Tor hidden services

Tor hidden services

[Ludovic Courtès]

Commit adds ‘tor-hidden-service’, which can be used to specify hidden
services quite easily.

For example, to have your SSH daemon accessible over something.onion:22,
just do:

  (operating-system
    ;; …
    (services (cons* (lsh-service #:interfaces '("127.0.0.1"))
                     (tor-hidden-service "ssh" '((22 "127.0.0.1:22")))
                     (tor-service)
                     %desktop-services)))

and then you can:

  torify ssh something.onion

from anywhere.

Ludo’.

Re: Tor hidden services

[Thompson, David]

On Fri, Nov 27, 2015 at 6:59 PM, Ludovic Courtès <ludo@gnu.org> wrote:
> Commit adds ‘tor-hidden-service’, which can be used to specify hidden
> services quite easily.
>
> For example, to have your SSH daemon accessible over something.onion:22,
> just do:
>
>   (operating-system
>     ;; …
>     (services (cons* (lsh-service #:interfaces '("127.0.0.1"))
>                      (tor-hidden-service "ssh" '((22 "127.0.0.1:22")))
>                      (tor-service)
>                      %desktop-services)))
>
> and then you can:
>
>   torify ssh something.onion
>
> from anywhere.

Wow, awesome!  I've never used a Tor hidden service before because I
never understood how things work, but this configuration looks so
simple that I don't have much excuse to not try it out.  Thanks!

- Dave

Re: Tor hidden services

[Ludovic Courtès]

"Thompson, David" <dthompson2@worcester.edu> skribis:

> On Fri, Nov 27, 2015 at 6:59 PM, Ludovic Courtès <ludo@gnu.org> wrote:
>> Commit adds ‘tor-hidden-service’, which can be used to specify hidden
>> services quite easily.
>>
>> For example, to have your SSH daemon accessible over something.onion:22,
>> just do:
>>
>>   (operating-system
>>     ;; …
>>     (services (cons* (lsh-service #:interfaces '("127.0.0.1"))
>>                      (tor-hidden-service "ssh" '((22 "127.0.0.1:22")))
>>                      (tor-service)
>>                      %desktop-services)))
>>
>> and then you can:
>>
>>   torify ssh something.onion
>>
>> from anywhere.
>
> Wow, awesome!  I've never used a Tor hidden service before because I
> never understood how things work, but this configuration looks so
> simple that I don't have much excuse to not try it out.  Thanks!

We largely owe this to Tor, which is itself very simple to configure:

  https://www.torproject.org/docs/tor-hidden-service.html.en

Pretty cool!

Ludo’.

Re: Tor hidden services

[Leo Famulari]

On Sat, Nov 28, 2015 at 12:59:46AM +0100, Ludovic Courtès wrote:
> Commit adds ‘tor-hidden-service’, which can be used to specify hidden
> services quite easily.
> 
> For example, to have your SSH daemon accessible over something.onion:22,
> just do:
> 
>   (operating-system
>     ;; …
>     (services (cons* (lsh-service #:interfaces '("127.0.0.1"))
>                      (tor-hidden-service "ssh" '((22 "127.0.0.1:22")))
>                      (tor-service)
>                      %desktop-services)))
> 
> and then you can:
> 
>   torify ssh something.onion
> 
> from anywhere.

That's awesome! Thanks for making this service.

Are there any technical advantages to using lsh instead of OpenSSH, or
is the primary advantage the copyleft license?

Re: Tor hidden services

[Ludovic Courtès]

Leo Famulari <leo@famulari.name> skribis:

> Are there any technical advantages to using lsh instead of OpenSSH, or
> is the primary advantage the copyleft license?

Various things are designed differently, which you may or may not like
(for instance the SPKI-inspired ‘lsh-authorize’
vs. ~/.ssh/authorized_keys, ‘lshg’ on the client side, use of Nettle
rather than OpenSSL for crypto primitives, etc.)

I like lshd but my growing concern is that it hasn’t seen new releases
in a while and its default cipher suites need to be updated, for
instance.

Ludo’.