13 ms·

Tor is a great sysadmin tool (2020)

420 points by azalemeth 5y ago

rinron 5y ago
One very important thing not mentioned is that the tor exit node could be capturing your traffic or do a MITM attack. Its a great idea for testing but only after you have encryption working, and of course pay special attention to your ssh fingerprints.
- segfaultbuserr 5y ago
  If the endpoint is in your control and you'd like to experiment with Tor, you can configure your server as an Onion Service, so you are protected by Tor's own end-to-end encryption (whose traffic cannot be captured by MITM since the hostnames themselves are the public keys). For non-anonymous uses, you should active the "Single Service Onion" mode, so the 6-hop (extra 3-hop for server anonymity) is skipped, allowing standard 3-hop latency and performance. It also saves bandwidth for exit nodes - all non-exit relays can forward Onion traffic.
- boring_twenties 5y ago
  Hidden services are not accessed through exit nodes. Relay nodes cannot capture your traffic or perform MITM attacks.
- fswwi 5y ago
  Cloudflare is mitm, btw.
  - vntok 5y ago
    So is your network firewall, what's your point?
    - fswwi 5y ago
      Cloudflare can see decrypted content when HTTPS is used.
lambdaba 5y ago
ngrok.com allows some of these, at full (or at least, much better speed, haven't benchmarked), and is mostly free (paid plan required for custom subdomains). Sharing this for those still unaware of it, it's a great service.
- anaganisk 5y ago
  Or better yet, use cloudflare tunnels and setup an actual permanent tunnel with custom subdomain support. If you want it to be a temporary one, it supports that too. For FREE.
  - Shank 5y ago
    Is that part of Cloudflare Teams? No offense to Cloudflare, but their pricing is really unclear. I have an account and I use them for a lot, but they have 3 different "plans" and then they have various ad-hoc products. Tunnel just says "view in dashboard." [0] If I click on that link while logged in, I'm taken to my dashboard with no indication of how to use Tunnel or anything. The plans page [1] indicates that it's part of argo smart routing. If I click on "activate argo" it actually does the exact same thing as the teams "view in dashboard" button -- it redirects me to the dashboard and has no indication of being activated or anything. Really frustrating. [0]: https://www.cloudflare.com/products/tunnel/ https://www.cloudflare.com/products/tunnel/ [1]: https://www.cloudflare.com/plans/ https://www.cloudflare.com/plans/
    - PaywallBuster 5y ago
      It's confusing for me too product page says it requires paid Argo (smart routing) subscription https://www.cloudflare.com/en-gb/products/tunnel/ https://www.cloudflare.com/en-gb/products/tunnel/ the blog page says its free https://blog.cloudflare.com/tunnel-for-everyone/ https://blog.cloudflare.com/tunnel-for-everyone/ and actually you can install and run it quite easily brew uninstall cloudflare/cloudflare/cloudflared cloudflared login cloudflared tunnel this will launch a tunnel with a random subdomain listening to http://localhost:8080 http://localhost:8080
azalemeth 5y ago
In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be to "just" run an onionsite with onion services authentication [1], preventing it being publicly accessed without the pre-shared key. If your onion service just redirects to ssh (presumably with certificate-only auth) I can't help but think that this is almost an example of security by obscurity done right. [1] https://support.torproject.org/en-US/onionservices/client-auth/ https://support.torproject.org/en-US/onionservices/client-au...
- KingMachiavelli 5y ago
  For that use case why not just use Wireguard?
  - deleted 5y ago
    [deleted]
    - alisonkisk 5y ago
      Wireguard is not the same as ZeroTier.
- nine_k 5y ago
  If your hard-to-reach server can connect to the internet (via a bunch of NATs and whatnot), you can just make it access your box of choice by e.g. Wireguard, or plain SSH with port-forwaring, or attach it as a node to your ZeroTier private network. You only need a bunch of jump hosts if your target server has no Internet connectivity, and should not, in which case all these levels of bastions do make sense.
  - azalemeth 5y ago
    That requires having another publicly accessible box, or trusting ZeroTier though, doesn't it? The onion approach does not.
api 5y ago
Not sure why you'd use this instead of something like ZeroTier or a bounce box, but I can think of one reason: you want to hide the location of something in your infrastructure to make side channel attacks on the cloud provider or physical location a lot harder.
- alisonkisk 5y ago
  Part of the point is to generate non-criminal usage of Tor to legitimize it.
unsignedint 5y ago
Back when I was managing system in a small company, I had a couple of systems on hidden service with auth cookies. When port forward failed or otherwise had problem accessing, it provided decent plan B for getting things back online.
lifeisstillgood 5y ago
Being a small cog, but using clever tricks to get your job done is not solving the problem. An organisation that prevents itself from acting rationally is an organisation that should die Schumpter-style. Please don't prevent it.
- sumtechguy 5y ago
  Also circumventing this sort of thing in many orgs is a first class ticket to finding a new job. Friend of mine did that, they walked him to the curb with his cardboard box that day. His sin? Turned off virus scanning because it was taking 4 hours to do a 20 min build.
  - azalemeth 5y ago
    To be honest, if I were in that situation I'd be thinking something along the lines of "well, that was a dodged bullet".
  - novok 5y ago
    The organization did him a favor. Many other, far more well paying companies response to doing that is working with the developer to figure out a system to make them both happy, or just silently ignoring it until they figure out a better solution. Or just talking to the person and asking them to stop, vs firing.
    - sumtechguy 5y ago
      Took him nearly a year to find a job and had to go on food stamps. I do not think he saw it that way. If you are in some of these smaller markets it can take time to find a job. Especially if you do not live in the area.
- throwaway09223 5y ago
  I'm not seeing where this relates to organizational dysfunction. Using an external point to test a system is a standard practice. I'm also a little confused because preventing someone from using their abilities to problem solve would be a cause of dysfunction -- a seemingly avoidable one.
segfaultbuserr 5y ago
The article didn't mention another nice trick: Tor is also a great tool for accessing IPv4 sites in a IPv6-only network and vice versa.
dijit 5y ago
I actually use tailscale for exactly this reason. NAT is the devil. The latency of tor might be a bit too much though.
5faulker 5y ago
Interesting use of a security tool
jedberg 5y ago
Heh, most of these use cases I solved by having a personal jumphost in a cabinet in a datacenter. But this is very clever! I like the idea of using Tor because you'll get much better tests.
asddubs 5y ago
I like using tor when testing DNS resolution related stuff, to circumvent some part of my system having a cached entry already.
tempfs 5y ago
Using Tor for anything in a corporate network will rightfully get you into serious shit with IT security. I see a lot of people also advocating ngrok, wireguard, etc. You all may not realize that actual threat actors use all of these same techniques and making yourself look like them could very well lead to your termination as this kind of circumvention of security controls is absolutely a threat to the org and a violation of security policy. TLDR; If you need remote access, use the proper channels....pretty please. For everyone's sake.
- sockpuppet_12 5y ago
  This is the correct answer, and also the hardest answer because it's going to require you to have to swallow your pride. Security will already be monitoring your traffic as a basic first step, which they will pipe straight into a SIEM or SOAR system. Doing this stuff will likely get you flagged for an audit.
swiley 5y ago
I loved TOR when I was a broke student without enough money to have one or two always on machines with public IPs I could reverse proxy to.
eximius 5y ago
So the big message is proxies are useful? I mean, sure. I'm not sure why Tor makes a better choice than anything else?
INTPenis 5y ago
I recently had to do some basic sysadmin stuff over tor and I disagree with OP. Two things that failed mieserably, fetching a file that was just shy of 5M, and a reverse SSH tunnel. The SSH tunnel was unusable, it would only last for minutes at the most. I wish I could use mosh but that requires UDP. The file transfer was actually done with curl and the file was often incomplete. This was all done within Europe where we have the highest concentration of tor nodes. So no, I don't think tor is appropriate for sysadmin tasks.
- aarchi 5y ago
  > This was all done within Europe where we have the highest concentration of tor nodes. So Tor nodes take locality into account? Although, that would improve speeds, it seems like an information leak.
  - INTPenis 5y ago
    Not sure, just an educated guess but peering is best in that region so there is a large selection of nodes with very good peering. No need to use a node outside of europe.
- eloeffler 5y ago
  Out of curiosity: Have yout set up your onion service in single-hop/Non-Anonymous mode as suggested in the article? I've been using tor for shell access only and it worked reasonably well for me, but I havent't tried this mode and wonder if your issues persist if it is used.
  - INTPenis 5y ago
    No I didn't know you could do that. But also in my use case anonymity was a requisite.
slacka 5y ago
Tor is also useful is to verify country specific customization on your website are working. I regularly used Tor on reports of issues with default language or currency. It's just a quick toggle of a setting in "torrc" to limit your exit node to a specific country code.
skadamat 5y ago
Smells a bit like Wireguard use case!
- RIMR 5y ago
  Wireguard is a great technology, and if latency and file transfers are important you should use it, but a Tor hidden service is way easier to set up, and way more reliable.
trey-jones 5y ago
Several years ago I used a Tor Hidden Service in a professional capacity to expose an application from a Wireless network with properties that we wouldn't know ahead of time. Worked like a charm, and no regrets. My favorite part was telling my employer "We're using TOR for this" eyebrows.
deleted 5y ago
[deleted]
menduza23 5y ago
Tor is a great tool for freedom. People tend to bash it and say people use it for child porn. But the reality with freedom and free choice is that you can also use that freedom to do bad. We are seeing censorship in the west on the same scale as china right now. I won't be surprised if Tor gets taken out of action in the west soon.
posterboy 5y ago
why did I read sadism instead of sysadmin?
RIMR 5y ago
I used to have Nessus installed on a NUC that I would just drop into a customer's network closet for a weekend, and monitor remotely. I hosted the Nessus UI as a Tor Hidden Service, and it worked great. We just cycled the key every quarter for added security, and so that ex-employees wouldn't know where to find it.
jstrieb 5y ago
I can confirm that Tor is very useful for exposing services when you cannot port forward! Specifically, I've used Tor for connecting to GitHub Actions virtual machines over SSH. This is great for debugging Actions without running them over and over again. I also used this for a project that sets up an ephemeral, collaborative environment in one of the GitHub Actions VMs. https://github.com/jstrieb/ctf-collab https://github.com/jstrieb/ctf-collab
suyash 5y ago
For some reason IT dept hates as I get notification when I try to use it. I think coz it jumps over so many IP addresses.
brightball 5y ago
This is an excellent set of use cases! I didn’t know about torsocks either.
kaycebasques 5y ago
Just wanted to send a drive-by comment that I very much like the design of this website. Very information dense. The top nav could use some work on mobile but other than that it is quite well done. Author, if you're reading this, I will probably "borrow" much of your design! (I'll give a shout-out in my footer however if I do end up "borrowing")
nyanpasu64 5y ago
In sysadmin use cases where you're only interested in accessing a website from a different IP, or setting up a reverse shell/service to hole-punch NATs, but don't need anonymity and untraceability, is Tor's multi-layered onion routing a latency and bandwidth impediment, and would you be better off turning it off (not sure if possible with the current codebase)?
chaostheory 5y ago
“However, to take a literal view, X is just a Y tool, and it can be used in any way that you want.” Society would be better if people took this view with all tools. They’re just tools. Unlike people they don’t have intent.

420 points by azalemeth 5y ago

One very important thing not mentioned is that the tor exit node could be capturing your traffic or do a MITM attack. Its a great idea for testing but only after you have encryption working, and of course pay special attention to your ssh fingerprints.

segfaultbuserr 5y ago
If the endpoint is in your control and you'd like to experiment with Tor, you can configure your server as an Onion Service, so you are protected by Tor's own end-to-end encryption (whose traffic cannot be captured by MITM since the hostnames themselves are the public keys). For non-anonymous uses, you should active the "Single Service Onion" mode, so the 6-hop (extra 3-hop for server anonymity) is skipped, allowing standard 3-hop latency and performance. It also saves bandwidth for exit nodes - all non-exit relays can forward Onion traffic.
boring_twenties 5y ago
Hidden services are not accessed through exit nodes. Relay nodes cannot capture your traffic or perform MITM attacks.
fswwi 5y ago
Cloudflare is mitm, btw.
- vntok 5y ago
  So is your network firewall, what's your point?
  - fswwi 5y ago
    Cloudflare can see decrypted content when HTTPS is used.

lambdaba 5y ago

ngrok.com allows some of these, at full (or at least, much better speed, haven't benchmarked), and is mostly free (paid plan required for custom subdomains). Sharing this for those still unaware of it, it's a great service.

anaganisk 5y ago
Or better yet, use cloudflare tunnels and setup an actual permanent tunnel with custom subdomain support. If you want it to be a temporary one, it supports that too. For FREE.
- Shank 5y ago
  Is that part of Cloudflare Teams? No offense to Cloudflare, but their pricing is really unclear. I have an account and I use them for a lot, but they have 3 different "plans" and then they have various ad-hoc products. Tunnel just says "view in dashboard." [0] If I click on that link while logged in, I'm taken to my dashboard with no indication of how to use Tunnel or anything. The plans page [1] indicates that it's part of argo smart routing. If I click on "activate argo" it actually does the exact same thing as the teams "view in dashboard" button -- it redirects me to the dashboard and has no indication of being activated or anything. Really frustrating. [0]: https://www.cloudflare.com/products/tunnel/ https://www.cloudflare.com/products/tunnel/ [1]: https://www.cloudflare.com/plans/ https://www.cloudflare.com/plans/
  - PaywallBuster 5y ago
    It's confusing for me too product page says it requires paid Argo (smart routing) subscription https://www.cloudflare.com/en-gb/products/tunnel/ https://www.cloudflare.com/en-gb/products/tunnel/ the blog page says its free https://blog.cloudflare.com/tunnel-for-everyone/ https://blog.cloudflare.com/tunnel-for-everyone/ and actually you can install and run it quite easily brew uninstall cloudflare/cloudflare/cloudflared cloudflared login cloudflared tunnel this will launch a tunnel with a random subdomain listening to http://localhost:8080 http://localhost:8080

azalemeth 5y ago

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be to "just" run an onionsite with onion services authentication [1], preventing it being publicly accessed without the pre-shared key. If your onion service just redirects to ssh (presumably with certificate-only auth) I can't help but think that this is almost an example of security by obscurity done right. [1] https://support.torproject.org/en-US/onionservices/client-auth/ https://support.torproject.org/en-US/onionservices/client-au...

KingMachiavelli 5y ago
For that use case why not just use Wireguard?
- deleted 5y ago
  [deleted]
  - alisonkisk 5y ago
    Wireguard is not the same as ZeroTier.
nine_k 5y ago
If your hard-to-reach server can connect to the internet (via a bunch of NATs and whatnot), you can just make it access your box of choice by e.g. Wireguard, or plain SSH with port-forwaring, or attach it as a node to your ZeroTier private network. You only need a bunch of jump hosts if your target server has no Internet connectivity, and should not, in which case all these levels of bastions do make sense.
- azalemeth 5y ago
  That requires having another publicly accessible box, or trusting ZeroTier though, doesn't it? The onion approach does not.

api 5y ago

Not sure why you'd use this instead of something like ZeroTier or a bounce box, but I can think of one reason: you want to hide the location of something in your infrastructure to make side channel attacks on the cloud provider or physical location a lot harder.

alisonkisk 5y ago
Part of the point is to generate non-criminal usage of Tor to legitimize it.

unsignedint 5y ago

Back when I was managing system in a small company, I had a couple of systems on hidden service with auth cookies. When port forward failed or otherwise had problem accessing, it provided decent plan B for getting things back online.

lifeisstillgood 5y ago

Being a small cog, but using clever tricks to get your job done is not solving the problem. An organisation that prevents itself from acting rationally is an organisation that should die Schumpter-style. Please don't prevent it.

sumtechguy 5y ago
Also circumventing this sort of thing in many orgs is a first class ticket to finding a new job. Friend of mine did that, they walked him to the curb with his cardboard box that day. His sin? Turned off virus scanning because it was taking 4 hours to do a 20 min build.
- azalemeth 5y ago
  To be honest, if I were in that situation I'd be thinking something along the lines of "well, that was a dodged bullet".
- novok 5y ago
  The organization did him a favor. Many other, far more well paying companies response to doing that is working with the developer to figure out a system to make them both happy, or just silently ignoring it until they figure out a better solution. Or just talking to the person and asking them to stop, vs firing.
  - sumtechguy 5y ago
    Took him nearly a year to find a job and had to go on food stamps. I do not think he saw it that way. If you are in some of these smaller markets it can take time to find a job. Especially if you do not live in the area.
throwaway09223 5y ago
I'm not seeing where this relates to organizational dysfunction. Using an external point to test a system is a standard practice. I'm also a little confused because preventing someone from using their abilities to problem solve would be a cause of dysfunction -- a seemingly avoidable one.

segfaultbuserr 5y ago

The article didn't mention another nice trick: Tor is also a great tool for accessing IPv4 sites in a IPv6-only network and vice versa.

dijit 5y ago

I actually use tailscale for exactly this reason. NAT is the devil. The latency of tor might be a bit too much though.

5faulker 5y ago

Interesting use of a security tool

jedberg 5y ago

Heh, most of these use cases I solved by having a personal jumphost in a cabinet in a datacenter. But this is very clever! I like the idea of using Tor because you'll get much better tests.

asddubs 5y ago

I like using tor when testing DNS resolution related stuff, to circumvent some part of my system having a cached entry already.

tempfs 5y ago

Using Tor for anything in a corporate network will rightfully get you into serious shit with IT security. I see a lot of people also advocating ngrok, wireguard, etc. You all may not realize that actual threat actors use all of these same techniques and making yourself look like them could very well lead to your termination as this kind of circumvention of security controls is absolutely a threat to the org and a violation of security policy. TLDR; If you need remote access, use the proper channels....pretty please. For everyone's sake.

sockpuppet_12 5y ago
This is the correct answer, and also the hardest answer because it's going to require you to have to swallow your pride. Security will already be monitoring your traffic as a basic first step, which they will pipe straight into a SIEM or SOAR system. Doing this stuff will likely get you flagged for an audit.

swiley 5y ago

I loved TOR when I was a broke student without enough money to have one or two always on machines with public IPs I could reverse proxy to.

eximius 5y ago

So the big message is proxies are useful? I mean, sure. I'm not sure why Tor makes a better choice than anything else?

INTPenis 5y ago

I recently had to do some basic sysadmin stuff over tor and I disagree with OP. Two things that failed mieserably, fetching a file that was just shy of 5M, and a reverse SSH tunnel. The SSH tunnel was unusable, it would only last for minutes at the most. I wish I could use mosh but that requires UDP. The file transfer was actually done with curl and the file was often incomplete. This was all done within Europe where we have the highest concentration of tor nodes. So no, I don't think tor is appropriate for sysadmin tasks.

aarchi 5y ago
> This was all done within Europe where we have the highest concentration of tor nodes. So Tor nodes take locality into account? Although, that would improve speeds, it seems like an information leak.
- INTPenis 5y ago
  Not sure, just an educated guess but peering is best in that region so there is a large selection of nodes with very good peering. No need to use a node outside of europe.
eloeffler 5y ago
Out of curiosity: Have yout set up your onion service in single-hop/Non-Anonymous mode as suggested in the article? I've been using tor for shell access only and it worked reasonably well for me, but I havent't tried this mode and wonder if your issues persist if it is used.
- INTPenis 5y ago
  No I didn't know you could do that. But also in my use case anonymity was a requisite.

slacka 5y ago

Tor is also useful is to verify country specific customization on your website are working. I regularly used Tor on reports of issues with default language or currency. It's just a quick toggle of a setting in "torrc" to limit your exit node to a specific country code.

skadamat 5y ago

Smells a bit like Wireguard use case!

RIMR 5y ago
Wireguard is a great technology, and if latency and file transfers are important you should use it, but a Tor hidden service is way easier to set up, and way more reliable.

trey-jones 5y ago

Several years ago I used a Tor Hidden Service in a professional capacity to expose an application from a Wireless network with properties that we wouldn't know ahead of time. Worked like a charm, and no regrets. My favorite part was telling my employer "We're using TOR for this" eyebrows.

deleted 5y ago

[deleted]

menduza23 5y ago

Tor is a great tool for freedom. People tend to bash it and say people use it for child porn. But the reality with freedom and free choice is that you can also use that freedom to do bad. We are seeing censorship in the west on the same scale as china right now. I won't be surprised if Tor gets taken out of action in the west soon.

posterboy 5y ago

why did I read sadism instead of sysadmin?

RIMR 5y ago

I used to have Nessus installed on a NUC that I would just drop into a customer's network closet for a weekend, and monitor remotely. I hosted the Nessus UI as a Tor Hidden Service, and it worked great. We just cycled the key every quarter for added security, and so that ex-employees wouldn't know where to find it.

jstrieb 5y ago

I can confirm that Tor is very useful for exposing services when you cannot port forward! Specifically, I've used Tor for connecting to GitHub Actions virtual machines over SSH. This is great for debugging Actions without running them over and over again. I also used this for a project that sets up an ephemeral, collaborative environment in one of the GitHub Actions VMs. https://github.com/jstrieb/ctf-collab https://github.com/jstrieb/ctf-collab

suyash 5y ago

For some reason IT dept hates as I get notification when I try to use it. I think coz it jumps over so many IP addresses.

brightball 5y ago

This is an excellent set of use cases! I didn’t know about torsocks either.

kaycebasques 5y ago

Just wanted to send a drive-by comment that I very much like the design of this website. Very information dense. The top nav could use some work on mobile but other than that it is quite well done. Author, if you're reading this, I will probably "borrow" much of your design! (I'll give a shout-out in my footer however if I do end up "borrowing")

nyanpasu64 5y ago

In sysadmin use cases where you're only interested in accessing a website from a different IP, or setting up a reverse shell/service to hole-punch NATs, but don't need anonymity and untraceability, is Tor's multi-layered onion routing a latency and bandwidth impediment, and would you be better off turning it off (not sure if possible with the current codebase)?

chaostheory 5y ago

“However, to take a literal view, X is just a Y tool, and it can be used in any way that you want.” Society would be better if people took this view with all tools. They’re just tools. Unlike people they don’t have intent.