2

What exactly is considered best practice when setting up an open SSH server as a Tor hidden service? I do it this way, but I feel like there's a better way of doing this:

I just set SSH up as a HiddenServiceDir under /var/lib/tor/ssh, find my assigned hostname and add these lines to my ~/.ssh/config

Host myhost
HostName d6frsudqtx123vxf.onion
ProxyCommand socat STDIO SOCKS4A:127.0.0.1:%h:%p,socksport=9050
Is there a better or more secure way of doing this?

Regards.

  • seems fine. Might be concerned about the way you authentication so it only accepts standard usernames and you never authenticate via public key. You should probably also hard code the SSH fingerprint of the service into the SSH config so that you don't have to worry about verifying it. – Lizbeth Jun 4 '15 at 19:55
  • That's a good idea, I'll do that. – Paul Sypnowich Jun 4 '15 at 20:43
  • @Lizbeth - Could you please clarify "Might be concerned about the way you authentication so it only accepts standard usernames and you never authenticate via public key."? You can't be saying we should never authenticate with a key (as opposed to a password), are you? And by "only accepts standard unames" are you referring to setting the AllowUsers keyword in the sshd config? – Diagon Jun 30 at 12:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.