With all the recent fuss about the NSA being able to decrypt pretty much anything they like, it's more important than ever to focus on ensuring you're running up to date server software. I also came across an article detailing exactly how out of the loop Tor exit node providers are. This I find concerning for far too many reasons to list, and hope here to provide some information on how to stay up to date. Version 2.4 of Tor is still in RC phase, but seems to be widely regarded on the mailing lists as stable enough for people to adopt officially.
The encryption techniques Tor 2.3 and previous used were RSA-1024/DH-1024 with AES-128. These are some of the most popular cryptographic techniques currently employed, and thus are considered to be some of the most likely to have been broken by the NSA's crypto team. The RC edition uses ECC (Elliptic Curve Cryptography), which is generally considered to be far better - although there are doubts from some experts.
By far one of the most common Linux base distributions are Debian, and its various derivatives. The Tor Project have taken this into account, and provide .deb packages for many of these. To ensure you're using version 2.4, you must currently use the development branch - at least until the official release date.
Here's a simple set of instructions for getting the latest edition of Tor installed on your server...
Step 1: Add apt repository
Add the following lines to /etc/apt/sources.list.d/tor, or i that folder doesn't exist, /etc/apt/sources.list
deb http://deb.torproject.org/torproject.org <distribution> main
deb http://deb.torproject.org/torproject.org experimental-<distribution> main</distribution></distribution>
Just replace
- sid - Debian Sid
- wheezy - Debian Wheezy
- squeeze - Debian Squeeze
- raring - Ubuntu Raring Ringtail (13.04)
- quantal - Ubuntu Quantal Quetzal (12.10)
- precise - Ubuntu Precise Pangolin (12.04 LTS)
- oneiric - Ubuntu Oneiric Ocelot (11.10)
- natty - Ubuntu Natty Narwhal (11.04)
- lucid - Ubuntu Lucid Lynx (10.04 LTS)
Step 2: Install GPG keys
You need to run the following commands in Ubuntu's terminal to get the Torproject GPG keys:
gpg --keyserver keys.gnupg.net --recv 886DDD89
gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
Step 3: Install
Simply run sudo apt-get update && apt-get install tor deb.torproject.org-keyring to install everything you need!
Addendum:
Do bear in mind, however, that this IS the development version - when Tor 2.4 is released in its final form, you may want to remove the experimental-
I have also built a package for Slackwares 13.37 and 12.2, for which you will need libevent. This version for 14.0 will compile fine on both versions I have provided packages for. You can find those packages here. (links to be updated when uploaded - sorry for the delay guys)
As always, questions, corrections and anything constructive are more than welcome. If you'd like me to build a tor package for your favourite (and free) distribution, please feel free to ask away - I'll do what I can.
n00b