On my VPS server, I would like to set up ssh access only from the Tor network. I know that if I torrify ssh it will be visible only on the Tor network. However, my server works only in clearn and it is not configured Tor. Is there a possibility to configure ssh so as to permit a login from a specific network, and that network will be Tor? Can I define the whole Tor network as the subnet?
2 Answers
To define the whole network as subnet, logically, first you would need to know all tor nodes/servers. there are several thousands of nodes and some of them are not public. but if you can collect all that information, maybe it would be possible. but as I know, many tor nodes are at amazon hosting, I think if they just restart server they can change IP address.
-
yeah, i know i am a dreamer :) but thanks for answer– user732Commented Mar 24, 2014 at 21:20
Below just my though, PollyPocket.
You could define firewall rules to drop all incoming packets to your sshd port except those originating from defined tor exit nodes. Then you could use these exit nodes only to connect to your sshd.
The issue here is a lack of vhost support by sshd so you cannot be sure whether an incoming connection originates from tor or an exit node itself (in case an exit node acts as a clearnet proxy too) as long as you don't control the exit node yourself. A workaround would be to allow only these exit nodes hosted securely by you.
Interesting question very much. Hope to see further discussion.
-
Cool, thanks, sound interesting. I am using private bridge and own private exit node :)– user732Commented May 10, 2015 at 6:42
-
1You may be also interested in mktorfw.sh script of tor-hacking-utils from pseudo-flaw.net. It "create a very restrictive iptables firewall rules that allow only those IP/port combinations found in /var/lib/tor/cached-descriptors* (or /var/lib/tor/cached-routers* for pre-0.2.0.7)"– RemikCommented Jun 24, 2015 at 15:06