I've tried to set up the use of ssh via tor.
/etc/tor/torrc:
[...]
HiddenServiceDir /var/lib/tor/sshd
HiddenServicePort 443 127.0.0.1:443
/var/lib/tor/sshd has the hostname
and private_key
after reloading the service.
SSH is set up with private/public key authentication on port 443 and works fine without tor.
On the client I've edited the ~/.ssh/config
:
Host *.onion
Port 443
User user
HostName <hostname>.onion
ProxyCommand ncat --proxy 127.0.0.1:9050 --proxy-type socks5 %h %p
IdentityFile ~/.ssh/id_ed25519
Now, if I try to connect from the client with ssh -vvv -o LogLevel=DEBUG3 <hostname>.onion
, the following output is shown:
OpenSSH_7.3p1 Debian-1, OpenSSL 1.0.2j 26 Sep 2016
debug1: Reading configuration data /home/user/.ssh/config
debug1: /home/user/.ssh/config line 1: Applying options for <hostname>.onion
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug3: kex names ok: [[email protected]]
debug1: Executing proxy command: exec ncat --proxy 127.0.0.1:9050 --proxy-type socks5 <hostname>.onion 443
debug1: permanently_drop_suid: 1000
debug1: identity file /home/user/.ssh/id_ed25519 type 4
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.3p1 Debian-1
^C
Permissions on the private/public key files:
-rw------- 1 user user 444 Oct 22 12:36 id_ed25519
-rw------- 1 user user 93 Oct 22 12:36 id_ed25519.pub
-rw------- 1 user user 3.4K Oct 22 12:36 id_rsa
-rw------- 1 user user 737 Oct 22 12:36 id_rsa.pub
If I use torify
, like torify ssh -p 443 -vvv user@<hostname>.onion
. The following output is printed. The command keeps awaiting input, but nothing else happens.
OpenSSH_7.3p1 Debian-1, OpenSSL 1.0.2j 26 Sep 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug3: kex names ok: [[email protected]]
debug2: resolving "<hostname>.onion" port 443
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to <hostname>.onion [127.42.42.0] port 443.
after a while it times out:
[Oct 22 19:03:02] ERROR torsocks[29886]: Connection timed out (in socks5_recv_connect_reply() at socks5.c:536)
debug1: connect to address 127.42.42.0 port 443: Connection timed out
ssh: connect to host <hostname>.onion port 443: Connection timed out
sudo tail -f /var/log/auth.log | grep sshd
shows absolutely no activity when I try to connect.
Where do I start troubleshooting?
EDIT Apparently it didn't suffice to reload the tor service on the server side. After a sudo service tor restart
everything worked just fine.
ProxyCommand ncat --nodns --proxy 127.0.0.1:9050 --proxy-type socks5 --proxy-auth %h:ssh_%p %h %p
. Could you try if this works? What ncat version do you have installed?