[{"data":1,"prerenderedAt":392},["ShallowReactive",2],{"project-19310747":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":34,"aspects":35,"strip":44,"post_text":46,"what":47,"said":80,"maker_in_thread":193,"shape":203,"grid":208,"attempts":353,"same_week":354,"maker_shows":45,"maker_hidden":384,"reader_version":385,"card":386},"19310747","tor_ssh.sh","One command to enable SSH access via Tor","title","Show HN: tor_ssh.sh – One command to enable SSH access via Tor","https:\u002F\u002Fgitlab.com\u002Fgrownetics\u002Fdevops\u002Fblob\u002Fmaster\u002Ftor_ssh.sh","gitlab.com","NickBusey",1551796603,2019,93,65,522,2195,24,"notable","infrastructure","remote access scripts","cli",[24,25,26,27],"tor hidden service","ssh over tor","nat traversal","onion address","curious",-0.157,{"positive":31,"neutral":32,"mixed":31,"critical":33},2,9,5,18,{"design":36,"idea":38,"execution":40,"privacy":41,"performance":42,"docs":43},{"positive":37,"critical":37},0,{"positive":39,"critical":37},1,{"positive":37,"critical":39},{"positive":37,"critical":39},{"positive":39,"critical":37},{"positive":37,"critical":39},[37,45,45,45,33,45,45,39,37,45,45,37,39,33,45,37,39,39,37,37,37,37,37,37,37,37,37,37,37,37,37,37,37,37,37,37,45,45,37,39],3,null,{"problem":48,"audience":46,"pricing":46,"motivation":59,"time_to_build":46,"stack":63,"openness":77,"stage":78,"team_size":79},{"value":49,"source":50,"evidence":51},"Reaching SSH on machines behind NAT without port forwarding","maker",[52,56],{"id":53,"by":54,"text":55},"19311480","buildbuildbuild","NAT traversal is a useful and underrated Tor hidden service use case. Careful though: installing the version of Tor which is included in Ubuntu’s distribution is not recommended,…",{"id":57,"by":11,"text":58},"19311992","The purpose is easy NAT traversal for things like onsite physical servers or CI testing. Tor is not reserved for nefarious purposes.",{"value":60,"source":50,"evidence":61},"Easy NAT traversal for onsite servers and CI debugging",[62],{"id":57,"by":11,"text":58},[64,72],{"value":65,"source":66,"evidence":67},"bash","inferred",[68],{"id":69,"by":70,"text":71},"19310886","UI_at_80x24","I like the theory behind this and the motivation. But this has to stop: ># Usage (as root): $ bash \u003C(curl -s https:\u002F\u002Fgitlab.com\u002Fgrownetics\u002Fdevops\u002Fraw\u002Fmaster\u002Ftor_ssh.sh) Spoon…",{"value":73,"source":66,"evidence":74},"Tor",[75],{"id":76},"post","open_source","launched","unknown",{"praise":81,"objections":98,"requests":136,"questions":154,"alternatives":169},[82,91],{"value":83,"source":84,"evidence":85},"Useful NAT traversal use case","commenter",[86,87],{"id":53,"by":54,"text":55},{"id":88,"by":89,"text":90},"19312487","0xdeadbeefbabe","Will ssh experience timeouts and connection aborts detailed here http:\u002F\u002Fsites.inka.de\u002Fbigred\u002Fdevel\u002Ftcp-tcp.html or is that not applicable? Nice script BTW.",{"value":92,"source":84,"evidence":93},"Useful for debugging CI builds",[94],{"id":95,"by":96,"text":97},"19311128","dessant","This is also valuable for debugging CI builds, and it can be more secure than the debugging mode CI services provide when coupled with an ssh key. For example on Travis CI a host…",[99,110,118,125],{"value":100,"source":84,"evidence":101},"Overwrites torrc instead of appending",[102,106],{"id":103,"by":104,"text":105},"19311055","berbec","``` # Append the hidden service configuration to the Torrc file echo -e \"HiddenServiceDir \u002Fvar\u002Flib\u002Ftor\u002Fonion-ssh\u002F\\nHiddenServicePort 22 127.0.0.1:22\" > \u002Fetc\u002Ftor\u002Ftorrc ``` Unless…",{"id":107,"by":108,"text":109},"19311165","jstanley","The default ubuntu torrc has everything commented out so is effectively blank anyway. Using \">\" instead of \">>\" means you don't end up with multiple copies of the same hidden…",{"value":111,"source":84,"evidence":112},"Piping curl to bash is unsafe",[113,114],{"id":69,"by":70,"text":71},{"id":115,"by":116,"text":117},"19311407","LinuxBender","I understand what you are saying, but respectfully disagree. Conditioning people to use `curl | bash` trains them to not review anything and blindly run untrusted code. I have…",{"value":119,"source":84,"evidence":120},"Uses deprecated Onion v2 addresses",[121],{"id":122,"by":123,"text":124},"19313687","jamieweb","How come you aren't using ```HiddenServiceVersion 3```? Onion v2 (16 char addresses) uses old crypto (SHA1\u002FDH\u002FRSA1024) and has now been superseded by Onion v3 (56 char addresses,…",{"value":126,"source":84,"evidence":127},"Ubuntu-only assumption",[128,132],{"id":129,"by":130,"text":131},"19311557","bromonkey","tor_ssh.sh – One command to enable SSH access via Tor to some servers: Debian is not the entirety of Linux",{"id":133,"by":134,"text":135},"19311046","throwaway2048","\"any server\" running ubuntu...",[137,146,150],{"value":138,"source":84,"evidence":139},"Add check before appending hidden service config",[140,143],{"id":141,"by":104,"text":142},"19311244","Maybe something like ``` if [ $(grep \"HiddenServicePort 22\" \u002Fetc\u002Ftor\u002Ftorrc | wc -l) -eq 0] ```",{"id":144,"by":11,"text":145},"19311183","Exactly, for simplicity since nothing is in there by default, it gets overwritten. To keep the script nice and short I decided not to add that detection. I would happily merge…",{"value":147,"source":84,"evidence":148},"Use Onion v3 addresses",[149],{"id":122,"by":123,"text":124},{"value":151,"source":84,"evidence":152},"Use Tor project PPA instead of Ubuntu package",[153],{"id":53,"by":54,"text":55},[155,159],{"value":156,"source":84,"evidence":157},"Why not use HiddenServiceVersion 3",[158],{"id":122,"by":123,"text":124},{"value":160,"source":84,"evidence":161},"Why the systemd replacement and restart behaviour",[162,166],{"id":163,"by":164,"text":165},"19310949","acdha","This line was puzzling: ``` # Remove the bogus tor service Ubuntu installs by default ``` Is there a bug in the upstream package or something? Otherwise this just looks like a…",{"id":167,"by":164,"text":168},"19311200","Typically I'd put that into a comment right above that line. I'd also really be inclined to install a replacement service instead so you'd get automatic restarts if you aren't…",[170,176,186],{"value":171,"source":84,"evidence":172},"ZeroTier",[173],{"id":174,"by":54,"text":175},"19311585","I highly recommend ZeroTier for maintaining stable connectivity and static private IPs regardless of NAT or networking environment peculiarities. It also supports multipath…",{"value":177,"source":84,"evidence":178},"torsocks",[179,183],{"id":180,"by":181,"text":182},"19311579","ressetera","There's also torsocks or even tsocks if you need something more battle tested. EDIT: I stand corrected, see @buildbuildbuild reply.",{"id":184,"by":54,"text":185},"19311619","That does the reverse: allows you to connect to public IP addresses through Tor. This solution exposes your local SSH server as a static hidden service without needing to forward…",{"value":187,"source":84,"evidence":188},"tinc and WireGuard",[189],{"id":190,"by":191,"text":192},"19310957","pwnna","This works pretty well, especially if you have personal computers behind different NATs. One of the issue is still that you have to distribute the tor domain name out all over…",{"comments":194,"answered":39,"key":195},6,[196,199,202],{"id":197,"text":198},"19311147","https:\u002F\u002Faskubuntu.com\u002Fa\u002F903341",{"id":200,"text":201},"19311212","Yea, I agree. I actually was thinking before I posted this \"Someone will ask about that line, I should just add the link to the comments\" haha. (Just added it.) If you read the…",{"id":144,"text":145},{"commenters":204,"max_depth":205,"maker_replies":194,"first_comment_mins":206,"lifespan_hours":207},32,8,19,11,[209,213,215,216,220,222,225,227,230,232,233,234,236,238,239,240,242,244,247,250,252,254,257,259,262,264,267,269,273,276,279,281,285,287,289,292,294,296,298,301,303,305,307,309,310,312,314,316,318,321,324,327,330,333,336,339,341,344,346,351],[210,37,37,211,212,37],"19311475","other\u002Fneutral\u002Fnone","miduil",[190,39,45,214,191,37],"project\u002Fmixed\u002Fdesign",[174,39,37,211,54,37],[217,39,45,218,219,37],"19312765","project\u002Fneutral\u002Fidea","jancsika",[53,31,45,221,54,37],"maker\u002Fmixed\u002Fexecution",[223,31,37,224,123,37],"19313448","commenter\u002Fpositive\u002Fidea",[95,45,33,226,96,37],"project\u002Fpositive\u002Fidea",[163,228,45,229,164,37],4,"maker\u002Fneutral\u002Fexecution",[197,228,37,231,11,39],"maker\u002Fneutral\u002Fdocs",[167,228,45,229,164,37],[200,228,37,231,11,39],[103,33,39,235,104,37],"project\u002Fcritical\u002Fexecution",[107,33,37,237,108,37],"commenter\u002Fneutral\u002Fexecution",[144,33,37,229,11,39],[141,33,45,229,104,37],[241,33,45,229,108,37],"19311414",[243,33,37,211,104,37],"19314073",[245,194,37,211,246,37],"19312764","adenner",[129,248,39,249,130,37],7,"project\u002Fcritical\u002Fnone",[122,205,45,251,123,37],"maker\u002Fneutral\u002Fprivacy",[88,32,33,253,89,37],"project\u002Fpositive\u002Fperformance",[180,255,45,256,181,37],10,"project\u002Fneutral\u002Fnone",[184,255,37,258,54,37],"commenter\u002Fneutral\u002Fidea",[260,207,37,211,261,37],"19312726","thomasdd",[133,263,39,249,134,37],12,[69,265,39,266,70,37],13,"project\u002Fcritical\u002Fdocs",[268,265,37,231,11,39],"19310899",[270,265,37,271,272,37],"19310918","commenter\u002Fneutral\u002Fdocs","gpm",[274,265,37,271,275,37],"19311030","v_lisivka",[277,265,37,271,278,37],"19311068","bouk",[280,265,37,271,275,37],"19311101",[282,265,37,283,284,37],"19311215","commenter\u002Fneutral\u002Fnone","vegardx",[286,265,37,283,275,37],"19311356",[288,265,37,283,284,37],"19311469",[290,265,37,271,291,37],"19310922","tsukurimashou",[293,265,37,283,164,37],"19310923",[295,265,37,283,275,37],"19311034",[297,265,37,283,164,37],"19311217",[299,265,37,283,300,37],"19311400","jdeca568",[302,265,37,283,275,37],"19312741",[304,265,37,283,164,37],"19314806",[306,265,37,283,116,37],"19311043",[308,265,37,283,164,37],"19311277",[115,265,37,283,116,37],[311,265,37,211,116,37],"19313350",[313,265,37,283,164,37],"19314826",[315,265,37,283,116,37],"19315235",[317,265,37,283,164,37],"19315722",[319,265,37,271,320,37],"19311141","ithkuil",[322,265,37,283,323,37],"19311258","swixmix",[325,265,37,283,326,37],"19311495","kej",[328,265,37,283,329,37],"19311583","badideaprojects",[331,265,37,211,332,37],"19311218","teddyh",[334,265,37,283,335,37],"19311309","dev_dull",[337,265,45,231,338,37],"19311679","aboutruby",[340,265,37,231,11,39],"19311712",[342,265,45,343,338,37],"19311947","project\u002Fneutral\u002Fprivacy",[57,265,37,345,11,39],"maker\u002Fneutral\u002Fidea",[347,348,39,349,350,37],"19312520",14,"project\u002Fcritical\u002Fprivacy","xiii1408",[352,348,37,283,108,37],"19312599",[],[355,360,365,370,375,380],{"id":356,"name":357,"points":358,"category":359},"19274941","Level Up WebAssembly",410,"learning_science",{"id":361,"name":362,"points":363,"category":364},"19269938","Expensive Chat",250,"consumer_social",{"id":366,"name":367,"points":368,"category":369},"19320117","QuickChart",204,"data",{"id":371,"name":372,"points":373,"category":374},"19301018","htrace.sh",155,"dev_tools",{"id":376,"name":377,"points":378,"category":379},"19299760","An Easy Programming Language",144,"languages",{"id":381,"name":382,"points":383,"category":369},"19305408","Tile38",130,false,"v2",{"id":387,"name":5,"line":6,"ai":384,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":388,"top":18,"kw":389,"maker":11,"domain":10,"tier":19,"attempts":37,"strip":390,"url":9,"mix":391,"praise":83,"objection":100,"sub":21},19310747,-0.16,[24,25,26,27],"0333533103301530110000000000000000003301",[31,32,31,33],1794036575465]