3 ms·

I use Tor hidden services. All incoming Tor connections come from "localhost". Every single one of them. In order to propey secure, say, a Tor hidden services

by pierat 3y ago

I use Tor hidden services. All incoming Tor connections come from "localhost". Every single one of them. In order to propey secure, say, a Tor hidden services sshd, you can't use fail2ban. You must use 2fa. Fail2ban would just nearly immediately ban you from ever logging in. I also turn down the login delay to a few seconds, just to make bruting harder.

crazygringo 3y ago
I've never set up a Tor server, but I would have assumed incoming traffic could only be sent out to the internet, and that it would be blocked from accessing anything on your LAN, anything in 198.0.1.x. Is that not the case? Otherwise how could anyone even have a printer connected to their network without people constantly printing junk pages as a prank? If you've got a setup where Tor traffic can send a packet to your NAS in the first place, you're a far braver soul than I... I trust a firewall far more than I'll trust 2FA.
bauruine 3y ago
Yes all onion service connections appear from 127.0.0.1 but the current v3 onions are not guess or enumerateable. If you don't publish your address you get 0 attacks ever. Have you put your onion address all over the Internet to get attacked?
- pierat 3y ago
  That's not true. When you make a HS, it is announced in the Tor's dHT. Now, it is true that the scope of the v3 dHT is limited, it is not 0. (And more specifically, Tor is a 6-4 mixing network overlay with dHT DNS.)
  - bauruine 3y ago
    >However, clients still need to ask the directory for information about a specific onion address, which would again allow mass collection of onion addresses. With V3 onion services, this is prevented by using key derivation to derive a daily-rotated identifier ("blinded public key"). [0] This is the information I have. It's not possible for a relay to know an .onion address like it was with v2. Could you please link to something that proofs the contrary? [0] https://blog.torproject.org/v3-onion-services-usage/ https://blog.torproject.org/v3-onion-services-usage/

by pierat 3y ago

crazygringo 3y ago

I've never set up a Tor server, but I would have assumed incoming traffic could only be sent out to the internet, and that it would be blocked from accessing anything on your LAN, anything in 198.0.1.x. Is that not the case? Otherwise how could anyone even have a printer connected to their network without people constantly printing junk pages as a prank? If you've got a setup where Tor traffic can send a packet to your NAS in the first place, you're a far braver soul than I... I trust a firewall far more than I'll trust 2FA.

bauruine 3y ago

Yes all onion service connections appear from 127.0.0.1 but the current v3 onions are not guess or enumerateable. If you don't publish your address you get 0 attacks ever. Have you put your onion address all over the Internet to get attacked?

pierat 3y ago
That's not true. When you make a HS, it is announced in the Tor's dHT. Now, it is true that the scope of the v3 dHT is limited, it is not 0. (And more specifically, Tor is a 6-4 mixing network overlay with dHT DNS.)
- bauruine 3y ago
  >However, clients still need to ask the directory for information about a specific onion address, which would again allow mass collection of onion addresses. With V3 onion services, this is prevented by using key derivation to derive a daily-rotated identifier ("blinded public key"). [0] This is the information I have. It's not possible for a relay to know an .onion address like it was with v2. Could you please link to something that proofs the contrary? [0] https://blog.torproject.org/v3-onion-services-usage/ https://blog.torproject.org/v3-onion-services-usage/