6 ms·

The main downside to this is that performance will generally be quite bad. Tor trades performance for anonymity. Unless you specifically need anonymity — which

The main downside to this is that performance will generally be quite bad. Tor trades performance for anonymity. Unless you specifically need anonymity — which is highly unlikely when you are just trying to reach back to a host of your own behind a NAT — there probably isn't any benefit in using Tor.

crtasm 5y ago
I'd still recommend trying it - performance is good enough for my needs. Is there still an onion service config option to use 3 hops instead of 6? I can't find the documentation on the current tor project website. edit: found it in the manpage: HiddenServiceSingleHopMode
- system33- 5y ago
  Disable the SocksPort, then set two options to really convince tor that you know what you're doing, then configure your onion service as usual. SocksPort 0 HiddenServiceSingleHopMode 1 HiddenServiceNonAnonymousMode 1 HiddenServiceDir /var/lib/tor/ssh_service HiddenServicePort 22 HiddenServiceDir /var/lib/tor/http_service HiddenServicePort 80
  - madacol 5y ago
    why disable SocksPort?
- zxcvbn4038 5y ago
  By default it is six hops for complete circuit between client and hidden service. Three hops from client to rendezvous point, then three hops from rendezvous point to the hidden service. If you go below that you might as well host on the public internet.
  - ycuser2 5y ago
    If the main goal is not anonymity this should not be a problem?
jancsika 5y ago
Suppose I've got an RPI and I want to ssh into it from anywhere in the world. If I ssh into it through a hidden service then the hidden service address IS its canonical address, regardless of whether I'm sitting in the living room or on the international space station. As it turns out I don't need to log in to my RPI from the ISS. But if I did need that, good luck explaining to me how to do that with impunity using a pile of brittle Linux configurations. Tell me how to do it and I bet I'll fuck it up.
- iso1631 5y ago
  $ ssh 123.45.67.8 Assuming there's internet on the ISS
  - monocasa 5y ago
    There is. They look like they're coming from a ground station to geoip.
    - iso1631 5y ago
      I guess it would be a hassle updating geoip databases every few seconds with a new location :D
  - jancsika 5y ago
    I didn't write it explicitly, but I was describing ssh'ing to an RPI behind a NAT as most residential U.S. internet is. In that case 123.45.67.8 won't help you. In fact, I think the comment I was responding to understood my meaning and retroactively edited their comment to include the part between the dashes about accessing a compy behind a NAT. GP-- did you do that or am I imagining things? Anyway, I agree with that comment as written-- if you don't ever need to care about breaking through NATs, Tor isn't a big benefit. (But there are, however, a large number of situations where users do care about NATs. GP only mentioned the one I had in mind. So I don't agree with the greater upshot of anonymity being the determining factor in Tor use.)
    - 5y ago
jstanley 5y ago
You can't say there "isn't any benefit" in using Tor without saying what you're comparing against. OP had a problem, and solved it using Tor. Suggesting there isn't any benefit in using Tor, without offering an alternative, is to suggest that you just shouldn't solve the problem. Of course there's a benefit in using Tor: it gets you through NAT for free! It also gets you end-to-end encryption for free.
- neilalexander 5y ago
  I am not saying you shouldn't solve the problem. I am saying that Tor is probably not the best tool available for the task if you don't specifically care about anonymity and there are more efficient tools available. Zerotier is one example, Cloudflare Argo is another, tinc is another, Yggdrasil is another, Tailscale is another. Some VPN providers (like Mullvad) will happily forward ports to you from their VPN servers. As the author linked to at the very beginning of their post, you could even set up something similar by hand with a VPS (free-tier would suffice) and off-the-shelf VPN software like Wireguard.
arpa 5y ago
hasn't Tor performance improved over the years? i mean, it still doesn't make sense to use torrents over it, but for ssh and maybe some light file transfer it should be enough, no?
- jandrese 5y ago
  Tor performance is really not that bad. Hidden services are worse because they effectively go through the network twice, but even then it's generally acceptable. People have the impression that it's like going back to a modem, but it's more like going to a laggy DSL connection.
mikotodomo 5y ago
I use Tor and it's fast.

crtasm 5y ago

I'd still recommend trying it - performance is good enough for my needs. Is there still an onion service config option to use 3 hops instead of 6? I can't find the documentation on the current tor project website. edit: found it in the manpage: HiddenServiceSingleHopMode

system33- 5y ago
Disable the SocksPort, then set two options to really convince tor that you know what you're doing, then configure your onion service as usual. SocksPort 0 HiddenServiceSingleHopMode 1 HiddenServiceNonAnonymousMode 1 HiddenServiceDir /var/lib/tor/ssh_service HiddenServicePort 22 HiddenServiceDir /var/lib/tor/http_service HiddenServicePort 80
- madacol 5y ago
  why disable SocksPort?
zxcvbn4038 5y ago
By default it is six hops for complete circuit between client and hidden service. Three hops from client to rendezvous point, then three hops from rendezvous point to the hidden service. If you go below that you might as well host on the public internet.
- ycuser2 5y ago
  If the main goal is not anonymity this should not be a problem?

jancsika 5y ago

Suppose I've got an RPI and I want to ssh into it from anywhere in the world. If I ssh into it through a hidden service then the hidden service address IS its canonical address, regardless of whether I'm sitting in the living room or on the international space station. As it turns out I don't need to log in to my RPI from the ISS. But if I did need that, good luck explaining to me how to do that with impunity using a pile of brittle Linux configurations. Tell me how to do it and I bet I'll fuck it up.

iso1631 5y ago
$ ssh 123.45.67.8 Assuming there's internet on the ISS
- monocasa 5y ago
  There is. They look like they're coming from a ground station to geoip.
  - iso1631 5y ago
    I guess it would be a hassle updating geoip databases every few seconds with a new location :D
- jancsika 5y ago
  I didn't write it explicitly, but I was describing ssh'ing to an RPI behind a NAT as most residential U.S. internet is. In that case 123.45.67.8 won't help you. In fact, I think the comment I was responding to understood my meaning and retroactively edited their comment to include the part between the dashes about accessing a compy behind a NAT. GP-- did you do that or am I imagining things? Anyway, I agree with that comment as written-- if you don't ever need to care about breaking through NATs, Tor isn't a big benefit. (But there are, however, a large number of situations where users do care about NATs. GP only mentioned the one I had in mind. So I don't agree with the greater upshot of anonymity being the determining factor in Tor use.)
  - 5y ago

jstanley 5y ago

You can't say there "isn't any benefit" in using Tor without saying what you're comparing against. OP had a problem, and solved it using Tor. Suggesting there isn't any benefit in using Tor, without offering an alternative, is to suggest that you just shouldn't solve the problem. Of course there's a benefit in using Tor: it gets you through NAT for free! It also gets you end-to-end encryption for free.

neilalexander 5y ago
I am not saying you shouldn't solve the problem. I am saying that Tor is probably not the best tool available for the task if you don't specifically care about anonymity and there are more efficient tools available. Zerotier is one example, Cloudflare Argo is another, tinc is another, Yggdrasil is another, Tailscale is another. Some VPN providers (like Mullvad) will happily forward ports to you from their VPN servers. As the author linked to at the very beginning of their post, you could even set up something similar by hand with a VPS (free-tier would suffice) and off-the-shelf VPN software like Wireguard.

arpa 5y ago

hasn't Tor performance improved over the years? i mean, it still doesn't make sense to use torrents over it, but for ssh and maybe some light file transfer it should be enough, no?

jandrese 5y ago
Tor performance is really not that bad. Hidden services are worse because they effectively go through the network twice, but even then it's generally acceptable. People have the impression that it's like going back to a modem, but it's more like going to a laggy DSL connection.

mikotodomo 5y ago

I use Tor and it's fast.