User:HR/SSH over Tor - Revision history

HR at 11:47, 21 March 2021

2021-03-21T11:47:17Z

← Older revision		Revision as of 11:47, 21 March 2021
Line 1:		Line 1:
	Create a SSH<ref>[[wikipedia:SSH_(Secure_Shell)]]</ref> connection via the Tor<ref>[[wikipedia:Tor_(anonymity_network)]]</ref> network.		Create a SSH <ref>[[wikipedia:SSH_(Secure_Shell)]]</ref> connection via the Tor <ref>[[wikipedia:Tor_(anonymity_network)]]</ref> network.

	== Background ==		== Background ==
Line 12:		Line 12:
	== Implementation ==		== Implementation ==

	For our example setup we ~~need~~:		For our example setup we use:
	* Raspberry Pi <ref>[[wikipedia:Raspberry_Pi]]</ref>		* Raspberry Pi <ref>[[wikipedia:Raspberry_Pi]]</ref>
	* Your computer		* Your computer
Line 18:		Line 18:
	=== Raspberry Pi ===		=== Raspberry Pi ===

	'''Caveat:''' all commands are entered on the command-line interface <ref>[[wikipedia:Command-line_interface]]</ref>.		'''''Caveat:''' all commands are entered on the command-line interface <ref>[[wikipedia:Command-line_interface]]</ref>.''

	==== Install & configure Tor ====		==== Install & configure Tor ====
Line 39:		Line 39:

	The Raspberry is now ready to receive SSH connections via the Tor network.		The Raspberry is now ready to receive SSH connections via the Tor network.

			==== Onion address ====

			Later we'll need the Raspberry's .onion address to connect to our onion service. To display it just type:

		⚫	sudo cat /var/lib/tor/ssh_onion_service/hostname

	=== Your Computer ===		=== Your Computer ===
Line 44:		Line 50:
	==== Linux (Ubuntu) ====		==== Linux (Ubuntu) ====

	'''Caveat:''' all commands are entered on the command-line interface.		'''''Caveat:''' all commands are entered on the command-line interface.''

	===== Install tor =====		===== Install tor =====
Line 50:		Line 56:
	sudo apt install tor		sudo apt install tor

	===== Install ~~netcat~~ =====		===== Install socat =====

	We'll need ~~netcat~~ to connect our SSH session to the Tor network.		We'll need socat to connect our SSH session to the Tor network.

	sudo apt install ~~netcat-openbsd~~		sudo apt install socat

	===== Connect to Raspberry =====		===== Connect to Raspberry =====
Line 65:		Line 71:
	====== Parameters in SSH command ======		====== Parameters in SSH command ======

	ssh -o "ProxyCommand nc -X ~~5 -x 127.0.0.1~~:~~9050~~ %h %p" -o PreferredAuthentications=password -o PubkeyAuthentication=no pi@[onion address]		ssh -o "ProxyCommand socat STDIO SOCKS4A:localhost:%h:%p,socksport=9050" -o PreferredAuthentications=password -o PubkeyAuthentication=no pi@[onion address]

	You'll find the onion address on the Raspberry:

⚫	sudo cat /var/lib/tor/ssh_onion_service/hostname

	====== Parameters in SSH config file ======		====== Parameters in SSH config file ======

	Add your config to ~/.ssh/config		Add your config to ''~/.ssh/config'' . Create the file if it doesn't exist.

	Host raspberry-tor		Host raspberry-tor
Line 80:		Line 82:
	PreferredAuthentications password		PreferredAuthentications password
	PubkeyAuthentication no		PubkeyAuthentication no
	ProxyCommand nc ~~-X 5 -x~~ localhost:~~9050~~ %h %p		ProxyCommand socat STDIO SOCKS4A:localhost:%h:%p,socksport=9050

	Then, to connect to the Raspberry, you ~~just~~ invoke your SSH session with:		Then, to connect to the Raspberry, you invoke your SSH session with:

	ssh raspberry-tor		ssh raspberry-tor
Line 95:		Line 97:
	=== Forwarding of local ports ===		=== Forwarding of local ports ===

	Suppose there is also a LanBox in the remote network. We can connect to the LanBox via our Tor Raspi with our locally installed LCedit+ by forwarding a few ports towards the IP of the LanBox. Given the LanBox has the IP address 10.0.0.3, then the ssh command to forward the necessary ports is:		Suppose there is also a LanBox <ref>[[https://www.lanbox.com]]</ref> in the remote network. We can connect to the LanBox via our Tor-Raspi with our locally installed LCedit+ (LanBox's software suite) by forwarding a few ports towards the IP of the LanBox. Given the LanBox has the IP address 10.0.0.3, then the ssh command to forward the necessary ports is:

		⚫	ssh -o "ProxyCommand socat STDIO SOCKS4A:localhost:%h:%p,socksport=9050" -o PreferredAuthentications=password -o PubkeyAuthentication=no -L 4776:10.0.0.3:777 -L 4777:10.0.0.3:4777 -L 6454:10.0.0.3:6454 pi@[onion address]

		⚫	Then, when starting LCedit+, connect to ''localhost:4776'' . By default the LanBox is using port 777 for the authentication but by using port 4776 instead we avoid invoking ssh with root privileges. Ports below 1024 are so called ''system ports'' and require root privileges to temper with.
⚫	ssh -o "ProxyCommand nc -X ~~5 -x 127.0.0.1~~:~~9050~~ %h %p" -o PreferredAuthentications=password -o PubkeyAuthentication=no -L 4776:10.0.0.3:777 -L 4777:10.0.0.3:4777 -L 6454:10.0.0.3:6454 pi@[onion address]

			'''''Caveat:''' because the Lanbox's authentication channel isn't encrypted, it's a good idea to use at least a SSH port forward if you're connecting to your LanBox via a possibly hostile network, like the Internet. Otherwise your LanBox's password can be scooped in transit and ghosts might enter your machine.''
⚫	Then, when starting LCedit+, connect to ''localhost:4776'' . ~~We're~~ using port ~~4776~~ ~~instead~~ of ~~777~~ ~~(LanBox~~ ~~default)~~ to avoid invoking ssh with root privileges. Ports below 1024 are so called ''system ports'' and require root privileges.

	Or you store the parameters in the SSH config file (~/.ssh/config) for easier invokation:		Or you store the parameters in the SSH config file (~/.ssh/config) for easier invokation:
Line 108:		Line 112:
	PreferredAuthentications password		PreferredAuthentications password
	PubkeyAuthentication no		PubkeyAuthentication no
	ProxyCommand nc ~~-X 5 -x~~ localhost:~~9050~~ %h %p		ProxyCommand socat STDIO SOCKS4A:localhost:%h:%p,socksport=9050
	LocalForward 4776 10.0.0.3:777		LocalForward 4776 10.0.0.3:777
	LocalForward 4777 10.0.0.3:4777		LocalForward 4777 10.0.0.3:4777
	LocalForward 6454 10.0.0.3:6454		LocalForward 6454 10.0.0.3:6454

	~~Then~~ invoke ssh with:		And invoke ssh with:

	ssh raspberry-forward-tor		ssh raspberry-forward-tor

HR: /* Enable SSH server */

2021-03-21T10:10:14Z

Enable SSH server

← Older revision		Revision as of 10:10, 21 March 2021
Line 33:		Line 33:
	sudo systemctl restart tor.service		sudo systemctl restart tor.service

	==== ~~Enable~~ SSH server ====		==== Install & configure SSH server ====

			sudo apt install openssh-server
	sudo systemctl enable ssh.service		sudo systemctl enable ssh.service

HR: /* Install netcat */

2021-03-21T10:07:09Z

Install netcat

← Older revision		Revision as of 10:07, 21 March 2021
Line 53:		Line 53:
	We'll need netcat to connect our SSH session to the Tor network.		We'll need netcat to connect our SSH session to the Tor network.

	sudo apt install ~~openbsd-~~netcat		sudo apt install netcat-openbsd

	===== Connect to Raspberry =====		===== Connect to Raspberry =====

HR at 01:31, 21 March 2021

2021-03-21T01:31:34Z

← Older revision		Revision as of 01:31, 21 March 2021
Line 115:		Line 115:

	ssh raspberry-forward-tor		ssh raspberry-forward-tor

			== See also ==

			*[[UDP over SSH]] (UDP over SSH over Tor is also possible)

	== References ==		== References ==
	<div class="references-small"><references /></div>		<div class="references-small"><references /></div>

	[[Category:Networking]]

HR: /* Background */

2021-03-20T14:21:24Z

Background

← Older revision		Revision as of 14:21, 20 March 2021
Line 2:		Line 2:

	== Background ==		== Background ==
	Imagine you want to access a remote computer which is connected to a local network with Internet access. The remote computer has a local IP address which is not accessible from the ~~outside~~ unless the access point, where the remote computer is connected to, explicitly forwards the specific port(s) for the incoming connections to the computer.		Imagine you want to access a remote computer which is connected to a local network with Internet access. The remote computer has a local IP address which is not accessible from outside the local network unless the access point, where the remote computer is connected to, explicitly forwards the specific port(s) for the incoming connections to the computer.

	In the case you're at home and have access to the configuration of your access point that's not so hard to archive. But if the computer is located somewhere else e.g. as part of an installation in some venue, then forwarding the port can become tricky, e.g. because of burocracy. Given you are in such a tricky situation, then putting a little computer (like a Raspberry Pi) with Tor to the mix might be a workaround to consider.		In the case you're at home and have access to the configuration of your access point that's not so hard to archive. But if the computer is located somewhere else e.g. as part of an installation in some venue, then forwarding the port can become tricky, e.g. because of burocracy. Given you are in such a tricky situation, then putting a little computer (like a Raspberry Pi) with Tor to the mix might be a workaround to consider.

HR: /* Forwarding of local ports */

2021-03-20T14:16:48Z

Forwarding of local ports

← Older revision		Revision as of 14:16, 20 March 2021
Line 100:		Line 100:
	Then, when starting LCedit+, connect to ''localhost:4776'' . We're using port 4776 instead of 777 (LanBox default) to avoid invoking ssh with root privileges. Ports below 1024 are so called ''system ports'' and require root privileges.		Then, when starting LCedit+, connect to ''localhost:4776'' . We're using port 4776 instead of 777 (LanBox default) to avoid invoking ssh with root privileges. Ports below 1024 are so called ''system ports'' and require root privileges.

	Or you store the parameters in the SSH config file for easier invokation:		Or you store the parameters in the SSH config file (~/.ssh/config) for easier invokation:

	Host raspberry-forward-tor		Host raspberry-forward-tor
Line 111:		Line 111:
	LocalForward 4777 10.0.0.3:4777		LocalForward 4777 10.0.0.3:4777
	LocalForward 6454 10.0.0.3:6454		LocalForward 6454 10.0.0.3:6454

			Then invoke ssh with:

			ssh raspberry-forward-tor

	== References ==		== References ==

HR: /* Forwarding of local ports */

2021-03-20T14:12:38Z

Forwarding of local ports

← Older revision		Revision as of 14:12, 20 March 2021
Line 98:		Line 98:
	ssh -o "ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p" -o PreferredAuthentications=password -o PubkeyAuthentication=no -L 4776:10.0.0.3:777 -L 4777:10.0.0.3:4777 -L 6454:10.0.0.3:6454 pi@[onion address]		ssh -o "ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p" -o PreferredAuthentications=password -o PubkeyAuthentication=no -L 4776:10.0.0.3:777 -L 4777:10.0.0.3:4777 -L 6454:10.0.0.3:6454 pi@[onion address]

	Then, when starting LCedit+, connect to ''localhost:4776'' . We're using port 4776 instead of 777 (LanBox default) to avoid invoking ssh with root privileges. Ports below 1024 are so called ''~~reseverd~~ ports'' and require root privileges.		Then, when starting LCedit+, connect to ''localhost:4776'' . We're using port 4776 instead of 777 (LanBox default) to avoid invoking ssh with root privileges. Ports below 1024 are so called ''system ports'' and require root privileges.

	Or you store the parameters in the SSH config file for easier invokation:		Or you store the parameters in the SSH config file for easier invokation:

HR: /* Forwarding of local ports */

2021-03-20T14:07:34Z

Forwarding of local ports

← Older revision		Revision as of 14:07, 20 March 2021
Line 94:		Line 94:
	=== Forwarding of local ports ===		=== Forwarding of local ports ===

	Suppose there is also a LanBox in the remote network. We can connect to the LanBox via our Tor Raspi with our locally installed LCedit+ by forwarding a few ports towards the IP of the LanBox. ~~Suppose~~ the LanBox has the IP address 10.0.0.3, then the ssh command to forward the necessary ports is:		Suppose there is also a LanBox in the remote network. We can connect to the LanBox via our Tor Raspi with our locally installed LCedit+ by forwarding a few ports towards the IP of the LanBox. Given the LanBox has the IP address 10.0.0.3, then the ssh command to forward the necessary ports is:

	ssh -o "ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p" -o PreferredAuthentications=password -o PubkeyAuthentication=no -L 4776:10.0.0.3:777 -L 4777:10.0.0.3:4777 -L 6454:10.0.0.3:6454 pi@[onion address]		ssh -o "ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p" -o PreferredAuthentications=password -o PubkeyAuthentication=no -L 4776:10.0.0.3:777 -L 4777:10.0.0.3:4777 -L 6454:10.0.0.3:6454 pi@[onion address]

HR: Created page with "Create a SSHwikipedia:SSH_(Secure_Shell) connection via the Torwikipedia:Tor_(anonymity_network) network. == Background == Imagine you want to a..."

2021-03-19T16:16:02Z

Created page with "Create a SSH<ref>wikipedia:SSH_(Secure_Shell)</ref> connection via the Tor<ref>wikipedia:Tor_(anonymity_network)</ref> network. == Background == Imagine you want to a..."

New page

Create a SSH<ref>[[wikipedia:SSH_(Secure_Shell)]]</ref> connection via the Tor<ref>[[wikipedia:Tor_(anonymity_network)]]</ref> network.

== Background ==
Imagine you want to access a remote computer which is connected to a local network with Internet access. The remote computer has a local IP address which is not accessible from the outside unless the access point, where the remote computer is connected to, explicitly forwards the specific port(s) for the incoming connections to the computer.

In the case you're at home and have access to the configuration of your access point that's not so hard to archive. But if the computer is located somewhere else e.g. as part of an installation in some venue, then forwarding the port can become tricky, e.g. because of burocracy. Given you are in such a tricky situation, then putting a little computer (like a Raspberry Pi) with Tor to the mix might be a workaround to consider.

The Tor feature we want to use here is called onion service <ref>[[wikipedia:Tor_(anonymity_network)#Onion_services]]</ref>. Onion services can be any networked service you would run on a regular server, like SSH or HTTP(S), but are accessible via the Tor network. Onion services have the nice property that you can directly connect to the computer running that service, even if the computer is connected to a local network (with Internet access) and has no public IP address and without the necessity to forward any ports from the access point to the computer.

In addition to that we can use this Tor enabled computer to connect to other devices in the remote local network.

== Implementation ==

For our example setup we need:
* Raspberry Pi <ref>[[wikipedia:Raspberry_Pi]]</ref>
* Your computer

=== Raspberry Pi ===

'''Caveat:''' all commands are entered on the command-line interface <ref>[[wikipedia:Command-line_interface]]</ref>.

==== Install & configure Tor ====

sudo apt install tor

Now we configure the SSH onion service by editing ''/etc/tor/torrc'' . In the ''location-hidden services'' section add:

HiddenServiceDir /var/lib/tor/ssh_onion_service/
HiddenServicePort 22 127.0.0.1:22

Then we restart Tor:

sudo systemctl restart tor.service

==== Enable SSH server ====

sudo systemctl enable ssh.service

The Raspberry is now ready to receive SSH connections via the Tor network.

=== Your Computer ===

==== Linux (Ubuntu) ====

'''Caveat:''' all commands are entered on the command-line interface.

===== Install tor =====

sudo apt install tor

===== Install netcat =====

We'll need netcat to connect our SSH session to the Tor network.

sudo apt install openbsd-netcat

===== Connect to Raspberry =====

Now we're ready to connect our computer to the Raspberry via the Tor network. When invoking SSH we have basically two options:

# write all required parameters in the ssh command, or
# have the required parameters stored in a configuration file for easier invokation.

====== Parameters in SSH command ======

ssh -o "ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p" -o PreferredAuthentications=password -o PubkeyAuthentication=no pi@[onion address]

You'll find the onion address on the Raspberry:

sudo cat /var/lib/tor/ssh_onion_service/hostname

====== Parameters in SSH config file ======

Add your config to ~/.ssh/config

Host raspberry-tor
HostName [onion address]
User pi
PreferredAuthentications password
PubkeyAuthentication no
ProxyCommand nc -X 5 -x localhost:9050 %h %p

Then, to connect to the Raspberry, you just invoke your SSH session with:

ssh raspberry-tor

==== Mac ====
Todo

==== Windows ====
Todo

== Expanding the functionality ==
=== Forwarding of local ports ===

Suppose there is also a LanBox in the remote network. We can connect to the LanBox via our Tor Raspi with our locally installed LCedit+ by forwarding a few ports towards the IP of the LanBox. Suppose the LanBox has the IP address 10.0.0.3, then the ssh command to forward the necessary ports is:

ssh -o "ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p" -o PreferredAuthentications=password -o PubkeyAuthentication=no -L 4776:10.0.0.3:777 -L 4777:10.0.0.3:4777 -L 6454:10.0.0.3:6454 pi@[onion address]

Then, when starting LCedit+, connect to ''localhost:4776'' . We're using port 4776 instead of 777 (LanBox default) to avoid invoking ssh with root privileges. Ports below 1024 are so called ''reseverd ports'' and require root privileges.

Or you store the parameters in the SSH config file for easier invokation:

Host raspberry-forward-tor
HostName [onion address]
User pi
PreferredAuthentications password
PubkeyAuthentication no
ProxyCommand nc -X 5 -x localhost:9050 %h %p
LocalForward 4776 10.0.0.3:777
LocalForward 4777 10.0.0.3:4777
LocalForward 6454 10.0.0.3:6454

== References ==
<div class="references-small"><references /></div>

[[Category:Networking]]