2

I've tried to set up the use of ssh via tor.

/etc/tor/torrc:

[...]

HiddenServiceDir /var/lib/tor/sshd
HiddenServicePort 443 127.0.0.1:443

/var/lib/tor/sshd has the hostname and private_key after reloading the service.

SSH is set up with private/public key authentication on port 443 and works fine without tor.

On the client I've edited the ~/.ssh/config:

Host *.onion
    Port 443 
    User user
    HostName <hostname>.onion
    ProxyCommand ncat --proxy 127.0.0.1:9050 --proxy-type socks5 %h %p
    IdentityFile ~/.ssh/id_ed25519

Now, if I try to connect from the client with ssh -vvv -o LogLevel=DEBUG3 <hostname>.onion, the following output is shown:

OpenSSH_7.3p1 Debian-1, OpenSSL 1.0.2j  26 Sep 2016
debug1: Reading configuration data /home/user/.ssh/config
debug1: /home/user/.ssh/config line 1: Applying options for <hostname>.onion
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug3: kex names ok: [curve25519-sha256@libssh.org]
debug1: Executing proxy command: exec ncat --proxy 127.0.0.1:9050 --proxy-type socks5 <hostname>.onion 443
debug1: permanently_drop_suid: 1000
debug1: identity file /home/user/.ssh/id_ed25519 type 4
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.3p1 Debian-1
^C

Permissions on the private/public key files:

-rw-------  1 user user  444 Oct 22 12:36 id_ed25519
-rw-------  1 user user   93 Oct 22 12:36 id_ed25519.pub
-rw-------  1 user user 3.4K Oct 22 12:36 id_rsa
-rw-------  1 user user  737 Oct 22 12:36 id_rsa.pub

If I use torify, like torify ssh -p 443 -vvv user@<hostname>.onion. The following output is printed. The command keeps awaiting input, but nothing else happens.

OpenSSH_7.3p1 Debian-1, OpenSSL 1.0.2j  26 Sep 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug3: kex names ok: [curve25519-sha256@libssh.org]
debug2: resolving "<hostname>.onion" port 443
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to <hostname>.onion [127.42.42.0] port 443.

after a while it times out:

[Oct 22 19:03:02] ERROR torsocks[29886]: Connection timed out (in socks5_recv_connect_reply() at socks5.c:536)
debug1: connect to address 127.42.42.0 port 443: Connection timed out
ssh: connect to host <hostname>.onion port 443: Connection timed out

sudo tail -f /var/log/auth.log | grep sshd shows absolutely no activity when I try to connect.

Where do I start troubleshooting?

EDIT Apparently it didn't suffice to reload the tor service on the server side. After a sudo service tor restart everything worked just fine.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.