4 ms·

> (2) There is no good solution for end-to-end transit that copes with the ugliness of endpoint networks. Yes, there is. And it exists right now, and it's comp

by kefka 11y ago

> (2) There is no good solution for end-to-end transit that copes with the ugliness of endpoint networks. Yes, there is. And it exists right now, and it's completely free. TOR. I've been using TOR hidden services for months now. On every machine (Linux), I install TOR and set 22/SSH available as a hidden service. This gives me a [HASH].onion address. Now, why is that useful? The Hidden Services gives you a flat address space so that every .onion is reachable easily. There's no NAT, no firewalls, no stupid of any sort. And unlike "static IP/port forward/hole in NAT/Dynamic DNS" anti-solution, you install TOR, set up which ports are to be forwarded, and off you go. I've also figured out how to get full .onion resolution on a Linux system as well. That means, instead of having to do a "Run Tor Browser/proxy" for every program, you simply use the .onion where you want. The DNS resolver takes care of obfuscation and TOR handing and everything. So that means you could have a list of servers in different physical locations with firewalls, NATS, and other network tools. And you can administer them via CHEF or Puppet or Ansible using a list of .onion in your config files. I use Mosquitto, a MQTT broker to handle my data store. I have sensors in 3 physical different locations (my house, a friend's house, and my local hackerspace). I don't have access to the border router on 2 of them; but that doesn't matter. TOR takes care of all transit. The last piece of this puzzle is Node-Red for handling of IoT data. With the aforementioned DNS solution I figured out, I can pub/sub data to my mosquitto broker, sitting on port 8883 on my onion. The Node-Red doesn't have to know where the machines are, nor does my Mosquitto broker. My hardware platform is self-made: Arduino Nano clones, nRF24L01+ mesh networking chip, whatever sensors, and the MySensors library. Works really well. Tl;Dr. An IoT system that guarantees anonymity, privacy, and security. And doesn't rely on someone else's machines.

linkregister 11y ago
This sounds awesome! Any plans of putting any of these scripts on Github? I think this stuff could do a lot of good.
- kefka 11y ago
  I'm building my tools from Node-Red, so they're in JSON. But the caveat is they fill my niche I need. The TOR part, is something that would work everywhere. Configuring Hidden Services isn't hard, but resolving .onions across the system is... So here's how to do it. (from my previous comment a few weeks ago) * 4 points by kefka 18 days ago | parent | on: The Research Pirates of the Dark Web I find the way TOR is used lacking. I really would like to have .Onion resolution across my whole system (in my case, I extensively use Linux). So, Here's a way to do just that: I use a significant amount of HiddenServices to communicate back and forth with my machines. My eventual goal was to be able to process data from different geographical areas and have them inserted into MQTT via Node-Red. Until now, it was all or nothing with regards to proxy settings. I have figured that out. For those that want to integrate seamless .onion usage across the whole of Node-Red (and every other Linux program), follow this. get the following packages (Ubuntu, Debian) sudo apt-get install tor iptables dnsmasq dnsutils Add the following to the /etc/tor/torrc file VirtualAddrNetworkIPv4 10.192.0.0/10 AutomapHostsOnResolve 1 TransPort 9040 DNSPort 53 DNSListenAddress 127.0.0.2 Restart TOR sudo service tor restart Edit /etc/dnsmasq.conf and add the following: listen-address=127.0.0.1 resolv-file=/etc/realresolv.conf server=/onion/127.0.0.2 Make a new file, called /etc/realresolv.conf . Add this in the file: nameserver 107.170.95.180 nameserver 8.8.8.8 Restart DNSmasq: sudo service dnsmasq restart Run the IPtables firewall update for redirection sudo iptables -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -j REDIRECT --to-ports 9040 Also, this script must be run at every boot, so add this in /etc/rc.local, ABOVE the "exit 0" /sbin/iptables -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -j REDIRECT --to-ports 9040 Once you do those things, your whole Linux sustem will be able to resolve .onion addresses seamlessly, yet leaving alone canonical address schemes. this means that you can talk with a MQTT-out on an .onion, or control remote servers via exec node and SSH. And since you don't have to poke holes through firewalls, networking between Hidden Nodes with Node-Red sitting on top makes IoT sensor capture from remote areas (Work, home, car, hackerspace) very easy. Of course, this does not discuss how to actually add a new hidden service You should think very hard before enabling a service: Make sure there is good authentication on them along with the newest updates. There is no determining origination on these kinds of attacks. cite: http://www.linuxquestions.org/questions/linux-networking-3/h.. http://www.linuxquestions.org/questions/linux-networking-3/h.... , Have confirmed directions work flawlessly on Ubuntu 14.04, 15.04, and 15.10 (various flavors of Ubuntu, XUbuntu, KUbuntu)
  - Spakman 11y ago
    Thank you very much. This has given me a lot of food for thought. I hadn't ever considered TOR for NAT traversal for a start.
    - kefka 11y ago
      I'm glad I have :) HN seems to have gotten poisonous with people saying "you cant, you wont, you shouldnt".. and yet the alternative solutions aren't posited. That disturbs me. I try to set a rule, that if I complain about something, I try to have an alternate path to go forward. Right now, I'm looking into IPFS (interplanetary file system. tldr: single worldwide git repo backed by bittorrent). So far, I've been able to share a staggering amount of content quickly. Our hackerspace has decent bandwith, except when we have open house nights every wednesday. Using IPFS allowed me to share the newest Star Trek Horizon movie with 10 machines in ~6 minutes. Turns out, they are also working on IPFS-aware Tor, so that the file hosters can reside purely in .onion space. You can probably see why that is interesting to me: worldwide backed tor repo access. Files can be hosted with little/no knowledge who they came from, or to unknown destinations. I'm also working on porting http://s-macke.github.io/jor1k/demos/main.html http://s-macke.github.io/jor1k/demos/main.html so it resides purely on IPFS, including your user data (just stored in a separate key). This would allow distributed computing in a Linux js environment, with networking support... unlike Ethereum which processes data in "Instructions per second" speeds (10^8 slower than your laptop). I've my hands full, but distributed applications are really, finally here. It's what I can call the cloud, without hearing "other peoples' servers" in the back of my head.
unsignedint 11y ago
And Tor even provides rudimentary ACL built into .onion address itself with somewhat obscure options of HiddenServiceAuthorizeClient, and HidServAuth. This basically lets you create a circle of Hidden Services you can only access if you have a matching key.

by kefka 11y ago

linkregister 11y ago

This sounds awesome! Any plans of putting any of these scripts on Github? I think this stuff could do a lot of good.

kefka 11y ago
I'm building my tools from Node-Red, so they're in JSON. But the caveat is they fill my niche I need. The TOR part, is something that would work everywhere. Configuring Hidden Services isn't hard, but resolving .onions across the system is... So here's how to do it. (from my previous comment a few weeks ago) * 4 points by kefka 18 days ago | parent | on: The Research Pirates of the Dark Web I find the way TOR is used lacking. I really would like to have .Onion resolution across my whole system (in my case, I extensively use Linux). So, Here's a way to do just that: I use a significant amount of HiddenServices to communicate back and forth with my machines. My eventual goal was to be able to process data from different geographical areas and have them inserted into MQTT via Node-Red. Until now, it was all or nothing with regards to proxy settings. I have figured that out. For those that want to integrate seamless .onion usage across the whole of Node-Red (and every other Linux program), follow this. get the following packages (Ubuntu, Debian) sudo apt-get install tor iptables dnsmasq dnsutils Add the following to the /etc/tor/torrc file VirtualAddrNetworkIPv4 10.192.0.0/10 AutomapHostsOnResolve 1 TransPort 9040 DNSPort 53 DNSListenAddress 127.0.0.2 Restart TOR sudo service tor restart Edit /etc/dnsmasq.conf and add the following: listen-address=127.0.0.1 resolv-file=/etc/realresolv.conf server=/onion/127.0.0.2 Make a new file, called /etc/realresolv.conf . Add this in the file: nameserver 107.170.95.180 nameserver 8.8.8.8 Restart DNSmasq: sudo service dnsmasq restart Run the IPtables firewall update for redirection sudo iptables -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -j REDIRECT --to-ports 9040 Also, this script must be run at every boot, so add this in /etc/rc.local, ABOVE the "exit 0" /sbin/iptables -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -j REDIRECT --to-ports 9040 Once you do those things, your whole Linux sustem will be able to resolve .onion addresses seamlessly, yet leaving alone canonical address schemes. this means that you can talk with a MQTT-out on an .onion, or control remote servers via exec node and SSH. And since you don't have to poke holes through firewalls, networking between Hidden Nodes with Node-Red sitting on top makes IoT sensor capture from remote areas (Work, home, car, hackerspace) very easy. Of course, this does not discuss how to actually add a new hidden service You should think very hard before enabling a service: Make sure there is good authentication on them along with the newest updates. There is no determining origination on these kinds of attacks. cite: http://www.linuxquestions.org/questions/linux-networking-3/h.. http://www.linuxquestions.org/questions/linux-networking-3/h.... , Have confirmed directions work flawlessly on Ubuntu 14.04, 15.04, and 15.10 (various flavors of Ubuntu, XUbuntu, KUbuntu)
- Spakman 11y ago
  Thank you very much. This has given me a lot of food for thought. I hadn't ever considered TOR for NAT traversal for a start.
  - kefka 11y ago
    I'm glad I have :) HN seems to have gotten poisonous with people saying "you cant, you wont, you shouldnt".. and yet the alternative solutions aren't posited. That disturbs me. I try to set a rule, that if I complain about something, I try to have an alternate path to go forward. Right now, I'm looking into IPFS (interplanetary file system. tldr: single worldwide git repo backed by bittorrent). So far, I've been able to share a staggering amount of content quickly. Our hackerspace has decent bandwith, except when we have open house nights every wednesday. Using IPFS allowed me to share the newest Star Trek Horizon movie with 10 machines in ~6 minutes. Turns out, they are also working on IPFS-aware Tor, so that the file hosters can reside purely in .onion space. You can probably see why that is interesting to me: worldwide backed tor repo access. Files can be hosted with little/no knowledge who they came from, or to unknown destinations. I'm also working on porting http://s-macke.github.io/jor1k/demos/main.html http://s-macke.github.io/jor1k/demos/main.html so it resides purely on IPFS, including your user data (just stored in a separate key). This would allow distributed computing in a Linux js environment, with networking support... unlike Ethereum which processes data in "Instructions per second" speeds (10^8 slower than your laptop). I've my hands full, but distributed applications are really, finally here. It's what I can call the cloud, without hearing "other peoples' servers" in the back of my head.

unsignedint 11y ago

And Tor even provides rudimentary ACL built into .onion address itself with somewhat obscure options of HiddenServiceAuthorizeClient, and HidServAuth. This basically lets you create a circle of Hidden Services you can only access if you have a matching key.