Goal
The intention is to set up an SSH entrance which is more secure (or at least more obfuscated) than a default setup with Port Forwarding or VPN.
Previous research and context
TL;DR, see question at the bottom.
I have done a fair amount of research, am familiar with how onion routing works and have proven that this setup works. To avoid ambiguity, here is a detailed description of the intended use case and my current considerations.
Let's start with the practical setup and context:
This setup is intended for use on Linux servers, but should also work on Mac and Windows.
My setup:
- Set up Tor hidden service on server to generate onion address
- Expose custom SSH port in the Tor config
- Set up a somewhat exotic SSH client config to connect over Tor
Current considerations
Advantages (compared to Port Forwarding or connecting via LAN):
- No router port forwarding required, and therefore SSH port can be hidden, even on LAN
- Tor punches through most router firewalls which may block SSH traffic (there is even a FascistFirewall config option)
- Can connect from anywhere in the world
- More resistent to censorship and packet sniffing
- When someone finds the SSH port on the onion address, it would not easily be correlated with the real (IP) address, and it is therefore a semi-anonymous entrance
- Security should not suffer, as the point of entrance is still the OpenSSH server, which is widely-used, well-supported, well-tested and thus considered reliable and secure
Disadvantages:
- High ping will be multiple seconds (time between typing a character and seeing it appear on screen)
- Bandwidth is low, connecting will take 10 seconds or more
- Disconnection or lock-out are more likely due to more points of failure
Security risks, that I am so far aware of:
- Running SSH over Tor is less a security measure than an obfuscation, and therefore give a false sense of security
- Accountability is harder, as the remote address in logs will show up as Tor or localhost instead of the client IP
- Anyone who finds the SSH port on the onion address is likely a more advanced adversary than your average clearnet scanner bot
- This setup is more niche, and therefore has less support and testing
- The Tor hidden service adds a layer that in itself could get compromised
Questions
This leaves me wondering:
- Are my current assumptions correct?
- Is there anything else that needs to be taken into account? (especially risks and disadvantages)
- Is this setup considered fit for production purposes? Despite the research, SSH over Tor still sounds like a hack that professionals would frown upon.
- Has there been any pentesting or professional research in this area?
