Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor is a great sysadmin tool (2020)

jamieweb.net

Post reply on HN
Print view View original

51–60 of 125 posts

Re: Tor is a great sysadmin tool (2020)

#51

Post by unethical_ban »

azalemeth wrote: post #29
ISL wrote: post #20

Earlier quoted context omitted.

Think from the beginning what will be the end: "I thought your security policy was too overbearing, so I used tor." IT departments make their choices for reasons. The key is to help them understand your use-case, and they'll probably help you through the problem in a way that might limit collateral damage. Source: have seen firewall bypasses (with a pre-shared key) get leveraged as a way to hack an entire university…

I tried doing that, and largely succeeded, but the specific area of the university in question will not have a bastion SSH host anywhere on their network. They will not allow SSH access in at all . They will however allow SSH access to other parts of the university, with different people in charge, which explicitly do allow an SSH bastion host to exist (and provide several for that purpose). So, the net result is tha…

To quote Dr. Manhattan, "Without condemning, or condoning, I understand".

I am in network security. I have stopped shadow IT, and been a part of it.

Your situation seems so ungodly stupid and anathema to the point of IT, that the remaining courses of action should be the following.

Thoroughly document via email your attempts at explaining requirements to Netsec, to document in writing their objections, to do your best with what they provide you... and WHEN things catastrophically break, point the finger at them and thoroughly document how if you had the proper, industry-standard tooling, you could have prevented the loss of research/time/money.

Re: Tor is a great sysadmin tool (2020)

#53

Post by kodablah »

njsubedi wrote: post #49
kodablah wrote: post #14

Earlier quoted context omitted.

Yup, and it's easy to make server and client side tooling use Tor to make this mostly transparent. Latency/bandwidth isn't _that_ bad when communicating with an onion service. And it can be even faster if server anonymity isn't a goal (server set HiddenServiceSingleHopMode and HiddenServiceNonAnonymousMode and create ephemerial onion service with NonAnonymous). I use Tor plenty to self-host services from my house tha…

Could you share more about your setup?

Sure. I wrote https://github.com/cretz/bine (though I admittedly don't work on it much these days). I just have a few-line daemon that starts an HTTP (or gRPC or whatever) server on ephemeral onion service. Then I use that onion ID to access it (via TorBrowser or Orbot or a client built with the same library).

Re: Tor is a great sysadmin tool (2020)

#54

Post by trey-jones »

Several years ago I used a Tor Hidden Service in a professional capacity to expose an application from a Wireless network with properties that we wouldn't know ahead of time.

Worked like a charm, and no regrets. My favorite part was telling my employer "We're using TOR for this" eyebrows.

Re: Tor is a great sysadmin tool (2020)

#55

Post by zaphar »

unethical_ban wrote: post #51
azalemeth wrote: post #29

Earlier quoted context omitted.

I tried doing that, and largely succeeded, but the specific area of the university in question will not have a bastion SSH host anywhere on their network. They will not allow SSH access in at all . They will however allow SSH access to other parts of the university, with different people in charge, which explicitly do allow an SSH bastion host to exist (and provide several for that purpose). So, the net result is tha…

To quote Dr. Manhattan, "Without condemning, or condoning, I understand". I am in network security. I have stopped shadow IT, and been a part of it. Your situation seems so ungodly stupid and anathema to the point of IT, that the remaining courses of action should be the following. Thoroughly document via email your attempts at explaining requirements to Netsec, to document in writing their objections, to do your bes…

THIS. Don't paper over the issues with shadow IT. Make them painfully obvious to the point where IT has to do something or answer to it. Otherwise it will not change.

I've given teams the option to turn off their pagers when this sort of thing happens with the justification that they can't fix it anyway. And then documented the crap out of why they can't fix it so when someone asks I can point to existing policy. It's very effective if done right.

Re: Tor is a great sysadmin tool (2020)

#56

Post by aarchi »

INTPenis wrote: post #46

I recently had to do some basic sysadmin stuff over tor and I disagree with OP. Two things that failed mieserably, fetching a file that was just shy of 5M, and a reverse SSH tunnel. The SSH tunnel was unusable, it would only last for minutes at the most. I wish I could use mosh but that requires UDP. The file transfer was actually done with curl and the file was often incomplete. This was all done within Europe where…

> This was all done within Europe where we have the highest concentration of tor nodes.

So Tor nodes take locality into account? Although, that would improve speeds, it seems like an information leak.

Re: Tor is a great sysadmin tool (2020)

#57

Post by croutonwagon »

lifeisstillgood wrote: post #13

Being a small cog, but using clever tricks to get your job done is not solving the problem. An organisation that prevents itself from acting rationally is an organisation that should die Schumpter-style. Please don't prevent it.

I use similar "clever tricks", albeit with SSH and socks to do the same type of testing.

DNS can be funky, its useful to test resolution externally and internally.

Traffic can be funky when routed, its useful to t-shoot sites through a proxy here and there as there have been times it works internally and is broken externally (often security appliances are inline that may need debugging).

Working in IT infra/ops means its our jobs to use some of these tools to troubleshoot these methods.

Re: Tor is a great sysadmin tool (2020)

#59

Post by menduza23 »

Tor is a great tool for freedom. People tend to bash it and say people use it for child porn. But the reality with freedom and free choice is that you can also use that freedom to do bad. We are seeing censorship in the west on the same scale as china right now. I won't be surprised if Tor gets taken out of action in the west soon.

Re: Tor is a great sysadmin tool (2020)

#60

Post by INTPenis »

aarchi wrote: post #56
INTPenis wrote: post #46

I recently had to do some basic sysadmin stuff over tor and I disagree with OP. Two things that failed mieserably, fetching a file that was just shy of 5M, and a reverse SSH tunnel. The SSH tunnel was unusable, it would only last for minutes at the most. I wish I could use mosh but that requires UDP. The file transfer was actually done with curl and the file was often incomplete. This was all done within Europe where…

> This was all done within Europe where we have the highest concentration of tor nodes. So Tor nodes take locality into account? Although, that would improve speeds, it seems like an information leak.

Not sure, just an educated guess but peering is best in that region so there is a large selection of nodes with very good peering. No need to use a node outside of europe.
Post reply on HN