Tor is a great sysadmin tool (2020) • Hacker News Board

Re: Tor is a great sysadmin tool (2020)

#31

Post by pigeonhole123 » Tue, Aug 31, 2021, 6:19 PM UTC

PaywallBuster wrote: post #24

Shank wrote: post #11

Earlier quoted context omitted.

Is that part of Cloudflare Teams? No offense to Cloudflare, but their pricing is really unclear. I have an account and I use them for a lot, but they have 3 different "plans" and then they have various ad-hoc products. Tunnel just says "view in dashboard." [0] If I click on that link while logged in, I'm taken to my dashboard with no indication of how to use Tunnel or anything. The plans page [1] indicates that it's…

It's confusing for me too product page says it requires paid Argo (smart routing) subscription https://www.cloudflare.com/en-gb/products/tunnel/ the blog page says its free https://blog.cloudflare.com/tunnel-for-everyone/ and actually you can install and run it quite easily brew uninstall cloudflare/cloudflare/cloudflared cloudflared login cloudflared tunnel this will launch a tunnel with a random subdomain listening…

It became free recently, so they've probably just forgotten to update their documentation which seems to be a pattern with CF.

Re: Tor is a great sysadmin tool (2020)

#32

Post by tempfs » Tue, Aug 31, 2021, 6:19 PM UTC

Using Tor for anything in a corporate network will rightfully get you into serious shit with IT security.

I see a lot of people also advocating ngrok, wireguard, etc. You all may not realize that actual threat actors use all of these same techniques and making yourself look like them could very well lead to your termination as this kind of circumvention of security controls is absolutely a threat to the org and a violation of security policy.

TLDR; If you need remote access, use the proper channels....pretty please. For everyone's sake.

Re: Tor is a great sysadmin tool (2020)

#33

Post by marcodiego » Tue, Aug 31, 2021, 6:22 PM UTC

krtyiktj wrote: post #10

azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your head would spin. you'd get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.

Is tor traffic that easy to detect?

Re: Tor is a great sysadmin tool (2020)

#34

Post by blendergeek » Tue, Aug 31, 2021, 6:28 PM UTC

marcodiego wrote: post #33

krtyiktj wrote: post #10

Earlier quoted context omitted.

at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your head would spin. you'd get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.

Is tor traffic that easy to detect?

Yes. It goes to a known tor node.

Re: Tor is a great sysadmin tool (2020)

#35

Post by Forbo » Tue, Aug 31, 2021, 6:28 PM UTC

marcodiego wrote: post #33

krtyiktj wrote: post #10

Earlier quoted context omitted.

at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your head would spin. you'd get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.

Is tor traffic that easy to detect?

Relay and exit node IPs aren't private, so admins will often collect them and just block them en masse. This causes problems, because a lot of that same IP space will often be shared with things like pool.ntp.org nodes.

Re: Tor is a great sysadmin tool (2020)

#36

Post by swiley » Tue, Aug 31, 2021, 6:29 PM UTC

I loved TOR when I was a broke student without enough money to have one or two always on machines with public IPs I could reverse proxy to.

Re: Tor is a great sysadmin tool (2020)

#37

Post by fswwi » Tue, Aug 31, 2021, 6:30 PM UTC

rinron wrote: post #8

One very important thing not mentioned is that the tor exit node could be capturing your traffic or do a MITM attack. Its a great idea for testing but only after you have encryption working, and of course pay special attention to your ssh fingerprints.

Cloudflare is mitm, btw.

Re: Tor is a great sysadmin tool (2020)

#38

Post by rattlesnakedave » Tue, Aug 31, 2021, 6:33 PM UTC

krtyiktj wrote: post #10

azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your head would spin. you'd get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.

> you'd get an unpleasant phone call or visit to your office and be warned

sometimes I wonder why IT departments and security in general get a bad wrap, then I see things like this.

Re: Tor is a great sysadmin tool (2020)

#39

Post by eximius » Tue, Aug 31, 2021, 6:39 PM UTC

So the big message is proxies are useful? I mean, sure. I'm not sure why Tor makes a better choice than anything else?

Re: Tor is a great sysadmin tool (2020)

#40

Post by sillysaurusx » Tue, Aug 31, 2021, 6:40 PM UTC

derefr wrote: post #27

krtyiktj wrote: post #10

Earlier quoted context omitted.

at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your head would spin. you'd get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.

Obviously, you should plan around this by gathering all the MAC addresses of every machine in the office, and then have your machine spoof through them in rotation. /s

It makes me sad every time I think about it, but Aaron Swartz did this during his saga. Well, sort of: he incremented the MAC address by 1.

Point being, it's not foolproof. If some clever undergrad is thinking about dodging the suits, win by fooling them, not by fighting them.

If you do insist on fighting, though, start at https://www.whonix.org/wiki/Mental_Model and then read the entire Whonix wiki https://www.whonix.org/wiki/Documentation. It's what I used when I was serious about dodging the cartels, and that knowledge will protect you as much as anything will.

(You'll hopefully conclude that the protection is too brittle to risk your life, as I did.)