[[TOC(noheading, depth=4)]]
= Torifying SSH =
Secure Shell (SSH) is an encrypted network protocol for utilizing network services securely over an unsecured network. Common applications include remote command-line login and remote command execution, but any network service can be secured with SSH. The protocol specification distinguishes between two major versions, referred to as SSH-1 and SSH-2. When used in conjunction with Tor (and some small measures are taken to prevent leakage), the full functionality of SSH can be anonymized.

=== Torifying SSH on Windows ===
The recommended methodology for Windows users to torify SSH is by utilising PuTTY. The page outlining where to download it as well as configuration can be found [wiki:doc/TorifyHOWTO/Putty here].

=== Torifying SSH on *NIX / MacOS ===
'''Warning:''' 'ssh some.host' will '''leak your UNIX username'''. If you do 'ssh theloginyouwant@some.host' it will '''not''' leak your username. That is why we suggest using non-identifying usernames on your machines to prevent such leaks in the first place.

Using SSH inside Whonix should be safe.

==== Option 1: Using torsocks ====
More plentiful and current information on torsocks can be found [https://trac.torproject.org/projects/tor/wiki/doc/torsocks here].

To use SSH with torsocks, simply use the command:

`torsocks ssh loginname@example.com`

you may want to add an alias like so:

{{{
alias ssh-tor='torsocks ssh'
}}}

==== Option 2: Using netcat-openbsd ====
{{{netcat-openbsd}}} (also known as simply 'netcat' or 'nc') is a networking utility with a simple interface that is primarily used for reading or writing from TCP and UDP sockets. It is available in the repositories of most modern UNIX operating systems.

When using netcat-openbsd, you can use the ssh {{{ProxyCommand}}} option:
{{{
ssh -o "ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p" <target_host>
}}}

To do it on a per-host basis, edit your ~/.ssh/config to look something like this:

{{{
host example.com
    user bar
    port 22
    ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p
}}}

Then you can just do {{{ssh example.com}}} and it will be torified.

If preferred, it is possible to make an alias for this and place it in your {{{~/.bash_rc}}} 
or {{{~/.bash_profile}}} like so:

{{{
alias ssh-tor='ssh -o "ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p"'

or

alias ssh-tor='ssh -o "ProxyCommand nc --proxy 127.0.0.1:9050 --proxy-type 
socks4 $(torsocks dig @213.73.91.35 +tcp +short %h | head -n 1) %p"'
}}}

Then you can simply issue the command {{{ssh-tor example.com}}}.

OpenSSH has a feature for looking up remote host keys in SSHFP DNS records;  don't use it, or it will try to resolve hostnames before it invokes your ProxyCommand and creates a leak.  To make sure this doesn't happen, pass {{{-o VerifyHostKeyDNS=no}}} on your ssh command line.

A good command for checking for DNS leakage is

{{{
tcpdump -vvvv -i <your_device> dst port 53
}}}

==== Option 3: Using connect-proxy ====
Add this to your ssh config file (`~/.ssh/config`):
{{{
host *-tor
     CheckHostIP  no
     Compression  yes
     Protocol     2
     ProxyCommand connect -4 -S localhost:9050 $(tor-resolve %h localhost:9050) 
%p
}}}
Then add a `-tor` to the server name on the commandline when you want to use tor.  E.g., if your ssh config file has:
{{{
host whitehouse*
hostname     whitehouse.gov
user         trump
}}}

you would run `ssh whitehouse-tor` to access that host over tor, or simply `ssh whitehouse` to go direct without tor.