Cliquez ici pour la version française de l'article

On my personal experimental infrastructure I always setup my VPS to expose my administration services through Tor hidden services. My server never directly accepts SSH connection, only people who know the SSH service's onion address and have the specific private key can connect. I think exposing administration services this way makes them extremely secure. I mentioned SSH, but the same approach obviously works for a web control panel, etc.

Principle

Tor is an anonymization network that lets you run hidden services. These services are anonymized behind three relays and advertise themselves on the network (through descriptors).


Tor doesn’t care about the original server’s reachability, even behind a NAT which is why I used it for home labbing.
Creating an onion service is as easy as installing the tor daemon and adding these lines to the torrc configuration file:

1
2
HiddenServiceDir /var/lib/tor/secret_ssh/
HiddenServicePort 22 127.0.0.1:22 # the port of the hidden service (22) followed by where the traffic will actually be listened on the server, this can be changed to a unix socket or even a different port, doesn't matter

After restarting or reloading tor, it will automatically generates an onion address inside the HiddenServiceDir (in the hostname file).
If we now point SSH to listen on the loopback address, it will receive traffic from the hidden service on port 22.
Now, if an attacker scans the server, they can’t even fingerprint or attempt to connect to SSH, since the port is closed / they don’t know the onion address.
Tor onion addresses are public, therefore to prevent anyone from even interacting with our private SSH hidden service, we can use Client Authorization.
With this, the hidden service only accepts connections from clients authorized through an asymmetric x25519 key.

Now, what if every service were behind Tor, would that be interesting? Absolutely, and I successfully replicated this setup for my home lab.
The idea is that the whole infrastructure runs as a hidden service, including web services, etc. A clearnet reverse proxy then forwards web traffic (via an nginx reverse proxy) and other protocols (through socat, for example) to the onion service.
The internet-facing server also serves as an uplink proxy for the main server, so the origin servers stay completely secret.
This clearnet reverse proxy can also handle filtering by running custom rulesets and blocking suspicious requests to the main server using tools such as CrowdSec.

Can this scale / is it viable?

Now surely not relying on a third party like cloudfare and have the same level of security have some drawbacks, right?:

  • First and foremost, reliability: while Tor is fairly resilient, network overload and global DDOS attacks do happen.
  • Tor hidden services add significant latency, and worse: latency is completely inconsistent, you may just get an unlucky circuit with very high latency that makes SSH barely usable.
  • Some hosting providers may block Tor guard or become suspicious of the server and block the client account, so it's essential to only use hosting providers that allow Tor.

I personally use Tor for my small personal projects and understand that such an architecture wouldn’t scale very well in a company where critical infrastructure requires permanent access, it would be a hassle to have to troubleshoot an SSH connection.
It should be “SSH works or the server is down,” not “maybe Tor is overloaded” or “maybe the tor daemon failed to build a circuit.” It just adds another layer of things to worry about and might not be suitable, but maybe that’s the cost of very good zero-trust security thanks to Tor’s decentralization?

I’m currently looking for a job by the way, please hire me!