Ask HN: Would you use Tor to connect to your distributed servers? | Hacker News Reader

Ask HN: Would you use Tor to connect to your distributed servers?

6 pointsmerqurio7 comments

We are looking for solutions to be able to connect to our servers that will be distributed to our customers (software is the product, not the hardware). As we don't know where they will end up, looking for possible alternatives to VPN I found out[1] that using the tor network could be a way to connect into the machines.

What should we consider before going with tor ? Would you do it ? Thanks !

[1]: http://gk2.sk/running-ssh-on-a-raspberry-pi-as-a-hidden-service-with-tor/

View on HN

* Tor will cause IDS and firewall alerts. This could lead to traffic being blocked.

* Tor HS are not particularly resilient and have relatively high latency.

* The addresses of Tor hidden services can be determined by an attacker (Malicious HSDir operators).

* The Tor network is already over capacity, and isn't intended or ready for commercial use. Carefully considering using a free community service for a commercial product.

* If you do ultimately use Tor, consider running Tor relays or donating to the foundation.

Great feedback! A couple of questions as we are new to

* What are the risks of unmasking a hidden Tor

* Planning a schedule to turn on tor will be a good solution for the resiliency problem ?

Thanks !

With the hidden service address, an attacker can access whichever ports are exposed by the hidden service.

Turning Tor off and on is a relatively expensive operation for the Tor network. It wouldn't particularly help resilience.

Thanks tshtf! I will keep learning on Tor before making any decision.

Personally I think it can be great to go with Tor, having a great excuse to support it too.

I have used Tor extensively in many situations and across many organizations and simply using it never "caused IDS and firewall alerts". Can you give examples?

What do you mean by "not particularly resilient", compared to other remote management solutions? Tor is very good at handling temporarily broken connections, change of networks etc. -- much better than many other solutions like openVPN.

Addresses of onion services in the current design can be discovered, true. Again, this is not different from many other remote management solutions. You can (and should in this scenario) use authenticated onion services, which means that unless you know a secret you cannot access any service behind an onion. See "HidServAuth" in the Tor manual.

"The Tor network is already over capacity" -- what makes you think that? Here's a graph roughly comparing available vs. used bandwidth: https://metrics.torproject.org/bandwidth.html

Yes, perfectly possible. With onion services, you get static identifiers to connect to the machine, and Tor is pretty good at working its way through NAT/firewalls. Bonus: You can seal that device off, and portscanning or similar won't give away anything.

Great ! That's a real nice bonus! Is there any security concern we should take into account about having tor running continuously ?

We tested with the instructions in the link above and worked really smoothly. The idea is the to orchestrate all the server with Ansible or Salt via tor SSH

Reply on news.ycombinator.com