Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor is a great sysadmin tool (2020)

jamieweb.net

Post reply on HN
Print view View original

41–50 of 125 posts

Re: Tor is a great sysadmin tool (2020)

#41

Post by throwaway09223 »

lifeisstillgood wrote: post #13

Being a small cog, but using clever tricks to get your job done is not solving the problem. An organisation that prevents itself from acting rationally is an organisation that should die Schumpter-style. Please don't prevent it.

I'm not seeing where this relates to organizational dysfunction. Using an external point to test a system is a standard practice.

I'm also a little confused because preventing someone from using their abilities to problem solve would be a cause of dysfunction -- a seemingly avoidable one.

Re: Tor is a great sysadmin tool (2020)

#42

Post by croutonwagon »

azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

Agree. Thats pretty interesting.

I use an SSH session and SOCKS5 proxy on a VPS provider for almost all of those other circumstances. Including checking external access etc.

But the last one is a solid use case.

Re: Tor is a great sysadmin tool (2020)

#44

Post by ryneandal »

ISL wrote: post #20
azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

Think from the beginning what will be the end: "I thought your security policy was too overbearing, so I used tor." IT departments make their choices for reasons. The key is to help them understand your use-case, and they'll probably help you through the problem in a way that might limit collateral damage. Source: have seen firewall bypasses (with a pre-shared key) get leveraged as a way to hack an entire university…

> IT departments make their choices for reasons.

In a perfect world, yes. But I've worked with/at places where ineptitude is rampant, and any attempts of understanding their reasoning is seen as insubordination.

Re: Tor is a great sysadmin tool (2020)

#45

Post by novok »

ISL wrote: post #20
azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

Think from the beginning what will be the end: "I thought your security policy was too overbearing, so I used tor." IT departments make their choices for reasons. The key is to help them understand your use-case, and they'll probably help you through the problem in a way that might limit collateral damage. Source: have seen firewall bypasses (with a pre-shared key) get leveraged as a way to hack an entire university…

IT departments make choices that benefit their own needs and for their own convience, often forgetting that the entire point of their department is to make the rest of the organization more effective. Sadly, it often goes the other way.

Shadow IT is a signal that the IT organization is doing things wrong. People use shadow IT because the IT department is not doing it's job properly, serving it's customer base based on the needs they show via their actions.

For example, if you see someone like azalemeth do the things he does, it shows that the IT department needs to become responsive enough and cooperative enough to not push him to do such things in the first place. You notice he's tried to do thing the IT department standard way first, and spent considerable effort before he started his shadow IT method.

Re: Tor is a great sysadmin tool (2020)

#46

Post by INTPenis »

I recently had to do some basic sysadmin stuff over tor and I disagree with OP.

Two things that failed mieserably, fetching a file that was just shy of 5M, and a reverse SSH tunnel.

The SSH tunnel was unusable, it would only last for minutes at the most. I wish I could use mosh but that requires UDP.

The file transfer was actually done with curl and the file was often incomplete.

This was all done within Europe where we have the highest concentration of tor nodes.

So no, I don't think tor is appropriate for sysadmin tasks.

Re: Tor is a great sysadmin tool (2020)

#47

Post by novok »

azalemeth wrote: post #18
nine_k wrote: post #7

Earlier quoted context omitted.

If your hard-to-reach server can connect to the internet (via a bunch of NATs and whatnot), you can just make it access your box of choice by e.g. Wireguard, or plain SSH with port-forwaring, or attach it as a node to your ZeroTier private network. You only need a bunch of jump hosts if your target server has no Internet connectivity, and should not, in which case all these levels of bastions do make sense.

That requires having another publicly accessible box, or trusting ZeroTier though, doesn't it? The onion approach does not.

ZeroTier, Tailscale and such are OSS and have been independently security & crypto audited. I don't know if tailscale has been audited, but since they are a more popular tool I bet they probably are too. They're actually really good tools and would probably be more reliable than tor tbh, I would recommend looking into them.

Re: Tor is a great sysadmin tool (2020)

#48

Post by novok »

sumtechguy wrote: post #22
lifeisstillgood wrote: post #13

Being a small cog, but using clever tricks to get your job done is not solving the problem. An organisation that prevents itself from acting rationally is an organisation that should die Schumpter-style. Please don't prevent it.

Also circumventing this sort of thing in many orgs is a first class ticket to finding a new job. Friend of mine did that, they walked him to the curb with his cardboard box that day. His sin? Turned off virus scanning because it was taking 4 hours to do a 20 min build.

The organization did him a favor. Many other, far more well paying companies response to doing that is working with the developer to figure out a system to make them both happy, or just silently ignoring it until they figure out a better solution. Or just talking to the person and asking them to stop, vs firing.

Re: Tor is a great sysadmin tool (2020)

#49

Post by njsubedi »

kodablah wrote: post #14
azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

Yup, and it's easy to make server and client side tooling use Tor to make this mostly transparent. Latency/bandwidth isn't _that_ bad when communicating with an onion service. And it can be even faster if server anonymity isn't a goal (server set HiddenServiceSingleHopMode and HiddenServiceNonAnonymousMode and create ephemerial onion service with NonAnonymous). I use Tor plenty to self-host services from my house tha…

Could you share more about your setup?

Re: Tor is a great sysadmin tool (2020)

#50

Post by slacka »

Tor is also useful is to verify country specific customization on your website are working. I regularly used Tor on reports of issues with default language or currency. It's just a quick toggle of a setting in "torrc" to limit your exit node to a specific country code.
Post reply on HN