Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor is a great sysadmin tool (2020)

jamieweb.net

Post reply on HN
Print view View original

71–80 of 125 posts

Re: Tor is a great sysadmin tool (2020)

#71

Post by alkz »

nqzero wrote: post #66
sillysaurusx wrote: post #40

Earlier quoted context omitted.

It makes me sad every time I think about it, but Aaron Swartz did this during his saga. Well, sort of: he incremented the MAC address by 1. Point being, it's not foolproof. If some clever undergrad is thinking about dodging the suits, win by fooling them, not by fighting them. If you do insist on fighting, though, start at https://www.whonix.org/wiki/Mental_Model and then read the entire Whonix wiki https://www.whoni…

building a new computer. want to be able to trust it 100% for at least a moment. i can't figure out how to "buy" a trusted copy of any linux and don't have any machines i have 100% trust in (who does), so can't burn it. current plan is to buy a chromebook solely for the purpose of downloading and burning ubuntu. alternatively, buy MSWindows, install on the new machine, burn, and then replace but this mental exercise…

most distributions provide signatures/checksums to verify the download eg. https://ubuntu.com/tutorials/how-to-verify-ubuntu#1-overview

Re: Tor is a great sysadmin tool (2020)

#72

Post by lacrosse_tannin »

Nullabillity wrote: post #62
novok wrote: post #47

Earlier quoted context omitted.

ZeroTier, Tailscale and such are OSS and have been independently security & crypto audited. I don't know if tailscale has been audited, but since they are a more popular tool I bet they probably are too. They're actually really good tools and would probably be more reliable than tor tbh, I would recommend looking into them.

> ZeroTier, Tailscale and such are OSS and have been independently security & crypto audited. Both rely on their centralized coordinator servers which can mess with your routes (and thus your traffic) however they please. ZeroTier has a published (but not OSS) coordinator, but their documentation pushes you towards their SaaS. Tailscale's coordinator is SaaS-only, unless something has changed very recently.

zerotier adhoc networks are controllerless, though ipv6 only.

The client can be set to not allow routes/addresses from a controller.

The client and controller are licensed BSL.

Re: Tor is a great sysadmin tool (2020)

#73

Post by lacrosse_tannin »

azalemeth wrote: post #18
nine_k wrote: post #7

Earlier quoted context omitted.

If your hard-to-reach server can connect to the internet (via a bunch of NATs and whatnot), you can just make it access your box of choice by e.g. Wireguard, or plain SSH with port-forwaring, or attach it as a node to your ZeroTier private network. You only need a bunch of jump hosts if your target server has no Internet connectivity, and should not, in which case all these levels of bastions do make sense.

That requires having another publicly accessible box, or trusting ZeroTier though, doesn't it? The onion approach does not.

you _could_ use your other device (the one you're connecting from) as the controller. whomst amongst us doesn't have a 3rd machine or VPS?

Re: Tor is a great sysadmin tool (2020)

#74

Post by azalemeth »

krtyiktj wrote: post #10
azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your head would spin. you'd get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.

The meek pluggable transport together with Azure's domain fronting service explicitly makes it look like it's connecting to an Azure instance over https. [1]

[1] https://gitlab.torproject.org/legacy/trac/-/wikis/doc/meek

Re: Tor is a great sysadmin tool (2020)

#75

Post by nine_k »

lacrosse_tannin wrote: post #72
Nullabillity wrote: post #62

Earlier quoted context omitted.

> ZeroTier, Tailscale and such are OSS and have been independently security & crypto audited. Both rely on their centralized coordinator servers which can mess with your routes (and thus your traffic) however they please. ZeroTier has a published (but not OSS) coordinator, but their documentation pushes you towards their SaaS. Tailscale's coordinator is SaaS-only, unless something has changed very recently.

zerotier adhoc networks are controllerless, though ipv6 only. The client can be set to not allow routes/addresses from a controller. The client and controller are licensed BSL.

Does this require addresses of nodes to be globally routable? (With such addresses you can as well connect directly.)

Re: Tor is a great sysadmin tool (2020)

#76

Post by sockpuppet_12 »

tempfs wrote: post #32

Using Tor for anything in a corporate network will rightfully get you into serious shit with IT security. I see a lot of people also advocating ngrok, wireguard, etc. You all may not realize that actual threat actors use all of these same techniques and making yourself look like them could very well lead to your termination as this kind of circumvention of security controls is absolutely a threat to the org and a vio…

This is the correct answer, and also the hardest answer because it's going to require you to have to swallow your pride.

Security will already be monitoring your traffic as a basic first step, which they will pipe straight into a SIEM or SOAR system. Doing this stuff will likely get you flagged for an audit.

Re: Tor is a great sysadmin tool (2020)

#77

Post by relax88 »

rattlesnakedave wrote: post #38
krtyiktj wrote: post #10

Earlier quoted context omitted.

at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your head would spin. you'd get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.

> you'd get an unpleasant phone call or visit to your office and be warned sometimes I wonder why IT departments and security in general get a bad wrap, then I see things like this.

When someone just does whatever they feel like and violates policy, what do you think should happen?

Should someone send them a sternly worded email for them to ignore?

Or maybe they should be allowed to do whatever they want regardless of what risk it poses to the organization?

Re: Tor is a great sysadmin tool (2020)

#78

Post by relax88 »

krtyiktj wrote: post #10
azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your head would spin. you'd get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.

I can confirm as someone who works in netsec that this exactly how it would have gone at my previous employer.

There is a tone of “I know what’s best and will do what I want” in this thread.

If you think that the way to get the IT department to implement something for you is to sidestep around policy instead of working with them, you will just piss them off.

Re: Tor is a great sysadmin tool (2020)

#79

Post by relax88 »

novok wrote: post #45
ISL wrote: post #20

Earlier quoted context omitted.

Think from the beginning what will be the end: "I thought your security policy was too overbearing, so I used tor." IT departments make their choices for reasons. The key is to help them understand your use-case, and they'll probably help you through the problem in a way that might limit collateral damage. Source: have seen firewall bypasses (with a pre-shared key) get leveraged as a way to hack an entire university…

IT departments make choices that benefit their own needs and for their own convience, often forgetting that the entire point of their department is to make the rest of the organization more effective. Sadly, it often goes the other way. Shadow IT is a signal that the IT organization is doing things wrong. People use shadow IT because the IT department is not doing it's job properly, serving it's customer base based o…

“Policy made my job slightly harder so because I know better than the netsec team who clearly has or should have unlimited time and resources to help me I will do what I want anyways, and put the organization at risk.”

Also known as “how to make the netsec team hate you 101”

I agree with you about why shadow IT exists, but most IT departments are spread so thin that expecting them to be super responsive to anything but the most critical business projects is often totally unreasonable.

Then they have to waste even more time hunting down idiots setting up Tor nodes on their internal networks.

Re: Tor is a great sysadmin tool (2020)

#80

Post by a1369209993 »

lacrosse_tannin wrote: post #73
azalemeth wrote: post #18

Earlier quoted context omitted.

That requires having another publicly accessible box, or trusting ZeroTier though, doesn't it? The onion approach does not.

you _could_ use your other device (the one you're connecting from) as the controller. whomst amongst us doesn't have a 3rd machine or VPS?

Your other device doesn't have a public IP address either.
Post reply on HN