<story><title>Tor is a great sysadmin tool (2020)</title><url>https://www.jamieweb.net/blog/tor-is-a-great-sysadmin-tool/</url></story><parent_chain><item><author>krtyiktj</author><text>at our lab the tor traffic would be noticed by the cyber security group&amp;#x27;s ids and all traffic from your host would start dropping at the border so fast your head would spin. you&amp;#x27;d get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.</text></item><item><author>azalemeth</author><text>In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit.&lt;p&gt;One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~&amp;#x2F;.ssh&amp;#x2F;config file in order to access it because of your university&amp;#x27;s overbearing IT department^W^W^W^W network topology, would be to &amp;quot;just&amp;quot; run an onionsite with onion services authentication [1], preventing it being publicly accessed without the pre-shared key. If your onion service just redirects to ssh (presumably with certificate-only auth) I can&amp;#x27;t help but think that this is &lt;i&gt;almost&lt;/i&gt; an example of security by obscurity done right.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;support.torproject.org&amp;#x2F;en-US&amp;#x2F;onionservices&amp;#x2F;client-auth&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;support.torproject.org&amp;#x2F;en-US&amp;#x2F;onionservices&amp;#x2F;client-au...&lt;/a&gt;</text></item></parent_chain><comment><author>derefr</author><text>Obviously, you should plan around this by gathering all the MAC addresses of every machine in the office, and then have your machine spoof through them in rotation. &amp;#x2F;s</text></comment>
<story><title>Tor is a great sysadmin tool (2020)</title><url>https://www.jamieweb.net/blog/tor-is-a-great-sysadmin-tool/</url></story><parent_chain><item><author>krtyiktj</author><text>at our lab the tor traffic would be noticed by the cyber security group&amp;#x27;s ids and all traffic from your host would start dropping at the border so fast your head would spin. you&amp;#x27;d get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.</text></item><item><author>azalemeth</author><text>In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit.&lt;p&gt;One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~&amp;#x2F;.ssh&amp;#x2F;config file in order to access it because of your university&amp;#x27;s overbearing IT department^W^W^W^W network topology, would be to &amp;quot;just&amp;quot; run an onionsite with onion services authentication [1], preventing it being publicly accessed without the pre-shared key. If your onion service just redirects to ssh (presumably with certificate-only auth) I can&amp;#x27;t help but think that this is &lt;i&gt;almost&lt;/i&gt; an example of security by obscurity done right.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;support.torproject.org&amp;#x2F;en-US&amp;#x2F;onionservices&amp;#x2F;client-auth&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;support.torproject.org&amp;#x2F;en-US&amp;#x2F;onionservices&amp;#x2F;client-au...&lt;/a&gt;</text></item></parent_chain><comment><author>rattlesnakedave</author><text>&amp;gt; you&amp;#x27;d get an unpleasant phone call or visit to your office and be warned&lt;p&gt;sometimes I wonder why IT departments and security in general get a bad wrap, then I see things like this.</text></comment>