diff --git a/docs/anonymity-configuration.rst b/docs/anonymity-configuration.rst
index c8266c849..5ad9ae740 100644
--- a/docs/anonymity-configuration.rst
+++ b/docs/anonymity-configuration.rst
@@ -302,7 +302,11 @@ Server anonymity, automatic configuration
 To configure a server node to listen on an anonymizing network, create the
 node with the ``--listen=tor`` option. This requires a Tor configuration that
 either launches a new Tor daemon, or has access to the Tor control port (and
-enough authority to create a new onion service).
+enough authority to create a new onion service). On Debian/Ubuntu systems, do
+``apt install tor``, add yourself to the control group with ``adduser
+YOURUSERNAME debian-tor``, and then logout and log back in: if the ``groups``
+command includes ``debian-tor`` in the output, you should have permission to
+use the unix-domain control port at ``/var/run/tor/control``.
 
 This option will set ``reveal-IP-address = False`` and ``[connections] tcp =
 tor``. It will allocate the necessary ports, instruct Tor to create the onion