4

I am trying to setup SSH tunneling using tor on Ubuntu 14.04

I have added the tor repo: 

deb http://mirror.noreply.org/pub/tor lenny main

And installing the following packages: 

  - tor
  - connect-proxy

And this is my .ssh/config

Host *
CheckHostIP no
Compression yes
Protocol 2
ProxyCommand connect -4 -S localhost:9050 $(tor-resolve %h localhost:9050) %p

But when I try to SSH to a host I seem to get this error

OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /home/adithya/.ssh/config
debug1: /home/adithya/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Executing proxy command: exec connect -4 -S localhost:9050 $(tor-resolve 192.168.0.10 localhost:9050) 22
debug1: identity file /home/adithya/.ssh/id_rsa type -1
debug1: identity file /home/adithya/.ssh/id_rsa-cert type -1
debug1: identity file /home/adithya/.ssh/id_dsa type -1
debug1: identity file /home/adithya/.ssh/id_dsa-cert type -1
debug1: identity file /home/adithya/.ssh/id_ecdsa type -1
debug1: identity file /home/adithya/.ssh/id_ecdsa-cert type -1
debug1: permanently_drop_suid: 1000
ERROR: Got error response: 91: 'request rejected or failed'.
FATAL: failed to begin relaying via SOCKS.
ssh_exchange_identification: Connection closed by remote host

Can someone please help me trouble shoot this?

Thanks,

Improve this question
2
  • Check your SocksPolicy settings. I've had the same problem, because my torrc contained default value of this entry (which is accept 192.168.0.1/16). After changing the settings, ssh is working for me through tor.
    – mr_m1m3
    Commented Oct 19, 2016 at 12:22
  • First of all, check your Tor logs - is it "fully bootstrapped" for 100%? and - please post your torrc configs for the tor you're using on both sides - let's fix it!
    – Alexey Vesnin ♦
    Commented Oct 19, 2016 at 16:47

1 Answer 1

Reset to default
2

I tend to use socat instead of connect, using the following ProxyCommand:

ProxyCommand socat STDIO SOCKS4A:localhost:%h:%p,socksport=9050

No need to use tor-resolve, as, quoting the man page,

In the command string, any occurrence of '%h' will be substituted by the host name to connect, '%p' by the port, and '%r' by the remote user name.

And I've verified that it indeed passes the name, as this works even when the HostName (not the Host) is a tor hidden service.

That being said, please note that I'm mainly using Gentoo, but I remember setting up this this command on Ubuntu, somewhere in 12.* (I don't have access to that machine any more).

Improve this answer
4
  • I did try using socat. I am getting this error. 2015/09/04 07:47:35 socat[1913] E socks: connect request rejected or failed ssh_exchange_identification: Connection closed by remote host Do i have to make any configuration changes for socat?
    – Adithya
    Commented Sep 4, 2015 at 2:18
  • Now this looks like tor itself is not accepting connections (or is accepting them on a different port). Please check where tor is listening (netstat -tlpn | grep tor, possibly with sudo for netstat. Also check your tor configuration (it will either be /etc/tor/torrc, ~/.tor/torrc, or if you use vidalia as well it will be ~/.vidalia/torrc or something similar. Look for SocksPort SocksListenAddress and SocksPolicy in those files.
    – Torinthiel
    Commented Sep 4, 2015 at 8:05
  • netstat shows that it's running on 9050 and the same in torrc value for SocksPort. I don't know whats causing the error. I have tired this before and it had worked now it's just not working.
    – Adithya
    Commented Sep 8, 2015 at 15:28
  • @Adithya sorry for late response. Maybe firewall in that case? iptables -L -n. And have you verified that it's not listening on external address only?
    – Torinthiel
    Commented Oct 3, 2015 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .