{"id":6154,"date":"2026-09-04T23:05:23","date_gmt":"2026-09-04T14:05:23","guid":{"rendered":"https:\/\/eternalsphere.net\/echoes\/?p=6154"},"modified":"2026-09-12T17:17:45","modified_gmt":"2026-09-12T08:17:45","slug":"7yn50jtn989ehxy","status":"publish","type":"post","link":"https:\/\/blog.eternalsphere.net\/index.php\/2026\/09\/04\/7yn50jtn989ehxy\/","title":{"rendered":"Exposing SSH Through a Tor Onion Service: How Secure Is It?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Tor and Onion Services are closely related, but they are not the same thing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <strong>Tor network<\/strong> is the larger anonymity network made up of clients, relays, directory infrastructure, and routing mechanisms.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An <strong>Onion Service<\/strong> is a type of service that operates inside the Tor network and is accessed through a <code>.onion<\/code> address.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So <code>.onion<\/code> is not a separate network parallel to Tor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A more accurate model is:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> <code>                        Tor Network\n                              \u2502\n             \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n             \u2502                \u2502                \u2502\n        Normal Tor        Tor Relays      Onion Services\n        Browsing                              \u2502\n             \u2502                                \u25bc\n             \u25bc                           xxxxx.onion\n        Exit Relay\n             \u2502\n             \u25bc\n      Normal Internet\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This distinction becomes especially interesting when SSH is exposed through an Onion Service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of publishing SSH directly to the public Internet, the service can exist only inside Tor.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">1. How Public SSH Usually Works<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">A conventional SSH server exposed to the Internet often looks like this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Internet\n   \u2502\n   \u25bc\nPublic IP\n   \u2502\n   \u25bc\nTCP\/22\n   \u2502\n   \u25bc\nRouter \/ Firewall\n   \u2502\n   \u25bc\nsshd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the server sits behind a home router, port forwarding is often required:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Internet\n   \u2502\n   \u25bc\nPublic IP\n   \u2502\n   \u25bc\nRouter\n   \u2502\n   \u25bc\nPort Forwarding\n   \u2502\n   \u25bc\nInternal Server\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This means the SSH service is directly reachable from the public Internet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Automated scanners can discover it and attempt:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>password guessing;<\/li>\n\n\n\n<li>username enumeration;<\/li>\n\n\n\n<li>brute-force authentication;<\/li>\n\n\n\n<li>SSH version detection;<\/li>\n\n\n\n<li>vulnerability scanning;<\/li>\n\n\n\n<li>botnet probes.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Even when SSH itself is configured securely, the service is still publicly exposed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Anyone on the Internet can knock on the door.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">2. SSH Through an Onion Service<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">An Onion-based SSH setup can instead look like this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Remote SSH Client\n        \u2502\n        \u25bc\n       Tor\n        \u2502\n        \u25bc\nxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.onion\n        \u2502\n        \u25bc\nServer Tor Process\n        \u2502\n        \u25bc\n127.0.0.1:2222\n        \u2502\n        \u25bc\n      sshd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The server may have no public SSH port at all.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There is no need for:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SERVER_IP:22\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">to exist.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The remote user connects to the Onion address rather than directly to the server&#8217;s public IP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This fundamentally changes the attack surface.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">3. SSH Can Be Completely Removed From the Public Internet<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">One of the strongest advantages is that sshd can listen only on localhost.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>127.0.0.1:2222\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The resulting architecture becomes:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Public Internet \u2500\u2500X\u2500\u2500&gt; sshd\n\nLAN \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500X\u2500\u2500&gt; sshd\n\nTor process \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500&gt; 127.0.0.1:2222\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Only the local Tor daemon can reach the SSH listener.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The public Internet cannot directly connect to it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This means that ordinary Internet-wide SSH scanning no longer reaches the SSH daemon at all.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">4. Why Port Forwarding Is Often Unnecessary<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Traditional remote access usually relies on inbound connectivity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A client connects into the server&#8217;s network:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Internet\n   \u2193\nRouter\n   \u2193\nPort Forward\n   \u2193\nServer\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Onion Services work differently.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The server itself creates outbound Tor circuits:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Server\n   \u2502\n   \u2502 outbound\n   \u25bc\nTor Network\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The remote client also connects to Tor:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Client\n   \u2502\n   \u25bc\nTor Network\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The two sides are connected through Tor&#8217;s Onion Service rendezvous mechanism.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Conceptually:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Client\n   \\\n    \\\n     Tor Network\n    \/\n   \/\nServer\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The client never needs to initiate a direct TCP connection to the server&#8217;s public IP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore an Onion Service often works without:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>inbound NAT forwarding;<\/li>\n\n\n\n<li>a public SSH port;<\/li>\n\n\n\n<li>a static IP address;<\/li>\n\n\n\n<li>dynamic DNS.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">As long as the server can establish outbound Tor connections, the Onion Service can remain reachable.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">5. Dynamic Public IP Addresses Become Less Important<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Traditional remote SSH frequently depends on the server&#8217;s current public IP address.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If it changes:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Old IP\n   \u2193\nConnection fails\n   \u2193\nNew IP\n   \u2193\nUpdate DDNS\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">An Onion Service identity works differently.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Its address is derived from cryptographic keys, not from the server&#8217;s current public IP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Public IP changes\n        \u2193\nTor reconnects\n        \u2193\nSame Onion identity\n        \u2193\nSame .onion address\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This separates:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Service Identity\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">from:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Network Location\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The server can move between networks while preserving the same Onion address, provided its Onion Service private keys remain intact.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">6. A <code>.onion<\/code> Address Should Not Be Treated as a Password<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Modern Onion addresses are extremely difficult to guess randomly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, they are still addresses.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">They should not be treated as secrets equivalent to authentication credentials.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Without additional protection:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Knows .onion address\n        \u2502\n        \u25bc\nCan attempt to access service\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A stronger design adds another layer:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Onion Service Client Authorization<\/strong><\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">7. First Authentication Layer: Onion Client Authorization<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Tor v3 Onion Services can require authorized clients.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With client authorization enabled:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Knows .onion address\n        \u2502\n        \u25bc\nHas valid Onion client key?\n        \u2502\n   \u250c\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2510\n   \u2502         \u2502\n  No        Yes\n   \u2502         \u2502\n   X         \u25bc\nBlocked     Service reachable\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This means that knowing the Onion address alone is not enough.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An unauthorized user cannot even reach the underlying SSH service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is important because it moves the first security boundary ahead of sshd itself.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Everyone\n   \u2193\nsshd\n   \u2193\nAuthentication\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">the design becomes:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Everyone\n   \u2193\nOnion Client Authorization\n   \u2193\nOnly authorized devices\n   \u2193\nsshd\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">8. Second Authentication Layer: SSH Public-Key Authentication<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Even when Onion Client Authorization is enabled, SSH should retain its own strong authentication.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A hardened SSH configuration typically includes:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PubkeyAuthentication yes\nPasswordAuthentication no\nKbdInteractiveAuthentication no\nPermitRootLogin no\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Access can also be restricted to specific accounts:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>AllowUsers admin\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The authentication chain then becomes:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Tor\n \u2502\n \u25bc\nOnion Client Authorization\n \u2502\n \u25bc\nSSH Server\n \u2502\n \u25bc\nSSH Public-Key Authentication\n \u2502\n \u25bc\nShell\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">An attacker would need both:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Valid Onion client credential\n+\nValid SSH private key\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Compromising only one layer is not enough.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">9. The Two Key Systems Protect Different Things<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Onion client credentials and SSH keys may look similar because both use public-key cryptography, but their purposes are different.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Onion Client Authorization<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Answers:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Is this device allowed to reach the Onion Service?<\/p>\n<\/blockquote>\n\n\n\n<pre class=\"wp-block-code\"><code>Tor Network\n   \u2502\n   \u25bc\nClient Authorization\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">It controls service reachability.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">SSH Public-Key Authentication<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Answers:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Is this user allowed to log into the operating system?<\/p>\n<\/blockquote>\n\n\n\n<pre class=\"wp-block-code\"><code>sshd\n \u2502\n \u25bc\nSSH Authentication\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">It controls system access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Onion Client Key\n       \u2502\n       \u25bc\nNetwork access permission\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">and:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SSH Private Key\n       \u2502\n       \u25bc\nLogin permission\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">are independent security layers.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">10. The Server Has Its Own Important Keys<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">An Onion-based SSH setup involves several cryptographic identities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The server may contain:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SERVER\n\u2502\n\u251c\u2500 Onion Service private key\n\u251c\u2500 SSH host private keys\n\u2514\u2500 authorized_keys\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The client may contain:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>CLIENT\n\u2502\n\u251c\u2500 Onion client-auth private key\n\u251c\u2500 SSH private key\n\u2514\u2500 known_hosts\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These serve different purposes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Onion Service private key<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Defines the cryptographic identity associated with the <code>.onion<\/code> address.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If this key is stolen, an attacker may be able to impersonate the Onion Service.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">SSH host key<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Allows the SSH client to verify that it is connecting to the expected SSH server.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">SSH client private key<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Authenticates the SSH user.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Onion client key<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Authenticates the device to the Onion Service before SSH is reached.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">11. SSH Host-Key Verification Still Matters<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Onion Services already provide cryptographic service identity, but SSH host-key verification should still remain enabled.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Disabling it with settings such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>StrictHostKeyChecking=no\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">removes an important security layer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A stronger model is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Correct .onion identity\n        +\nCorrect SSH host key\n        +\nValid Onion client credential\n        +\nValid SSH client key\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The SSH server fingerprint can be verified once through a trusted channel and then stored in:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>~\/.ssh\/known_hosts\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the SSH host key later changes unexpectedly, SSH will warn the user.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That warning should not be ignored automatically.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">12. Why Fail2ban Becomes Less Important<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Traditional public SSH frequently uses Fail2ban.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The model is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Attacker IP\n    \u2502\n    \u25bc\nsshd\n    \u2502\nRepeated failures\n    \u2502\n    \u25bc\nFail2ban\n    \u2502\n    \u25bc\nBan source IP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This works because sshd can see the remote client&#8217;s IP address.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With an Onion Service, however:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Remote Client\n     \u2502\n     \u25bc\nTor Network\n     \u2502\n     \u25bc\nLocal Tor Process\n     \u2502\n     \u25bc\nsshd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The SSH daemon usually does not see the real remote Internet IP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As a result, IP-based blocking is much less useful.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A better strategy is to prevent unauthorized users from reaching sshd in the first place:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Unknown Client\n      \u2502\n      \u25bc\nOnion Client Authorization\n      \u2502\n      X\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This is often a stronger model than allowing repeated login attempts and then blocking addresses afterward.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">13. SSH Should Still Be Hardened<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Tor does not replace SSH security.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SSH should still follow normal hardening practices.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PasswordAuthentication no\nPermitRootLogin no\nPubkeyAuthentication yes\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Unused SSH capabilities can also be disabled.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">OpenSSH supports features such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>local forwarding;<\/li>\n\n\n\n<li>remote forwarding;<\/li>\n\n\n\n<li>dynamic SOCKS forwarding;<\/li>\n\n\n\n<li>agent forwarding;<\/li>\n\n\n\n<li>X11 forwarding;<\/li>\n\n\n\n<li>tunneling.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If these are unnecessary, they can be restricted:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>AllowTcpForwarding no\nAllowAgentForwarding no\nX11Forwarding no\nPermitTunnel no\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In more restrictive environments:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DisableForwarding yes\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">may also be appropriate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The principle is simple:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">A remote administrative account should expose only the capabilities it actually needs.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">14. Root Login Should Usually Remain Disabled<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Using Tor does not justify direct root login.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A safer model is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SSH\n \u2193\nRestricted administrator account\n \u2193\nsudo\n \u2193\nPrivileged operation\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">instead of:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SSH\n \u2193\nroot\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A typical setting is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PermitRootLogin no\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This reduces the consequences of a compromised SSH credential.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">15. LAN SSH and Onion SSH Can Be Separated<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">A server may need both:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>local SSH access from a trusted LAN;<\/li>\n\n\n\n<li>remote SSH through Tor.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These can be separated.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> <code>                   \u250c\u2500\u2500 LAN SSH\nLAN \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n                    \u2514\u2500\u2500 192.168.x.x:22\n\n\nTor \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500&gt; 127.0.0.1:2222\n                              \u2502\n                              \u25bc\n                         Onion SSH\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Two separate sshd instances can even be used.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">LAN SSH<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>192.168.x.x:22\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For trusted local access.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Onion SSH<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>127.0.0.1:2222\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For Tor-only access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Onion-facing SSH instance can then use stricter policies:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PasswordAuthentication no\nPermitRootLogin no\nAllowUsers remote-admin\nDisableForwarding yes\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This keeps local and remote trust boundaries separate.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">16. Tor Does Not Fix SSH Vulnerabilities<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">An Onion Service hides the network location and changes who can reach the service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It does not magically secure vulnerable software.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An outdated or badly configured SSH server can still be dangerous.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Examples include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>unpatched OpenSSH;<\/li>\n\n\n\n<li>weak account permissions;<\/li>\n\n\n\n<li>poor key management;<\/li>\n\n\n\n<li>insecure shell configuration;<\/li>\n\n\n\n<li>exposed credentials;<\/li>\n\n\n\n<li>vulnerable PAM configuration.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Tor primarily protects:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Network path\n+\nService location\n+\nExposure model\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">SSH protects:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Authentication\n+\nSession security\n+\nAccess control\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Both layers remain necessary.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">17. Tor Does Not Replace Host Security Either<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">If the server itself is compromised, Tor cannot restore security.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Malware\nRoot compromise\nCredential theft\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">can defeat protections at a completely different layer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Applications may also accidentally reveal identifying information such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>public IP addresses;<\/li>\n\n\n\n<li>internal hostnames;<\/li>\n\n\n\n<li>email addresses;<\/li>\n\n\n\n<li>DNS names;<\/li>\n\n\n\n<li>system metadata;<\/li>\n\n\n\n<li>network topology.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore Onion Service security still depends on:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>system updates;<\/li>\n\n\n\n<li>file permissions;<\/li>\n\n\n\n<li>least privilege;<\/li>\n\n\n\n<li>secure key storage;<\/li>\n\n\n\n<li>service isolation;<\/li>\n\n\n\n<li>logging;<\/li>\n\n\n\n<li>backups;<\/li>\n\n\n\n<li>application security.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Tor is one layer in a larger security design.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">18. A Strong Onion SSH Architecture<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">A robust private remote-management design can look like this:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> <code>                   PUBLIC INTERNET\n                          \u2502\n                    TCP\/22 closed\n                          \u2502\n                          X\n\n\nAuthorized Client\n       \u2502\n       \u25bc\n      Tor\n       \u2502\n       \u25bc\nxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.onion\n       \u2502\n       \u25bc\nOnion Client Authorization\n       \u2502\n       \u25bc\nServer Tor Process\n       \u2502\n       \u25bc\n127.0.0.1:2222\n       \u2502\n       \u25bc\nOpenSSH\n       \u2502\n       \u251c\u2500 Public-key authentication only\n       \u251c\u2500 Password login disabled\n       \u251c\u2500 Root login disabled\n       \u251c\u2500 Restricted user\n       \u251c\u2500 SSH host-key verification\n       \u2514\u2500 Unnecessary forwarding disabled\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The complete security chain becomes:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1. No public SSH port\n          \u2193\n2. Server IP not exposed through the Onion Service\n          \u2193\n3. Onion Client Authorization\n          \u2193\n4. Onion Service cryptographic identity\n          \u2193\n5. SSH host-key verification\n          \u2193\n6. SSH public-key authentication\n          \u2193\n7. Restricted non-root account\n          \u2193\n8. Operating-system security\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">An attacker must cross multiple independent security boundaries.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">19. Public SSH vs Onion SSH<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Property<\/th><th>Public SSH<\/th><th>Onion SSH<\/th><\/tr><\/thead><tbody><tr><td>Public IP required<\/td><td>Usually<\/td><td>No<\/td><\/tr><tr><td>Public SSH port<\/td><td>Usually<\/td><td>Can be completely absent<\/td><\/tr><tr><td>NAT port forwarding<\/td><td>Often<\/td><td>Usually unnecessary<\/td><\/tr><tr><td>Dynamic DNS<\/td><td>Often useful<\/td><td>Usually unnecessary<\/td><\/tr><tr><td>Server IP exposed<\/td><td>Yes<\/td><td>Designed to remain hidden<\/td><\/tr><tr><td>Client IP visible to server<\/td><td>Yes<\/td><td>Usually no<\/td><\/tr><tr><td>Internet-wide scanners reach sshd<\/td><td>Yes<\/td><td>Not directly<\/td><\/tr><tr><td>Password brute-force exposure<\/td><td>Common<\/td><td>Can be blocked before SSH with client authorization<\/td><\/tr><tr><td>SSH public-key authentication<\/td><td>Recommended<\/td><td>Still recommended<\/td><\/tr><tr><td>Root restriction<\/td><td>Recommended<\/td><td>Still recommended<\/td><\/tr><tr><td>Onion client authorization<\/td><td>Not applicable<\/td><td>Available<\/td><\/tr><tr><td>IP-based Fail2ban<\/td><td>Useful<\/td><td>Less useful<\/td><\/tr><tr><td>Latency<\/td><td>Lower<\/td><td>Higher<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The principal disadvantage is additional latency.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tor traffic traverses multiple relays, so SSH sessions are slower than direct LAN or public-IP connections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For tasks such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>remote administration;<\/li>\n\n\n\n<li>shell access;<\/li>\n\n\n\n<li>configuration changes;<\/li>\n\n\n\n<li>emergency maintenance;<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">the additional latency is often acceptable.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">20. The Most Interesting Part Is Not \u201cAnonymous SSH\u201d<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The architecture is often described as:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">SSH over Tor.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">But that description misses the more important security benefit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The real transformation is:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>SSH changes from a publicly exposed Internet service into a private service that exists only inside Tor.<\/strong><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Traditional public SSH:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SERVER_IP:22\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">means:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Anyone who can reach the IP can attempt to connect.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Onion SSH with client authorization:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.onion\n   \u2193\nClient Authorization\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">means:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Only devices with the appropriate Onion credential can even reach the SSH authentication layer.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">That is a fundamentally different exposure model.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h1 class=\"wp-block-heading\">21. The Three-Layer Security Model<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The entire architecture can be summarized in three layers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Layer 1: Tor<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Provides:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Hidden server location\n+\nHidden client IP\n+\nAnonymous routing\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Layer 2: Onion Client Authorization<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Answers:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Who is allowed to reach this service?\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Layer 3: SSH<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Answers:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Who is allowed to log into the operating system?\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The most concise way to describe the architecture is:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Tor protects the communication path, Onion Client Authorization controls who may reach the service, and SSH controls who may log into the server.<\/strong><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Used together, these mechanisms can turn SSH from a publicly visible management port into a hidden, authenticated, multi-layer remote administration service available only through the Tor network.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Tor and Onion Services are closely related, but they are not the same thing. The Tor network is the larger anonymity network made up of clients, relays, directory infrastructure, and routing mechanisms. An Onion Service is a type of service that operates inside the Tor network and is accessed through &hellip;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[120],"tags":[242,245],"class_list":["post-6154","post","type-post","status-publish","format-standard","hentry","category-1s3b6h7r2zay02x","tag-ssh","tag-tor"],"_links":{"self":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6154","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/comments?post=6154"}],"version-history":[{"count":1,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6154\/revisions"}],"predecessor-version":[{"id":6155,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6154\/revisions\/6155"}],"wp:attachment":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/media?parent=6154"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/categories?post=6154"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/tags?post=6154"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}