Risks
- Whenever you connect to your server, such as for monitoring or other administrative tasks, if you do so through the clearweb then you are liable to being recorded. Even when using SSH you will leave a trail of metadata all the way back to your access point. That might be enough to get your door busted down the line.
+ Whenever you connect to your server, such as for monitoring or other administrative tasks, if you do so without going through Tor, then the cloud provider knows that you are the one connecting to that server. Even when using SSH you will leave a trail of metadata all the way back to your access point. That might be enough to get your door busted down the line if you intend on hosting anything sensitive on that server.
In the following part of the post we will look into how to set up advanced monitoring tools so you don't have to keep an eye on a bunch of tmux sessions with glances/top open in order to know the behaviour of your systems over time.
- First, you need to read and understand how to connect to your server safely and anonymously (see
this article), grok it and then come back here.
+ This tutorial will assume that you have acquired servers anonymously via non-KYC cloud providers, and that you are only accessing them anonymously through tor
+ See
this article if you have not already.
...
@@ -200,8 +201,13 @@
First, let's have a look at the network topology we'll be building:

+
+
+ - Our whonix workstation will connect through tor to a central monitoring server in order to access the grafana dashboard containing our monitoring data.
+ - Our monitoring server will itself connecth through tor to the target monitored servers using prometheus
+
-
Setting up the Server
+
Setting up the central monitoring server
First you want to set up your central monitoring server. For ease of use and better performance we are going to colocate the prometheus collector along with grafana.
@@ -221,7 +227,7 @@
Tor Configuration
-
On the Client
+
On the target server to be monitored
run the following as root to create a hidden service for the prometheus collector
@@ -254,7 +260,7 @@ cat /var/lib/tor/onion/prometheus/hostname
[clientaddr].onion
-
On the aggregator
+
On the central monitoring server
The prometheus collector will only be accessed locally by grafana so it doesn't need to be accessible over tor. Grafana, on the other hand, does.
@@ -301,8 +307,8 @@ systemctl status tor #check that everything works
And that's all you'll need! one hidden service for grafana.
You'll find your hostname in /var/lib/tor/onion/grafana/hostname.
-
Prometheus server configuration
-clean and simple: we scrape our server every 10s for new data, configure a proxy URL so scraping happens over tor, using our socksport and configure ou scraping targets.
+
Prometheus server configuration on the central monitoring server
+Clean and simple: we scrape our server every 10s for new data, configure a proxy URL so scraping happens over tor, using our socksport and configure ou scraping targets.
@@ -331,8 +337,14 @@ scrape_configs:
+
+This configuration will make the central monitoring server behave in the following way:
+
+ - Scrap itself directly to collect its own data (prometheus is only exposed on loopback for this)
+ - Scrap the target monitored server through tor via the socks proxy
+
-
Grafana configuration
+
Grafana configuration on the central monitoring server
Let's start grafana and make it available: as root, as tor is already configured we can then access it through our torbrowser