General

How to set up SSH over tor, with an RSA SSH login.

Started by AncientIdai · Feb 3, 2025

#5589
Hi everyone! This tutorial will go over a couple of things to set up a secure sh connection (little ssh pun there, not a typo)

The things we will be setting up

1) Enabling ssh login using an RSA key

2) Disabling password login

3) Enabling ssh over tor

4) Disabling ssh over Clearnet

Let's get started!

Requirements:

-A vps

-Tor

-A computer with linux

-Basic knowledge of setting up tor on a vps

As always, In pinned messages of /d/hiddenservice there is a list of good vps providers where you can test this out.

I am an amateur, you are an amateur, we're both amateurs, let's not use this tutorial to set up a criminal enterprise <3

First things first, open up your home computer with linux (or virtualbox ;). ) and make sure ssh is installed and everything is up to date.

part one: The client-side setup



apt-get update && apt-get upgrade -y

apt-get install openssh-client



Now, let's generate our key.



ssh-keygen -b 4096



ssh-keygen is the command we use to generate our key

-b 4096 is the argument we use to decide how many bits our key will be.

You will then be asked to name the file, and give it a password.

If everything went well you'll be shown a nice random art image.

If you check the directory where you created the file (and used the default names) you'll see 2 files, named id_rsa and id_rsa.pub These are respectively your private and public keys.

Part two: The server-side setup

First log in like you normally would using ssh.

This is the "dangerous" part, since this will be the only time you connect to your vps through it's Clearnet ip.

Make sure you have your proxies/vpn/tor correctly set up before connecting to the vps.

Check how you have connected to it using last

You should normally see the ip of where you have connected from, check if it's a tor exit relay and you're good. if it's not, time to burn that motherfucker down like it's a bug on your electric lighter.

Now that we're logged in and we have checked that it's through tor, Let's add another user through which we'll log in. It's best if this is not a standard name.

After adding the user, we'll log in and put the public rsa key in ~/.ssh/authorized_keys



adduser onionuser

su onionuser

mkdir ~/.ssh

cd ~/.ssh

nano ~/.ssh/authorized_keys

[copy and paste the rsa public key in here]



Well done, let's move onto part three.

Part three: Disabling password login.

Now that we have set up our login through an RSA key, which is much safer than just a password, we'll also have to let ssh know that we don't want to use a password anymore.

Open the file located at /etc/ssh/sshd_config and look for the lines

#PasswordAuthentication

#PubkeyAuthentication

Comment these out and Make sure PubKey is set to yes, and Passwordauthentication is set to no.

Now, let's restart sshd and test whether or not we did everything correct.



sudo systemctl restart sshd

ssh originalusername@your_vps_ip



It should say something along the lines of "Permission denied (publickey)

If you change originalusername to the username of the user we just added you will be able to log in using your public key!

[Part x: Interlude]

Well done, we're doing pretty alright so far. Let's continue on with setting up tor over ssh

First, We'll be installing tor, then configuring it to listen on port 80085.

After that, we'll get our hidden service hostname, change ssh to connect on port 80085, only allow connections over tor, bim bada boom, we're done. pretty easy right?

[Part four: Installing tor and setting up ssh over tor.]



apt-get install tor

nano /etc/tor/torrc



Change these 2 lines so it looks a little bit like this:

HiddenServiceDir /var/lib/tor/ssh

HiddenServicePort 5555 127.0.0.1:5555

And restart tor so it generates a hostname file in our Hidden service directory.

Then open up our sshd config over at /etc/ssh/sshd_config

Change Port 22 to port 5555, uncomment and change ListenAddress to "ListenAddress 127.0.0.1"

Also, just for fun, let's uncomment the line saying "Banner none" to make our ssh server a bit more tedious to find.

Again, restart the sshd service and try logging in using our onion hostname!

Make sure to connect to port 5555, otherwise it won't work :P



ssh -p 5555 onionuser@onionhostname.onion



bim bada boom you're done!

We have set up our very own ssh connection over tor, with a VPS that does not allow any ssh connections over Clearnet! well done.
#5592
↳ Replying to @AncientIdai
This is a good tutorial but it has a fallback, if anything happens to the Tor process running on the remote server, you will be locked out of the machine,it can happen.
#5593
↳ Replying to @AncientIdai
Good one! Still xmr broke, but will use this as soon as I have a dark vps

> Check how you have connected to it using last

This would mean connecting twice if I'm not mistaken.

On debian you can check your /var/log/auth.log

> port 80085 ... port 5555

Titties or default, make up your mind ;)

/u/jackroberts is right.

You could use an alternative daemon manager than systemd that might detect problems.

Another option is a daily or weekly restart in cron to make sure you can eventually get access again.
#5594
↳ Replying to @drisdane
Hehehe originally wanted to do 80085 because... Funny number, but port limit doesn't go that high :(
#5596
↳ Replying to @deleted-dd5f43ed
Ya but most hosts offer access to the shell from the host dashboard which should only be used in emergencies like this or create a second tor instance with exact same setup so you have 2 tors running. If the main one fails you can connect to the second one.