Last week I documented the steps necessary to get a tor relay node up and running using Windows. This was mainly because I wanted to give a gentle introduction to anyone interested in cryptography and internet freedom who may not have a large chunk of experience in tech. I strongly believe anyone can become an expert in any niche given the scale of information currently available on the internet, and I don't think technology is any different. All it takes is a little bit of inspiration, which I was hoping to provide by taking it slow. Now we're going to turn up the volume a bit.
Introduction
One large drawback of hosting a relay node on your personal laptop is your connection to the tor network is not persistent. Every time you close your laptop or shut it off and turn it back on, your tor software loses all the connections that were so helpfully shuttling network traffic for everyone. This time, we're going to set up a Free Tier AWS EC2 instance in the cloud, and run the relay node software using this server space. This will ensure our node will forever stay up supporting the tor network and internet freedom!
One thing to note is, once you've got your EC2 instance provisioned, you can put any software you want on it and it will automatically be connected to the rest of the internet! I use this frequently for a lot of my side projects.
Also, I'm going to assume you're running some flavor of Linux and have some familiarity with the command line moving forward. If you don't, please don't fret, just google, and as always, don't hesitate to reach out to me and ask for help!
Welcome to The Cloud
First, we'll go to https://aws.amazon.com/ and click "Sign In to Console". You'll click "I am a new user." after being directed to the next page and entering your email address. Heore you'll enter your first name, retype your email address, and set your password. Then click "Create account". You'll then be redirected to a Contact Information page. Select the Personal Account radio button. Fill out the information in the form. When you're done, click the Agreement check box and then Create Account (if it took you more than two tries to get the captcha don't worry....I did too). Next AWS asks for your payment information. I know when I first signed up I was hesitant. I'm always hestitant about inputting credit card info. However, I assure you, your account will not be charged throughout this tutorial. And in fact, I've inadvertently racked up $1100 in AWS charges after uploading my IAM keys to github (yes, I'm that stupid) and had them all refunded. Amazon rocks with refunds.
Next, you'll fill out the captcha and click the button to receive the phone call from Amazon herself. Type in the pin shown on the screen and end the phone call. Then click Continue. We want the Basic support plan, so select that and again click continue. You'll be taken to the homepage, click Signin to Console. Enter your email, and password your set earlier in the tutorial.
You now have an AWS account. Welcome to the cloud.
AWS
There are an endless supply of cloud computing resources supplied by Amazon. We'll only be looking at 1 today, but I recommend you check out as much as you can. In fact, if you don't have a job, or dislike the one you've got and you learn the ins and outs of AWS, you could easily land yourself a dev-ops role at a great company.
EC2
We'll be using the EC2 service provided by AWS, so click that one, under AWS services. EC2 stands for Elastic Compute Gen 2. The elastic part means that your computational resources can scale up or down depending on how much you're using. I believe you can also bid on computing resources, whereby the price fluctuates with demand for Amazon's servers. Since we'll be doing very minimal computing, this means ours will be free!
Click the blue Launch Instance button. You'll be presented with various different Operating Systems that you can put on your EC2 instance. We'll be using Ubuntu, so scroll down until you see Ubuntu Server 16.04 and click select. Here we'll choose the computing resources that we'd like to use on the server. Leave it as is, which should be the t2.micro settings, which as Amazon has so kindly informed us is free tier eligible. Now, click Review and Launch, and finally, Launch.
Private Key File
You'll now be presented with a pop up informing you that you need to create a private key file in order to SSH (secure shell) into your Ubuntu server. As I said, we're turning the volume up for this tutorial. Here's the general idea of what we're doing.
You have a laptop that you're reading this blog post on. Somewhere in New York or Oregon, or hell, even Tokyo, Amazon has a bunch of servers it uses for various tasks on its website. Well it's decided to sell some of those servers to the public to make money when they aren't using them. You've just been given a server somewhere in the deepest depths of Mordor.
Great! we have a server! but how do we access it? We have to use a networking protocol that allows us to pass commands to the computer through the internet. However, we don't want anyone to be able to pass commands to our computer, so we need a way of securing it. Enter: the private key file. Using roughly the same technique that keeps your traffic secure while you do your online banking, or the bitcoin blockchain secure, we can keep our commands to the cloud computer safe.
Bombs Away!
Select Create a new key pair, then name it whatever you like. I'm going to name mine "torRelayNode" because that's what I'll be using this EC2 instance for. Then click "Download Key Pair". Save this file somewhere safe, if anyone gets ahold of it, they'll have access to your server and can do whatever they'd like with your AWS account.
Now click Launch Instances, then View Instances. You should see your new t2.micro instance, with an Instance State of running.
While we're here, we're going to set the port forwarding for the port we'll be using on the tor node. On the left, you'll see Network & Security, and under that Security Groups, click that. You should see two security groups, we want the one that belongs to the launch-wizard-1 Group Name. When you click it you should see it's current network rules. The only one should be of type SSH, using the TCP protocol, on port 22, from any source (0.0.0.0/0). Click the Edit button above that, and Add Rule. From the drop down under Type, choose Custom TCP, the protocol is TCP, the port will be 9001 (as we'll see in the next tutorial). Using the Source dropdown, select "Anywhere". You've now added the firewall rule to allow for incoming connections on the tor network to connect to your node on port 9001. If at any point you decide to change the tor node's port in the torrc file, don't forget to change it here as well!
You now have your very own cloud computer!
SSH
But how do we access it? We use that private key file we downloaded, and ssh into it. First we need to get the public IP address associated with our EC2 instance. On the left (where you saw Network & Security) you should see Instances, click Instances under that. You should see "Public DNS:" below where all of your EC2 instances are listed, and a big long string starting with "ec2-". That's your shiny new server's address on the internet. Copy it, we'll need it later.
Next, we'll open up the command line, cd into whatever directory you downloaded or moved the private key file to, then change the execution permissions of that file with chmod:
chmod 400 <The name of your .pem file, in my case torRelayNode.pem>
and finally:
ssh -i <The name of your .pem file> ubuntu@ec2-the-ip-address-you-copied-from-before
Note, that you'll need to be in the same directory as your .pem file, or pass the command the path to your .pem file. If it's your first time logging into your EC2 instance, you'll be asked if you want to trust it. Type yes and hit enter. Now you're on your new computer!
Shutting it Down
Before I forget, if you do somehow end up getting charged somewhere down the road from AWS, you can kill your instance by going to the Instances page, clicking your instance, selecting the Actions drop down, and changing the Instance State from Start to Stop (and the nuclear option, Terminate). You'll still have to cough up the charges (they should be small) but this should stop you from getting any more. Also, on that note, I'd recommend looking into setting a billing alarm to send you an email if you ever do get charged. I'll also monitor this EC2 instance for a month and post an update if it does end up charging me, so we can fix it together if it does. Also, again, don't hesitate to get in touch if you have any problems with the charges!
Next Steps
In the next blog post, we'll get the tor relay software up and running on your new cloud server, and you can now brag at parties that you're actually protecting revolutionaries in dictatorial countries, just like I do any time someone asks me which VPN to use. Also, don't forget to buy a tor sticker to put on your laptop, as you'll have joined the brotherhood after the next tutorial.
