Anonymous network protocol
• OpenSSH: Secure shell implementation

---

🤝 Contributing

This is an educational project for 42's Cybersecurity Piscine. While it's a completed assignment, suggestions for improvements are welcome!

Areas for Enhancement

• Add multi-page navigation
• Implement WebSocket for real-time features
• Add monitoring dashboard
• Create automated tests
• Add CI/CD pipeline
• Implement rate limiting

---

⚠️ Disclaimer

This project is created for educational purposes only as part of 42's Cybersecurity curriculum.

Important Notes:

• Do not use for illegal activities
• Tor hidden services should comply with local laws
• SSH security depends on proper key management
• Always use strong, unique keys for authentication
• Keep software updated for security patches

---

📄 License

This project is part of the 42 School curriculum and follows the school's guidelines.

---

👨‍💻 Author

Your Name - @yourusername

• 42 Intra: your_login
• School: 42 Beirut
• Project: ft_onion (Cybersecurity Piscine)
• Score: 125/100

---

🙏 Acknowledgments

• 42 Network for the challenging curriculum
• The Tor Project for privacy tools and documentation
• Docker Community for containerization resources
• Alpine Linux for minimal, secure base images
• 42 Beirut peers for discussions and peer-evaluation

---

🧅 Stay Anonymous, Stay Secure 🧅

Made with 🖤 at 42 Beirut