Hacker News new | past | comments | ask | show | jobs | submit login

does anyone have a configured aws image? seems like that would help - people could just deploy them to micro instances for free...

[i am about to try build this on an aws instance, but since i know very little about images i am sure others will be better/quicker than me]

[update: if anyone else is doing this, you are best picking a new base distro that is new enough to contain libevent 2]

OK, i think (i have never done this before) that the following image should be public - ami-a97eaec0

it contains a basic 64 bit amazon linux image, with the extra code generated according to lgeek below http://news.ycombinator.com/item?id=3579531

to run, deploy the image, connect as ec2-user in the normal way and then:

- modify ~/tor.sh to change the port on which obsproxy listens, if you want

- change the security group to allow ports 9100 and 2189 (or whatever you change 2189 to above) (you may need to restart the instance at this point to apply the security group).

- modify the bandwidth limit in /usr/local/etc/tor/torrc (ie sudo emacs -nw /usr/local/etc/tor/torrc) - currently it's 50 KB/s which i think comes out as around $10-20 a month if it's fully used.

- start with the tor.sh script.

- check tor.log and note your external IP address.

- check external access using something like "telnet xxx.xxx.xxx.xxx 2189" (which generates a screenful of binary on success).

- contact tor-assistants at torproject.org so they can give the bridge location out to someone that needs it.

please post here or email me if there are any issues (a confirmation that you can access the ami would be cool too :o). also, are AWS external IP addresses permanent (if not, may need to use elastic IP + DNS)?

It looks like you left your public key in authorized_keys. I guess it was an honest mistake, but at the very least anyone using this AMI should remove it.

Now, please don't be offended, but this is one of the reasons I prefer instructions or more generally an easy way to replicate a result - which is easier to verify - rather than the built software/AMI/whatever. It's trivial to offer a compromised system and nearly impossible to verify that a system is secure.

On the other hand, tor and obfsproxy work for me using your AMI.

Security groups are applied as soon as you save your changes, no restart is required.

I've never seen an external IP address for an EC2 box change, I don't believe they do. They are typically part of the hostname and it would be strange to have amazon change this at random points in time. Elastic IP is good if you want to change a server a domain points to without having to wait for DNS propagation.

I just confirmed that I can access your AMI in the US East region. Be aware, however, that AMIs are region specific and thus your AMI cannot be found or used in any other region (such as US West).

thanks to the comments, i've created a new ami, ami-2b61b142, which should not have my keys. again, this is in US east.

i will delete the ami described in the post above, please use this one.

this will still have my contact details in the tor config /usr/local/etc/tor/torrc - you should change those too... (not a security issue, but if they email me about your install, there's not much i can do...)

Here's how to install everything on Amazon's AMI: https://gist.github.com/1802068

Note that obfsproxy seems to crash in managed mode, so run it stand-alone. Configure tor as a regular bridge (https://www.torproject.org/docs/bridges.html.en#RunningABrid...), and then start obfsproxy with ./obfsproxy obfs2 --dest= server

9001 is the bridge port configured in tor and 1051 is the port which will accepted obfuscated connections. I think that a random port is chosen in managed mode, so you might want to change it.

Although AWS is cool to allow lots of people, all the eggs are still in the AWS basket, which makes it easy to block. If lots of people were to run things on their own servers scattered all over the global, all over the IP space, then it's harder to block.

that's true. so perhaps you could start one up somewhere else? thanks!

Please, someone familiar with Tor and the special bridge mentioned here, make such an image available. I would deploy one ASAP.

You'll still need to pay for the bandwidth, right?

I've set it up in my home server (it's seems really easy, at least according to their instructions), but I only have 512kbps of upload, which will probably limit its usefulness.

Is this something that you can easily scale up and down? If so, shoot me an e-mail and I'll sponsor you to crank it up for the next month. (e-mail in my profile description)

i understand that there's 15GB/month of bandwidth included in a free micro instance (and i have used one as a personal ssh tunnel without paying anything). the images in the link i gave - https://cloud.torproject.org/ - look like they include some limited to the free amount.

for something like this, personally, i am also willing to spend some money [i am still working on aws trying to get an image working - last attempt failed through lack of scsi drivers afaict - will post here if successful].

And you can also configure Tor to only use a certain bandwidth quota per day/week/month.

Just FYI, what andrew said sounded like a plan to me, but AWS only gives 750 hours with the free tier. Might suffice for now, but not forever. So looks like I'll have to do this on an linux vm instead (at home).

What base image are you working from?

i was trying to get an opensuse 12.1 ami from suse studio running (as it has libevent 2). however, i am now following this http://news.ycombinator.com/item?id=3579531 and with the fixes i posted in the comments there, things appear to be ok (waiting for tor compile to finish).

I am pretty sure AWS (like most major hosts) does not allow the operation of TOR nodes. [this statement is wrong see below, my bad sorry]

absolutely not.

it is common - https://cloud.torproject.org/

tor is not mentioned on the aws site - http://aws.amazon.com/search?searchQuery=tor&searchPath=...

there is nothing related in the customer agreement - http://aws.amazon.com/agreement/ (no mention of tor, proxy, etc).

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact