How to host Onion Services securely?

Privacy Questions
1

Torproject has a great guide Tor Project | Set up Your Onion Service. (Step 6) and Tor Project | Advanced settings

But does anyone have a guide/tips that are more advanced other than the ones mentioned in Torproject guide?

2
3

https://blog.nihilism.network/servers/endgame/index.html

EndGameV3 Anti DDOS / Load Balancer / WAF service popularized by Dread

For protecting onion hidden services against DDoS attacks.

4

Not exactly the same, but I once wrote about how to configure a hidden service in alt-svc mode, in order to improve performance for a clearnet website that’s being accessed over Tor.

Improves performance because when you set it up on your website, Tor browsers can access your website via regular relays instead of having to use an exit node.

5

Onion Services in the Wild: A Study of Deanonymization Attacks

This paper diverges from the common focus on the technical vulnerabilities of the Tor protocol and instead explores the practical aspects of deanonymizing Onion Service users and operators. Despite Tor’s robust security mechanisms, human errors in its usage and operation frequently lead to deanonymization. This study models law enforcement agencies as powerful attackers and evaluates documents from 136 court cases to determine investigative methods. We find that investigators employ different methods depending on the offense, with user mistakes being the dominant angle. Technical attacks, though comparatively rare, are highly effective and can potentially impact a large number of users simultaneously. Attacks on the well-researched Tor protocol are exceptionally rare, but their impact is even more significant. We argue that the human aspect of using Tor is the most critical deanonymization angle and that tailored guidelines for ethical users can help protect them from oppressive retaliation while still enabling the prosecution of criminal activity.

1 Like
6

This guide is for how to connect to your VPS anonymously using Tor only, it was made for static sites, but you can also use it for dynamic sites.

https://sacredground.click/howto

EDIT; you shouldn’t also host other things on that VPS if you don’t want to link it to your identity.