5

I noticed that when using iptables_torify to force connections through TOR that .onion addresses are mapped to local virtual IPs in the 10.66.x.x range. This is indicated in the torrc file:

VirtualAddrNetwork 10.66.0.0/255.255.0.0
AutomapHostsOnResolve 1

Unfortunately, TOR is constantly assigning different IPs to the same hidden service which is causing a few problems. For example:

Whenever I use my local ssh client to connect to a hidden service I get some kind of message like:

The authenticity of host 'blahblahblahblah.onion (10.66.51.17)' can't be established. ECDSA key fingerprint is 0a:1b:2c:..... Are you sure you want to continue connecting (yes/no)?

Now if I click yes all is good until next time I reboot the computer I get the same message again with a different address (eg: 10.66.172.189). Sometimes I get an address that was already used for a different hidden service and I have to go to ~/.ssh/know_keys to delete the line in question before I can connect.

I really need to be able to just tell tor to permanently map address blahblahblah.onion to let's say 10.66.10.10. That way I could just ssh 10.66.10.10 and have the ssh fingerprint for 10.66.10.10 listed once and for all in my ~/.ssh/knownhosts file.

Thank you Linostar for suggesting:

ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user@host

However SSH is only one of my problems that I showed for illustration purposes. And actually I would like to use the .ssh/known_keys file to verify the keys of the servers I'm connecting to rather than just blindly connecting to the server.

I also need to use other programs that may only give the option of specifying an IP address for outgoing connections. For example, if I want to tell FireFox to connect to a proxy server (the proxy server has a .onion address). I'm sure there's a work around for that too but just specifying the ip address would be a lot simpler for me.

Anyway, I don't want to rely on iptables to send DNS requests to TOR when it would be a lot simpler and more secure to just specify the ip address of the hidden service. On some servers I'm unable to configure iptables anyway. And I don't want to take the risk of a DNS leak in case I made an error configuring iptables or if the configuration was changed without my knowledge.

All that to say that mapping an .onion address to a specific IP would be a very important benefit that would save a lot of trouble for nothing. Hopefully somebody has a solution!

Improve this question
1
  • You should be able to use an onion address as a proxy in Firefox. Remember that local virtual IP addresses are meant to be temporary, and the benefits from making them static can be found elsewhere (or so I think).
    – Linostar
    Commented Jan 31, 2015 at 11:34

1 Answer 1

Reset to default
2

I am not aware of any method to map .onion addresses to local IP addresses like you described, so I am going to propose an alternative approach.

When connecting to an onion SSH service, use the following command syntax:

ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user@host

That will make ssh bypass the KnownHosts files and not ask for fingerprint checking anymore, which is kind of useless when you have an ever-varying service IP address.

To make things easier, you can make an alias of the command above. For example:

alias sshtor='ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'

and place that alias line in your ~/.bashrc, so you can connect to onion SSH servers by typing:

sshtor user@host
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .