Hosting Tor hidden services with Whonix on remote server

Question

I want to use Whonix for my hidden services and am planning to use it on a remote dedicated server, the issue is I would have to connect to the dedicated server through SSH, will that compromise the security in any way ( as SSH will be through clearnet). I understand that Whonix will be located on a virtual box and have its own Tor tunnel but still the question arises as it will be a remote server and I will not have a physical access to the server.

Answer 1

Full disclosure:
I am a maintainer of Whonix.

I want to use Whonix for my hidden services and am planning to use it on a remote dedicated server,

Setting this up could become difficult, depending on the server. For example if the server really is "only" an OpenVZ VM, I don't think it will be possible to install VirtualBox or use physical isolation somehow. It's certainly possible on a root server (because that is just like a normal hardware computer under your control), but hosting VMs on vservers could be difficult. [Not impossible.] But this is another topic.

the issue is I would have to connect to the dedicated server through SSH, will that compromise the security in any way

Yes. The host of the server can see where the SSH connection is coming from. My advice: use Whonix to connect to that server. Only connect to that server using Whonix. For everything, ssh, file transfer, etc.

it will be a remote server and I will not have a physical access to the server

Not having physical security, as in someone else has physical access has grave disadvantages for security. Server hosts have full control. They can see everyone who is connecting to the server. (Unless, they are using Tor. Hence, use Tor when you connect to it.) They can also see, what the server is running from the management console (html files, data bases, passwords, configs, everything). Maybe in future it will be possible to securely servers in the cloud while not giving the host itself access by using RAM encryption (something like PrivateCore). But I don't think these are already secure and vetted systems. However, secure hosting in the cloud while not trusting the host is worth a separate discussion (most likely it has been asked on security.stackexchange already).