Tor: What MSPs need to know

Danny Bradbury

Spend long enough in the hosting or managed service provider (MSP) industry, and someone will eventually ask you about Tor, the online anonymity system that shields peoples’ identities when surfing the Internet and allows them to run anonymous websites.

Your business customers may want to know what it is, and may even want you to support it. Here’s what you need to know when they come calling.

How does Tor work?

torTor creates an independent routing layer on top of the regular Internet, effectively replacing the Domain Naming System (DNS) with its own protocol.

It uses the onion routing concept, first created by the US Naval Research Laboratory. This encases network packets in multiple layers of encryption, much like the layers of an onion. Network traffic is sent from the regular Internet, entering the Tor network through a relay (explained below), and then travelling along a path comprising other, randomly selected relays.

The network packet passes through at least three of these relays, each of which then removes a layer of the encryption ‘onion’ so that it can read the identity of the next relay and forward it. This system shields the origin of the traffic, and thus the user’s identity.

By the time the traffic leaves the final relay in the Tor network, all the layers of the onion have been removed, leaving the unencrypted packets which are then forwarded to their final destination on the public Internet.

Why would they want to use Tor?

anonymous browsingUsers communicating with sites on the public Internet using Tor as an intermediary typically do so to shield their identities, preserving anonymity online.

There is also another use case, where the final destination for the network packet lies on the Tor network itself. Those destinations are ‘hidden services’ – typically websites or other services running on the Dark Web. These sites shield the identity of their owners, and of the people visiting them.

Because the Tor software runs anywhere, it can easily be installed on an hosting company’s servers. Technically speaking, customers can run three kinds of Tor nodes on an MSP’s systems, simply by renting a virtual private server or shared host. These are:

  • Relays
    These are the computers within the tor network that receive traffic either from the public Internet or from other Tor relays. They then pass this traffic onto other relays. Relays can also run the ‘hidden services’ websites, which typically have the ‘.onion’ suffix.
  • Bridges
    These are Tor relays whose addresses are not listed as part of the Tor network. They’re for private use, typically in countries known to block the IP addresses of known Tor relays.
  • Exit nodes
    These are the relay nodes that forward traffic from the Tor network to the public Internet.

The question isn’t so much whether you can support Tor, but why businesses would want to use the service, and whether you should allow the software on your servers. Let’s take those in order.

What are the business uses for Tor?

There are many illegitimate uses for Tor, ranging from drug-peddling to illegal pornography. There are also legitimate ones, though.

A business executive may want to report data breaches or other sensitive to a central clearinghouse without revealing their identity or location. In some cases, a company may want to run a hidden Tor service to collect sensitive information from participating users. A whistleblowing site is a good example. Certain kinds of organizations, such as human rights and other activist groups, may want those functions to make their participants feel safer.

Companies may also want to shield their employees’ identities and locations during web surfing to avoid other companies detecting patterns in their traffic and drawing conclusions about their business plans. They may want to shield their real IP addresses when viewing competitors’ websites, to get a ‘vanilla’ view of them. This stops competitors configuring their web servers to deliver different information to requests coming from a particular company’s IP addresses.

Should you support Tor?

The primary concern for hosting firms and MSPs considering Tor support is legal liability, and these liability issues revolve mainly around exit nodes. These are the relays that send unencrypted information from the Tor network to the outside world, and they are publically identifiable. If you operate an exit node on your servers, then others will identify you as the source of any traffic it creates.

That may concern some MSPs because statistically speaking, an exit node is likely to pass illegal traffic at some point in its operation. An exit node acts as a funnel from the entire network, and doesn’t just handle its owner’s Tor traffic.

Even the Electronic Frontier Foundation, which is a long-time proponent of Tor, admits that anyone running an exit node should prepare themselves to deal with complaints and “the possibility that their servers may attract the attention of law enforcement agencies”. However, it also believes that it is legal to operate a Tor exit node in the US.

That may not be the case for other jurisdictions, though. Austria effectively criminalized the operation of exit nodes in a legal opinion.

Consequently, attitudes towards supporting different kinds of Tor nodes are mixed, and the Tor project maintains an informal crowdsourced list of users’ experiences here. Your mileage may vary. Take professional legal advice on the matter to reflect your own jurisdiction and operating conditions.

Ultimately, there are few if any practical reasons for a business to run a Tor exit node. It can use Tor for anonymous surfing by installing it on employees’ machines and finding any relay. Running a private bridge node on an MSP server may provide them with a dedicated, reliable relay infrastructure, however.

Tor is one of the better-known websites, but there are other anonymity networks, including Freenet and I2P.