What exactly is considered best practice when setting up an open SSH server as a Tor hidden service? I do it this way, but I feel like there's a better way of doing this:

I just set SSH up as a HiddenServiceDir under /var/lib/tor/ssh, find my assigned hostname and add these lines to my ~/.ssh/config

Host myhost
HostName d6frsudqtx123vxf.onion
ProxyCommand socat STDIO SOCKS4A:,socksport=9050
Is there a better or more secure way of doing this?


  • seems fine. Might be concerned about the way you authentication so it only accepts standard usernames and you never authenticate via public key. You should probably also hard code the SSH fingerprint of the service into the SSH config so that you don't have to worry about verifying it. – Lizbeth Jun 4 '15 at 19:55
  • That's a good idea, I'll do that. – Paul Sypnowich Jun 4 '15 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.