The intention is to set up an SSH entrance which is more secure (or at least more obfuscated) than a default setup with Port Forwarding or VPN.

Previous research and context

TL;DR, see question at the bottom.

I have done a fair amount of research, am familiar with how onion routing works and have proven that this setup works. To avoid ambiguity, here is a detailed description of the intended use case and my current considerations.

Let's start with the practical setup and context:

This setup is intended for use on Linux servers, but should also work on Mac and Windows.

My setup:

  1. Set up Tor hidden service on server to generate onion address
  2. Expose custom SSH port in the Tor config
  3. Set up a somewhat exotic SSH client config to connect over Tor

Current considerations

Advantages (compared to Port Forwarding or connecting via LAN):

  • No router port forwarding required, and therefore SSH port can be hidden, even on LAN
  • Tor punches through most router firewalls which may block SSH traffic (there is even a FascistFirewall config option)
  • Can connect from anywhere in the world
  • More resistent to censorship and packet sniffing
  • When someone finds the SSH port on the onion address, it would not easily be correlated with the real (IP) address, and it is therefore a semi-anonymous entrance
  • Security should not suffer, as the point of entrance is still the OpenSSH server, which is widely-used, well-supported, well-tested and thus considered reliable and secure


  • High ping will be multiple seconds (time between typing a character and seeing it appear on screen)
  • Bandwidth is low, connecting will take 10 seconds or more
  • Disconnection or lock-out are more likely due to more points of failure

Security risks, that I am so far aware of:

  • Running SSH over Tor is less a security measure than an obfuscation, and therefore give a false sense of security
  • Accountability is harder, as the remote address in logs will show up as Tor or localhost instead of the client IP
  • Anyone who finds the SSH port on the onion address is likely a more advanced adversary than your average clearnet scanner bot
  • This setup is more niche, and therefore has less support and testing
  • The Tor hidden service adds a layer that in itself could get compromised


This leaves me wondering:

  1. Are my current assumptions correct?
  2. Is there anything else that needs to be taken into account? (especially risks and disadvantages)
  3. Is this setup considered fit for production purposes? Despite the research, SSH over Tor still sounds like a hack that professionals would frown upon.
  4. Has there been any pentesting or professional research in this area?
  • +1. I've run an SSH server over TOR this way in the past, without issues. I would assume you would harden your SSH server by disabling password authentication and only allowing public key authentication. In addition, you might want to consider enabling TOR client authentication, as this add another layer of security and will prevent your SSH server from being exposed until the client authenticates through TOR. Related: security.stackexchange.com/questions/260136/…
    – mti2935
    May 20 at 21:36
  • 1) "which is more secure (or at least more obfuscated)" - What do you mean by "more secure"? What is not secure in SSH? What threats exactly you see in using SSH directly?
    – mentallurg
    May 20 at 22:13
  • 2) "a default setup with Port Forwarding or VPN" - Why do you call it "default"? Default for whom - for you, for some company (please name this company), default for some provider? Default is to use direct connection to SSH port, without port forwarding, without VPN.
    – mentallurg
    May 21 at 0:07
  • @mti2935 Although my question is not about SSH itself, in this setup I have already hardened it with pubkey-only. I would like to try and add Tor Client Authentication to the setup, but have not been able to get this working just yet. This would definitely add another layer of security, since SSH would not directly be exposed. May 22 at 11:42
  • @mentallurg 1) Of course SSH in itself is already secure and tested (as I mentioned). However, I have learned that security is about layers, and having a secure SSH server behind another secure Tor service will make it significantly harder to find, with the added benefit that port scan bots will fail to find the entrance and pollute the logs. 2) What I meant to say is "most used", as SSH over Tor seems rather exotic, I have never seen anyone actually use it. I would like to know if that is because of a risk I am unaware about (or maybe just convenience). May 22 at 11:50


You must log in to answer this question.

Browse other questions tagged .