The things we will be setting up
1) Enabling ssh login using an RSA key
2) Disabling password login
3) Enabling ssh over tor
4) Disabling ssh over Clearnet
Let's get started!
Requirements:
-A vps
-Tor
-A computer with linux
-Basic knowledge of setting up tor on a vps
As always, In pinned messages of /d/hiddenservice there is a list of good vps providers where you can test this out.
I am an amateur, you are an amateur, we're both amateurs, let's not use this tutorial to set up a criminal enterprise <3
First things first, open up your home computer with linux (or virtualbox ;). ) and make sure ssh is installed and everything is up to date.
part one: The client-side setup
apt-get update && apt-get upgrade -y
apt-get install openssh-client
Now, let's generate our key.
ssh-keygen -b 4096
ssh-keygen is the command we use to generate our key
-b 4096 is the argument we use to decide how many bits our key will be.
You will then be asked to name the file, and give it a password.
If everything went well you'll be shown a nice random art image.
If you check the directory where you created the file (and used the default names) you'll see 2 files, named id_rsa and id_rsa.pub These are respectively your private and public keys.
Part two: The server-side setup
First log in like you normally would using ssh.
This is the "dangerous" part, since this will be the only time you connect to your vps through it's Clearnet ip.
Make sure you have your proxies/vpn/tor correctly set up before connecting to the vps.
Check how you have connected to it using last
You should normally see the ip of where you have connected from, check if it's a tor exit relay and you're good. if it's not, time to burn that motherfucker down like it's a bug on your electric lighter.
Now that we're logged in and we have checked that it's through tor, Let's add another user through which we'll log in. It's best if this is not a standard name.
After adding the user, we'll log in and put the public rsa key in ~/.ssh/authorized_keys
adduser onionuser
su onionuser
mkdir ~/.ssh
cd ~/.ssh
nano ~/.ssh/authorized_keys
[copy and paste the rsa public key in here]
Well done, let's move onto part three.
Part three: Disabling password login.
Now that we have set up our login through an RSA key, which is much safer than just a password, we'll also have to let ssh know that we don't want to use a password anymore.
Open the file located at /etc/ssh/sshd_config and look for the lines
#PasswordAuthentication
#PubkeyAuthentication
Comment these out and Make sure PubKey is set to yes, and Passwordauthentication is set to no.
Now, let's restart sshd and test whether or not we did everything correct.
sudo systemctl restart sshd
ssh originalusername@your_vps_ip
It should say something along the lines of "Permission denied (publickey)
If you change originalusername to the username of the user we just added you will be able to log in using your public key!
[Part x: Interlude]
Well done, we're doing pretty alright so far. Let's continue on with setting up tor over ssh
First, We'll be installing tor, then configuring it to listen on port 80085.
After that, we'll get our hidden service hostname, change ssh to connect on port 80085, only allow connections over tor, bim bada boom, we're done. pretty easy right?
[Part four: Installing tor and setting up ssh over tor.]
apt-get install tor
nano /etc/tor/torrc
Change these 2 lines so it looks a little bit like this:
HiddenServiceDir /var/lib/tor/ssh
HiddenServicePort 5555 127.0.0.1:5555
And restart tor so it generates a hostname file in our Hidden service directory.
Then open up our sshd config over at /etc/ssh/sshd_config
Change Port 22 to port 5555, uncomment and change ListenAddress to "ListenAddress 127.0.0.1"
Also, just for fun, let's uncomment the line saying "Banner none" to make our ssh server a bit more tedious to find.
Again, restart the sshd service and try logging in using our onion hostname!
Make sure to connect to port 5555, otherwise it won't work :P
ssh -p 5555 onionuser@onionhostname.onion
bim bada boom you're done!
We have set up our very own ssh connection over tor, with a VPS that does not allow any ssh connections over Clearnet! well done.