I have set up a relay with its own dynamic public IP directly on the Internet. The only port allowed on the public interface is the ORPort, and this is the way I want to keep it. However, it would be beneficial to also let this relay be reachable from my private network for management purposes. I would like both SSH and Control Port. The relay should not have Internet access through the private network.
What is the best way to achieve this? Are there security concerns with this setup?
Thanks!
Recommendation: SSH over Tor. Create an v3 onion service for SSH. This will reduce your attack surface to only allow connections from Tor but not from the internet. Best practice for SSH security is to use a key to log in and not a password. Also, you can have SSH run on 2222 or some random port instead of the standard port 22 to further hide that it is actually out there.
The negative is that SSH over Tor is noticeable laggy. Not to the point of being unusable, but to the point that it can be really irritating if you are expecting a near instantaneous response time.
[warn] Tor is currently configured as a relay and a hidden service. That's not very secure: you should probably run your hidden service in a separate Tor process, at least -- see https://trac.torproject.org/8742 Any comments to this?
Commented
Jan 5, 2020 at 0:53
ControlPort is not so safe to be opened just by itself even in a private network, but a STunnel with a strict local CA and certificate verification solves this problem easily. SSH port can be opened to your private network, but for public network just make a hidden service for it with the client key to avoid the service guessing and corresponding attack vectors
