OpenSSH is a great means to protect your connection from being sniffed by others. However, this isn’t always enough. Simply proving that you connected to a server is enough to get incriminated. Unfortunately, SSH doesn’t provide a native way to obfuscate to whom it connects. Instead, a proxy server can be set up. And this is where TOR comes to play. This howto covers installing TOR on a Debian based system and setting up SSH to use TOR.<\/p>\n
Installing TOR<\/p>\n
First you should to add the TOR repository to your system. It’s only necessary if there’s no package in the default repositories.<\/p>\n
Add the following line to your \/etc\/apt\/sources.list file. You have to replace lenny with your distribution.<\/p>\n
deb http:\/\/mirror.noreply.org\/pub\/tor lenny main<\/p>\n
To use this repository without problems, you have to add the PGP key to your system.<\/p>\n
apt-key adv –recv-keys –keyserver subkeys.pgp.net 0x94C09C7F<\/p>\n
Update your repositories and install TOR.<\/p>\n
apt-get update && apt-get install -y tor<\/p>\n
If you want to use TOR with OpenSSH, you have to install another program called connect-proxy.<\/p>\n
apt-get install -y connect-proxy<\/p>\n
Setup OpenSSH to use TOR for all connections<\/p>\n
However, this is not recommended, but here is how it works.<\/p>\n
Add the following block to the top of your ~\/.ssh\/config file.<\/p>\n
Host *
\nCheckHostIP no
\nCompression yes
\nProtocol 2
\nProxyCommand connect -4 -S localhost:9050 $(tor-resolve %h localhost:9050) %p<\/p>\n
The command line syntax won’t change at all.<\/p>\n
Set up OpenSSH to use TOR for a specific connection<\/p>\n
I recommend using TOR only for a specific connection. All other connections won’t be affected.<\/p>\n
Add this block to your ~\/.ssh\/config. You have to replace mydomain with the host domain name or IP address and myaccount with your user name.<\/p>\n
Host mydomain
\nHostName mydomain.com
\nUser myaccount
\nCheckHostIP no
\nCompression yes
\nProtocol 2
\nProxyCommand connect -4 -S localhost:9050 $(tor-resolve %h localhost:9050) %p<\/p>\n
Set up OpenSSH to use TOR for a bunch of connections<\/p>\n
Instead of setting up TOR for every single connections, you can do this for a bunch of connections at once. Following example shows how it works.<\/p>\n
Host anon_*
\nCheckHostIP no
\nCompression yes
\nProtocol 2
\nProxyCommand connect -4 -S localhost:9050 $(tor-resolve %h localhost:9050) %p
\nHost anon_mydomain
\nHostName mydomain.com
\nUser myaccount
\nHost anon_mydomain2
\nHostName mydomain2.com
\nUser myaccount
\nPort 980<\/p>\n
This way you know exactly if you’re using TOR or not.<\/p>\n
Conclusion<\/p>\n
It is very simple to anonymize your SSH sessions if you know what you’re doing. I’ve written this tutorial for legal purposes only. Using this is your own risk.<\/p>\n","protected":false},"excerpt":{"rendered":"
OpenSSH is a great means to protect your connection from being sniffed by others. However, this isn’t always enough. Simply proving that you connected to a server is enough to get incriminated. Unfortunately, SSH doesn’t provide a native way to obfuscate to whom it connects. Instead, a proxy server can be set up. And this… <\/p>\n