Skip to content
atori.tech

SSH over Tor

Difficulty: Easy Tested v0.18.5.3

Log in to your node from anywhere, without opening any port on your router. An onion service makes the node's SSH server reachable through Tor, at an address only you know.

Requirements

Why SSH keys matter here

Over Tor, every login attempt reaches SSH from 127.0.0.1, the node itself. fail2ban from 1.5 never bans the node's own addresses, so it can't slow down someone guessing passwords through the onion address. Keep the address private, and use SSH keys with password logins disabled, so there's no password to guess.

Create the onion service

On the node, edit Tor's configuration:

sudo nano /etc/tor/torrc

Add at the end:

# MoneroBox: SSH onion service
HiddenServiceDir /var/lib/tor/sshd/
HiddenServicePort 22 127.0.0.1:22

Reload Tor and read the new address:

sudo systemctl reload tor
sudo cat /var/lib/tor/sshd/hostname

Save it in your password manager as your SSH onion, and keep it private. The firewall needs no new rule: Tor connects to SSH from inside the node.

Connect from your regular computer

Install Tor and torsocks (on Debian/Ubuntu: sudo apt install -y tor torsocks; on macOS: brew install tor torsocks, then brew services start tor), then: 

torsocks ssh nodeadmin@YOUR_SSH_ONION.onion

Tor Browser's Tor listens on port 9150 instead of 9050. Keep Tor Browser open, then: 

TORSOCKS_TOR_PORT=9150 torsocks ssh nodeadmin@YOUR_SSH_ONION.onion

The first time, SSH asks you to trust the node's key. It's the same key as on your LAN, so the fingerprint matches the one you checked in 1.3.

A shortcut: ssh monerobox-tor

Add to ~/.ssh/config on your regular computer: 

Host monerobox-tor
    HostName YOUR_SSH_ONION.onion
    User nodeadmin
    ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p
Then ssh monerobox-tor connects through Tor, no torsocks needed. This needs the OpenBSD version of nc (netcat-openbsd on Debian/Ubuntu; the macOS one works as is). Use port 9150 with Tor Browser.

Validation

Once you're logged in over Tor, check where the connection comes from:

echo $SSH_CONNECTION

127.0.0.1 43120 127.0.0.1 22

The first address is 127.0.0.1: the connection came through Tor, not from your network.

Troubleshooting

torsocks: connection refused / Unable to connect

Tor isn't running on your regular computer. Start the Tor service, or open Tor Browser and use TORSOCKS_TOR_PORT=9150.

The connection times out
  • A new onion address can take a minute or two to become reachable. Wait, then try again.
  • On the node, check that Tor reloaded cleanly: sudo journalctl -u tor@default -n 20.
  • Check the address for typos: it's 56 characters, followed by .onion.

Uninstall

Remove the SSH onion service block from /etc/tor/torrc, then:

sudo systemctl reload tor
sudo rm -rf /var/lib/tor/sshd

The old address stops working for good.