2 ms·

This works pretty well, especially if you have personal computers behind different NATs. One of the issue is still that you have to distribute the tor domain na

by pwnna 8y ago

This works pretty well, especially if you have personal computers behind different NATs. One of the issue is still that you have to distribute the tor domain name out all over the place. You also need to keep the keys safe if you want to keep that domain name. These two part I found to be more annoying to deal with, although this is true for most VPN solutions (thinking about tinc, wireguard).

buildbuildbuild 8y ago
I highly recommend ZeroTier for maintaining stable connectivity and static private IPs regardless of NAT or networking environment peculiarities. It also supports multipath bonding of interfaces like SD-WAN. (in an alpha branch) We use it to connect to touring production racks using a consistent IP regardless of what concert venue ISP they might be connected to on a given day.
jancsika 8y ago
> One of the issue is still that you have to distribute the tor domain name out all over the place. I don't understand why you couldn't have a small utility to take a human memorable password that maps to a weak-ass private key, then ratchet up to a secure keypair on the server once the initial connection is made: 1. Run utility in "server" mode. 2. Enter password "I am not the target of a state level actor atm" into utility 3. Utility maps your weak-ass password to a weak-ass private key, generates the pubkey from that, and consequently creates the Tor hidden service behind which your openssh server can now be accessed. 4. On the client, run the utility in "client" mode and type in your weak-ass password 5. Utility maps the password to the server's weakass kepair and generates the corresponding onion address from it. 6. Utility creates a tunnel over Tor to connect to that onion address. 7. Server and client are now connected, with no memorization of human unreadable strings. Hurray! 8. Once connected, the server generates a secure keypair and sends the corresponding new onion addy to the client over the current connection. 9. Client receives the new onion addy, disconnects, then connects to the new addy. 10. Repeat for each client. Once all clients are connected, server destroys the original hidden service.

by pwnna 8y ago

buildbuildbuild 8y ago

I highly recommend ZeroTier for maintaining stable connectivity and static private IPs regardless of NAT or networking environment peculiarities. It also supports multipath bonding of interfaces like SD-WAN. (in an alpha branch) We use it to connect to touring production racks using a consistent IP regardless of what concert venue ISP they might be connected to on a given day.

jancsika 8y ago

> One of the issue is still that you have to distribute the tor domain name out all over the place. I don't understand why you couldn't have a small utility to take a human memorable password that maps to a weak-ass private key, then ratchet up to a secure keypair on the server once the initial connection is made: 1. Run utility in "server" mode. 2. Enter password "I am not the target of a state level actor atm" into utility 3. Utility maps your weak-ass password to a weak-ass private key, generates the pubkey from that, and consequently creates the Tor hidden service behind which your openssh server can now be accessed. 4. On the client, run the utility in "client" mode and type in your weak-ass password 5. Utility maps the password to the server's weakass kepair and generates the corresponding onion address from it. 6. Utility creates a tunnel over Tor to connect to that onion address. 7. Server and client are now connected, with no memorization of human unreadable strings. Hurray! 8. Once connected, the server generates a secure keypair and sends the corresponding new onion addy to the client over the current connection. 9. Client receives the new onion addy, disconnects, then connects to the new addy. 10. Repeat for each client. Once all clients are connected, server destroys the original hidden service.