[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-talk] Anonymous SSH Hack.

On 09/12/2016 03:54 PM, Ben Tasker wrote:
>      CheckHostIP=no
> Don't do a DNS lookup of the host, the Tor exit node's going to do that
> anyway, and again, the queries will be observable by your ISP

I'm thinking that the use of ProxyCommand makes that redundant?
The manual page for ssh_config(5) says

	Note that CheckHostIP is not available for connects
	with a proxy command.

I just did a quick test with only VerifyHostKeyDNS set to 'no'

 ssh -o "VerifyHostKeyDNS=no" \
 -o ProxyCommand="nc -X 5 -x localhost:9150 %h %p" \

while for leakage, I checked on a Ubuntu 14.04 LTS system with tcpdump:

 tcpdump -vvv -A -qpli p3p1 'dst port 53'

and it showed no activity for the above ssh connection.  It does show
DNS queries for non-Tor ssh connections and other activities with the
same tcpdump session.

And CheckHostIP isn't mentioned in the official documentation:


So it may not be needed.


tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to