diff --git a/opsec/anonymous_server_monitoring/index.html b/opsec/anonymous_server_monitoring/index.html index da16a9f..2da909e 100644 --- a/opsec/anonymous_server_monitoring/index.html +++ b/opsec/anonymous_server_monitoring/index.html @@ -200,6 +200,72 @@ First, let's have a look at the network topology we'll be building:
+ +

Setting up the Server

+ + First you want to set up your central monitoring server. For ease of use and better performance we are going to colocate the prometheus collector along with grafana. + +

Tor Configuration

+ The prometheus collector will only be accessed locally by grafana so it doesn't need to be accessible over tor. Grafana, on the other hand, does. +
+ + Let's start with our torrc:
+

+AutomapHostsSuffixes .onion,.exit
+DataDirectory /var/lib/tor
+SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+HiddenServiceDir /var/lib/tor/onion/grafana
+HiddenServicePort 80 127.0.0.1:2700
+
+ +And that's all you'll need! one hiddn service for grafana.
You'll find your hostname in /var/lib/tor/onion/grafana/hostname. + +

Prometheus server configuration

+clean and simple: we scrape our server every 10s for new data, configure a proxy URL so scraping happens over tor, using our socksport and configure ou scraping targets + +

+global:
+  scrape_interval: 10s
+scrape_configs:
+- job_name: nodes
+  proxy_url: socks5h://localhost:9050
+  static_configs:
+  - labels: {}
+    targets:
+    - [fill later with our client .onion address]:9002
+
+ +

Setting up the client

+On the client it's even easier. + +

Tor Configuration

+Since prometheus works on a pull model, you will need to expose your node exporter, no need for a socks proxy either. +
+ +

+AutomapHostsSuffixes .onion,.exit
+DataDirectory /var/lib/tor
+HiddenServiceDir /var/lib/tor/onion/prometheus
+HiddenServicePort 9002 127.0.0.1:9002
+
+ + Next, you need to install the prometheus-node-exporter. Depending on your distribution of choice it's very likely it's in your package manager under that name. +
+ + and here is how we will start it in our unit file :
+

+prometheus_node_exporter --collector.systemd --web.listen-address 127.0.0.1:9002 --collector.ethtool --collector.softirqs --collector.tcpstat --collector.wifi
+ 
+ +
+ Do note that the name of the executable might change based on your distribution. What it does: +
+ + +