10

I've just started using Tor recently, and I'm not sure exactly what security issues come with the benefits.

What should/shouldn't I be worried about (in both everyday normal-web browsing use, in visiting hidden services, and in running my own)?

-- A bit of background for this question; what specifically prompted it --

I'm planning on going live with a rough web site for person/professional use within the next couple weeks, and I want it to be well-protected, but at the same time able to be remotely administered.

I do plan to actually harden the webserver (and use a strong SSH password, login to an account with as little privilege as possible, etc.), but I have no idea whether exclusively doing SSH administration over Tor would be a useful level of misdirection, or would just open me up to possibly undesirable attention from people monitoring the Tor network.

edit: The guy who mentioned 'Tor is just for anonymity' is correct. I guess I should rephrase that last bit: From what I've read, it seems like I wouldn't need to configure my router to forward all requests to the SSH port if I made SSH only available through Tor. If that's the case, it would mean fewer people would be able to access the port, because fewer would be aware of it, and it would be easier to see irregularities in the server logs. It would be more for the purpose of defense-in-depth and making maintenance easier than anything else. However, since I'm not sure what the disadvantages might be, I'm asking this question to clarify.

|improve this question
  • 4
    One huge disadvantage of Tor is bandwidth. Anyone who uses tor for a few minutes will see it is extremely slow, due to a couple reaosns. – user11869 Mar 8 '13 at 3:53
  • I've noticed this- but for a text-only SSH session it shouldn't be too much of an issue. – root Mar 8 '13 at 4:31
  • So you're proposing limiting SSH login to only allow it from Tor? I'm not quite sure how you'd implement that but even if it is possible what's the point? It would be far better/simpler to limit SSH login to your I.P address(es). Also, as anyone can use Tor you're not really restricting people from accessing it - just obscuring it a little – Andy Smith Mar 8 '13 at 9:26
  • 1
    I still don't get what you gain from TOR. Did you buy the server anonymously so you want to access it anonymously? You shouldn't send information from different personas over a single TOR circuit. Else it's possible to see that the same person owns that server, and did some other activities you don't want to be linked with. – CodesInChaos Mar 8 '13 at 18:43
  • Nothing to do with anonymity. And the benefit I'm looking to gain only tangentially relates to security. I recognize it's an anonymizer. I was asking about security disadvantages, since I'm already aware there aren't really security advantages. Luckily, the answers have been helpful. – root Mar 8 '13 at 20:34
10

  1. Performance sucks

    It's better than a couple of years ago, but still not great.

  2. Low latency anonymizers are prone to traffic analysis.

    In particular if somebody can observe your traffic and your target's traffic, they can correlate that.

    Anonymous remailers avoid this problem by adding longer delays, but you can't use them for interactive applications, such as browsing the web.

  3. Exit nodes see your traffic in plain

    If you don't use a secure protocol on top of Tor, the exit node can sniff your passwords etc. Using SSL or SSH you should be fine, but be sure to validate the certificate/fingerprints.

    This doesn't apply to using hidden services, since there is no exit node, and MitM attacks are prevented by the fingerprint in the domain. But be careful that you're accessing the correct domain, they're pretty hard to memorize/verify.

One interesting variant is connecting to a VPN over Tor. That helps with 3), provided you trust the VPN, but you need to figure out a way to buy VPN access anonymously.

|improve this answer
  • VPN over TOR. ? Don't you think it as an overkill considering even there is no apparent RISK of him using ssh alone? I think its here where one should be concerned or question if how much security is actually enough aka "acceptable level of security – Saladin Mar 8 '13 at 8:23
  • 3
    @asadz If you only use SSH, then it's not really necessary since SSH provides security. But if you browse the web, using untrusted TOR exit nodes isn't so nice. VPN only is OK for normal users, but I don't trust the anonymity of a typical VPN. VPN over TOR is what I'd use if I were doing something seriously illegal, such as hacking other people's websites. – CodesInChaos Mar 8 '13 at 8:27
  • under the context of this question, I don't think he is planning to do illegal with the site he manages himself. He just want remote administration, for which I considered ssh to provide adequate protection. When its VPN over TOR like over protected security, it makes security investigation also difficult, considering a good security design should define appropriate levels of trust and adjust the security response / controls appropriately. – Saladin Mar 8 '13 at 9:24
  • 1
    I agree with @CodesInChaos here. The point is that the endpoint of the Tor network is essentially untrusted when using exit nodes, but placed in a privileged position (potential MitM), so SSH / VPN protocols provide end-to-end security that can protect you against attack vectors from that node. – Polynomial Mar 8 '13 at 9:36
  • 1
    @asadz No, if the server end was compromised it does not mean that the client end would be too. If the client end is compromised, then you've got bigger problems, and the compromise was likely nothing to do with using Tor or a VPN. – Polynomial Mar 8 '13 at 9:43
8

SSH is very sensitive to latency, since every single key stroke implies a round-trip to the server. Doing SSH over a high-latency link is a recipe for high levels of frustrations. I already find more than 200 ms of latency unbearable after a few minutes of SSH -- with Tor, you'll get much more. That point alone will make you regret considering Tor several times per day.

As for the security benefits... well, you used the expressions "misdirection" and "fewer would be aware of it". That's security through obscurity, which is not very popular in these parts. Such measures do not bring much security overall (and, worse, do not bring quantifiable security). They will deter amateur attackers who are not knowledgeable or not very motivated; but these small fry attackers would not have been a big threat anyway. The real danger lies in powerful, competent attackers who will make the effort to do a bit of research on their target, and, for instance, find this very security.SE post where you argue, in plain words, about restricting access to Tor users. In any case, competent attackers will use Tor, if only to hide their tracks. Therefore, a case could be made about not restricting SSH access to Tor users, but quite the opposite: block SSH access from Tor.

If you want "misdirection" just to keep your log files smaller, set the SSH server to a port distinct from the standard 22. It would be a grave error to believe that it increases security, but it will avoid the thousands of daily connection attempts from botnet which try to extend their territory in a purely automated fashion; thus, you will keep smaller log files and correspondingly increase your chances of spotting fishy business in the said log files.

For security, use SSH key-based authentication and/or good, very random passwords.

|improve this answer
  • To be honest, this is new to me; ''every single key stroke implies a round-trip to the server'', you mean if I type in the command line : nmap -sS -Pn --top-ports 10 8.8.8.8, this will take 33 round-trips before execution ? – elsadek Jul 27 '16 at 7:58
6

If I understand you correctly, your objective is to use Tor to increase the security of the communications channel between yourself and your web server?

Tor's main purpose is anonymity. It does not secure the communications channel between the exit node and the destination. Proper use of SSH (use a passphrase) should be more than adequate.

The only reason you would want to use Tor in this scenario is if you need to hide the fact that you're admin-ing a particular server. Based on your description, this isn't a consideration, so just use SSH.

|improve this answer
  • The reason I originally asked, and am thinking of implementing the idea, is that connecting a hidden service to Tor, from what I've read, wouldn't require me to change my router configuration. So, if a normal person on the internet tried to check for a vulnerability on whatever port I use for SSH on the server, they would be denied access by the router. If that's the case, it would mean I would only need to worry about a subset of possible people attacking that port. It would also mean combing through fewer server log entries to determine whether an attack was successful. – root Mar 8 '13 at 4:13
  • So, I am aware it's intended purpose is just anonymity. But if it has the added advantage of making fewer people able to access the port I'm using for SSH, all the better. I'm not going to rely on that to make the server safe, but if I understand what I've read correctly it should make maintenance easier. Fewer ports open to the wider internet. And if I don't understand what I've read correctly, I would want to know that before I deploy anything. Hence the question. I guess I should have been clearer about that... – root Mar 8 '13 at 4:17
  • correction: its – root Mar 8 '13 at 4:23
1

Have you looked into other alternatives? Like a internet based VPN? If the other site is under your own control you can that do easily, by configuring your end point filtering devices.

A default VPN setup provides higher assurance then TOR for that matter.

If you are looking for remote admin, I think bandwidth for you would matter. I think TOR gives you variable delays, whereas with VPN it's a measured and fixed delay, and therefore better for performance.

|improve this answer
  • I agree with the recommendation to look at VPNs, for the particular situation experienced by the original poster. I strongly disagree with the blanket statement that VPN provides higher assurance than Tor; for anonymity (which doesn't matter here, but is the standard motivation for using Tor), that seems very unlikely to be true. – D.W. Mar 8 '13 at 18:13
  • 1
    @D.W. thanks for the comments. The problem here with tor is there is too much in the mix; the entire cloud is not owned by me, there are more relay-nodes (more points of interception), on vpn is just the two main nodes (site-site vpn) and also the security services provided by vpn is different from tor. VPN has access control, confidential, integrity and authentication, so its no apple to apple comparison. Tor wins on anonymity and it serves different purpose it glides like a stealth fighter on open skies undetected. – Saladin Mar 8 '13 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.