I am trying to setup SSH tunneling using tor on Ubuntu 14.04

I have added the tor repo:

deb http://mirror.noreply.org/pub/tor lenny main

And installing the following packages:

  - tor
  - connect-proxy

And this is my .ssh/config

Host *
CheckHostIP no
Compression yes
Protocol 2
ProxyCommand connect -4 -S localhost:9050 $(tor-resolve %h localhost:9050) %p

But when I try to SSH to a host I seem to get this error

OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /home/adithya/.ssh/config
debug1: /home/adithya/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Executing proxy command: exec connect -4 -S localhost:9050 $(tor-resolve localhost:9050) 22
debug1: identity file /home/adithya/.ssh/id_rsa type -1
debug1: identity file /home/adithya/.ssh/id_rsa-cert type -1
debug1: identity file /home/adithya/.ssh/id_dsa type -1
debug1: identity file /home/adithya/.ssh/id_dsa-cert type -1
debug1: identity file /home/adithya/.ssh/id_ecdsa type -1
debug1: identity file /home/adithya/.ssh/id_ecdsa-cert type -1
debug1: permanently_drop_suid: 1000
ERROR: Got error response: 91: 'request rejected or failed'.
FATAL: failed to begin relaying via SOCKS.
ssh_exchange_identification: Connection closed by remote host

Can someone please help me trouble shoot this?


  • Check your SocksPolicy settings. I've had the same problem, because my torrc contained default value of this entry (which is accept After changing the settings, ssh is working for me through tor.
    – mr_m1m3
    Oct 19, 2016 at 12:22
  • First of all, check your Tor logs - is it "fully bootstrapped" for 100%? and - please post your torrc configs for the tor you're using on both sides - let's fix it!
    – Alexey Vesnin
    Oct 19, 2016 at 16:47

1 Answer 1


I tend to use socat instead of connect, using the following ProxyCommand:

ProxyCommand socat STDIO SOCKS4A:localhost:%h:%p,socksport=9050

No need to use tor-resolve, as, quoting the man page,

In the command string, any occurrence of '%h' will be substituted by the host name to connect, '%p' by the port, and '%r' by the remote user name.

And I've verified that it indeed passes the name, as this works even when the HostName (not the Host) is a tor hidden service.

That being said, please note that I'm mainly using Gentoo, but I remember setting up this this command on Ubuntu, somewhere in 12.* (I don't have access to that machine any more).

  • I did try using socat. I am getting this error. 2015/09/04 07:47:35 socat[1913] E socks: connect request rejected or failed ssh_exchange_identification: Connection closed by remote host Do i have to make any configuration changes for socat?
    – Adithya
    Sep 4, 2015 at 2:18
  • Now this looks like tor itself is not accepting connections (or is accepting them on a different port). Please check where tor is listening (netstat -tlpn | grep tor, possibly with sudo for netstat. Also check your tor configuration (it will either be /etc/tor/torrc, ~/.tor/torrc, or if you use vidalia as well it will be ~/.vidalia/torrc or something similar. Look for SocksPort SocksListenAddress and SocksPolicy in those files.
    – Torinthiel
    Sep 4, 2015 at 8:05
  • netstat shows that it's running on 9050 and the same in torrc value for SocksPort. I don't know whats causing the error. I have tired this before and it had worked now it's just not working.
    – Adithya
    Sep 8, 2015 at 15:28
  • @Adithya sorry for late response. Maybe firewall in that case? iptables -L -n. And have you verified that it's not listening on external address only?
    – Torinthiel
    Oct 3, 2015 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .