3

What exactly is considered best practice when setting up an open SSH server as a Tor hidden service? I do it this way, but I feel like there's a better way of doing this:

I just set SSH up as a HiddenServiceDir under /var/lib/tor/ssh, find my assigned hostname and add these lines to my ~/.ssh/config 

Host myhost
HostName d6frsudqtx123vxf.onion
ProxyCommand socat STDIO SOCKS4A:127.0.0.1:%h:%p,socksport=9050
Is there a better or more secure way of doing this?

Regards.

Improve this question
3
  • seems fine. Might be concerned about the way you authentication so it only accepts standard usernames and you never authenticate via public key. You should probably also hard code the SSH fingerprint of the service into the SSH config so that you don't have to worry about verifying it.
    – Lizbeth
    Jun 4, 2015 at 19:55
  • That's a good idea, I'll do that.
    – Paul Sypnowich
    Jun 4, 2015 at 20:43
  • @Lizbeth - Could you please clarify "Might be concerned about the way you authentication so it only accepts standard usernames and you never authenticate via public key."? You can't be saying we should never authenticate with a key (as opposed to a password), are you? And by "only accepts standard unames" are you referring to setting the AllowUsers keyword in the sshd config?
    – Diagon
    Jun 30, 2019 at 12:20

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .