jeena/home-assistant.github.io
1
0
Fork 0
Code Issues Pull requests Projects Packages Wiki Activity Actions
home-assistant.github.io/docs/ecosystem/tor/index.html
Travis CI 1680ccf2f7 Site updated at 2017-05-13 18:19:51 UTC
2017-05-13 18:19:51 +00:00

383 lines
24 KiB
HTML
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

<!doctype html>
<!--[if lt IE 7]> <html class="no-js lt-ie9 lt-ie8 lt-ie7"> <![endif]-->
<!--[if IE 7]> <html class="no-js lt-ie9 lt-ie8"> <![endif]-->
<!--[if IE 8]> <html class="no-js lt-ie9"> <![endif]-->
<!--[if gt IE 8]><!--> <html> <!--<![endif]-->
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
<title>Tor Onion Service Configuration - Home Assistant</title>
<meta name="author" content="Home Assistant">
<meta name="description" content="Configure Tor to work with Home Assistant to provide secure remote access without opening your firewall">
<meta name="viewport" content="width=device-width">
<link rel="canonical" href="https://home-assistant.io/docs/ecosystem/tor/">
<meta property="fb:app_id" content="338291289691179">
<meta property="og:title" content="Tor Onion Service Configuration">
<meta property="og:site_name" content="Home Assistant">
<meta property="og:url" content="https://home-assistant.io/docs/ecosystem/tor/">
<meta property="og:type" content="article">
<meta property="og:description" content="Configure Tor to work with Home Assistant to provide secure remote access without opening your firewall">
<meta property="og:image" content="https://home-assistant.io/images/default-social.png">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:site" content="@home_assistant">
<meta name="twitter:title" content="Tor Onion Service Configuration">
<meta name="twitter:description" content="Configure Tor to work with Home Assistant to provide secure remote access without opening your firewall">
<meta name="twitter:image" content="https://home-assistant.io/images/default-social.png">
<link href="/stylesheets/screen.css" media="screen, projection" rel="stylesheet">
<link href="/atom.xml" rel="alternate" title="Home Assistant" type="application/atom+xml">
<link rel='shortcut icon' href='/images/favicon.ico' />
<link rel='icon' type='image/png' href='/images/favicon-192x192.png' sizes='192x192' />
</head>
<body >
<header>
<div class="grid-wrapper">
<div class="grid">
<div class="grid__item three-tenths lap-two-sixths palm-one-whole ha-title">
<a href="/" class="site-title">
<img width='40' src='/demo/favicon-192x192.png'>
<span>Home Assistant</span>
</a>
</div>
<div class="grid__item seven-tenths lap-four-sixths palm-one-whole">
<nav>
<input type="checkbox" id="toggle">
<label for="toggle" class="toggle" data-open="Main Menu" data-close="Close Menu"></label>
<ul class="menu pull-right">
<li><a href="/getting-started/">Getting started</a></li>
<li><a href="/components/">Components</a></li>
<li><a href="/docs/">Docs</a></li>
<li><a href="/cookbook/">Examples</a></li>
<li><a href="/developers/">Developers</a></li>
<li><a href="/blog/">Blog</a></li>
<li><a href="/help/">Need help?</a></li>
</ul>
</nav>
</div>
</div>
</div>
</header>
<div class="grid-wrapper">
<div class="grid grid-center">
<div class="grid__item two-thirds lap-one-whole palm-one-whole">
<article class="page">
<div class='edit-github'><a href='https://github.com/home-assistant/home-assistant.github.io/tree/current/source/_docs/ecosystem/tor.markdown'>Edit this page on GitHub</a></div>
<header>
<h1 class="title indent">
Tor Onion Service Configuration
</h1>
</header>
<hr class="divider">
<p>This is an example about how you can configure Tor to provide secure remote access to your Home Assistant instance as an Onion site, through <a href="https://www.torproject.org/docs/hidden-services.html.en">Tor’s Hidden Service</a> feature. With this enabled, you do not need to open your firewall ports or setup HTTPS to enable secure remote access.</p>
<p>This is useful if you want to have:</p>
<ul>
<li>Access your Home Assistant instance remotely without opening a firewall port or setting up a VPN</li>
<li>Don’t want to or know how to get an SSL/TLS certificate and HTTPS configuration setup</li>
<li>Want to block attackers from even being able to access/scan your port and server at all</li>
<li>Want to block anyone from knowing your home IP address and seeing your traffic to your Home Assistant</li>
</ul>
<h2><a class="title-link" name="background-and-contact" href="#background-and-contact"></a> Background and Contact</h2>
<p>This configuration is part of an effort to apply strong cryptography technologies (like Onion Routing and End-to-End Encryption) to technology we increasingly depend on in our day to day lives. Just like when WhatsApp enabled end-to-end encryption messaging for everyone, every home automation and IoT platform should do the same, because A) the technology is all there, freely licensed and open-source and B) up to this point, all the commercial manufacturers have been doing a horrific job with security.</p>
<p>You can learn more about how Tor can be used to secure home automation and IoT platforms through this short set of slides on the <a href="https://github.com/n8fr8/talks/blob/master/onion_things/Internet%20of%20Onion%20Things.pdf">Internet of Onion Things</a></p>
<h2><a class="title-link" name="hidden-services-and-onion-sites" href="#hidden-services-and-onion-sites"></a> Hidden Services and Onion Sites</h2>
<p>Tor allows clients and relays to offer hidden services. That is, you can offer a web server, SSH server, etc., without revealing your IP address to its users. In fact, because you don’t use any public address, you can run a hidden service from behind your firewall. Learn more about Hidden Services on the <a href="https://www.torproject.org/docs/tor-hidden-service.html.en">Tor Project website</a>.</p>
<p>Onion sites are websites that run on a Tor Hidden Service node. “dot onion” sites are an <a href="https://datatracker.ietf.org/doc/rfc7686/">IETF recognized special use domain name</a>.</p>
<h2><a class="title-link" name="setting-up-tor-on-your-home-assistant" href="#setting-up-tor-on-your-home-assistant"></a> Setting up Tor on your Home Assistant</h2>
<p>First, install Tor. On a Debian-based system, you can install the package easily:</p>
<div class="language-bash highlighter-rouge"><pre class="highlight"><code><span class="gp">$ </span>sudo apt-get install tor
</code></pre>
</div>
<p>You can find more instructions for downloading and installing Tor on other platforms on the <a href="https://www.torproject.org/download/download.html">Tor Project Download Page</a>.</p>
<p>Next, modify Tor’s main configuration file <code class="highlighter-rouge">/etc/tor/torrc</code> to include the following lines:</p>
<div class="language-bash highlighter-rouge"><pre class="highlight"><code><span class="c">############### This section is just for location-hidden services ###</span>
<span class="c">## Once you have configured a hidden service, you can look at the</span>
<span class="c">## contents of the file ".../hidden_service/hostname" for the address</span>
<span class="c">## to tell people.</span>
...
HiddenServiceDir /var/lib/tor/homeassistant/
HiddenServicePort 80 127.0.0.1:8123
HiddenServiceAuthorizeClient stealth haremote1
...
</code></pre>
</div>
<p>The “stealth” entry above ensures traffic to and from your Home Assistant instance over Tor, is hidden even from other nodes on the Tor network. The <code class="highlighter-rouge">haremote1</code> value is a generic client name entry that you can modify as you please.</p>
<p>Then, restart Tor:</p>
<div class="language-bash highlighter-rouge"><pre class="highlight"><code><span class="gp">$ </span>sudo /etc/init.d/tor restart
</code></pre>
</div>
<p>Then read the new generated authentication cookie from the Tor-generated hostname file:</p>
<div class="language-bash highlighter-rouge"><pre class="highlight"><code><span class="gp">$ </span>sudo more /var/lib/tor/homeassistant/hostname
</code></pre>
</div>
<p>The output of that command should look something like this, but with your own unique “dot onion” domain and authentication cookie:</p>
<div class="language-bash highlighter-rouge"><pre class="highlight"><code>abcdef1234567890.onion ABCDEF1122334455667789 <span class="c"># client: haremote1</span>
</code></pre>
</div>
<p>You are now done with the Home Assistant Tor server configuration. Make sure your Home Assistant instance is running, and now you can move to client configuration.</p>
<h2><a class="title-link" name="tor-client-access-setup" href="#tor-client-access-setup"></a> Tor Client Access Setup</h2>
<p>Using this setup, you can access your Home Assistant instance over Tor from your laptop or mobile device, using Tor Browser and other software.</p>
<p>Add the authentication cookie to your <code class="highlighter-rouge">torrc</code> client configuration on your laptop or mobile device. Using the sample values from above, it would look like this:</p>
<div class="language-bash highlighter-rouge"><pre class="highlight"><code>HidServAuth abcdef1234567890.onion ABCDEF1122334455667789
</code></pre>
</div>
<p>For Tor Browser on Windows, Mac or Linux, you can find the torrc file here: <code class="highlighter-rouge">&lt;tor browser install directory&gt;/Browser/TorBrowser/Data/Tor/torrc-defaults</code></p>
<p>Once you have added the entry, restart the browser, and then browse to the “dot onion” site address to connect to your Home Assistant instance.</p>
<p>For <a href="https://guardianproject.info/apps/orbot">Orbot: Tor on Android</a>, add it in <strong>Orbot</strong> -&gt; <strong>Menu</strong> -&gt; <strong>Settings</strong> to the “Torrc Custom Config” entry. Restart Orbot, and then use the <a href="https://guardianproject.info/apps/orfox/">Orfox browser app</a>, and browse to the “dot onion” site name to access your Home Assistant instance. You can also use Orbot’s VPN mode, to enable Tor access from any application on your device, such as Tasker or Owntracks.</p>
<p>On iOS, we have not fully tested this yet, but you should be able to add custom torrc entries on <a href="https://mike.tig.as/onionbrowser/">Onion Browser</a>, Red Onion or TOBY browsers, all available in the iTunes App Store.</p>
<h2><a class="title-link" name="some-more-advanced-ideas" href="#some-more-advanced-ideas"></a> Some More Advanced Ideas</h2>
<p>With this configuration, only you can access your Home Assistant instance Onion site through Tor, and no one else. You can share the authentication cookie with multiple devices and users, or you can generate a unique one for each - up to you! If you have multiple, say for an industrial, business or corporate configuration, this would provide an easy way to revoke access to a specific user or device.</p>
<p>If you always access your Home Assistant instance via Tor, you can easily run this on an isolated “IoT” network segment at your install site, keeping your internal home network traffic separate from any potentially compromised devices (like cheap “smart” lightbulbs with backdoors!).</p>
<p>You could also use Tor as a means to connect your Home Assistant instance to a remote device, sensor or other service that you do not want to or connect provide a direct, open IP connection to. Again, Tor provides authenticated and confidential routing (aka “privacy and encryption”) by default, without having to setup TLS/SSL or VPN. It is just important to secure IoT nodes within your network, as it is to secure remote access!</p>
<p>As mentioned, with Orbot on Android, you can enable a “full device” VPN mode, that allows any app you have to tunnel through Tor, even if it is not Tor or proxy aware. This means you should be able to enter your “dot onion” Onion site address into any app you want to access to your Home Assistant instance, and it should work.</p>
<p>This configuration was provided by @n8fr8 (<a href="https://github.com/n8fr8">github</a>, <a href="https://twitter.com/n8fr8">twitter</a>) of the <a href="https://guardianproject.info">Guardian Project</a> and <a href="https://torproject.org">Tor Project</a>. You can send questions, feedback and ideas to <a href="mailto:support@guardianproject.info">support@guardianproject.info</a>.</p>
</article>
</div>
<aside id="sidebar" class="grid__item one-third lap-one-whole palm-one-whole">
<div class="grid">
<section class="aside-module grid__item one-whole lap-one-half">
<div class='section'>
<h1 class="title delta">Topics</h1>
<ul class='divided sidebar-menu'>
<li>
<a href='/docs/installation/'>Installation </a>
<ul>
<li><a href='/docs/installation/virtualenv/'>Python Virtual Env </a></li>
<li><a href='/docs/installation/raspberry-pi-all-in-one/'>Raspberry Pi All-in-One </a></li>
<li><a href='/docs/installation/updating/'>Updating </a></li>
<li><a href='/docs/installation/troubleshooting/'>Troubleshooting </a></li>
</ul>
</li>
<li>
<a href='/docs/hassbian/'>Hassbian </a>
<ul>
<li><a href='/docs/hassbian/installation/'>Installation </a></li>
<li><a href='/docs/hassbian/customization/'>Customization </a></li>
<li><a href='/docs/hassbian/common-tasks/'>Common tasks </a></li>
<li><a href='/docs/hassbian/integrations/'>Integrations </a></li>
<li><a href='/docs/hassbian/upgrading/'>Upgrading </a></li>
</ul>
</li>
<li>
<a href='/docs/configuration/'>Configuration </a>
<ul>
<li><a href='/docs/configuration/yaml/'>YAML </a></li>
<li><a href='/docs/configuration/basic/'>Basic information </a></li>
<li><a href='/docs/configuration/devices/'>Setting up devices </a></li>
<li><a href='/docs/configuration/customizing-devices/'>Customizing entities </a></li>
<li><a href='/docs/configuration/troubleshooting/'>Troubleshooting </a></li>
<li><a href='/docs/configuration/securing/'>Security Check Points </a></li>
</ul>
</li>
<li>
Advanced Configuration
<ul>
<li><a href='/docs/configuration/remote/'>Remote access </a></li>
<li><a href='/docs/configuration/packages/'>Packages </a></li>
<li><a href='/docs/configuration/splitting_configuration/'>Splitting up the configuration </a></li>
<li><a href='/docs/configuration/secrets/'>Storing Secrets </a></li>
<li><a href='/docs/configuration/templating/'>Templating </a></li>
<li><a href='/docs/configuration/group_visibility/'>Group Visibility </a></li>
<li><a href='/docs/configuration/platform_options/'>Entity component platform options </a></li>
</ul>
</li>
<li>
Core objects
<ul>
<li><a href='/docs/configuration/events/'>Events </a></li>
<li><a href='/docs/configuration/state_object/'>State Objects </a></li>
</ul>
</li>
<li>
<a href='/docs/automation/'>Automation </a>
<ul>
<li><a href='/docs/automation/examples/'>Examples </a></li>
<li><a href='/docs/automation/trigger/'>Triggers </a></li>
<li><a href='/docs/automation/condition/'>Conditions </a></li>
<li><a href='/docs/automation/action/'>Actions </a></li>
<li><a href='/docs/automation/templating/'>Templates </a></li>
</ul>
</li>
<li>
<a href='/docs/frontend/'>Frontend </a>
<ul>
<li><a href='/docs/frontend/mobile/'>Android/iOS Homescreen </a></li>
<li><a href='/docs/frontend/webserver/'>Web server fingerprint </a></li>
<li><a href='/docs/frontend/browsers/'>Browser Compatibility List </a></li>
</ul>
</li>
<li>
<a href='/docs/backend/'>Backend </a>
<ul>
<li><a href='/docs/backend/database/'>Database </a></li>
<li><a href='/docs/backend/updater/'>Updater </a></li>
<li><a href='/developers/api/'>API </a></li>
</ul>
</li>
<li>
<a href='/docs/scripts/'>Scripts </a>
<ul>
<li><a href='/docs/scripts/service-calls/'>Service Calls </a></li>
<li><a href='/docs/scripts/conditions/'>Conditions </a></li>
</ul>
</li>
<li>
<a href='/docs/tools/'>Tools and Helpers </a>
<ul>
<li><a href='/docs/tools/dev-tools/'>Developer Tools </a></li>
<li><a href='/docs/tools/hass/'>hass </a></li>
<li><a href='/docs/tools/scripts/'>Scripts </a></li>
</ul>
</li>
<li>
<a href='/docs/z-wave/'>Z-Wave </a>
<ul>
<li><a href='/docs/z-wave/controllers/'>Controllers </a></li>
<li><a href='/docs/z-wave/settings/'>Modifying Settings </a></li>
<li><a href='/docs/z-wave/device-specific/'>Device Specific </a></li>
</ul>
</li>
<li>
<a href='/docs/mqtt/'>MQTT </a>
<ul>
<li><a href='/docs/mqtt/broker/'>Broker </a></li>
<li><a href='/docs/mqtt/certificate/'>Certificate </a></li>
<li><a href='/docs/mqtt/discovery/'>Discovery </a></li>
<li><a href='/docs/mqtt/service/'>Publish service </a></li>
<li><a href='/docs/mqtt/birth_will/'>Birth and last will messages </a></li>
<li><a href='/docs/mqtt/testing/'>Testing your setup </a></li>
<li><a href='/docs/mqtt/logging/'>Logging </a></li>
<li><a href='/docs/mqtt/processing_json/'>Processing JSON </a></li>
</ul>
</li>
<li>
<a href='/docs/ecosystem/ios/'>iOS </a>
<ul>
<li><a href='/docs/ecosystem/ios/notifications/basic/'>Basic notifications </a></li>
<ul>
<li><a href='/docs/ecosystem/ios/notifications/sounds/'>Sounds </a></li>
<li><a href='/docs/ecosystem/ios/notifications/architecture/'>Architecture </a></li>
<li><a href='/docs/ecosystem/ios/notifications/privacy_security_rate_limits/'>Privacy, rate limiting and security </a></li>
</ul>
<li>Advanced notifications</li>
<ul>
<li><a href='/docs/ecosystem/ios/notifications/attachments/'>Attachments </a></li>
<li><a href='/docs/ecosystem/ios/notifications/content_extensions/'>Dynamic content </a></li>
<li><a href='/docs/ecosystem/ios/notifications/actions/'>Actionable notifications </a></li>
<li><a href='/docs/ecosystem/ios/notifications/requesting_location_updates/'>Requesting location updates </a></li>
</ul>
<li><a href='/docs/ecosystem/ios/location/'>Location Tracking </a></li>
<li><a href='/docs/ecosystem/ios/integration/'>Integration with other apps </a></li>
</ul>
</li>
<li>
<a href='/docs/ecosystem/'>Ecosystem </a>
<ul>
<li>
<a href='/docs/autostart/'>Autostart </a>
<ul>
<li><a href='/docs/autostart/systemd/'>systemd (Linux) </a></li>
<li><a href='/docs/autostart/upstart/'>Upstart (Linux) </a></li>
<li><a href='/docs/autostart/init.d/'>init.d (Linux) </a></li>
<li><a href='/docs/autostart/macos/'>macOS </a></li>
<li><a href='/docs/autostart/synology/'>Synology NAS </a></li>
</ul>
</li>
<li>
<a href='/docs/ecosystem/appdaemon/'>AppDaemon </a>
<ul>
<li><a href='/docs/ecosystem/appdaemon/installation/'>Installation </a></li>
<li><a href='/docs/ecosystem/appdaemon/configuration/'>Configuration </a></li>
<li><a href='/docs/ecosystem/appdaemon/example_apps/'>Example Apps </a></li>
<li><a href='/docs/ecosystem/appdaemon/running/'>Running AppDaemon </a></li>
<li><a href='/docs/ecosystem/appdaemon/reboot/'>Starting AppDaemon at Reboot </a></li>
<li><a href='/docs/ecosystem/appdaemon/operation/'>Operation </a></li>
<li><a href='/docs/ecosystem/appdaemon/windows/'>AppDaemon on Windows </a></li>
<li><a href='/docs/ecosystem/appdaemon/updating/'>Updating AppDaemon </a></li>
<li><a href='/docs/ecosystem/appdaemon/tutorial/'>AppDaemon Tutorial </a></li>
<li><a href='/docs/ecosystem/appdaemon/api/'>AppDaemon API Reference </a></li>
</ul>
</li>
<li>
<a href='/docs/ecosystem/hadashboard/'>HADashboard </a>
<ul>
<li><a href='/docs/ecosystem/hadashboard/installation/'>Installation </a></li>
<li><a href='/docs/ecosystem/hadashboard/dash_config/'>Dashboard Configuration </a></li>
<li><a href='/docs/ecosystem/hadashboard/hapush/'>HAPush </a></li>
<li><a href='/docs/ecosystem/hadashboard/reboot/'>Reboot </a></li>
<li><a href='/docs/ecosystem/hadashboard/updating/'>Updating HADashboard </a></li>
</ul>
</li>
<li>
<a href='/docs/ecosystem/notebooks/'>Notebooks </a>
<ul>
<li><a href='/docs/ecosystem/notebooks/'>Introduction </a></li>
<li><a href='/docs/ecosystem/notebooks/installation/'>Installation </a></li>
<li><a href='/docs/ecosystem/notebooks/graph/'>Graph </a></li>
<li><a href='/docs/ecosystem/notebooks/api/'>Home Assistant API </a></li>
<li><a href='/docs/ecosystem/notebooks/database/'>Databsase </a></li>
<li><a href='/docs/ecosystem/notebooks/stats/'>Statistics </a></li>
</ul>
</li>
<li>
Remote access
<ul>
<li><a href='/docs/ecosystem/apache/'>Apache </a></li>
<li><a href='/docs/ecosystem/nginx/'>NGINX </a></li>
<li><a class='active' href='/docs/ecosystem/tor/'>Tor Onion Service </a></li>
</ul>
</li>
<li>
Certificates
<ul>
<li><a href='/docs/ecosystem/certificates/tls_self_signed_certificate/'>Self-signed certificate </a></li>
<li><a href='/docs/ecosystem/certificates/tls_domain_certificate/'>Certificate domain owners </a></li>
<li><a href='/docs/ecosystem/certificates/lets_encrypt/'>Let's Encrypt (detailed) </a></li>
</ul>
</li>
<li>
Backup
<ul>
<li><a href='/docs/ecosystem/backup/backup_github/'>Backup to GitHub </a></li>
<li><a href='/docs/ecosystem/backup/backup_dropbox/'>Backup to Dropbox </a></li>
<li><a href='/docs/ecosystem/backup/backup_usb/'>Backup to USB device </a></li>
</ul>
</li>
<li><a href='/docs/ecosystem/scenegen/'>scenegen </a></li>
<li><a href='/docs/ecosystem/synology/'>Synology </a></li>
<li><a href='/docs/ecosystem/hass-configurator/'>HASS Configurator </a></li>
</ul>
</ul>
</div>
</section>
</div>
</aside>
</div>
</div>
<footer>
<div class="grid-wrapper">
<div class="grid">
<div class="grid__item">
<div class="copyright">
<a rel="me" href='https://twitter.com/home_assistant'><i class="icon-twitter"></i></a>
<a rel="me" href='https://facebook.com/homeassistantio'><i class="icon-facebook"></i></a>
<a rel="me" href='https://plus.google.com/110560654828510104551'><i class="icon-google-plus"></i></a>
<a rel="me" href='https://github.com/home-assistant/home-assistant'><i class="icon-github"></i></a>
<div class="credit">
Contact us at <a href='mailto:hello@home-assistant.io'>hello@home-assistant.io</a> (no support!).<br>
Website powered by <a href='http://jekyllrb.com/'>Jekyll</a> and the <a href='https://github.com/coogie/oscailte'>Oscalite theme</a>.<br />
Hosted by <a href='https://pages.github.com/'>GitHub</a> and served by <a href='https://cloudflare.com'>CloudFlare</a>.
</div>
<a rel="license" href="http://creativecommons.org/licenses/by-nc-sa/4.0/"><img alt="Creative Commons License" style="border-width:0" src="https://i.creativecommons.org/l/by-nc-sa/4.0/88x31.png" /></a><br /><span xmlns:dct="http://purl.org/dc/terms/" property="dct:title">home-assistant.io</span> is licensed under a <a rel="license" href="http://creativecommons.org/licenses/by-nc-sa/4.0/">Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License</a>.
</div>
</div>
</div>
</div>
</footer>
<script>
var _gaq=[['_setAccount','UA-57927901-1'],['_trackPageview']];
(function(d,t){var g=d.createElement(t),s=d.getElementsByTagName(t)[0];
g.src=('https:'==location.protocol?'//ssl':'//www')+'.google-analytics.com/ga.js';
s.parentNode.insertBefore(g,s)}(document,'script'));
</script>
</body>
</html>
Reference in a new issue View git blame Copy permalink