My SSH Trick

10 hours of jetlag and rainy afternoon naps don’t mix. It’s 2 minutes to 2AM here in Provo, UT and I can’t sleep so I’m blogging.

I want to ssh into a machine that doesn’t have any external IP. In the case of my situation at home, I get a 192.168… IP from my ISP because of a shared connection. In other cases, I have VM’s with natted IP’s that also have no direct way in.

I could pay for a VPN service and vpn into these machines, but instead I’m using a free way of doing it. I use Tor.

Here’s how it works, the Tor service reaches out to the Tor network and is listening on port 22 (or whatever port I choose for ssh) for incoming requests. I use “torsocks ssh zzzzzzzzz.onion” from my laptop and I am in. This bypasses the external internet and gives me a pretty secure route from my laptop to my home machine only via Tor.

Here’s how I set it up with OpenSUSE

On your remote or inaccessible server:

$ sudo zypper in tor

This installs the tor service and the torsocks proxy app.

$ sudo vim /etc/tor/torrc

Uncomment the following lines:

HiddenServiceDir /var/lib/tor/hidden_service/
HiddenServicePort 22 127.0.0.1:22
$sudo systemctl start tor

The service is now started and you should have a new .onion address

$ cat /var/lib/tor/hidden_service/hostname

On your local machine/laptop/etc:

$ sudo zypper in tor
$ sudo systemctl start tor
$ torsocks ssh xxxxxxxxx.onion

This is a cool trick. Of course you can use it on any server/VM/etc even if they do have accessible IP’s. In those cases, I suggest that you close the firewall on port 22 and allow it to be only accessible via Tor. There is no need to have extra ports open to the internet.

Using Tor is a great way to add security to your network communication. In addition to the SSH encryption, the packets have additional encryption due to the nature of how Tor works.

About privacy. You also benefit from the inherent privacy of the Tor network which you might not get if you believe that your ISP, etc is gathering data on it’s users. If they are monitoring packets are that interested, they can probably see that you are using Tor but they can’t see what you are doing or where you are connecting. Is it more or less private that using the Tor Browser? I don’t know. It’s worth looking into. My feeling is that since ssh is low-bandwidth, has no possible extra problems that browsers have such as javascript, vulnerabilities, etc. it probably is as safe or safer.

Anyway, I hope this helps people out if you’re like me and have to make do with an ISP that makes using the web just a little harder.

One last thing. Tor is more laggy than a straight connection. You’re not doing anything wrong, it’s just a side-effect of how this all works.

Advertisements

3 thoughts on “My SSH Trick

  1. Good info & I like to keep track of all the different ways to access a remote machine, so this is a new one for me! At one time I ran my remote linux apps on a windows desktop, using an x emulation and ssh. Other useful options are winswitch/xpra and neorouter. Winswitch & xpra allow use of remote desktop and/or integrate individual remote apps onto the local host. Neorouter is an easy to use vpn, works with tigervnc, nextcloud, etc. and integrates linux / windows / mac machines. TigerVNC is optimized for linux and Ultravnc is optimized for windows, so I use whichever one the server machine runs best.

    Liked by 1 person

  2. interesting!!
    I can access to my machine (a little Pi witha Nextcloud and a couple sevices more) via dinamic dns service, and set up a port forward in my router.
    With this trick that is not necesary?

    ‘ve phun!!

    Liked by 1 person

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.