Just wanted to send a drive-by comment that I very much like the design of this website. Very information dense. The top nav could use some work on mobile but other than that it is quite well done. Author, if you're reading this, I will probably "borrow" much of your design! (I'll give a shout-out in my footer however if I do end up "borrowing")
Tor is a great sysadmin tool (2020)
101–110 of 125 posts
Re: Tor is a great sysadmin tool (2020)
#102Earlier quoted context omitted.
Think from the beginning what will be the end: "I thought your security policy was too overbearing, so I used tor." IT departments make their choices for reasons. The key is to help them understand your use-case, and they'll probably help you through the problem in a way that might limit collateral damage. Source: have seen firewall bypasses (with a pre-shared key) get leveraged as a way to hack an entire university…
I tried doing that, and largely succeeded, but the specific area of the university in question will not have a bastion SSH host anywhere on their network. They will not allow SSH access in at all . They will however allow SSH access to other parts of the university, with different people in charge, which explicitly do allow an SSH bastion host to exist (and provide several for that purpose). So, the net result is tha…
You might try Zerotier or Tailscale running either natively or using an RPi as a bridge. Assuming your IT rules don't forbid it, both should be fairly resilient to simple/random port blocking. They're actually used by a lot of enterprises to provide secure p2p networks with automatic port punching and nat traversal.
Re: Tor is a great sysadmin tool (2020)
#103In sysadmin use cases where you're only interested in accessing a website from a different IP, or setting up a reverse shell/service to hole-punch NATs, but don't need anonymity and untraceability, is Tor's multi-layered onion routing a latency and bandwidth impediment, and would you be better off turning it off (not sure if possible with the current codebase)?
Re: Tor is a great sysadmin tool (2020)
#104One very important thing not mentioned is that the tor exit node could be capturing your traffic or do a MITM attack. Its a great idea for testing but only after you have encryption working, and of course pay special attention to your ssh fingerprints.
Cloudflare is mitm, btw.
So is your network firewall, what's your point?
Re: Tor is a great sysadmin tool (2020)
#105I recently had to do some basic sysadmin stuff over tor and I disagree with OP. Two things that failed mieserably, fetching a file that was just shy of 5M, and a reverse SSH tunnel. The SSH tunnel was unusable, it would only last for minutes at the most. I wish I could use mosh but that requires UDP. The file transfer was actually done with curl and the file was often incomplete. This was all done within Europe where…
Out of curiosity: Have yout set up your onion service in single-hop/Non-Anonymous mode as suggested in the article?
I've been using tor for shell access only and it worked reasonably well for me, but I havent't tried this mode and wonder if your issues persist if it is used.
Re: Tor is a great sysadmin tool (2020)
#106Re: Tor is a great sysadmin tool (2020)
#107I recently had to do some basic sysadmin stuff over tor and I disagree with OP. Two things that failed mieserably, fetching a file that was just shy of 5M, and a reverse SSH tunnel. The SSH tunnel was unusable, it would only last for minutes at the most. I wish I could use mosh but that requires UDP. The file transfer was actually done with curl and the file was often incomplete. This was all done within Europe where…
Out of curiosity: Have yout set up your onion service in single-hop/Non-Anonymous mode as suggested in the article? I've been using tor for shell access only and it worked reasonably well for me, but I havent't tried this mode and wonder if your issues persist if it is used.
No I didn't know you could do that. But also in my use case anonymity was a requisite.
Re: Tor is a great sysadmin tool (2020)
#108Earlier quoted context omitted.
> ZeroTier, Tailscale and such are OSS and have been independently security & crypto audited. Both rely on their centralized coordinator servers which can mess with your routes (and thus your traffic) however they please. ZeroTier has a published (but not OSS) coordinator, but their documentation pushes you towards their SaaS. Tailscale's coordinator is SaaS-only, unless something has changed very recently.
zerotier adhoc networks are controllerless, though ipv6 only. The client can be set to not allow routes/addresses from a controller. The client and controller are licensed BSL.
Ad-hoc networks don't seem particularly useful here. From their documentation:
> Keep in mind that these networks are public and anyone in the entire world can join them. Care must be taken to avoid exposing vulnerable services or sharing unwanted files or other resources.
Re: Tor is a great sysadmin tool (2020)
#109Earlier quoted context omitted.
> ZeroTier, Tailscale and such are OSS and have been independently security & crypto audited. Both rely on their centralized coordinator servers which can mess with your routes (and thus your traffic) however they please. ZeroTier has a published (but not OSS) coordinator, but their documentation pushes you towards their SaaS. Tailscale's coordinator is SaaS-only, unless something has changed very recently.
This is fair. Their client node software is audited though, and the contents of your packets are not accessible to the router. This is why the amount of the possible meddling is limited to a DoS, AFAICT. Who audits the Tor nodes that do onion routing is anyone's guess; I suppose ZeroTier is no worse than them.
> Their client node software is audited though, and the contents of your packets are not accessible to the router. This is why the amount of the possible meddling is limited to a DoS, AFAICT.
Normally the coordinator just forwards the keys from your peers, and so doesn't see the contents (the traffic doesn't pass through it, and even if it did it didn't have the key).
However, that assumes that the coordinator is being truthful with the network topology that it sends you. It could send you any topology that it wants to! This means that it could start MITMing whenever it wants to by telling you that $SERVER_IP's peer is now actually $COORDINATOR_KEY at $COORDINATOR_IP.
Theoretically you could defend against this by, say, running a cronjob that validates that the Wireguard keys are unchanged. But at that point you're not really gaining much compared to just using wg-quick.
Tor is different, because the .onion domain name inherently encodes the public key of the site you're connecting to. There is no way to change the key without also changing the URLs that people connect to!
Re: Tor is a great sysadmin tool (2020)
#110“However, to take a literal view, X is just a Y tool, and it can be used in any way that you want.”
Society would be better if people took this view with all tools. They’re just tools. Unlike people they don’t have intent.