4

Pretend I have a Tor hidden service.

For ultimate security I would firewall the internet entirely, except for Tor, to try to reduce IP address leakage and other security risks.

My problem is how could I then connect to the box via SSH?

My question is how can you keep all ports closed for security reasons, but still access VPS with SSH? I can't think of a secure way of doing this, which keeps server secure.

  • 3
    Port knocking is a common way to go, if you want to keep ports closed. Some might argue though, that it's a security through obscurity pattern. – Arminius May 19 '16 at 10:55
  • @Arminius It's a good idea (I have included a description), however hopefully there are other ways with proper security, not obscurity stuff. "Port knocking is a stealth method to externally open ports that, by default, the firewall keeps closed. It works by requiring connection attempts to a series of predefined closed ports" – k1308517 May 19 '16 at 11:59
  • 1
    You could use cryptographic port knocking in order to avoid the "security through obscurity" method. But in the end, you might as well use properly locked down SSH with a non-standard port and obtain a result that is more or less equivalent. – Stephane May 19 '16 at 12:37
  • Is having the box connect to you via reverse shell through Tor an option ? Maybe from an external Jump Box in another country ? If so then you don't need to have any ports open outside of Tor. – Trey Blalock May 19 '16 at 18:41
  • 1
    Why not require SSH connections to originate within Tor? There are plenty of guides on SSHing within Tor, including this one on tor.SE. – Adam Katz May 19 '16 at 22:36
1

A lot of what I discussed in this answer about alternate SSH ports is applicable to this question.

Since your goal is to be as invisible as possible*, I think your best bet is secure port knocking with a tool like fwknop (as noted in this crypto.SE question) or perhaps a custom one-time password scheme for sufficiently complicated port knocks (to help protect against replay attacks).

Another idea is to port knock through Tor; there may be latency within Tor, but port knocking doesn't consume much bandwidth and can be configured to tolerate more latency. Once you've knocked on the .onion address, the end of your knock could be an encrypted (or plaintext, depending on your sensitivity) form of your client public IP address, which would then be able to access the server's public IP address for a short time window.

You'll also want a system like Fail2ban, which can recognize failed logins and ban the IP that attempted them (by default, Fail2ban blocks an IP for ten minutes after ten failed logins within ten minutes, but this is all configurable). This will help protect you against attacks coming from systems that share your public IP address (e.g. by being behind the same NAT or by claiming your IP when you disconnect).

I'd still recommend using Tor for your everyday access and only fail over to the public internet when Tor becomes too slow (which hopefully isn't that often; much of Tor's slow speed comes from being starved for exit nodes, but a hidden service doesn't need an exit node).

*Since Tor runs atop the internet, it still needs some ports exposed to the public internet. You won't be completely invisible and any adversary should be able to easily determine that your server runs Tor. You might be able to do some kind of reverse port-knocking (upon detecting a port scan, drop all packets to and from that IP), but some port scans are hard to detect (and an attacker might start with the port in question).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.