{"id":542,"date":"2021-07-04T19:49:36","date_gmt":"2021-07-05T02:49:36","guid":{"rendered":"https:\/\/looseassociations.com\/?p=542"},"modified":"2021-12-08T10:17:24","modified_gmt":"2021-12-08T18:17:24","slug":"stopgap-for-onion-v2-to-v3-migration","status":"publish","type":"post","link":"https:\/\/looseassociations.com\/?p=542","title":{"rendered":"stopgap for onion v2 to v3 migration"},"content":{"rendered":"

I use Tor onion services<\/a> (location-hidden services) to manage a lot of my servers, since some are behind NAT or have dynamic IP addresses and onion services do excellent NAT traversal and allow access without knowing IP addresses. Alas, for security reasons the older v2-style onion addresses will deprecate in 11 days. I thought it would be trivial to generate v3 addresses for all my servers, and for most it was, but I ran into some grief.<\/p>\n

I have a remote server running on a distant site for maintaining a dynamic DNS address and allowing me to traverse NAT to keep port forwarding and other configurations current. Alas, it’s a Raspberry Pi Zero W (0w) and the Debian Tor repos are so out-of-date that they don’t support Tor versions new enough to allow for v3 onions. Building from source on a 0w is too much for the little machine over long, fragile connections so I need — before July 15th — to allow an alternate method of NAT traversal or I’ll lose access to the server completely.<\/p>\n

Looks like a reverse SSH proxy is in order.<\/p>\n

First, I need to define an address for a server with a static IP address. I’ll use\u00a0zara.sacdoc.org, since it’s already a router, but I’ll create a specific domain name for it,\u00a0tunnel.sacdoc.org, so that it will be independent of the router name. So I create an appropriate A record so that\u00a0tunnel.sacdoc.org\u00a0points to the IP address for\u00a0zara.sacdoc.org. I could use a cname, but I don’t like them.<\/p>\n

Next, I need to be able to shell into\u00a0tunnel.sacdoc.org\u00a0from the 0w. I’ll create a user on tunnel which I’ll confusingly name tunnel. It needs a login shell and directory but can (should) have very limited privileges. Give it a good password, even though it’s only temporary.<\/p>\n

Create an ssh key pair on the 0w and copy the public key to tunnel using the password to get access.
\nssh-keygen<\/code>
\nssh-copy-id tunnel@tunnel.sacdoc.org<\/code><\/p>\n

Install autossh to open a reverse tunnel and keep it open
\nsudo apt install autossh<\/code><\/p>\n

Put the autossh command in \/etc\/rc.local using 2222 as the remote port and 2223 as the monitoring port. You might need to change the location of your private key file as well as the device names and port numbers.
\nautossh -M 2223 -fN -o \"PubkeyAuthentication=yes\" -o \"StrictHostKeyChecking=false\" -o \"PasswordAuthentication=no\" -o \"ServerAliveInterval 60\" -o \"ServerAliveCountMax 3\" -o \"IdentityFile=\/home\/pi\/.ssh\/id_rsa\" -R tunnel.sacdoc.org:2222:localhost:22 tunnel@tunnel.sacdoc.org<\/code><\/p>\n

Cool! At least now I have access to the server until I can either build a modern Tor for Raspbian from source or somebody updates the Debian repositories.<\/p>\n

EDIT 20210705@15:54<\/strong><\/p>\n

The real source of the problem here is that the 0w is running Raspbian Stretch. Were I to upgrade to Raspbian Buster, it would install a still-outdated but new enough version of Tor to support v3 onions. I’m not sure I want to do a full OS distribution update on a device that’s hundreds of miles away, on a slow and unreliable net connection. I might wait and do that when I’m better able to afford to travel or ship packages around.<\/p>\n","protected":false},"excerpt":{"rendered":"

I use Tor onion services (location-hidden services) to manage a lot of my servers, since some are behind NAT or have dynamic IP addresses and onion services do excellent NAT traversal and allow access without knowing IP addresses. Alas, for security reasons the older v2-style onion addresses will deprecate in 11 days. I thought it … Continue reading stopgap for onion v2 to v3 migration<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-542","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/looseassociations.com\/index.php?rest_route=\/wp\/v2\/posts\/542"}],"collection":[{"href":"https:\/\/looseassociations.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/looseassociations.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/looseassociations.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/looseassociations.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=542"}],"version-history":[{"count":4,"href":"https:\/\/looseassociations.com\/index.php?rest_route=\/wp\/v2\/posts\/542\/revisions"}],"predecessor-version":[{"id":547,"href":"https:\/\/looseassociations.com\/index.php?rest_route=\/wp\/v2\/posts\/542\/revisions\/547"}],"wp:attachment":[{"href":"https:\/\/looseassociations.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=542"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/looseassociations.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=542"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/looseassociations.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=542"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}