10 ms·

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be to "just" run an onionsite with onion services authentication [1], preventing it being publicly accessed without the pre-shared key. If your onion service just redirects to ssh (presumably with certificate-only auth) I can't help but think that this is almost an example of security by obscurity done right. [1] https://support.torproject.org/en-US/onionservices/client-auth/ https://support.torproject.org/en-US/onionservices/client-au...

KingMachiavelli 5y ago
For that use case why not just use Wireguard?
- deleted 5y ago
  [deleted]
  - alisonkisk 5y ago
    Wireguard is not the same as ZeroTier.
nine_k 5y ago
If your hard-to-reach server can connect to the internet (via a bunch of NATs and whatnot), you can just make it access your box of choice by e.g. Wireguard, or plain SSH with port-forwaring, or attach it as a node to your ZeroTier private network. You only need a bunch of jump hosts if your target server has no Internet connectivity, and should not, in which case all these levels of bastions do make sense.
- azalemeth 5y ago
  That requires having another publicly accessible box, or trusting ZeroTier though, doesn't it? The onion approach does not.
  - novok 5y ago
    ZeroTier, Tailscale and such are OSS and have been independently security & crypto audited. I don't know if tailscale has been audited, but since they are a more popular tool I bet they probably are too. They're actually really good tools and would probably be more reliable than tor tbh, I would recommend looking into them.
    - Nullabillity 5y ago
      > ZeroTier, Tailscale and such are OSS and have been independently security & crypto audited. Both rely on their centralized coordinator servers which can mess with your routes (and thus your traffic) however they please. ZeroTier has a published (but not OSS) coordinator, but their documentation pushes you towards their SaaS. Tailscale's coordinator is SaaS-only, unless something has changed very recently.
      - nine_k 5y ago
        This is fair. Their client node software is audited though, and the contents of your packets are not accessible to the router. This is why the amount of the possible meddling is limited to a DoS, AFAICT. Who audits the Tor nodes that do onion routing is anyone's guess; I suppose ZeroTier is no worse than them.
        Nullabillity 5y ago
        > Their client node software is audited though, and the contents of your packets are not accessible to the router. This is why the amount of the possible meddling is limited to a DoS, AFAICT. Normally the coordinator just forwards the keys from your peers, and so doesn't see the contents (the traffic doesn't pass through it, and even if it did it didn't have the key). However, that assumes that the coordinator is being truthful with the network topology that it sends you. It could send you any topology that it wants to! This means that it could start MITMing whenever it wants to by telling you that $SERVER_IP's peer is now actually $COORDINATOR_KEY at $COORDINATOR_IP. Theoretically you could defend against this by, say, running a cronjob that validates that the Wireguard keys are unchanged. But at that point you're not really gaining much compared to just using wg-quick. Tor is different, because the .onion domain name inherently encodes the public key of the site you're connecting to. There is no way to change the key without also changing the URLs that people connect to!
krtyiktj 5y ago
at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your head would spin. you'd get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.
- derefr 5y ago
  Obviously, you should plan around this by gathering all the MAC addresses of every machine in the office, and then have your machine spoof through them in rotation. /s
  - sillysaurusx 5y ago
    It makes me sad every time I think about it, but Aaron Swartz did this during his saga. Well, sort of: he incremented the MAC address by 1. Point being, it's not foolproof. If some clever undergrad is thinking about dodging the suits, win by fooling them, not by fighting them. If you do insist on fighting, though, start at https://www.whonix.org/wiki/Mental_Model https://www.whonix.org/wiki/Mental_Model and then read the entire Whonix wiki https://www.whonix.org/wiki/Documentation https://www.whonix.org/wiki/Documentation. It's what I used when I was serious about dodging the cartels, and that knowledge will protect you as much as anything will. (You'll hopefully conclude that the protection is too brittle to risk your life, as I did.)
    - nqzero 5y ago
      building a new computer. want to be able to trust it 100% for at least a moment. i can't figure out how to "buy" a trusted copy of any linux and don't have any machines i have 100% trust in (who does), so can't burn it. current plan is to buy a chromebook solely for the purpose of downloading and burning ubuntu. alternatively, buy MSWindows, install on the new machine, burn, and then replace but this mental exercise has convinced me that security is almost impossible in this day and age
      - 5y ago
kodablah 5y ago
Yup, and it's easy to make server and client side tooling use Tor to make this mostly transparent. Latency/bandwidth isn't _that_ bad when communicating with an onion service. And it can be even faster if server anonymity isn't a goal (server set HiddenServiceSingleHopMode and HiddenServiceNonAnonymousMode and create ephemerial onion service with NonAnonymous). I use Tor plenty to self-host services from my house that are reachable anywhere (and often have a web interface I can access via Orbot). No hole-punching necessary.
- njsubedi 5y ago
  Could you share more about your setup?
  - kodablah 5y ago
    Sure. I wrote https://github.com/cretz/bine https://github.com/cretz/bine (though I admittedly don't work on it much these days). I just have a few-line daemon that starts an HTTP (or gRPC or whatever) server on ephemeral onion service. Then I use that onion ID to access it (via TorBrowser or Orbot or a client built with the same library).
    - njsubedi 5y ago
      Thank you!
ISL 5y ago
Think from the beginning what will be the end: "I thought your security policy was too overbearing, so I used tor." IT departments make their choices for reasons. The key is to help them understand your use-case, and they'll probably help you through the problem in a way that might limit collateral damage. Source: have seen firewall bypasses (with a pre-shared key) get leveraged as a way to hack an entire university lab/department.
- azalemeth 5y ago
  I tried doing that, and largely succeeded, but the specific area of the university in question will not have a bastion SSH host anywhere on their network. They will not allow SSH access in at all. They will however allow SSH access to other parts of the university, with different people in charge, which explicitly do allow an SSH bastion host to exist (and provide several for that purpose). So, the net result is that they've effectively out-sourced the control and responsibility of their environment to someone else. Normally this is fine, but my job involves programming and controlling large, expensive, and strangely fragile lab equipment. There's a resilience problem, and it's got to the point where others have suggested putting a GSM modem on a pci-e card inside some of the boxes in question, as the relevant IT department decides on a whim to block ports with no warning or justification. Some manufacturers of the devices in question do this as standard if you have a support contract. Trying to complain results in responses like "you have been used to doing things one way and this change now prevents you from working as before." I completely accept that this is a political problem and best solved as one, but ultimately SSH is an industry standard for a reason -- it's secure, and it's flexible. The machines in question are valuable, prone to breaking in the middle of the night, and we are an international bunch who cannot always connect from a well-defined ipv4 address, or from the university's VPN. (The latter is blocked by the IT department automatically, as it has too large a pool of potential users). The thing I find most frustrating is that this sort of political decision creates days worth of work instantaneously, for little benefit. All of the actually confidential or sensitive information is held in a completely separate network at any rate...
  - unethical_ban 5y ago
    To quote Dr. Manhattan, "Without condemning, or condoning, I understand". I am in network security. I have stopped shadow IT, and been a part of it. Your situation seems so ungodly stupid and anathema to the point of IT, that the remaining courses of action should be the following. Thoroughly document via email your attempts at explaining requirements to Netsec, to document in writing their objections, to do your best with what they provide you... and WHEN things catastrophically break, point the finger at them and thoroughly document how if you had the proper, industry-standard tooling, you could have prevented the loss of research/time/money.
croutonwagon 5y ago
Agree. Thats pretty interesting. I use an SSH session and SOCKS5 proxy on a VPS provider for almost all of those other circumstances. Including checking external access etc. But the last one is a solid use case.
fluential 5y ago
You will like this one as well “SSL/SSH Multiplexer” http://www.rutschle.net/tech/sslh/ http://www.rutschle.net/tech/sslh/
- kej 5y ago
  Fixed link: https://www.rutschle.net/tech/sslh/README.html https://www.rutschle.net/tech/sslh/README.html Note that while this is a handy tool, its use is apparent to anyone observing the connection.

KingMachiavelli 5y ago

For that use case why not just use Wireguard?

deleted 5y ago
[deleted]
- alisonkisk 5y ago
  Wireguard is not the same as ZeroTier.

nine_k 5y ago

If your hard-to-reach server can connect to the internet (via a bunch of NATs and whatnot), you can just make it access your box of choice by e.g. Wireguard, or plain SSH with port-forwaring, or attach it as a node to your ZeroTier private network. You only need a bunch of jump hosts if your target server has no Internet connectivity, and should not, in which case all these levels of bastions do make sense.

azalemeth 5y ago
That requires having another publicly accessible box, or trusting ZeroTier though, doesn't it? The onion approach does not.
- novok 5y ago
  ZeroTier, Tailscale and such are OSS and have been independently security & crypto audited. I don't know if tailscale has been audited, but since they are a more popular tool I bet they probably are too. They're actually really good tools and would probably be more reliable than tor tbh, I would recommend looking into them.
  - Nullabillity 5y ago
    > ZeroTier, Tailscale and such are OSS and have been independently security & crypto audited. Both rely on their centralized coordinator servers which can mess with your routes (and thus your traffic) however they please. ZeroTier has a published (but not OSS) coordinator, but their documentation pushes you towards their SaaS. Tailscale's coordinator is SaaS-only, unless something has changed very recently.
    - nine_k 5y ago
      This is fair. Their client node software is audited though, and the contents of your packets are not accessible to the router. This is why the amount of the possible meddling is limited to a DoS, AFAICT. Who audits the Tor nodes that do onion routing is anyone's guess; I suppose ZeroTier is no worse than them.
      - Nullabillity 5y ago
        > Their client node software is audited though, and the contents of your packets are not accessible to the router. This is why the amount of the possible meddling is limited to a DoS, AFAICT. Normally the coordinator just forwards the keys from your peers, and so doesn't see the contents (the traffic doesn't pass through it, and even if it did it didn't have the key). However, that assumes that the coordinator is being truthful with the network topology that it sends you. It could send you any topology that it wants to! This means that it could start MITMing whenever it wants to by telling you that $SERVER_IP's peer is now actually $COORDINATOR_KEY at $COORDINATOR_IP. Theoretically you could defend against this by, say, running a cronjob that validates that the Wireguard keys are unchanged. But at that point you're not really gaining much compared to just using wg-quick. Tor is different, because the .onion domain name inherently encodes the public key of the site you're connecting to. There is no way to change the key without also changing the URLs that people connect to!

krtyiktj 5y ago

at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your head would spin. you'd get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.

derefr 5y ago
Obviously, you should plan around this by gathering all the MAC addresses of every machine in the office, and then have your machine spoof through them in rotation. /s
- sillysaurusx 5y ago
  It makes me sad every time I think about it, but Aaron Swartz did this during his saga. Well, sort of: he incremented the MAC address by 1. Point being, it's not foolproof. If some clever undergrad is thinking about dodging the suits, win by fooling them, not by fighting them. If you do insist on fighting, though, start at https://www.whonix.org/wiki/Mental_Model https://www.whonix.org/wiki/Mental_Model and then read the entire Whonix wiki https://www.whonix.org/wiki/Documentation https://www.whonix.org/wiki/Documentation. It's what I used when I was serious about dodging the cartels, and that knowledge will protect you as much as anything will. (You'll hopefully conclude that the protection is too brittle to risk your life, as I did.)
  - nqzero 5y ago
    building a new computer. want to be able to trust it 100% for at least a moment. i can't figure out how to "buy" a trusted copy of any linux and don't have any machines i have 100% trust in (who does), so can't burn it. current plan is to buy a chromebook solely for the purpose of downloading and burning ubuntu. alternatively, buy MSWindows, install on the new machine, burn, and then replace but this mental exercise has convinced me that security is almost impossible in this day and age
    - 5y ago

kodablah 5y ago

Yup, and it's easy to make server and client side tooling use Tor to make this mostly transparent. Latency/bandwidth isn't _that_ bad when communicating with an onion service. And it can be even faster if server anonymity isn't a goal (server set HiddenServiceSingleHopMode and HiddenServiceNonAnonymousMode and create ephemerial onion service with NonAnonymous). I use Tor plenty to self-host services from my house that are reachable anywhere (and often have a web interface I can access via Orbot). No hole-punching necessary.

njsubedi 5y ago
Could you share more about your setup?
- kodablah 5y ago
  Sure. I wrote https://github.com/cretz/bine https://github.com/cretz/bine (though I admittedly don't work on it much these days). I just have a few-line daemon that starts an HTTP (or gRPC or whatever) server on ephemeral onion service. Then I use that onion ID to access it (via TorBrowser or Orbot or a client built with the same library).
  - njsubedi 5y ago
    Thank you!

ISL 5y ago

Think from the beginning what will be the end: "I thought your security policy was too overbearing, so I used tor." IT departments make their choices for reasons. The key is to help them understand your use-case, and they'll probably help you through the problem in a way that might limit collateral damage. Source: have seen firewall bypasses (with a pre-shared key) get leveraged as a way to hack an entire university lab/department.

azalemeth 5y ago
I tried doing that, and largely succeeded, but the specific area of the university in question will not have a bastion SSH host anywhere on their network. They will not allow SSH access in at all. They will however allow SSH access to other parts of the university, with different people in charge, which explicitly do allow an SSH bastion host to exist (and provide several for that purpose). So, the net result is that they've effectively out-sourced the control and responsibility of their environment to someone else. Normally this is fine, but my job involves programming and controlling large, expensive, and strangely fragile lab equipment. There's a resilience problem, and it's got to the point where others have suggested putting a GSM modem on a pci-e card inside some of the boxes in question, as the relevant IT department decides on a whim to block ports with no warning or justification. Some manufacturers of the devices in question do this as standard if you have a support contract. Trying to complain results in responses like "you have been used to doing things one way and this change now prevents you from working as before." I completely accept that this is a political problem and best solved as one, but ultimately SSH is an industry standard for a reason -- it's secure, and it's flexible. The machines in question are valuable, prone to breaking in the middle of the night, and we are an international bunch who cannot always connect from a well-defined ipv4 address, or from the university's VPN. (The latter is blocked by the IT department automatically, as it has too large a pool of potential users). The thing I find most frustrating is that this sort of political decision creates days worth of work instantaneously, for little benefit. All of the actually confidential or sensitive information is held in a completely separate network at any rate...
- unethical_ban 5y ago
  To quote Dr. Manhattan, "Without condemning, or condoning, I understand". I am in network security. I have stopped shadow IT, and been a part of it. Your situation seems so ungodly stupid and anathema to the point of IT, that the remaining courses of action should be the following. Thoroughly document via email your attempts at explaining requirements to Netsec, to document in writing their objections, to do your best with what they provide you... and WHEN things catastrophically break, point the finger at them and thoroughly document how if you had the proper, industry-standard tooling, you could have prevented the loss of research/time/money.

croutonwagon 5y ago

Agree. Thats pretty interesting. I use an SSH session and SOCKS5 proxy on a VPS provider for almost all of those other circumstances. Including checking external access etc. But the last one is a solid use case.

fluential 5y ago

You will like this one as well “SSL/SSH Multiplexer” http://www.rutschle.net/tech/sslh/ http://www.rutschle.net/tech/sslh/

kej 5y ago
Fixed link: https://www.rutschle.net/tech/sslh/README.html https://www.rutschle.net/tech/sslh/README.html Note that while this is a handy tool, its use is apparent to anyone observing the connection.