1

I've tried to set up the use of ssh via tor.

/etc/tor/torrc:

[...]

HiddenServiceDir /var/lib/tor/sshd
HiddenServicePort 443 127.0.0.1:443

/var/lib/tor/sshd has the hostname and private_key after reloading the service.

SSH is set up with private/public key authentication on port 443 and works fine without tor.

On the client I've edited the ~/.ssh/config:

Host *.onion
    Port 443 
    User user
    HostName <hostname>.onion
    ProxyCommand ncat --proxy 127.0.0.1:9050 --proxy-type socks5 %h %p
    IdentityFile ~/.ssh/id_ed25519

Now, if I try to connect from the client with ssh -vvv -o LogLevel=DEBUG3 <hostname>.onion, the following output is shown:

OpenSSH_7.3p1 Debian-1, OpenSSL 1.0.2j  26 Sep 2016
debug1: Reading configuration data /home/user/.ssh/config
debug1: /home/user/.ssh/config line 1: Applying options for <hostname>.onion
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug3: kex names ok: [curve25519-sha256@libssh.org]
debug1: Executing proxy command: exec ncat --proxy 127.0.0.1:9050 --proxy-type socks5 <hostname>.onion 443
debug1: permanently_drop_suid: 1000
debug1: identity file /home/user/.ssh/id_ed25519 type 4
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.3p1 Debian-1
^C

Permissions on the private/public key files:

-rw-------  1 user user  444 Oct 22 12:36 id_ed25519
-rw-------  1 user user   93 Oct 22 12:36 id_ed25519.pub
-rw-------  1 user user 3.4K Oct 22 12:36 id_rsa
-rw-------  1 user user  737 Oct 22 12:36 id_rsa.pub

If I use torify, like torify ssh -p 443 -vvv user@<hostname>.onion. The following output is printed. The command keeps awaiting input, but nothing else happens.

OpenSSH_7.3p1 Debian-1, OpenSSL 1.0.2j  26 Sep 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug3: kex names ok: [curve25519-sha256@libssh.org]
debug2: resolving "<hostname>.onion" port 443
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to <hostname>.onion [127.42.42.0] port 443.

after a while it times out:

[Oct 22 19:03:02] ERROR torsocks[29886]: Connection timed out (in socks5_recv_connect_reply() at socks5.c:536)
debug1: connect to address 127.42.42.0 port 443: Connection timed out
ssh: connect to host <hostname>.onion port 443: Connection timed out

sudo tail -f /var/log/auth.log | grep sshd shows absolutely no activity when I try to connect.

Where do I start troubleshooting?

EDIT Apparently it didn't suffice to reload the tor service on the server side. After a sudo service tor restart everything worked just fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.