3

Tor recently started fiddling with Tor and found out I can host a Tor hidden service that will allow me to forward SSH traffic through a firewall. My setup is: I have a computer at home hosting a SSH Hidden Service on Tor with these settings:

SocksPort 9050
SocksListenAddress 127.0.0.1
HiddenServiceDir ./.hs/
HiddenServicePort <port number> 127.0.0.1:22

On my work computer I simply connect to this hidden service through Tor, so to make sure my traffic is being routed through the Tor-network i used torsocks.

So now my command to connect to the home pc shoudl be: torsocks ssh -p<port number> user@myhiddenservice.onion

Yet I keep getting the following error:

ERROR torsock[12879]: General SOCKS server failure (in socks5_recv_connect_reply() at socks5.c:516)

ssh: connect to host port : Connection refused

I don't know why I can't connect to the service, it seems to be running fine, no problems.

Please help, thanks!

1
  • if you ssh to localhost from the system running ssh, can you connect? (e.g. is your sshd bound explicitly to an interface?) also is the date, time and, timezone accurate on both your sshd system and your ssh client system? they must be to use onion services.
    – cacahuatl
    Jun 20 '16 at 20:37
2

You're not fully understanding how Tor works with traffic, let me explain : it has it's SOCKS listener through which one he can give you an access to the hidden service by default. That's it. It is definitely not an out-of-the-box transparent proxy. You need either to put SSH through SOCKS proxy loke this :

ssh -o ProxyCommand='nc -x <your-SockListenAddress-value>:<your-SocksPort-value> %h %p'  user@myhiddenservice.onion

or use a local mapping in torrc and forward all the traffic to the "mapping network" :

VirtualAddrNetworkIPv4 10.10.0.0/16
AutomapHostsOnResolve 1

via your firewall to : port number for transparent proxying. Tor itself does not offering any routing - it's just a door, Neo ;)

3
  • they're using torsocks in this instance, which would handle the forwarding of the traffic through tor without any extra steps.
    – cacahuatl
    Jun 20 '16 at 20:36
  • @canonizingironize I'd like to propose to rename torsocks to torsucks, actually - such a glitchy piece of sh..ellscript =) That's why I do recommend to use manuap proxy specification - this will work
    – Alexey Vesnin
    Jun 20 '16 at 20:52
  • it works fine. mostly it's not a shellscript it's a .so that hooks libc functions. it is more resistant to accidental leaks than native proxy settings and it works fine with ssh to .onion in my experience.
    – cacahuatl
    Jun 20 '16 at 21:19
0

I do it this way on my machines running Linux Devuan OS;

Install Tor openssh-server on your server. Setup a hidden service and stealth cookie for each remote user (Peter and Paul) Add the following to your server torrc file;

HiddenServiceDir /var/lib/tor/ssh-hs/

HiddenServiceVersion 2 #(note version 3 HS no longer supports torsocks ssh)

HiddenServiceAuthorizeClient stealth Peter, Paul

HiddenServicePort 22 127.0.0.1:22

Restart Tor

cat /var/lib/tor/ssh-hs/hostname

waocn6y277pycxqe.onion pMaCvZ9O96oicewJOQIpdB # client: Peter

ahc6pdvxjc3ojchv.onion f3cJeHARFIbGx+TX0itZex # client: Paul

The 16 characters plus .onion is the hidden service address and second column is the stealth authentication cookie. Provide the onion address and the stealth cookie to the intended recipient, Peter and Paul.

To access the system Peter and Paul need to add the stealth cookie, to their torrc file as follows;

HidServAuth waocn6y277pycxqe.onion pMaCvZ9O96oicewJOQIpdB # client: Peter

HidServAuth ahc6pdvxjc3ojchv.onion f3cJeHARFIbGx+TX0itZex # client: Paul

Restart Tor on these machines

HOW TO CONNECT METHOD 1 Install torsocks on the remote machines. Peter can now access the system using the following command:

torsocks ssh waocn6y277pycxqe.onion

and Paul

torsocks ssh ahc6pdvxjc3ojchv.onion

METHOD 2 Set the ssh-server to accept connections on the ssh-hs onion address and the address 127.0.0.1:22(same as HS) Add users Peter, Paul to sshd on the server. Peter and Paul must install sshuttle on the remove machines Connect to server from the remote machines by means of the following commands;

sshuttle --no-latency-control --dns -r peter@waocn6y277pycxqe.onion 0.0.0.0/0

sshuttle --no-latency-control --dns -r paul@ahc6pdvxjc3ojchv.onion 0.0.0.0/0

This was my original reference; Chuck Peters https://axs.org/tor/ssh_access_over_Tor.html but unfortunately the site no longer seems to exsists.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.