Internet Gratis en Unefon

SSH over Tor

Overview

OpenSSH is a fantastic means to protect the contents of your communications. However, this isn't always enough. Sometimes simply proving you made a connection to a server is enough to incriminate and incarcerate a person. Natively, SSH does not possess a capability to obfuscate to whom it connects. Fortunately, Tor provides just such a capability. By sending the connection through the Tor network, an observer can see a connection to the first (of three nodes), not the connection to the destination. This prevents an adversary from conducting traffic analysis against your connections.

---

Compiling connect

Download connect.c. Compile connect and install it in /usr/local/bin with the following commands.

# gcc -o /usr/local/bin/connect connect.c
# chmod 755 /usr/local/bin/connect
# chown root.root /usr/local/bin/connect

---

Running SSH through Tor

To run SSH over Tor, run the following command. Substitute your username for marlowe, the IP address you wish to connect for 1.2.3.4 and the IP address of your Tor server for localhost.

% ssh -l marlowe -2 1.2.3.4 -o ProxyCommand="/usr/local/bin/connect -4 -S localhost:9050 %h %p"

Warning, before using the above command, make sure you understand what the command does.

• "-l" specifies the username to log into on the remote machine
• "-2" forces ssh to try protocol version 2 only. Don't use version 1 as it is a security risk.
• "-o" passes the following argument as option in the format used in the configuration file. In this case, it passes the option ProxyCommand with the value of "/usr/local/bin/connect -4 -S localhost:9050 %h %p"

Additional options for ssh are covered in its man page. The "-4" option tells connect to use SOCKS protocol 4. The "-S" option specifies the hostname and port number of the SOCKS server to relay. Addtional options are listed in detail in the source code for connect.c
Do not pass a hostname instead of an IP address as the remote machine to which you wish to connect. If you pass a hostname, ssh uses your name server to resolve the name before passing it to connect. This deprives you of the protection of Tor for your name resolution. Instead use the program tor-resolve which is included with the Tor distribution. tor-resolve takes two arguments, the first is a fully qualified domain name (FDQN), the second is SOCKS proxy connection. The example below resolves www.google.com over the SOCKS proxy running on localhost over 9050 using Tor.

% tor-resolve www.google.com localhost:9050
64.233.161.99

Copyright 2006-2012 Patrick R. McDonald <marlowe@antagonism.org> (GPG key (old)/ GPG key (new))
This document last modified Monday, 09-May-2011 19:27:09 UTC