On Dec 17, 2018, at 22:51, Mirimir <mirimir@riseup.net> wrote:
And sure, I could setup .onion SSH for everything, and that'd arguably be more secure. But sometimes I'm just too lazy for that.
I'm pretty frickin' lazy, but I do this with all my servers. Here's the recipe for Linux/Debian provisioning: -*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*- # cat >>/etc/apt/sources.list deb https://deb.torproject.org/torproject.org stretch main deb-src https://deb.torproject.org/torproject.org stretch main # apt install gnupg2 dirmngr # gpg2 --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 I've had gpg2 fail, in which case this should work: # gpg --keyserver hkp://pool.sks-keyservers.net --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 # gpg2 --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add - # apt update # apt install tor deb.torproject.org-keyring edit /etc/tor/torrc, the "hidden services" section, to add: HiddenServiceDir /var/lib/tor/control/ HiddenServicePort 22 127.0.0.1:22 # service tor restart # cat /var/lib/tor/control/hostname Record the onion address for posterity -*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*-.,,.-*"*- The SSH sessions to the .onion address seem pretty darned solid. --Ron