diff --git a/graphs/.$monitoring.drawio.bkp b/graphs/.$monitoring.drawio.bkp new file mode 100644 index 0000000..b69124f --- /dev/null +++ b/graphs/.$monitoring.drawio.bkp @@ -0,0 +1,77 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/graphs/monitoring.drawio b/graphs/monitoring.drawio new file mode 100644 index 0000000..7008c55 --- /dev/null +++ b/graphs/monitoring.drawio @@ -0,0 +1,77 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/opsec/anonymous_server_monitoring/add_datasource.png b/opsec/anonymous_server_monitoring.old/add_datasource.png similarity index 100% rename from opsec/anonymous_server_monitoring/add_datasource.png rename to opsec/anonymous_server_monitoring.old/add_datasource.png diff --git a/opsec/anonymous_server_monitoring/architecture.dia b/opsec/anonymous_server_monitoring.old/architecture.dia similarity index 100% rename from opsec/anonymous_server_monitoring/architecture.dia rename to opsec/anonymous_server_monitoring.old/architecture.dia diff --git a/opsec/anonymous_server_monitoring/architecture.png b/opsec/anonymous_server_monitoring.old/architecture.png similarity index 100% rename from opsec/anonymous_server_monitoring/architecture.png rename to opsec/anonymous_server_monitoring.old/architecture.png diff --git a/opsec/anonymous_server_monitoring/datasource_config.png b/opsec/anonymous_server_monitoring.old/datasource_config.png similarity index 100% rename from opsec/anonymous_server_monitoring/datasource_config.png rename to opsec/anonymous_server_monitoring.old/datasource_config.png diff --git a/opsec/anonymous_server_monitoring/example_dashboard.png b/opsec/anonymous_server_monitoring.old/example_dashboard.png similarity index 100% rename from opsec/anonymous_server_monitoring/example_dashboard.png rename to opsec/anonymous_server_monitoring.old/example_dashboard.png diff --git a/opsec/anonymous_server_monitoring/glances.png b/opsec/anonymous_server_monitoring.old/glances.png similarity index 100% rename from opsec/anonymous_server_monitoring/glances.png rename to opsec/anonymous_server_monitoring.old/glances.png diff --git a/opsec/anonymous_server_monitoring/grafana_login.png b/opsec/anonymous_server_monitoring.old/grafana_login.png similarity index 100% rename from opsec/anonymous_server_monitoring/grafana_login.png rename to opsec/anonymous_server_monitoring.old/grafana_login.png diff --git a/opsec/anonymous_server_monitoring.old/index.html b/opsec/anonymous_server_monitoring.old/index.html new file mode 100644 index 0000000..7b69255 --- /dev/null +++ b/opsec/anonymous_server_monitoring.old/index.html @@ -0,0 +1,423 @@ + + + + + + + + + + + Anonymous Server Monitoring + + + + + + + + + + + + + + + + + + + +
+
+
+ + The Nihilism Opsec Blog +
+
+ +
+ +
+
+ + + +
+
+
+
+ Previous Page

Mulligan Security - 2025-02-07

+

+ +

Anonymous Server Monitoring

+ +

What is server monitoring?

+ + When deploying compute resources (bare-metal, VPSes or more abstract work units) you will have to manage a living system. This system will always have the following characteristics: +
    +
  • Limited ressources: the amounts of RAM and CPU cycles, network bandwidth as well as storage space are neither infinite nor free.
    • +
  • Evolving requirements: depending on how you use your services, how many concurrent users you have you might need more or less ressources than what you initially purchased
    • +
  • Nominal operating parameters: range of RAM and CPU use, temperatures and so on in which your service performs as expected
    • +
+ +

+ + The first item is fixed and only linked to your financial constraints. The other two are constantly evolving and thus must be monitored. + +

How do I do it?

+ How you monitor your systems can vary based on your technical requirements. It can be as simple as logging in once a week, check the output of some diagnostic command and calling it a day.
+ This will give you a snapshot but you will miss a lot of important information. + +

+ You can also set up a complicated system that reports current metrics, trends and gives you capacity planning alerts + based on the data obtained! + + You will have to find the middle-ground yourself, this article will propose one that you can tweak whichever way you need. + +

Risks of doing it improperly

+ + Accessing your server for monitoring purposes is, from a risk perspective, pretty much the same as doing any other administration task or interacting with the services hosted therein. If done improperly (say logging in over the clearweb from your home address) you've just given anyone looking an undeniable link between your overt identity and your clandestine activities. (which should never happen since you're supposed to segment your internet uses)

+ + + A fail-closed system is what you should strive for: opsec best practices should be the default and if there's a technical issue preventing you from following them (attack on tor, flaky network, client or server-side misconfiguration) the system should prevent access at all in order to keep you safe. +

What if I don't monitor my Servers ?

+ + If you don't properly monitor your infrastructure you will face the following consequences sooner or later: + +
    +
  • service instability: you won't notice when things start going awry
    • +
  • costs overrun: you will end up paying more than you need to in order to deliver the same service
    • +
  • undetected attacks: attacks that impact your services can go unnoticed when the cues (eg: high RAM consumption from a cryptojacking) are not picked up
    • +
  • And lastly, if you are going to run a sensitive service on a remote server, it will anyway be on borrowed time as we have explained previously, therefore you need to be able to easily detect whenever there is a downtime on one of the servers, while at the same time maintaining your anonymity.
    • +
+ + +

+
+
+
+
+ +
+
+
+
+

Risks

+ Whenever you connect to your server, such as for monitoring or other administrative tasks, if you do so without going through Tor, then the cloud provider knows that you are the one connecting to that server. Even when using SSH you will leave a trail of metadata all the way back to your access point. That might be enough to get your door busted down the line if you intend on hosting anything sensitive on that server. + +

+ In the following part of the post we will look into how to set up advanced monitoring tools so you don't have to keep an eye on a bunch of tmux sessions with glances/top open in order to know the behaviour of your systems over time. +

+ + This tutorial will assume that you have acquired servers anonymously via non-KYC cloud providers, and that you are only accessing them anonymously through tor + See this article if you have not already. +
+
+ ... +
+ ... +
+ Done? Let's proceed. +
+ +
+
+
+
+ + + +
+
+
+
+

+

Target Architecture

+ First, let's have a look at the network topology we'll be building: +
+ +
+
    +
  • Our whonix workstation will connect through tor to a central monitoring server in order to access the grafana dashboard containing our monitoring data.
    • +
  • Our monitoring server will itself connect through tor to the target monitored servers using prometheus
    • +
+ +

Setting up the central monitoring server

+ + First you want to set up your central monitoring server. For ease of use and better performance we are going to colocate the prometheus collector along with grafana. +
+ +

Required installation

+ + To get started we need the following software on the machine: +
+
    +
  • Tor: anonymize traffic
    • +
  • prometheus: aggregate metrics
    • +
  • prometheus-node-exporter: export local server metrics
    • +
  • docker: to run grafana
    • +
+ + + +

Tor Configuration

+ +

On the target server to be monitored

+run the following as root to create a hidden service for the prometheus collector + +

+apt update
+apt install prometheus-node-exporter tor
+systemctl stop tor #stop the tor service
+
+mkdir -p /var/lib/tor/onion/prometheus/authorized_clients #create the client auth keys folder to store our second layer of authentication
+chmod 400 -R /var/lib/tor/prometheus #set restrictive file permissions
+
+vi /etc/tor/torrc #edit the torrc file to add content
+
+cat /etc/tor/torrc
+AutomapHostsSuffixes .onion,.exit
+DataDirectory /var/lib/tor
+SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+HiddenServiceDir /var/lib/tor/onion/prometheus
+HiddenServicePort 9100 127.0.0.1:9100
+
+tor-client-auth-gen 
+private_key=descriptor:x25519:DBQW3GP5FCN2KQBDKTDKDAQUQWBEGBZ5TFYJE4KTJFBUOJPKYZBQ #paste this key to your local machine as your prometheus node will need it
+echo "descriptor:x25519:6HDNHLLKIFNU5Q6T75B6Q3GBYDO5ZF4SQUX7EYDEKWNLPQUWUBTA" > /var/lib/tor/onion/prometheus/0.auth
+
+chown debian-tor:debian-tor -R /var/lib/tor # make tor owner of this folder
+
+systemctl start tor #restart tor
+systemctl status tor #check that everything works
+
+cat /var/lib/tor/onion/prometheus/hostname
+[clientaddr].onion
+
+ +What's that tor-client-auth-gen you ask? In order to protect this critical service from attacks that could be done against the grafana servers or from stolen credentials we need more than just security by obscurity +(relying on the attacker not knowing our hidden service address). + +
+When a client tries to connect to an onion service they request a server descriptor from a tor directory server that gives them a path to a rendez-vous point where they will be able to talk to each other. The keys we just created will be used to encrypt this descriptor. Without the proper private key, even with the onion service address, an attacker won't be able to connect to it because they won't be able to find the rendez-vous point. +
+
+This is better than basic-auth for the following reasons: +
    +
  • More resistant to bruteforce attacks
    • +
  • Also protects against flaws in your application itself
    • +
  • Also protects you from fingerprinting attacks as no trafic can reach you without the required secret key
    • +
+
+
+ +

On the central monitoring server

+ + + The prometheus collector will only be accessed locally by grafana so it doesn't need to be accessible over tor. Grafana, on the other hand, does. +
+ + Let's start with tor's configuration, use the following commands as root: + +
+

+sudo systemctl stop tor #stop the tor service
+
+mkdir -p /var/lib/tor/auth_keys #create the client auth keys folder to store our second layer of authentication
+mkdir -p /var/lib/tor/onion/grafana #create the client auth keys folder to store our second layer of authentication
+chmod 400 -R /var/lib/tor/auth_keys #set restrictive file permissions
+
+#line below will allow your aggregator to connect to your monitored server. Without it no requests can even reach it
+echo "[prometheusclientaddr].onion:descriptor:x25519:DBQW3GP5FCN2KQBDKTDKDAQUQWBEGBZ5TFYJE4KTJFBUOJPKYZBQ" > /var/lib/tor/auth_keys/prometheus_server.auth_private
+
+chmod 400 -R /var/lib/tor/onion #set restrictive file permissions
+
+vi /etc/tor/torrc #edit the torrc file to add content
+
+cat /etc/tor/torrc
+AutomapHostsSuffixes .onion,.exit
+DataDirectory /var/lib/tor
+SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+HiddenServiceDir /var/lib/tor/onion/grafana
+HiddenServicePort 80 127.0.0.1:3000
+ClientOnionAuthDir /var/lib/tor/auth_keys
+
+tor-client-auth-gen 
+private_key=descriptor:x25519:YCPURSYN4FL4QKQSXFTGLYNBHOVVRCQYRZLFHMZFCUFU5R6DCRMQ
+public_key=descriptor:x25519:UUQW4LIO447WRQOSRSNDXEW5NZMSR3CYOP65ZIFWH6G2PUKWV5WQ
+
+echo "YCPURSYN4FL4QKQSXFTGLYNBHOVVRCQYRZLFHMZFCUFU5R6DCRMQ" > ~/mygrafana_auth_key
+echo "descriptor:x25519:UUQW4LIO447WRQOSRSNDXEW5NZMSR3CYOP65ZIFWH6G2PUKWV5WQ" > /var/lib/tor/onion/grafana/0.auth
+
+chown debian-tor:debian-tor -R /var/lib/tor # make tor owner of this folder
+
+systemctl start tor #restart tor
+systemctl status tor #check that everything works
+
+ +And that's all you'll need! one hidden service for grafana.
You'll find your hostname in /var/lib/tor/onion/grafana/hostname. + + +

Prometheus server configuration on the central monitoring server

+Clean and simple: we scrape our server every 10s for new data, configure a proxy URL so scraping happens over tor, using our socksport and configure ou scraping targets. +
+

+
+vi /etc/prometheus/prometheus.yml
+
+cat /etc/prometheus/prometheus.yml
+
+alerting:
+  alertmanagers: []
+global:
+  scrape_interval: 10s
+remote_read: []
+remote_write: []
+scrape_configs:
+- job_name: remote-nodes
+  proxy_url: socks5h://localhost:9050
+  static_configs:
+  - labels: {}
+    targets:
+    - [clientaddr].onion:9100
+- job_name: local-node
+  static_configs:
+  - labels: {}
+    targets:
+    - localhost:9100
+
+
+
+
+This configuration will make the central monitoring server behave in the following way: +
    +
  • Scrap itself directly to collect its own data (prometheus is only exposed on loopback for this)
    • +
  • Scrap the target monitored server through tor via the socks proxy
    • +
+ +

Grafana configuration on the central monitoring server

+ +Let's start grafana and make it available: as root, as tor is already configured we can then access it through our torbrowser +
+ +

+    docker run -d -p 127.0.0.1:3000:3000 --name=grafana grafana/grafana
+
+ + + +

+ +
+
+
+
+ +
+
+
+
+

+ +

Connecting to our grafana instance

+ On your monitoring server you can find your hostname at /var/lib/tor/grafana/hostname. Use it in the tor browser to reach your instance. You will be prompted for your private key, you can find it where you saved it earlier ~/mygrafana_auth_key, paste the part after + + + +
+ +

Configuring the data sources

+ Next we need to tell grafana to use prometheus as a data source:
+ + +
+
+ + Now, let's configure it (specifying localhost:9090 as the API port)
+
+ +
+
+
+ + And Voila! we have simple system monitoring over tor in a dashboard:
+ + + + +

+
+
+
+
+ + +
+
+
+
+ +

Conclusion

+ In this article we saw why and how you need to implement anonymous server monitoring for your infrastructure. If you are running hidden services with any form of sensitive data stored on them, having them under constant monitoring is a must because you need to detect downtimes quickly, without compromising your identity or the rest of your infrastructure. + + +
+
+
+
+ + + + +
+
+
+
+

Nihilism

+

+ Until there is Nothing left.

Legal Disclaimer

Creative Commons Zero: No Rights Reserved
+ +

+
+ +
+

My Links

+

+ + RSS Feed
SimpleX Chatrooms
+ +

+
+ +
+

About Mulligan Security

+

Donate XMR:
86NCojqYmjwim4NGZzaoLS2ozbLkMaQTnd3VVa9MdW1jVpQbseigSfiCqYGrM1c5rmZ173mrp8RmvPsvspG8jGr99yK3PSs


Contact: mulligansecurity@riseup.net
website
SimpleX

+ +
+ +
+ +
+
+ + + + + + + diff --git a/opsec/anonymous_server_monitoring/install.png b/opsec/anonymous_server_monitoring.old/install.png similarity index 100% rename from opsec/anonymous_server_monitoring/install.png rename to opsec/anonymous_server_monitoring.old/install.png diff --git a/opsec/anonymous_server_monitoring/top.png b/opsec/anonymous_server_monitoring.old/top.png similarity index 100% rename from opsec/anonymous_server_monitoring/top.png rename to opsec/anonymous_server_monitoring.old/top.png diff --git a/opsec/anonymous_server_monitoring/0.png b/opsec/anonymous_server_monitoring/0.png new file mode 100644 index 0000000..94010ec Binary files /dev/null and b/opsec/anonymous_server_monitoring/0.png differ diff --git a/opsec/anonymous_server_monitoring/1.png b/opsec/anonymous_server_monitoring/1.png new file mode 100644 index 0000000..5471907 Binary files /dev/null and b/opsec/anonymous_server_monitoring/1.png differ diff --git a/opsec/anonymous_server_monitoring/10.png b/opsec/anonymous_server_monitoring/10.png new file mode 100644 index 0000000..05f218e Binary files /dev/null and b/opsec/anonymous_server_monitoring/10.png differ diff --git a/opsec/anonymous_server_monitoring/11.png b/opsec/anonymous_server_monitoring/11.png new file mode 100644 index 0000000..4c72643 Binary files /dev/null and b/opsec/anonymous_server_monitoring/11.png differ diff --git a/opsec/anonymous_server_monitoring/2.png b/opsec/anonymous_server_monitoring/2.png new file mode 100644 index 0000000..1402f58 Binary files /dev/null and b/opsec/anonymous_server_monitoring/2.png differ diff --git a/opsec/anonymous_server_monitoring/20.png b/opsec/anonymous_server_monitoring/20.png new file mode 100644 index 0000000..f35614e Binary files /dev/null and b/opsec/anonymous_server_monitoring/20.png differ diff --git a/opsec/anonymous_server_monitoring/3.png b/opsec/anonymous_server_monitoring/3.png new file mode 100644 index 0000000..ce2949c Binary files /dev/null and b/opsec/anonymous_server_monitoring/3.png differ diff --git a/opsec/anonymous_server_monitoring/4.png b/opsec/anonymous_server_monitoring/4.png new file mode 100644 index 0000000..24dd844 Binary files /dev/null and b/opsec/anonymous_server_monitoring/4.png differ diff --git a/opsec/anonymous_server_monitoring/5.png b/opsec/anonymous_server_monitoring/5.png new file mode 100644 index 0000000..0bc5f77 Binary files /dev/null and b/opsec/anonymous_server_monitoring/5.png differ diff --git a/opsec/anonymous_server_monitoring/6.png b/opsec/anonymous_server_monitoring/6.png new file mode 100644 index 0000000..c493853 Binary files /dev/null and b/opsec/anonymous_server_monitoring/6.png differ diff --git a/opsec/anonymous_server_monitoring/7.png b/opsec/anonymous_server_monitoring/7.png new file mode 100644 index 0000000..87e1935 Binary files /dev/null and b/opsec/anonymous_server_monitoring/7.png differ diff --git a/opsec/anonymous_server_monitoring/8.png b/opsec/anonymous_server_monitoring/8.png new file mode 100644 index 0000000..cebfbd4 Binary files /dev/null and b/opsec/anonymous_server_monitoring/8.png differ diff --git a/opsec/anonymous_server_monitoring/9.png b/opsec/anonymous_server_monitoring/9.png new file mode 100644 index 0000000..490a172 Binary files /dev/null and b/opsec/anonymous_server_monitoring/9.png differ diff --git a/opsec/anonymous_server_monitoring/index.html b/opsec/anonymous_server_monitoring/index.html index 7b69255..3471750 100644 --- a/opsec/anonymous_server_monitoring/index.html +++ b/opsec/anonymous_server_monitoring/index.html @@ -4,11 +4,11 @@ - - + + - Anonymous Server Monitoring + Anonymous Monitoring (Grafana, Prometheus, Node-exporter) @@ -56,329 +56,366 @@ +
+
+
+
+ Previous Page

nihilist - 27 / 04 / 2025

+

Anonymous Monitoring (Grafana, Prometheus, Node-exporter)

+

In this tutorial we're going to cover how you can monitor the resource consumption of your remote servers while maintaining your anonymity, using Grafana, Prometheus, and node exporter.

+ + +

Sidenote: Help us improve this tutorial by letting us know if there's anything missing or incorrect on this git issue directly!

+ +
+
+
+
+ + +
+
+
+
+

What is the targeted setup?

+

In this setup, we have 3 servers. Server A is going to monitor Server B and C.

+ +

Server A is going to have the following 3 services:

+

+-Grafana: to display the data retrieved by prometheus
+-Prometheus: to retrieve the data served by the node-exporters
+-node-exporter: to serve the server resource usage data (ex: CPU consumption, RAM consumption, etc)
+	
+
+ +

Server B and C are going to have the node-exporter service on them, and thanks to it Server A's prometheus service is going to be able to monitor their resource consumption.

+

Now the added complexity that we have to navigate in this tutorial is that each server can only be reached by their own .onion hostnames. we cannot query them via their IPs directly because otherwise we'd reveal the origin and destination of the servers. Hence in this tutorial we're going to maintain the Serverside anonymity.

+
+
+
+
+ +
+
+
+
+

Server A setup (Grafana, Prometheus, Node-exporter)



+

First let's setup Server A:

+

+[ Wonderland ] [ /dev/pts/22 ] [/srv/]
+→ sudo apt install docker.io docker-compose -y
+
+[ Wonderland ] [ /dev/pts/22 ] [/srv/]
+→ mkdir /srv/grafana ; cd /srv/grafana
+
+[ Wonderland ] [ /dev/pts/22 ] [/srv/]
+→ vim docker-compose.yml
+
+ +

Then, we have the following docker-compose.yml:

+

+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ cat docker-compose.yml
+
+networks:
+  tor-monitoring:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 10.16.0.0/24
+          gateway: 10.16.0.1
+
+services:
+  grafana:
+    image: grafana/grafana-enterprise:latest
+    container_name: grafana
+    restart: unless-stopped
+    ports:
+     - '127.0.0.1:3222:3000'
+    volumes:
+      - grafana-data:/var/lib/grafana
+    environment:
+      GF_INSTALL_PLUGINS: "grafana-clock-panel,grafana-simple-json-datasource,grafana-worldmap-panel,grafana-piechart-panel"
+    networks:
+      tor-monitoring:
+        ipv4_address: 10.16.0.5
+
+  prometheus:
+    image: prom/prometheus:latest
+    volumes:
+      - ./prometheus/:/etc/prometheus/
+      - prometheus_data:/prometheus
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--storage.tsdb.path=/prometheus'
+      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
+      - '--web.console.templates=/usr/share/prometheus/consoles'
+    networks:
+      tor-monitoring:
+        ipv4_address: 10.16.0.4
+    restart: always
+
+  tor:
+    image: osminogin/tor-simple
+    container_name: tormonitoring
+    volumes:
+      - ./tor-data:/var/lib/tor
+      - ./tor-data/torrc:/etc/tor
+    networks:
+      tor-monitoring:
+        ipv4_address: 10.16.0.3
+
+volumes:
+    prometheus_data: {}
+    grafana-data: {}
+	
+
+ +

From there, you can already pull the containers and activate them:

+

+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ docker-compose pull ; docker-compose up -d
+
+
+

It's going to first pull the containers and then activate them, but we need to do some changes first to ensure that the tor container works as intended:

+

+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ docker-compose down
+	
+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ vim tor-data/torrc/torrc
+
+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ cat tor-data/torrc/torrc
+SOCKSPort 0.0.0.0:9050
+
+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ chown -R 100:65533 tor-data/
+
+
+

then we also configure prometheus to scrape the destination servers:

+

+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ vim prometheus/prometheus.yml
+
+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ cat prometheus/prometheus.yml
+global:
+  scrape_interval:     15s # By default, scrape targets every 15 seconds.
+  external_labels:
+    monitor: 'datura-monitor'
+
+scrape_configs:
+  - job_name: 'wonderland'
+    scrape_interval: 5s
+    proxy_url: socks5h://10.16.0.3:9050
+    static_configs:
+    - labels: {}
+      targets:
+      - serverAjezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion:9100
+      - serverBjezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion:9100
+      - serverCjezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion:9100
+    basic_auth:
+      username: 'admin'
+      password: 'P@SSW0RD'
+	
+
+

And then we can re-activate the containers:

+

+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ docker-compose up -d
+	
+
+

once done, we can configure the nginx reverse proxy to make sure that we can access our grafana instance:

+

+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ vim /etc/nginx/sites-available/monitoring
+
+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ cat /etc/nginx/sites-available/monitoring
+upstream monitoringend {
+        server 127.0.0.1:3222;
+        #server 10.8.0.2:3009;
+}
+
+
+server {
+        listen 4443;
+        listen [::]:4443;
+        server_name monitoring.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion;
+
+        location / {
+                                proxy_set_header Host $http_host;
+                proxy_pass http://monitoringend;
+                proxy_http_version 1.1;
+                proxy_set_header Upgrade $http_upgrade;
+                proxy_set_header Connection "Upgrade";
+                #client_max_body_size 1G;
+        }
+}
+
+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ ln -s /etc/nginx/sites-available/monitoring /etc/nginx/sites-enabled/
+
+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ nginx -t
+nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
+nginx: configuration file /etc/nginx/nginx.conf test is successful
+
+[ Wonderland ] [ /dev/pts/19 ] [/srv/grafana]
+→ systemctl restart nginx
+
+
+ + +
+
+
+
+ + +
- Previous Page

Mulligan Security - 2025-02-07

-

- -

Anonymous Server Monitoring

+

Configuring Grafana



+

Next, we can access our grafana instance to create the admin account and login:

+ +

Once logged in we make sure that our grafana instance uses our prometheus instance as a datasource:

+ + + +

here we mention the local IP of the prometheus container, being 10.16.0.4, with the service accessible on port 9090:

+ + +

Then, we import a dashboard to make sure that we can visualize the data we are monitoring, out of which i recommend the excellent "Node Exporter Full" dashboard (whose ID is 1860)

+ + + + + +

There, the dashboard is imported, but there's no data to be seen yet because we didn't configure the node-exporter daemons on the servers that we want to monitor.

-

What is server monitoring?

- - When deploying compute resources (bare-metal, VPSes or more abstract work units) you will have to manage a living system. This system will always have the following characteristics: -
    -
  • Limited ressources: the amounts of RAM and CPU cycles, network bandwidth as well as storage space are neither infinite nor free.
    • -
  • Evolving requirements: depending on how you use your services, how many concurrent users you have you might need more or less ressources than what you initially purchased
    • -
  • Nominal operating parameters: range of RAM and CPU use, temperatures and so on in which your service performs as expected
    • -
- -

- - The first item is fixed and only linked to your financial constraints. The other two are constantly evolving and thus must be monitored. - -

How do I do it?

- How you monitor your systems can vary based on your technical requirements. It can be as simple as logging in once a week, check the output of some diagnostic command and calling it a day.
- This will give you a snapshot but you will miss a lot of important information. - -

- You can also set up a complicated system that reports current metrics, trends and gives you capacity planning alerts - based on the data obtained! - - You will have to find the middle-ground yourself, this article will propose one that you can tweak whichever way you need. - -

Risks of doing it improperly

- - Accessing your server for monitoring purposes is, from a risk perspective, pretty much the same as doing any other administration task or interacting with the services hosted therein. If done improperly (say logging in over the clearweb from your home address) you've just given anyone looking an undeniable link between your overt identity and your clandestine activities. (which should never happen since you're supposed to segment your internet uses)

- - - A fail-closed system is what you should strive for: opsec best practices should be the default and if there's a technical issue preventing you from following them (attack on tor, flaky network, client or server-side misconfiguration) the system should prevent access at all in order to keep you safe. -

What if I don't monitor my Servers ?

- - If you don't properly monitor your infrastructure you will face the following consequences sooner or later: - -
    -
  • service instability: you won't notice when things start going awry
    • -
  • costs overrun: you will end up paying more than you need to in order to deliver the same service
    • -
  • undetected attacks: attacks that impact your services can go unnoticed when the cues (eg: high RAM consumption from a cryptojacking) are not picked up
    • -
  • And lastly, if you are going to run a sensitive service on a remote server, it will anyway be on borrowed time as we have explained previously, therefore you need to be able to easily detect whenever there is a downtime on one of the servers, while at the same time maintaining your anonymity.
    • -
- - -

-
+
- + + +
-

Risks

- Whenever you connect to your server, such as for monitoring or other administrative tasks, if you do so without going through Tor, then the cloud provider knows that you are the one connecting to that server. Even when using SSH you will leave a trail of metadata all the way back to your access point. That might be enough to get your door busted down the line if you intend on hosting anything sensitive on that server. - -

- In the following part of the post we will look into how to set up advanced monitoring tools so you don't have to keep an eye on a bunch of tmux sessions with glances/top open in order to know the behaviour of your systems over time. -

- - This tutorial will assume that you have acquired servers anonymously via non-KYC cloud providers, and that you are only accessing them anonymously through tor - See this article if you have not already. -
-
- ... -
- ... -
- Done? Let's proceed. -
- -
-
-
-
- - - -
-
-
-
-

-

Target Architecture

- First, let's have a look at the network topology we'll be building: -
- -
-
    -
  • Our whonix workstation will connect through tor to a central monitoring server in order to access the grafana dashboard containing our monitoring data.
    • -
  • Our monitoring server will itself connect through tor to the target monitored servers using prometheus
    • -
- -

Setting up the central monitoring server

- - First you want to set up your central monitoring server. For ease of use and better performance we are going to colocate the prometheus collector along with grafana. -
- -

Required installation

- - To get started we need the following software on the machine: -
-
    -
  • Tor: anonymize traffic
    • -
  • prometheus: aggregate metrics
    • -
  • prometheus-node-exporter: export local server metrics
    • -
  • docker: to run grafana
    • -
- - - -

Tor Configuration

- -

On the target server to be monitored

-run the following as root to create a hidden service for the prometheus collector - +

Configuring node-exporter on the remote servers



+

Next, we're going to configure node-exporter on the servers that we want to monitor:


-apt update
-apt install prometheus-node-exporter tor
-systemctl stop tor #stop the tor service
+[ Wonderland ] [ /dev/pts/19 ] [/srv/node-exporter]
+→ cat docker-compose.yml
+version: '3.7'
 
-mkdir -p /var/lib/tor/onion/prometheus/authorized_clients #create the client auth keys folder to store our second layer of authentication
-chmod 400 -R /var/lib/tor/prometheus #set restrictive file permissions
+services:
 
-vi /etc/tor/torrc #edit the torrc file to add content
+  node-exporter:
+    container_name: node-exporter
+    image: quay.io/prometheus/node-exporter:latest
+    #command:
+      #- '--path.rootfs=/host'
+    network_mode: host
+    pid: host
+    volumes:
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /:/rootfs:ro
+      - /:/host:ro,rslave
+      - ./web.yml:/etc/prometheus/web.yml
+    command:
+      - '--path.rootfs=/host'
+      - '--path.procfs=/host/proc'
+      - '--path.sysfs=/host/sys'
+      - --collector.filesystem.ignored-mount-points
+      - "^/(sys|proc|dev|host|etc|rootfs/var/lib/docker/containers|rootfs/var/lib/docker/overlay2|rootfs/run/docker/netns|rootfs/var/lib/docker/aufs)($$|/)"
+      - "--web.config.file=/etc/prometheus/web.yml"
+    restart: always
+    deploy:
+      mode: global
 
-cat /etc/tor/torrc
-AutomapHostsSuffixes .onion,.exit
-DataDirectory /var/lib/tor
-SOCKSPort 127.0.0.1:9050 IsolateDestAddr
-HiddenServiceDir /var/lib/tor/onion/prometheus
+
+

Now that docker-compose.yml is written, we need to write a small python script to hash the basicauth password:

+

+[ Wonderland ] [ /dev/pts/19 ] [/srv/node-exporter]
+→ vim gen-pass.py
+
+[ Wonderland ] [ /dev/pts/19 ] [/srv/node-exporter]
+→ cat gen-pass.py
+import getpass
+import bcrypt
+
+#sudo apt install python3-bcrypt
+
+password = getpass.getpass("password: ")
+hashed_password = bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt())
+print(hashed_password.decode())
+
+[ Wonderland ] [ /dev/pts/19 ] [/srv/node-exporter]
+→ sudo apt install python3-bcrypt -y
+
+[ Wonderland ] [ /dev/pts/19 ] [/srv/node-exporter]
+→ python3 gen-pass.py
+password: P@SSW0RD
+$2b$12$AZg14Yp.hvDLk/iaYk9.ReqXyfonW94cwqzzxewZDWzTdAQZFo3zy
+
+
+

now with the hashed password, we can write the web.yml config file that the node exporter will use:

+

+[ Wonderland ] [ /dev/pts/19 ] [/srv/node-exporter]
+→ vim web.yml
+
+[ Wonderland ] [ /dev/pts/19 ] [/srv/node-exporter]
+→ cat web.yml
+basic_auth_users:
+    admin: $2b$12$AZg14Yp.hvDLk/iaYk9.ReqXyfonW94cwqzzxewZDWzTdAQZFo3zy
+
+
+

And now finally we can pull the container image and activate it:

+

+[ Wonderland ] [ /dev/pts/19 ] [/srv/node-exporter]
+→ docker-compose pull ; docker-compose up -d
+
+
+

Then we also make sure that the node-exporter port 9100 is accessible via the onion domain, as otherwise we can't access it while maintaining the serverside anonymity:

+

+[ Wonderland ] [ /dev/pts/19 ] [/srv/node-exporter]
+→ cat /etc/tor/torrc | grep 9100
 HiddenServicePort 9100 127.0.0.1:9100
 
-tor-client-auth-gen 
-private_key=descriptor:x25519:DBQW3GP5FCN2KQBDKTDKDAQUQWBEGBZ5TFYJE4KTJFBUOJPKYZBQ #paste this key to your local machine as your prometheus node will need it
-echo "descriptor:x25519:6HDNHLLKIFNU5Q6T75B6Q3GBYDO5ZF4SQUX7EYDEKWNLPQUWUBTA" > /var/lib/tor/onion/prometheus/0.auth
+[ Wonderland ] [ /dev/pts/19 ] [/srv/node-exporter]
+→ systemctl restart tor@default
 
-chown debian-tor:debian-tor -R /var/lib/tor # make tor owner of this folder
-
-systemctl start tor #restart tor
-systemctl status tor #check that everything works
-
-cat /var/lib/tor/onion/prometheus/hostname
-[clientaddr].onion
-
- -What's that tor-client-auth-gen you ask? In order to protect this critical service from attacks that could be done against the grafana servers or from stolen credentials we need more than just security by obscurity -(relying on the attacker not knowing our hidden service address). - -
-When a client tries to connect to an onion service they request a server descriptor from a tor directory server that gives them a path to a rendez-vous point where they will be able to talk to each other. The keys we just created will be used to encrypt this descriptor. Without the proper private key, even with the onion service address, an attacker won't be able to connect to it because they won't be able to find the rendez-vous point. -
-
-This is better than basic-auth for the following reasons: -
    -
  • More resistant to bruteforce attacks
    • -
  • Also protects against flaws in your application itself
    • -
  • Also protects you from fingerprinting attacks as no trafic can reach you without the required secret key
    • -
-
-
- -

On the central monitoring server

- - - The prometheus collector will only be accessed locally by grafana so it doesn't need to be accessible over tor. Grafana, on the other hand, does. -
- - Let's start with tor's configuration, use the following commands as root: - -
-

-sudo systemctl stop tor #stop the tor service
-
-mkdir -p /var/lib/tor/auth_keys #create the client auth keys folder to store our second layer of authentication
-mkdir -p /var/lib/tor/onion/grafana #create the client auth keys folder to store our second layer of authentication
-chmod 400 -R /var/lib/tor/auth_keys #set restrictive file permissions
-
-#line below will allow your aggregator to connect to your monitored server. Without it no requests can even reach it
-echo "[prometheusclientaddr].onion:descriptor:x25519:DBQW3GP5FCN2KQBDKTDKDAQUQWBEGBZ5TFYJE4KTJFBUOJPKYZBQ" > /var/lib/tor/auth_keys/prometheus_server.auth_private
-
-chmod 400 -R /var/lib/tor/onion #set restrictive file permissions
-
-vi /etc/tor/torrc #edit the torrc file to add content
-
-cat /etc/tor/torrc
-AutomapHostsSuffixes .onion,.exit
-DataDirectory /var/lib/tor
-SOCKSPort 127.0.0.1:9050 IsolateDestAddr
-HiddenServiceDir /var/lib/tor/onion/grafana
-HiddenServicePort 80 127.0.0.1:3000
-ClientOnionAuthDir /var/lib/tor/auth_keys
-
-tor-client-auth-gen 
-private_key=descriptor:x25519:YCPURSYN4FL4QKQSXFTGLYNBHOVVRCQYRZLFHMZFCUFU5R6DCRMQ
-public_key=descriptor:x25519:UUQW4LIO447WRQOSRSNDXEW5NZMSR3CYOP65ZIFWH6G2PUKWV5WQ
-
-echo "YCPURSYN4FL4QKQSXFTGLYNBHOVVRCQYRZLFHMZFCUFU5R6DCRMQ" > ~/mygrafana_auth_key
-echo "descriptor:x25519:UUQW4LIO447WRQOSRSNDXEW5NZMSR3CYOP65ZIFWH6G2PUKWV5WQ" > /var/lib/tor/onion/grafana/0.auth
-
-chown debian-tor:debian-tor -R /var/lib/tor # make tor owner of this folder
-
-systemctl start tor #restart tor
-systemctl status tor #check that everything works
-
- -And that's all you'll need! one hidden service for grafana.
You'll find your hostname in /var/lib/tor/onion/grafana/hostname. - - -

Prometheus server configuration on the central monitoring server

-Clean and simple: we scrape our server every 10s for new data, configure a proxy URL so scraping happens over tor, using our socksport and configure ou scraping targets. -
-

-
-vi /etc/prometheus/prometheus.yml
-
-cat /etc/prometheus/prometheus.yml
-
-alerting:
-  alertmanagers: []
-global:
-  scrape_interval: 10s
-remote_read: []
-remote_write: []
-scrape_configs:
-- job_name: remote-nodes
-  proxy_url: socks5h://localhost:9050
-  static_configs:
-  - labels: {}
-    targets:
-    - [clientaddr].onion:9100
-- job_name: local-node
-  static_configs:
-  - labels: {}
-    targets:
-    - localhost:9100
-
-
-
-
-This configuration will make the central monitoring server behave in the following way: -
    -
  • Scrap itself directly to collect its own data (prometheus is only exposed on loopback for this)
    • -
  • Scrap the target monitored server through tor via the socks proxy
    • -
- -

Grafana configuration on the central monitoring server

- -Let's start grafana and make it available: as root, as tor is already configured we can then access it through our torbrowser -
- -

-    docker run -d -p 127.0.0.1:3000:3000 --name=grafana grafana/grafana
-
- - - -

- -
+ +

And now from there the server should be monitored as intended.

+
- + -
+ + +
-

+

Visualizing the result



+

Now that the remote server's node-exporter is reachable via it's onion domain, we can see that the resource usage started to appear in the dashboard that we setup earlier:

-

Connecting to our grafana instance

- On your monitoring server you can find your hostname at /var/lib/tor/grafana/hostname. Use it in the tor browser to reach your instance. You will be prompted for your private key, you can find it where you saved it earlier ~/mygrafana_auth_key, paste the part after - - - -
- -

Configuring the data sources

- Next we need to tell grafana to use prometheus as a data source:
- - -
-
- - Now, let's configure it (specifying localhost:9090 as the API port)
-
- -
-
-
- - And Voila! we have simple system monitoring over tor in a dashboard:
- - - - -

-
+ +

In this case, in the event of the remote server being seized, the adversary would only be able to see that it has been queried to from a tor exit node IP. This is to make sure that your anonymous infrastructure is able to sustain having each of it's individual servers being taken down, as long as they are not all taken down at once.

+

And that's it ! We can now monitor our own remote servers, while maintaining serverside anonymity at the same time.

+
-
- - -
-
-
-
- -

Conclusion

- In this article we saw why and how you need to implement anonymous server monitoring for your infrastructure. If you are running hidden services with any form of sensitive data stored on them, having them under constant monitoring is a must because you need to detect downtimes quickly, without compromising your identity or the rest of your infrastructure. - - -
-
-
-
+ @@ -404,9 +441,8 @@ Let's start grafana and make it available: as root, as tor is already configured
-

About Mulligan Security

-

Donate XMR:
86NCojqYmjwim4NGZzaoLS2ozbLkMaQTnd3VVa9MdW1jVpQbseigSfiCqYGrM1c5rmZ173mrp8RmvPsvspG8jGr99yK3PSs


Contact: mulligansecurity@riseup.net
website
SimpleX

- +

About nihilist

+

Donate XMR: 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8


diff --git a/opsec/logos/grafana.png b/opsec/logos/grafana.png new file mode 100644 index 0000000..30c0bb7 Binary files /dev/null and b/opsec/logos/grafana.png differ diff --git a/opsec/logos/node-exporter.png b/opsec/logos/node-exporter.png new file mode 100644 index 0000000..58d7c46 Binary files /dev/null and b/opsec/logos/node-exporter.png differ diff --git a/opsec/logos/prometheus.png b/opsec/logos/prometheus.png new file mode 100644 index 0000000..0c9e271 Binary files /dev/null and b/opsec/logos/prometheus.png differ diff --git a/rss/feed.xml b/rss/feed.xml index ec705be..b06a8f1 100644 --- a/rss/feed.xml +++ b/rss/feed.xml @@ -4,10 +4,18 @@ -Nihilism Network Blog -https://blog.nihilism.network -Nihilist`s Technical Blog - + +http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/ +Operational Security: Showing how Privacy, Anonymity and Deniability can be achieved online. + + + + Anonymous Monitoring (Grafana, Prometheus, Node-exporter) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/anonymous_server_monitoring/index.html + 2025042700 + In this tutorial we're going to cover how you can monitor the resource consumption of your remote servers while maintaining your anonymity, using Grafana, Prometheus, and node exporter. + + Self-Hosted LLM Hidden Service @@ -982,6 +990,7 @@ + diff --git a/rss/feed.xmlold b/rss/feed.xmlold new file mode 100644 index 0000000..3dd0955 --- /dev/null +++ b/rss/feed.xmlold @@ -0,0 +1,990 @@ + + + + + + +The Nihilism Opsec Blog +https://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion +Operational Security: Showing how Privacy, Anonymity and Deniability can be achieved online. + + + + Self-Hosted LLM Hidden Service + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/openwebuilocalllms/index.html + 2025042100 + In this tutorial we're going to look at how you can replace services like ChatGPT with your own local, self-hosted LLM, and make it available via Tor using a hidden service. + + + + + Where to hide your Monero Wealth ? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/monerowealth/index.html + 2025042001 + In this tutorial we're going to cover how and where you can safely store your monero wealth, even when an adversary seizes your harddrives. + + + + + Public Chats / Private Chats / Anonymous Chats / Deniable Chats + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/chats/index.html + 2025041600 + In this tutorial we're going to differentiate all 4 types of Chats, being the public, private, anonymous and deniable chats, and briefly showcase how simpleX fits all of our needs. + + + + + How to Verify One's Identity While Maintaining Anonymity Using PGP Canaries + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/pgpcanary/index.html + 2025041300 + In this tutorial we're covering how to verify someone's identity while maintaining their anonymity intact, thanks to PGP canaries + + + + + Sensitive Critical Data Backup Procedure + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/plausiblydeniabledataprotection/index.html + 2025040601 + In this tutorial we're going to cover how to backup the critical data that you would normally store inside of your Sensitive use VM, in order to make sure that your critical data (meaning your keepass .kdbx file, your SSH keys, your PGP keys, your Monero seed files) can still be accessed and reused, even if the adversary were to seize and destroy your devices in multiple takedowns. + + + + + Why is Metadata detrimental to Anonymity? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/anonymitymetadata/index.html + 2025040201 + In this tutorial we're going to cover why exactly is Metadata detrimental to one's anonymity + + + + + Sensitive use VMs Setup (Whonix VMs in a Veracrypt Hidden Volume) (April 2025 Update) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/sensitivevm/index.html + 2025040200 + In this tutorial we're going to cover how to setup Whonix VMs for Sensitive use. This means that our OPSEC requirement is that we need to be able to deny the existance of the Sensitive Whonix VM if the adversary ever gets access to our laptop. + + + + + The main source of Plausible Deniability: Deniable Encryption (April 2025 update) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/veracrypt/index.html + 2025040100 + In this tutorial we're going to cover how to use zulucrypt to create hidden veracrypt volumes to enable long-term sensitive use. + + + + + Using the Host-OS in live-mode to enable Sensitive Use + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/livemode/index.html + 2025040100 + In this tutorial we're going to cover how to use livemode and ram-wipe from inside kicksecure to enable sensitive use + + + + + Nextcloud .onion Setup (Anonymous File Hosting) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/nextcloud/index.html + 2025032701 + In this tutorial we're going to cover how you can install an .onion only Nextcloud instance, Nextcloud is a FOSS alternative to replace popular file hosting websites like google cloud or onedrive, which can be ideal to make sure that your files are backed up somewhere, all while preserving anonymity. I recommend self-hosting this service at home, that way you make sure that your personal data stays at your home, rather than making it readable by an adversary on a remote server. + + + + + How to become a Maintainer + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/maintainers/index.html + 2025032600 + In this tutorial we're going to cover how to become a maintainer for the Opsec blog, which is the next step for you if you are already a good content contributor for the blog. + + + + + Peer-to-Peer Large File Sharing (Torrents over I2P) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/i2ptorrents/index.html + 2025031700 + In this tutorial we're covering how to torrent files via i2p + + + + + Anonymous Server Monitoring + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/anonymous_server_monitoring/index.html + 2025031000 + In this tutorial, we're going to cover how you can monitor your servers remotely, but while maintaining anonymity the whole time. + + + + + OnionBalance for .onion domains load balancing + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/onionbalancelb/index.html + 2025022700 + In this tutorial we're going to cover how to setup high availability on the domain level for .onion websites, using onionbalance + + + + + How to setup a MySQL Master-Master replication over Tor + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/mysqlmastermaster/index.html + 2025022100 + In this tutorial we're going to cover how to have a master-master mysql replication going but while keeping Tor in between each server, to prevent an adversary from figuring out where each server is. + + + + + When the Adversary is the cloud provider himself + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/cloud_provider_adversary/index.html + 2025020600 + In this tutorial we're going to cover what are the 2 main strategies when it comes to hosting a sensitive service remotely + + + + + How to setup a basic NGINX / PHP / MySQL app + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/tornginxphpmysql/index.html + 2025020200 + in this tutorial we're going to cover how to setup a basic nginx php and mysql web app accessible over Tor, which we'll use later on to showcase high availability + + + + + How to join the Darknet Lantern Webring ? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/darknetlantern/index.html + 2025020100 + In this tutorial we're going to first explain why the Darknet Lantern is important in the current Darknet context, we'll cover what it is made of, and then we'll cover how to spin up a Darknet Lantern instance, how to maintain one's list of onion links, and lastly we'll cover how to join the Darknet Webring. + + + + + Monero Inheritence Management (VaultWarden Emergency Contacts) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/moneroinheritance/index.html + 2025012900 + In this tutorial we're going to cover how you can transfer your monero wealth to your successor safely without requiring a third-party. + + + + + How to explore the Darknet? (Visibility and Discoverability) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/darknetexploration/index.html + 2024012500 + In this tutorial we're going to take a look at what are the differences between the clearnet and the darknet, and how you can explore the darknet using the lantern project. + + + + + Why is High Availability Important for Deniability ? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/high_availability/index.html + 2024123000 + In this blogpost we're going to look into why High Availability is essential to maintain deniability for a particular hidden service. + + + + + How to navigate qubes OS and segment your internet uses + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/qubesosnetwork/index.html + 2024122000 + In this tutorial we will set up the environment for public, private and anonymous online identities, and how to use qubes os. + + + + + Stylography protection (Running a Local LLM and copy pasting messages) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/stylometry/index.html + 2024120400 + In this tutorial we're going to take a look at how you can run a LLM Locally to rewrite your messages to prevent sylometry fingerprinting (in order to make sure you're not being deanonymized from the way you're typing) + + + + + Why is the Darknet superior to Clearnet ? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/clearnetvsdarknet/index.html + 2024120200 + In this tutorial we're going to explain why you should host your services on the Darknet rather than the Clearnet. + + + + + Easy Private Chats - SimpleX + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion//opsec/privatesimplex/index.html + 2024120100 + In this article we'll compare a few options (Telegram, Signal and SimpleX) to see how their technical details stack up and determine which is best for easy private chats. + + + + + How to access Tor when you are in Russia or China using v2ray (vmess / vless) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/v2ray/index.html + 2024112700 + In this tutorial we're going to cover how you can access Tor while being in a heavily-censored country like russia or china, by using the censorship-circumvention tool called v2ray. + + + + + Gitea .onion Setup (Anonymous Code Repositories and Collaboration) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/gitea-anon/index.html + 2024112302 + In this tutorial we're going to take a look at how you can setup an anonymous gitea instance that is accessible over Tor, in order to be able to collaborate with people on projects, while maintaining everyone's anonymity. + + + + + One on One large file sharing (Syncthing over Tor) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/syncthinganon/index.html + 2024112300 + In this tutorial we're going to dive into how to transfer large files anonymously, using whonix and Syncthing + + + + + Mental Energy: How are you good at spending it ? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/mentalenergy/index.html + 2024111800 + In this tutorial we're going to explain the 3 ways you can spend your mental energy, just like money you can spend it gradually, spend it all in one go, or invest it to get a return over investment. + + + + + How to run the Blog Yourself + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/runtheblog/index.html + 2024111600 + In this tutorial we're going to see how you can host the nihilism blog yourself, since it has no copyright restrictions whatsoever. + + + + + How to Get a Credit Card Anonymously (Credit Cards as a Service) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/anoncreditcard/index.html + 2024110800 + In this tutorial we're going to look at how to get a credit card anonymously online + + + + + Sensitive use VMs Setup (Whonix VMs in a Veracrypt Hidden Volume) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/sensitivevm/index.html + 2024110701 + In this tutorial we're going to cover how to setup Whonix VMs for Sensitive use. This means that our OPSEC requirement is that we need to be able to deny the existance of the Sensitive Whonix VM if the adversary ever gets access to our laptop. + + + + + How to get and use residential proxies anonymously + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/anonproxy/index.html + 2024110700 + While Tor is a requirement to protect your anonymity online, some services refuse to be accessed anonymously, and are intentionally blocking connections coming from Tor exits nodes. A residential proxy will reroute your access through a residential ip address, which makes your connection look like it is coming from your ISP or your mobile carrier. + + + + + The main source of Plausible Deniability: Deniable Encryption + blog.nowhere.moe/opsec/veracrypt/index.html + 2024110501 + In this tutorial we're going to explain why deniable encryption is important for sensitive use, and why we need to have the host OS in live mode to be able to use it. + + + + + Using the Host-OS in live-mode to prepare for long-term Sensitive Use + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/livemode/index.html + 2024110400 + The main usecase of using your Host OS in live mode, is that you want to use it for long term sensitive activities (meaning, you want to save sensitive files on a harddrive). As you're going to see, using the Host OS in live mode is effectively a hard requirement for deniability. + + + + + Tails OS QEMU VM for Temporary Sensitive Use + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/tailsqemuvm/index.html + 2024110300 + In this tutorial we're going to see why Tails OS is suitable for Short Term Sensitive Use due to it's default live-mode feature, where upon shutting down the OS, every forensic trace of what you were doing is completely erased from memory, where the entire OS is loaded into. + + + + + + + One-on-One Large File Sharing (Syncthing over VPN) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/syncthingvpn/index.html + 2024110202 + In this tutorial we're going to showcase how you can send large files privately to someone else by using Syncthing. + + + + + How to Anonymously access websites that block Tor + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/whentorisblocked/index.html + 2024110200 + In this tutorial we're going to cover how we can circumvent a website's attempts at blocking Tor traffic, by using a VPN. As we discussed previously, this is relating to the serverside context required to know if we should combine the use of Tor with the use of a VPN. + + + + + Sensitive use VMs Setup (Whonix VMs in a Veracrypt Hidden Volume) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/sensitivevm/index.html + 2024110100 + In this tutorial we're going to cover how to setup Whonix VMs for Sensitive use. This means that our OPSEC requirement is that we need to be able to deny the existance of the Sensitive Whonix VM if the adversary ever gets access to our laptop. + + + + + Reflecting: Brainstorming Ideas while on the run + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/reflecting/index.html + 2024102702 + In this tutorial we're going to cover what to do when you get a simple or complex idea when you are not at home, and how you can quickly grab a hold of that idea before you forget about it + + + + + Productivity - Diet to favor cerebral activity + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/index.html + 2024102701 + In this tutorial we're going to cover what fuel you need to use for your body and brain to function at their best, what to avoid, and what food to prefer. we'll also go over on the frequency of meals you should have, and how to correctly assess what food is best for your body. + + + + + Reflecting: How to use graphs to help Brainstorming ideas (draw.io) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/graphs/index.html + 2024102604 + In this tutorial we're going to see why graphs are important, and how to make them using drawio. + + + + + Zero Email Workflow (in Thunderbird) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/zeroemail/index.html + 2024102602 + In this tutorial we're going to cover how you can organize your mailbox in such a way that only the important parts remain in your focus. We'll go over what labels to use, and how to set your priorities straight from both the inbox folder and the sent folder. + + + + + Pomodoro Focus times (Intentional pauses to prevent burnouts) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/pomodoro/index.html + 2024102601 + In this tutorial we're going to go over why you need to take breaks, how often, how long, and what you can do during those breaks. + + + + + Workspace Preparation: Mental Energy Optimisation + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/mentalopti/index.html + 2024102500 + In this tutorial we're going to cover how you can remove all blockers from your ability to focus on your work. We'll go over IRL measures to take, and digital measures to take. + + + + + Productivity: The Morning Routine + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/morningroutine/index.html + 2024102301 + In this tutorial we're covering when and how i start the day, and why i do those things. + + + + + Collaborative Project Management (Kanban in Gitea) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/kanban/index.html + 2024102203 + In this tutorial we're going to showcase how to create a git repository on gitea, and how to manage projects with a Kanban-style. + + + + + Micro Workflow: Todo Listing, Contextualizing, and Ordering Tasks + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/microworkflow/index.html + 2024102201 + In this tutorial we're going to look at how you can manage your workflow on the micro level, by listing the things you have to do, contextualizing them, and ordering each task. + + + + + Peer-to-Peer Large File Sharing (Torrents over VPN) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/p2ptorrents/index.html + 2024102002 + In this article, we will explore how, after binding a VPN to their torrent clients, Sam the Seeder can privately share a large file with Larry the Leecher. + + + + + Macro Time Management: Prioriting Projects and Calendar Scheduling + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/macrotime/index.html + 2024102000 + In this tutorial we're going to cover how to schdule time for your work projects and your personal projects. We're going to cover how you can priorize your projects, and how you can schedule it from inside Thunderbird, and using nextcloud CalDAV. + + + + + How to Get an Email Account Anonymously (Emails as a Service) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/anonemail/index.html + 2024101600 + In this article, we will explore how to sign up for email account anonymously. Specifically, we will explore a privacy-focused email provider, Proton Mail, and how to sign up using Tor without inputting any additional information whatsoever. + + + + + How to Receive Anonymous SMSes (Remote SMSes as a Service) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/anonsms/index.html + 2024101400 + In this tutorial we're going to showcase how to recieve SMSes anonymously, using a remote SMS as a service that doesn't require any KYC to use. + + + + + Easy Anonymous Chats Using SimpleX + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/anonsimplex/index.html + 2024101302 + In this tutorial we're going to see how to setup a chat application for Anonymous use. This is especially important in a world where mass-surveillance is nearly-omnipresent. It has become the end users' responsibility to uphold their privacy and anonymity while communicating online. + + + + + Macro Workflow: Listing Topics that truly matter + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/macroworkflow/index.html + 2024101301 + In this tutorial we'll cover briefly how to choose topics based on the reason behind your actions, we'll go over some example topics, and how to label them to be able to easily order them. + + + + + The right thing to do: What is the reason behind your actions? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/rightthing/index.html + 2024101200 + Introspection: What is it that truly matters to you? Acting out of self interest: Unfulfilling Immaturity, The right thing to do: The Fulfilling Maturity + + + + + Nihilism: Mantras to reset the Mind + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/nihilism/index.html + 2024101004 + In this tutorial we're going to cover the structure of your own mind, We're going to explain why it is not normal to follow the norm, and why Nihilism is vital for your own mental health. + + + + + How to Maintain Multiple Identities Online + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/multiple_identities/index.html + 2024101001 + In this tutorial, we’ll guide you through setting up and managing multiple online identities to enhance your privacy and security. We’ll discuss why this is crucial, how to establish distinct personas, and the steps you need to keep them isolated from each other. + + + + + How to remain Anonymous during a protest + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/anonprotest/index.html + 2024101000 + In this tutorial we're going to cover what must be taken into account when it comes to using phones outdoors, how you can remain anonymous outdoors, and what it takes to have a phone for anonymous use. + + + + + How to contribute to The Nihilism Blog + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/contribute/index.html + 2024100602 + In this tutorial we're going to look at how you can contribute to the opsec blog, we'll look into how the work is being organized, and how to contribute via gitea. We'll also look into how you can run the blog yourself since it's entirely public domain (Creative Commons Zero license). + + + + + How to setup a Haveno Seed Node + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/haveno-seednode/index.html + 2024100600 + In this tutorial we're going to take a look at how you can contribute to an existing Haveno Network, by running a Seed Node, in order to make the Haveno Network of your choice more resillient to potential takedowns. + + + + + How to send small files Anonymously (Onionshare) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/onionshare/index.html + 2024093000 + OnionShare is a free and open-source cross-platform tool that utilises the TOR network to anonymously share files (send and receive), host an onion website and create a simple chat room. + + + + + Hiding files in images with steghide + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/steghide/index.html + 2024092800 + steghide is a mature GPL-licensed CLI tool for hiding arbitrary data inside of of image files (and some archaic audio formats). Its official web presence is located at http://steghide.sourceforge.net/. it conceals data inside a larger coverfile in a way that is indistinguishable to first-order statistical analysis. This means there is are anomalies in the file histogram, making most pictures innocuous without having the original image to compare it to. + + + + + Cold Exposure: Where Discipline takes over Comfort + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/coldshowers/index.html + 2024092600 + What the body and mind doesn't want, but actually needs. The perfect discipline practice. + + + + + Opus Nihil: Dissolving Compulsions + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/opus-nihil/index.html + 2024092601 + What is it that you truly need ? What is it that you truly want ? Dissolve those compulsions yourself. + + + + + New Tutorial Category : Productivity Introduction - Discipline over Comfort + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/productivity/discipline/index.html + 2024092500 + Making sure that your Body and Mind are not getting in the way of your work, and making sure that you are working as efficiently as possible. + + + + + XMPP Chat Server Setup (Clearnet + Onion + OMEMO E2EE) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/xmpp2024/index.html + 2024092100 + In this tutorial, we're going to check out how to setup a XMPP chat server, that is accessible over Tor, as a hidden service, using Prosody. We'll also cover how to have a Clearnet XMPP server, and how to have OMEMO End to End encryption using the Gajim XMPP client. + + + + + Why can't I trust Centralised Exchanges, and random Monero nodes ? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/chainalysisattempts/index.html + 2024090700 + As of September 5, 2024 the sech1 posted on monero.town the following post, which was a repost of the following reddit post talking about a leaked Chainalysis meeting video about what was their progress on tracing monero transactions back in August 2023. This is a great opportunity to highlight the opsec weaknesses they are targeting so let's dive into it. + + + + + How to rent remote domains anonymously (Registrar resellers) ⭐ + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/anondomain/index.html + 2024090500 + Not many people know that it is possible to operate a clearnet website, anonymously. In this tutorial we're covering how you can rent a clearnet domain, anonymously. + + + + + Mine Monero with p2pool and xmrig + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/monerop2pool/index.html + 2024082500 + how to mine Monero using p2pool and xmrig. + + + + + How to use the Tor Browser on Mobile + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/MobileTor/index.html + 2024081901 + Sometimes you are not always in front of your computer but need to browse the web anonymously while being away from your home. In this tutorial we're going to cover how to browse the web anonymously while on your mobile device. + + + + + How to write good Tutorials + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/tutorial/index.html + 2024081900 + Because after all, how can you expect people to write good tutorials without being shown how to write them in the first place ? + + + + + Hiding files in videos (small or large files) with zuluCrypt + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/anonzulucrypt/index.html + 2024081800 + Using Steganography to hide small or large files into Video files, using zulucrypt + + + + + New Matrix Chat (Opsec, Sysadmin, hacking, Programming) + http://matrix.to/#/#nowheremoe:nowhere.moe + 2024081500 + As nowhere.moe and datura.network are being merged into nowhere.moe, feel free to join the new matrix chat + + + + + Why isn’t Privacy enough for Anonymous Use? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/anonuse/index.html + 2024081400 + In this post we are going to see why Privacy is not enough for Anonymous Use, and what can be done about it. + + + + + New domain: Nowhere.moe + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nowhere.moe.txt.asc + 2024081000 + Explaining how the ownership of the services will change + + + + + Route QEMU VMs through a Host OS VPN + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/vpnqemu/index.html + 2024080900 + In this tutorial we're going to check how to have VMs use a Host OS VPN, which can be vital if your ISP doesn't allow Tor traffic + + + + + Where to host Anonymous Clearnet Services ? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/anonclearnetservices/index.html + 2024060801 + In this tutorial we're going explain how you can have anonymous clearnet services, which can either remotely or self-hosted. + + + + + Where to host Anonymous Hidden Services ? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/hiddenservice/index.html + 2024060800 + In this tutorial we're going to look at where you can host Hidden Services, while still remaining Anonymous, One way is to host the service remotely, and the other is to self-host it. + + + + + Introduction to Self-Hosting Hidden Services + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/hiddenservices/index.html + 2024080300 + Clearnet Services: Centralized, but can be used anonymously, Tor Hidden Services: Decentralized and Anonymous, But Warning, do not host anything sensitive at Home! + + + + + Opening the Blog to contributions (earn XMR!) + http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/blog-contributions + 2024072500 + Long due, i'm now opening blog.nowhere.moe to contributions, i am offering monero (10-50euros per new complete blogpost), if you want to contribute a tutorial i didn't list yet, let me validate your idea beforehand. + + + + + Tor through VPN or VPN through Tor? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/torthroughvpn/index.html + 2024072400 + In this tutorial we're going to justify the 4 possible Tor / VPN combinations, based on both clienside and serverside contexts. We'll also discuss specific contexts where anonymity is too risky to attempt. + + + + + How to install GrapheneOS on a Pixel Phone + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/graphene/index.html + 2024071001 + In this tutorial we're going to setup graphene OS, an open source android operating system for google pixel phones. + + + + + The lack of Open Source Hardware (CPUs, Motherboards, GPUs) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/openhardware/index.html + 2024071000 + In this article we'll look at why Open source Hardware is vital, the current status of the closed-source hardware monopoly on the market, and the current status of open source hardware on the market + + + + + The main source of Anonymity: The Tor Network + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/torvsvpns/index.html + 2024063000 + In this tutorial we're going to explain why VPNs are not enough when it comes to maintaining Anonymity, and in what way Tor is the main source of Anonymity online. + + + + + What is Anonymity ? Why is it Important ? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/anonymityexplained/index.html + 2024062900 + In this tutorial we're going to explain what is Anonymity, What are the enemies of Anonymity, and why it is important, especially for international journalism. + + + + + How to compile open source software + How to verify software integrity + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/compilation/index.html + 2024062803 + In this tutorial we're going to cover Why compile even compile software yourself, how to compile c++ programs, and How to verify software integrity + + + + + How to get privacy from your ISP using a VPN + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/vpn/index.html + 2024062801 + In this tutorial we're going to cover Why does Bob need a VPN to begin with, how to purchase a VPN, How to download it, and how to verify that it is properly connected, from inside a debian VM, for private internet usage. + + + + + Linux Hypervisor Setup (QEMU/KVM virtualisation) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/hypervisorsetup/index.html + 2024062800 + In this tutorial we're going to cover how to setup the open source hypervisor QEMU/KVM in Linux host OS, using the libvirt technology. + + + + + How to install Linux from a Windows PC + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/linux/index.html + 2024061601 + In this tutorial, we're going to look at the first and foremost thing anyone can do to remove surveillance from their digital lives, by installing a free and open source software (FOSS) host operating system: Linux, in this case we're going to setup the latest Debian. + + + + + What is Privacy ? Why is it Important ? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/privacy/index.html + 2024061600 + This is where the Journey begins. We're going to look at why you should bother with Privacy first of all, and what it is exactly. + + + + + Tails OS QEMU VM for Temporary Anonymity + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/tailsqemuvm/index.html + 2024061400 + In this tutorial we're going to look at how you can run Tails OS (The Amnesic Incognito Linux System) in a QEMU VM, following the official documentation, along with how to setup persistant storage + + + + + Audit your OPSEC and determine the appropriate internet use + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/opsec4levels/index.html + 2024060900 + In this tutorial we're going to explore how you can audit your own level of opsec, using the following 6 parameters:Complexity, Transparency, Surveillance, Centralisation, Onymity, and Deniability. + + + + + Governments fear Decentralisation and Anonymity + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/govfear/index.html + 2024060701 + In this tutorial we're going to explain why Decentralisation and Anonymity are essential in reducing the power of the government over it's citizens. + + + + + Governments, Centralisation, and Law Enforcement + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/governments/index.html + 2024060700 + In this tutorial we're going to cover and explain what are governments, and why they are trying to force us into mass surveillance and KYC procedures. + + + + + OPSEC: The right technology and behavior + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/opsec/index.html + 2024060600 + Operational Security, is a process aimed at identifying if your actions can be observed by an adversary. In this context, how good your OPSEC is, determines the level of your privacy and anonymity. + + + + + Phone Numbers are incompatible with Privacy! + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/phonenumbers/index.html + 2024052600 + Sim Cards: the Deanonymization Tool, You cannot have an anonymous Phone at home. If a service requires your phone number, it is against both your Privacy and Anonymity + + + + + My Manifesto + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/manifesto/index.html + 2024052500 + Explaining why I have a blog in the first place + + + + + Haveno DEX Cash by Mail -> XMR transaction + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/haveno-cashbymail/index.html + 2024052400 + In this tutorial we're going to cover how to buy Monero, for cash by mail on the Haveno Decentralised Exchange. This was the most popular payment method back on LocalMonero, due to being an improvement over bank transfers (like SEPA in the EU) when it comes to trading larger volumes in the long run, as Cash cannot easily be traced by adversaries unlike bank transfers, making Cash by Mail one of the most private ways to exchange real world money for Monero. + + + + + Haveno DEX SEPA Instant -> XMR transaction + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/haveno-sepa/index.html + 2024052300 + In this tutorial we're going to cover an instant SEPA transfer (which is a bank transfer) transaction for monero, this is one of the most popular payment options in the EU region, a favorite of mine due to the speed of the transaction. + + + + + Haveno Decentralised Exchange Dispute resolution (Fiat -> XMR) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/haveno-arbitrator/index.html + 2024051900 + In this tutorial we're going to cover how the Haveno DEX handles trade disputes, which can happen as, after all it's decentralised, and anonymous by default. We'll cover What protects the Buyer or the Seller, what happens when you encounter a scammer, and how the arbitration resolution plays out. + + + + + Haveno Decentralised Exchange Face-to-Face Fiat to Monero Transaction + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/haveno-client-f2f/index.html + 2024140500 + Setting up Haveno DEX locally, making it connect to a Tor bridge, creating a buying offer, transacting with a user directly, to exchange FIAT for Monero, and then withdrawing your funds from the Haveno Monero wallet. + + + + + Internet usage segmentation (QEMU VMs + Identity Management) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/internetsegmentation/index.html + 2024030500 + Different Internet Usage, Identity Management, Multiple Virtual Machines (VMs), Internet Usage Segmentation Recap + + + + + Acquiring remote servers and domains anonymously (non-KYC providers) + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/anonymousremoteserver/index.html + 2024020501 + Finding out a non-KYC Cloud Provider and Email Provider, Purchasing the server anonymously (using Monero), and Accessing the server anonymously (SSH through Tor) + + + + + Clientside: Encryption is good, but you need Plausible Deniability + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/encryption/index.html + 2024050100 + Encryption Provides Privacy, But what happens when Bob is forced to give out your password? Why is Plausible Deniability is Vital? + + + + + Tor through VPN or VPN through Tor? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/torthroughvpn/index.html + 202404301 + Accessing websites that block Tor and Hiding Tor usage from your ISP + + + + + Why can't I trust closed source software? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/closedsource/index.html + 20240430 + No, you still can't trust closed source software + + + + + Sensitive .onion Services: Self-Host or Host Remotely ? + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/sensitiveremotevshome/index.html + 20240429 + Explaining what hosting sensitive services implies + + + + + Decentralized Finances + http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/servers/finances/index.html + 1 + Centralised currencies, Decentralised Currencies, and Centralised Exchanges, privacy cryptos and decentralised exchanges + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +