2

Tor recently started fiddling with Tor and found out I can host a Tor hidden service that will allow me to forward SSH traffic through a firewall. My setup is: I have a computer at home hosting a SSH Hidden Service on Tor with these settings:

SocksPort 9050
SocksListenAddress 127.0.0.1
HiddenServiceDir ./.hs/
HiddenServicePort <port number> 127.0.0.1:22

On my work computer I simply connect to this hidden service through Tor, so to make sure my traffic is being routed through the Tor-network i used torsocks.

So now my command to connect to the home pc shoudl be: torsocks ssh -p<port number> user@myhiddenservice.onion

Yet I keep getting the following error:

ERROR torsock[12879]: General SOCKS server failure (in socks5_recv_connect_reply() at socks5.c:516)

ssh: connect to host port : Connection refused

I don't know why I can't connect to the service, it seems to be running fine, no problems.

Please help, thanks!

  • if you ssh to localhost from the system running ssh, can you connect? (e.g. is your sshd bound explicitly to an interface?) also is the date, time and, timezone accurate on both your sshd system and your ssh client system? they must be to use onion services. – cacahuatl Jun 20 '16 at 20:37
1

You're not fully understanding how Tor works with traffic, let me explain : it has it's SOCKS listener through which one he can give you an access to the hidden service by default. That's it. It is definitely not an out-of-the-box transparent proxy. You need either to put SSH through SOCKS proxy loke this :

ssh -o ProxyCommand='nc -x <your-SockListenAddress-value>:<your-SocksPort-value> %h %p'  user@myhiddenservice.onion

or use a local mapping in torrc and forward all the traffic to the "mapping network" :

VirtualAddrNetworkIPv4 10.10.0.0/16
AutomapHostsOnResolve 1

via your firewall to : port number for transparent proxying. Tor itself does not offering any routing - it's just a door, Neo ;)

  • they're using torsocks in this instance, which would handle the forwarding of the traffic through tor without any extra steps. – cacahuatl Jun 20 '16 at 20:36
  • @canonizingironize I'd like to propose to rename torsocks to torsucks, actually - such a glitchy piece of sh..ellscript =) That's why I do recommend to use manuap proxy specification - this will work – Alexey Vesnin Jun 20 '16 at 20:52
  • it works fine. mostly it's not a shellscript it's a .so that hooks libc functions. it is more resistant to accidental leaks than native proxy settings and it works fine with ssh to .onion in my experience. – cacahuatl Jun 20 '16 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.