How to Set Up an SSH Server with Tor to Hide It from Shodan & Hackers « Null Byte :: WonderHowTo

The nextlibSSHorOpenSSH exploitmay bejust around the corner. Keep your SSH service out of Shodan's database before hackers find new ways to bypass the password protecting the server.Shodanhas been called the "hacker's search engine" because it's literally a searchable database of internet-connected devices and servers. It allows anyone to search for webcams, routers, servers,Raspberry Pis, traffic lights, point of sale systems, industrial control systems, andmuch more.The web tool accomplishes this by randomly iterating through every possible IP address in existence (whether it's online or not being used) and attempts to extractservice bannerson different ports. Service banners usually store metadata about the running service, like the service name, type, and version number.Why Set Up SSH with Tor?Any internet-connected device will inevitably be scanned by Shodan and other databases likeCensys. Hackers use these databases to locate out-of-date, vulnerable servers. Even system administrators who regularly update their servers and follow the best security practices are exposed to exploits. ThelibSSHauthentication bypass vulnerability is an excellent example of this.The libSSH vuln allowed hackers to connect to SSH services without first performing authentication. The most fully up-to-date services were still vulnerable to this exploit and put many servers and websites at risk. More importantly, fully updated systems are still exposed to exploits that have yet to be disclosed. Blackhat's sometimes horde andsell vulnerabilitiesinprivate communities. There's no telling how many undisclosed OpenSSH exploits may exist today.Toronion servicescan help mitigate exposure. Much like how onion websites can't be accessed using a standard web browser, SSH services can be configured only to allow access over Tor. It can make services entirely inaccessible for search engines like Shodan and more difficult for hackers to find.Don't Miss:Top 10 Exploit Databases for Finding VulnerabilitiesStep 1: Install TorThe first thing we need to do is installToron both thevirtual private server(VPS) and the client computer. The client can be a Debian, Ubuntu, or a Kali system to follow along. MacOS and Windows 10 users can check out theofficial Tor Project documentationfor installingtorproperly. For most readers, the SSH server will likely be a Debian VPS. However, this can be set up on an Ubuntu desktop orRaspberry Pi, for those who wish to remotely access computers at home.Tor is available in many Linux repositories. In most cases, the packages aren't reliably maintained or updated, which means there could be missing critical stability and security updates. Furthermore, anonymity software should always be acquired directly from the source (i.e.,torproject.org).Log into your SSH server and add the Tor Project's repository to your APT repository list with the followingechocommand, which works in Debian.~$ echo -e "deb https://deb.torproject.org/torproject.org $(lsb_release -sc) main \ndeb-src https://deb.torproject.org/torproject.org $(lsb_release -sc) main" > /etc/apt/sources.list.d/tor.listIf you're running Kali Linux, use the following command instead.~$ echo -e "deb https://deb.torproject.org/torproject.org stretch main \ndeb-src https://deb.torproject.org/torproject.org stretch main" > /etc/apt/sources.list.d/tor.listThen, download theTor Project's package signing keyand import it into your APT keyring with the following command.~$ wget -O- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | sudo apt-key add -

--2019-03-05 06:29:13--  https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc
Resolving deb.torproject.org (deb.torproject.org)... 82.195.75.101, 2001:41b8:202:deb:213:21ff:fe20:1426
Connecting to deb.torproject.org (deb.torproject.org)|82.195.75.101|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 19665 (19K) [text/plain]
Saving to: ‘STDOUT’

-                                       100%[================================>]  19.20K  54.8KB/s    in 0.4s

2019-03-05 06:29:16 (54.8 KB/s) - written to stdout [19665/19665]You'll see the "OK" output when the signing key has been added to your keyring. Next, update APT using the belowapt-getcommand.~$ apt-get update

Get:2 https://deb.torproject.org/torproject.org stretch InRelease [4,965 B]
Get:4 https://deb.torproject.org/torproject.org stretch/main Sources [1,169 B]
Get:5 https://deb.torproject.org/torproject.org stretch/main amd64 Packages [2,400 B]
Fetched 8,534 B in 8s (1,091 B/s)
Reading package lists... DoneInstall Tor using the belowapt-getcommand, and you're done.~$ apt-get install tor deb.torproject.org-keyring torsocks

Reading package lists... Done
Building dependency tree
Reading state information... Done
Suggested packages:
  mixmaster torbrowser-launcher socat tor-arm apparmor-utils obfs4proxy
The following NEW packages will be installed:
  deb.torproject.org-keyring
The following packages will be upgraded:
  torBoth the client and the VPS running the SSH server should have Tor installed. Be sure to follow the above steps on both systems.Step 2: Create an Onion Service on the ServerThe Tor process will likely get executed immediately after installing it so, as root (sudo), stop the process. This can be done using thesystemctlcommand.~$ sudo systemctl stop torThen, use a text editor to open the /etc/tor/torrc file. This is the configuration file used by Tor to modify its behavior and create onion services.~$ sudo nano /etc/tor/torrcThere will be a ton of information in this file. Most of it isn't relevant to this article. Scroll down a bit to the "This section is just for location-hidden services" section. In Debian and Kali Linux, it appears as shown below.############### This section is just for location-hidden services ###

## Once you have configured a hidden service, you can look at the
## contents of the file ".../hidden_service/hostname" for the address
## to tell people.
##
## HiddenServicePort x y:z says to redirect requests on port x to the
## address y:z.

#HiddenServiceDir /var/lib/tor/hidden_service/
#HiddenServicePort 80 127.0.0.1:80

#HiddenServiceDir /var/lib/tor/other_hidden_service/
#HiddenServicePort 80 127.0.0.1:80
#HiddenServicePort 22 127.0.0.1:22Uncomment (#) one "HiddenServiceDir" and one "HiddenServicePort" line, as such:############### This section is just for location-hidden services ###

## Once you have configured a hidden service, you can look at the
## contents of the file ".../hidden_service/hostname" for the address
## to tell people.
##
## HiddenServicePort x y:z says to redirect requests on port x to the
## address y:z.

#HiddenServiceDir /var/lib/tor/hidden_service/
#HiddenServicePort 80 127.0.0.1:80

HiddenServiceDir /var/lib/tor/other_hidden_service/
#HiddenServicePort 80 127.0.0.1:80
HiddenServicePort 22 127.0.0.1:22Save and exit the text editor. Then, restart tor using the below command.Don't Miss:Vim, the Unix Text Editor Every Hacker Should Be Familiar With~$ sudo systemctl restart torThe "hostname" file in the /var/lib/tor/other_hidden_service/ directory will hold the new onion address. Usecatto read the file. Take note of this onion address, it will be required in the next step.~$ cat /var/lib/tor/other_hidden_service/hostname

pkgsxmtmdrlxp7l3gfqysi3ceaochd4vnv7eax2fuyridmcz7ucvluad.onionStep 3: Verify the Onion Service Is Working (Optional)Before proceeding, it's good to make sure the SSH service is reachable using the new onion address. This can quickly be verified using thetorsocks, a shell wrapper used to transparently Tor-ify command line applications likecurl,wget, ornmap.Don't Miss:The Top 80+ Websites Available in the Tor NetworkThe following torsocks and curl command will query the new onion service. Be sure to append the SSH port number (:22), otherwise, curl will query port 80 by default and fail. A successful query will return the SSH version banner, as shown below.~$ torsocks curl http://pkgsxmtmdrlxp7l3gfqysi3ceaochd4vnv7eax2fuyridmcz7ucvluad.onion:22

SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u5Step 4: Make the SSH Service PrivateBy default, most SSH services are listening on every IPv4 interface. While not the case for all Linux distributions, this is true for popular ones like Ubuntu and Debian. This is usually represented as "0.0.0.0" in the /etc/ssh/sshd_config file, where SSH stores all of the service configurations.SSH services configured this way makes it possible to access the server from any computer in the world. Which is convenient for website administrators who need to make changes to their website from different devices and networks.First, let's have a look at SSH service running in the background. Usess, a tool for investigating sockets, to show processes (-p) listening (-l) for TCP (-t) connections.~$ ss -plt

State      Recv-Q Send-Q       Local Address:Port           Peer Address:Port
LISTEN     0      128                      *:ssh                       *:*           users:(("sshd",pid=1148,fd=3))If the server has applications running in the background (e.g., Apache, Nginx, IRC software, etc.), many services may appear here. Let's focus on theLocal Address:Portcolumn which reads*:ssh.Wildcards indicatethe SSH service is listening on every available IPv4 and IPv6 interface.Shodan is able to locate this SSH service because it's available (listening) in this state. To change this, open the /etc/ssh/sshd_config file and find the "ListenAddress" line(s).~$ sudo nano /etc/ssh/sshd_confnigIn Debian, it appears as shown below. They will probably be commented out, which is normal. When every ListenAddress is commented out, SSH falls back to its default configuration to listen on every interface.#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::Change the ListenAddress line to "127.0.0.1" and uncomment it as such:#Port 22
#AddressFamily any
ListenAddress 127.0.0.1
#ListenAddress ::Then, restart the SSH service.~$ sudo systemctl restart sshImmediately after executing thesystemctlcommand, the current SSH connection may close. The SSH service is no longer available on any IPv4 or IPv6 address so it's normal for the connection to break.Step 5: Connect to the SSH Server Using TorFortunately, the onion service was set up on the server so the SSH service can still be reached. Now, from the client (i.e., laptop or remote computer), use the belowtorsockscommand to connect to SSH service.~$ torsocks ssh -p 22 username@pkgsxmtmdrlxp7l3gfqysi3ceaochd4vnv7eax2fuyridmcz7ucvluad.onion

The authenticity of host 'pkgsxmtmdrlxp7l3gfqysi3ceaochd4vnv7eax2fuyridmcz7ucvluad.onion (127.42.42.0)' can't be established.
ECDSA key fingerprint is SHA256:f22LX7WJfLGOiKxP+0+cA/l5Q1GsJLFA30ZyMyGLMl4.
Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added 'pkgsxmtmdrlxp7l3gfqysi3ceaochd4vnv7eax2fuyridmcz7ucvluad.onion' (ECDSA) to the list of known hosts.
username@pkgsxmtmdrlxp7l3gfqysi3ceaochd4vnv7eax2fuyridmcz7ucvluad.onion's password:Step 6: Make Sure the SSH Service Isn't Visible to ShodanAfter logging into the server using the onion address, use thesscommand again to view listening services. It should no longer report SSH listening on every available interface, only 127.0.0.1.~$ ss -plt

State      Recv-Q Send-Q       Local Address:Port           Peer Address:Port
LISTEN     0      128              127.0.0.1:ssh                       *:*           users:(("sshd",pid=1162,fd=3))We can further verify this by executing a simplenmapversion (-sV) scan on the server.~$ nmap -p 22 -sV <vps ip here>

PORT   STATE  SERVICE VERSION
22/tcp closed sshThe SSH service may still appear on Shodan for days or even weeks. Shodan isn't great about purging old service banners and information. But that doesn't mean the SSH service is still accessible to attackers.ConclusionBy far the most significant caveat to using SSH with onion services is the slowness. Responses in the terminal can be painfully slow for someone who isn't used to onion services and Tor.Configuring Tor to work with SSH services in this way hides it from Shodan but doesn't make it entirely impossible to locate by hackers. It can still be reached using Tor, which significantly minimizes its overall exposure but doesn't make it altogether impervious to attacks.There's a security feature in Tor calledHiddenServiceAuthorizeClient. This feature allows users to essentially password-protect the onion service with anauthentication cookie. At the time of this writing, HiddenServiceAuthorizeClient isn't supported by thenewer "next-gen" onion services. It would be possible to generate older onion services, but it seems like bad security practice to use a soon to be a deprecated feature of Tor. In the future, it will be possible to use HiddenServiceAuthorizeClient with next-gen onions to make them completely inaccessible to anyone but you. For now, changing the SSH port number to something non-standard like 62359 or 41171 will help keep it off the radar of script-kiddies on the darknet mass-scanning on port 22.Don't Miss:Hide Sensitive Files in Encrypted Containers on Your Linux SystemFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by distortion/Null ByteRelatedHacking Windows 10:How to Turn Compromised Windows PCs into Web ProxiesHow To:Hack TOR Hidden ServicesHack Like a Pro:How to Find Vulnerable Targets Using Shodan—The World's Most Dangerous Search EngineHow To:Run Your Favorite Graphical X Applications Over SSHHow To:Locate & Exploit Devices Vulnerable to the Libssh Security FlawHow To:Detect Misconfigurations in 'Anonymous' Dark Web Sites with OnionScanHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 15 (Creating a Secure Tunnel to MySQL)Hacking Windows 10:How to Use SSH Tunnels to Forward Requests & Hack Remote RoutersSSH the World:Mac, Linux, Windows, iDevices and Android.How To:Create a Native SSH Server on Your Windows 10 SystemHow To:Use Private Encrypted Messaging Over TorHow To:Configure a Reverse SSH Shell (Raspberry Pi Hacking Box)How To:Use the Cowrie SSH Honeypot to Catch Attackers on Your NetworkHow To:Find Vulnerable Webcams Across the Globe Using ShodanHack Like a Pro:How to Find Any Router's Web Interface Using ShodanNews:Use ProtonMail More Securely Through the Tor NetworkNews:Reality of VPNs, Proxies, and TorHow To:Haunt a Computer with SSHHow To:The Top 80+ Websites Available in the Tor NetworkHow To:Enable the New Native SSH Client on Windows 10News:Anonymity, Darknets and Staying Out of Federal Custody, Part Three: Hidden ServicesNews:Anonymity, Darknets and Staying Out of Federal Custody, Part Two: Onions and DaggersEditor Picks:The Top 10 Secret Resources Hiding in the Tor NetworkHow To:Use Tortunnel to Quickly Encrypt Internet TrafficHow To:Remotely Control Computers Over VNC Securely with SSHHow To:Become Anonymous on the Internet Using TorHow To:Push and Pull Remote Files Securely Over SSH with PipesHow To:Create an SSH Tunnel Server and Client in LinuxNews:Anonymity Networks. Don't use one, use all of them!How To:Create a Free SSH Account on Shellmix to Use as a Webhost & MoreTor vs. I2P:The Great Onion DebateHow To:Safely Log In to Your SSH Account Without a PasswordNews:Anonymity, Darknets and Staying Out of Federal Custody, Part Four: The Invisible InternetGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingHow To:Conceal a USB Flash Drive in Everyday ItemsNews:Finding the Exploits Out in the World (For Beginner Hackers)Anonymous Browsing in a Click:Add a Tor Toggle Button to Chrome