Tor is a great sysadmin tool (2020)

#1

Post by azalemeth » Tue, Aug 31, 2021, 5:07 PM UTC

Tor is a great sysadmin tool (2020)
jamieweb.net

Re: Tor is a great sysadmin tool (2020)

#2

Post by lambdaba » Tue, Aug 31, 2021, 5:32 PM UTC

ngrok.com allows some of these, at full (or at least, much better speed, haven't benchmarked), and is mostly free (paid plan required for custom subdomains). Sharing this for those still unaware of it, it's a great service.

Re: Tor is a great sysadmin tool (2020)

#3

Post by azalemeth » Tue, Aug 31, 2021, 5:36 PM UTC

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit.

One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be to "just" run an onionsite with onion services authentication [1], preventing it being publicly accessed without the pre-shared key. If your onion service just redirects to ssh (presumably with certificate-only auth) I can't help but think that this is almost an example of security by obscurity done right.

[1] https://support.torproject.org/en-US/onionservices/client-au...

Re: Tor is a great sysadmin tool (2020)

#4

Post by api » Tue, Aug 31, 2021, 5:37 PM UTC

Not sure why you'd use this instead of something like ZeroTier or a bounce box, but I can think of one reason: you want to hide the location of something in your infrastructure to make side channel attacks on the cloud provider or physical location a lot harder.

Re: Tor is a great sysadmin tool (2020)

#5

Post by anaganisk » Tue, Aug 31, 2021, 5:40 PM UTC

lambdaba wrote: post #2

ngrok.com allows some of these, at full (or at least, much better speed, haven't benchmarked), and is mostly free (paid plan required for custom subdomains). Sharing this for those still unaware of it, it's a great service.

Or better yet, use cloudflare tunnels and setup an actual permanent tunnel with custom subdomain support. If you want it to be a temporary one, it supports that too. For FREE.

Re: Tor is a great sysadmin tool (2020)

#6

Post by KingMachiavelli » Tue, Aug 31, 2021, 5:51 PM UTC

azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

For that use case why not just use Wireguard?

Re: Tor is a great sysadmin tool (2020)

#7

Post by nine_k » Tue, Aug 31, 2021, 5:52 PM UTC

azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

If your hard-to-reach server can connect to the internet (via a bunch of NATs and whatnot), you can just make it access your box of choice by e.g. Wireguard, or plain SSH with port-forwaring, or attach it as a node to your ZeroTier private network.

You only need a bunch of jump hosts if your target server has no Internet connectivity, and should not, in which case all these levels of bastions do make sense.

Re: Tor is a great sysadmin tool (2020)

#8

Post by rinron » Tue, Aug 31, 2021, 5:53 PM UTC

One very important thing not mentioned is that the tor exit node could be capturing your traffic or do a MITM attack. Its a great idea for testing but only after you have encryption working, and of course pay special attention to your ssh fingerprints.

Re: Tor is a great sysadmin tool (2020)

#9

Post by unsignedint » Tue, Aug 31, 2021, 5:54 PM UTC

Back when I was managing system in a small company, I had a couple of systems on hidden service with auth cookies. When port forward failed or otherwise had problem accessing, it provided decent plan B for getting things back online.

Re: Tor is a great sysadmin tool (2020)

#10

Post by krtyiktj » Tue, Aug 31, 2021, 5:54 PM UTC

azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your head would spin. you'd get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.