Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor is a great sysadmin tool (2020)

jamieweb.net

Post reply on HN
Print view View original

11–20 of 125 posts

Re: Tor is a great sysadmin tool (2020)

#11

Post by Shank »

anaganisk wrote: post #5
lambdaba wrote: post #2

ngrok.com allows some of these, at full (or at least, much better speed, haven't benchmarked), and is mostly free (paid plan required for custom subdomains). Sharing this for those still unaware of it, it's a great service.

Or better yet, use cloudflare tunnels and setup an actual permanent tunnel with custom subdomain support. If you want it to be a temporary one, it supports that too. For FREE.

Is that part of Cloudflare Teams? No offense to Cloudflare, but their pricing is really unclear. I have an account and I use them for a lot, but they have 3 different "plans" and then they have various ad-hoc products. Tunnel just says "view in dashboard." [0] If I click on that link while logged in, I'm taken to my dashboard with no indication of how to use Tunnel or anything. The plans page [1] indicates that it's part of argo smart routing. If I click on "activate argo" it actually does the exact same thing as the teams "view in dashboard" button -- it redirects me to the dashboard and has no indication of being activated or anything. Really frustrating.

[0]: https://www.cloudflare.com/products/tunnel/

[1]: https://www.cloudflare.com/plans/

Re: Tor is a great sysadmin tool (2020)

#12

Post by [deleted] »

KingMachiavelli wrote: post #6
azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

For that use case why not just use Wireguard?

[deleted]

Re: Tor is a great sysadmin tool (2020)

#14

Post by kodablah »

azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

Yup, and it's easy to make server and client side tooling use Tor to make this mostly transparent. Latency/bandwidth isn't _that_ bad when communicating with an onion service. And it can be even faster if server anonymity isn't a goal (server set HiddenServiceSingleHopMode and HiddenServiceNonAnonymousMode and create ephemerial onion service with NonAnonymous).

I use Tor plenty to self-host services from my house that are reachable anywhere (and often have a web interface I can access via Orbot). No hole-punching necessary.

Re: Tor is a great sysadmin tool (2020)

#15

Post by segfaultbuserr »

rinron wrote: post #8

One very important thing not mentioned is that the tor exit node could be capturing your traffic or do a MITM attack. Its a great idea for testing but only after you have encryption working, and of course pay special attention to your ssh fingerprints.

If the endpoint is in your control and you'd like to experiment with Tor, you can configure your server as an Onion Service, so you are protected by Tor's own end-to-end encryption (whose traffic cannot be captured by MITM since the hostnames themselves are the public keys). For non-anonymous uses, you should active the "Single Service Onion" mode, so the 6-hop (extra 3-hop for server anonymity) is skipped, allowing standard 3-hop latency and performance. It also saves bandwidth for exit nodes - all non-exit relays can forward Onion traffic.

Re: Tor is a great sysadmin tool (2020)

#18

Post by azalemeth »

nine_k wrote: post #7
azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

If your hard-to-reach server can connect to the internet (via a bunch of NATs and whatnot), you can just make it access your box of choice by e.g. Wireguard, or plain SSH with port-forwaring, or attach it as a node to your ZeroTier private network. You only need a bunch of jump hosts if your target server has no Internet connectivity, and should not, in which case all these levels of bastions do make sense.

That requires having another publicly accessible box, or trusting ZeroTier though, doesn't it? The onion approach does not.

Re: Tor is a great sysadmin tool (2020)

#20

Post by ISL »

azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

Think from the beginning what will be the end: "I thought your security policy was too overbearing, so I used tor."

IT departments make their choices for reasons. The key is to help them understand your use-case, and they'll probably help you through the problem in a way that might limit collateral damage.

Source: have seen firewall bypasses (with a pre-shared key) get leveraged as a way to hack an entire university lab/department.

Post reply on HN