I want to setup TOR Onion hidden service with non-static pages. What should I use: Php or CGI? What is more safely? I don't want to reveal IP of machine - I live in China and I afraid goverment. I use linux, thttpd as webserver (thttpd, because someone told me, that Apache generate many IP informations in for example 404 sites).
3 Answers
Edit: Holy crap! I stand corrected. Tor's hidden services is awesome :)
Tor isn't going to help you much. I would recommend a host that's outside of the country (of which there are many free hosts). But of course your site will get blocked very quickly (as my blogs all did). If you have content that you don't want the government to see I would recommend using pseudonyms like the Baidu 10 mythological creatures.
Tor only protects your ability to surf the web without being seen. You cannot provide content to others this way though, it doesn't make sense. If nobody can find you because you're hidden you can't provide content to them.
There are also a number of web servers and bulletin boards that are anonymous in China and haven't been blocked but I don't know (I don't speak enough Chinese).
Good luck!
-
3"You cannot provide content to others this way though, it doesn't make sense." I believe you are wrong: torproject.org/docs/tor-hidden-service.html.en Dec 5, 2009 at 21:44
Any web site script is suitable if it is audited for privacy and properly configured. It requires skill to audit a web site script, so the best choice is something you can fully understand. CGI is simply a way for the server to talk to a program via STDIN and STDOUT, just like on a terminal. Thus, you can use any language in which you have proficiency, or any program that can be made to understand the web server's output! (Caveat: batch files and shell scripts are still a bad choice, because they are hard to secure.)
However, if the system on which the web server is on has direct access to the internet, accidental or malicious misconfiguration could reveal your ip address. This is the greater danger. The best idea is to run the web server in a virtual machine with an internal-facing network interface. With this, the server can not reveal your ip address because it does not know your ip address. Further, if malicious or poorly-configured code is accidentally run on that machine, any changes can be rolled back to the initial clean state.
In summary, the safest situation is to use a web server in a virtual machine with trusted code, and an eye on changes to the virtual system to detect intrusions. Safe enough would be untrusted code in a virtual machine, if you take care to properly configure the virtualizer (which is much easier than compitently auditing web site scripts for privacy!) so that it has no direct access to the internet or local disks.
consider running your server on openbsd... it comes with a specially secured version of apache and you can configure the system so it won't know its outside ip address (/etc/mygate)... openbsd is THE secure system which is recommended if you're concerned about keeping intruders out of places they shouldn't be looking.
php can be run in CGI mode or as a module to apache. php is not on the same level as CGI as it is a language, not a method of interfacing with a server.