[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-talk] Anonymous SSH Hack.
On 09/12/2016 03:54 PM, Ben Tasker wrote:
> Don't do a DNS lookup of the host, the Tor exit node's going to do that
> anyway, and again, the queries will be observable by your ISP
I'm thinking that the use of ProxyCommand makes that redundant?
The manual page for ssh_config(5) says
Note that CheckHostIP is not available for connects
with a proxy command.
I just did a quick test with only VerifyHostKeyDNS set to 'no'
ssh -o "VerifyHostKeyDNS=no" \
-o ProxyCommand="nc -X 5 -x localhost:9150 %h %p" \
while for leakage, I checked on a Ubuntu 14.04 LTS system with tcpdump:
tcpdump -vvv -A -qpli p3p1 'dst port 53'
and it showed no activity for the above ssh connection. It does show
DNS queries for non-Tor ssh connections and other activities with the
same tcpdump session.
And CheckHostIP isn't mentioned in the official documentation:
So it may not be needed.
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to