How to secure a .onion server

The original security notes are short: send host DNS through Tor, then follow standard NGINX hardening and optional port knocking for SSH.

Send host DNS through Tor

Add these directives to /etc/tor/torrc (then restart Tor):
```
VirtualAddrNetworkIPv4 10.192.0.0/10
AutomapHostsOnResolve 1
TransPort 9040
TransListenAddress 127.0.0.1
DNSPort 53
```
Newer Tor builds TransListenAddress is legacy syntax. Current Tor prefers address/port on TransPort / DNSPort. Check man tor on your release before copying this block blindly.
Point the resolver at Tor’s DNS port.
```
sudo vi /etc/resolv.conf
```
```
nameserver 127.0.0.1
```
```
sudo service network restart
```
On systemd-resolved hosts you may need a matching change in /etc/systemd/resolved.conf or the change will be overwritten.

Onion-specific hardening

The next page is the one to finish with: Tor’s own packages, unix sockets, key backup, DoS defenses, optional client auth, and headers for a static site.

Onion service checklist Seven items that matter more for a .onion host than extra PHP or knockd.

Secure NGINX

These topics were originally listed as external articles. The walkthroughs now live here, with credit on each page:

Install ModSecurity on NGINX Web application firewall in front of the local site. Based on Geekflare. Harden a LEMP stack NGINX, PHP, and MySQL baseline hardening. Based on RoseHosting.

Optional: knockd for remote access

If you still expose SSH on a cloud host, port knocking can keep the port closed until a known sequence is sent.

Obscure open ports with knockd Optional SSH port knocking. Based on TechRepublic.