docs/docs/ssh-over-tor.md

SSH over Tor

One of the best ways to maintain your anonymity on Tilde Black is to connect to ssh using tor. Your home IP address will be hidden from other users.

Recommended: ~/.ssh/config

Add something like this in your ~/.ssh/config:

# tilde.black

# create entries like these for all the usernames you want to use:
Host black-aaa
    User aaa

Host black-bbb
    User bbb

Host black*
    Port 2222
    # always connect over Tor
    HostName black6kfjetfuzaeozz7fs53whh7xtd4e27telrf5fg5kgdt5ah5plad.onion
    ProxyCommand nc -x 127.0.0.1:9050 -X 5 %h %p
    VerifyHostKeyDNS no
    # use a key created just for tilde.black
    IdentityFile ~/.ssh/id_black
    # optionally, set a default username
    User ccc

Then connect with ssh black or ssh black-<username>. This way you can never accidentally connect through plain TCP.

Requirements for this to work are that the tor daemon is running and netcat (nc) is installed.

Easy Mode

Before trying the rest of this document, you can try the easy-mode for ssh over tor:

• Install tor
• Run tor
• torify ssh @black6kfjetfuzaeozz7fs53whh7xtd4e27telrf5fg5kgdt5ah5plad.onion -p 2222

If that doesn't work for you for any reason, the process below is more explicit and will likely solve your problems.

Detail Mode

Overview

In order to ssh over tor, we'll need some way to make our terminal session or a terminal command run over the tor network. My favorite way to do this is with a program called torsocks. This utility pushes a single command or an entire shell through a socks proxy to your tor connection. Since torsocks is just a socks proxy that means we'll need to do a couple things to get it to work.

You'll need to:

• Install tor
• Configure tor
• Install torsocks
• Configure torsocks
• Start tor & torsocks
• ssh

Step 1: Install tor

Just like on the server you'll need to install tor on your local machine. Read up on the tor website to see which method works best for your operating system. It's probably a one-liner.

Step 2: Configure tor

We need to configure our local tor differently than we did the server. We don't need any hidden services this time, but we do need to allow local connections to use it as a SOCKS proxy. Here's the key lines you'll need to uncomment, change, or add:

SOCKSPort 9050
SOCKSPolicy accept 192.168.0.0/16
SOCKSPolicy accept6 FC00::/7
ControlPort 9051
CookieAuthentication 1

Step 3: Install torsocks

sudo apt install torsocks # linux
pkg_add torsocks # openbsd
brew install torsocks # probably works on osx?

Step 4: Configure torsocks

To be honest, I don't remember if this is required or if it comes like this out of the box. Edit the file /etc/tor/torsocks.conf and verify that the following lines are present and not commented out:

TorAddress 127.0.0.1
TorPort 9050

Step 5: Start tor & torsocks

Now that everything is all configured, whenever you want to run torsocks you'll need to first start tor in another terminal or tmux pane. Running tor is as easy as typing:

$ tor

You'll get some interesting output before it eventually says 100% bootstrapped. That means you're up and running. Now in your other terminal window you can start the torsocks proxy connection like so:

$ . torsocks on

This will respond back with: "Tor mode activated. Every command will be torified for this shell." And that's exactly it. You should be fully running now and able to try your ssh connection.

Step 6: ssh

$ ssh <username>@black6kfjetfuzaeozz7fs53whh7xtd4e27telrf5fg5kgdt5ah5plad.onion -p 2222

Step 7: Verify fingerprints

The Tilde.Black ssh fingerprints are listed below. Please verify your connection the first time you handshake with the server.

2048 SHA256:607+v+LKU8JMu3IBZ5TybQoU/R8kKsamYvtbEnW/LwA [tilde.black]:2222 (RSA)
256 SHA256:9WydxCE5fOFWfrOwZrJEKIm8OFhi+7vt5VsF7CGBDxg [tilde.black]:2222 (ECDSA)
256 SHA256:kCUXtju61+hD0wLZ0lb6OisP2Qf2K7hwyxTSvz5VoFM [tilde.black]:2222 (ED25519)

Optional: Configure SSH to Handle .onion Addresses

Adding the following lines to ~/.ssh/config will allow ssh(1) to connect to onion addresses using the Tor daemon's SOCKS proxy:

Host *.onion
    ProxyCommand /usr/bin/nc -xlocalhost:9050 -X5 %h %p

Now that ssh(1) knows how to connect to onion addresses, a convenient shortcut can be added for tilde.black's onion address:

Host tilde.black.onion
    HostName black6kfjetfuzaeozz7fs53whh7xtd4e27telrf5fg5kgdt5ah5plad.onion
    Port 2222
    <your-normal-configuration>

With those two additions ssh(1) can connect to tilde.black's onion address though a much more memorable name:

ssh user@tilde.black.onion

For more information about configuring SSH, see Configuring SSH