1

TLDR: I can SSH the onion address, but not the hostname that's CNAME'd to it.

I have the SSH server running as a Tor service, but I don't want to have to remember the onion address. I know I could just add the name to my SSH client config, but the purpose of this is to be able to access my computer when I'm borrowing someone else's, and obviously I don't want to mess too much with other people's settings. (And yes, these other computers are actually likely to have Tor already installed.) So I set up a hostname with a CNAME record pointing to the onion address. If I do torify ssh myaddress.onion, it works fine, but torify ssh mydomain.com results in:

1565911820 ERROR torsocks[31652]: Unable to resolve. Status reply: 4 (in socks5_recv_resolve_reply() at socks5.c:683)
ssh: Could not resolve hostname mydomain.com: Non-recoverable failure in name resolution

(And no, I did not literally type mydomain.com; the error is edited.)

Doing dig -t CNAME mydomain.com does return the onion address. All of my testing so far has been on the host machine itself (LUbuntu 18.04.3).

0

2 Answers 2

2

This is a failure in your understanding how DNS works, combined with the fact that .onion isn't a valid TLD in public DNS. Let me give you a crash-course in CNAME resolution, as well as a solution for you to try to 'alias' this on your side of things.

DNS CNAME Resolution

DNS CNAME records are called aliases. They act as a pointer saying "This domain is an alias for this other domain, resolve that domain and go to that destination."

If I have a domain example1.com with an A record of 1.2.3.4 which is my actual server, and example2.com set as a CNAME of example1.com, then when I go to example2.com DNS will see that the DNS records for example2.com for A record resolution depend on the record of example1.com. This works in NORMAL DNS because it's publicly addressed and able to be looked up.

The CNAME destination isn't really "shared" as the DNS lookup result for a DNS lookup that is being done, only the resulting A/AAAA record is cared about and since there can't be one for .onion it fails to DNS properly, and fails. Explanation below.

Why ONION Resolution Fails

CNAME records are NOT the same as Tor ONION addresses. When you look up a CNAME record against a .onion address in standard DNS, it hard-fails. This is because in public DNS, .onion isn't addressable and isn't a valid TLD.

CNAME records also do not 'resolve' to the alias address in the format of a 'redirect' like you think - the CNAME will only properly resolve if the destination of the CNAME pointer actually can return a public DNS record. Because it's a .onion it never will so it either NXDOMAINs or SERVFAILs on the lookups.

This is why you get the error you're getting.

How can I get this to work then?

By 'cheating' and configuring your SSH config a bit.

Try adding this section to your ~/.ssh/config file (create the file if it doesn't exist):

Host mydomain.com
    Hostname myaddress.onion

Then try to SSH again to mydomain.com. It should repoint this to your .onion address behind the scenes.

However, DO NOT rely on DNS to point domains to .onion addresses - they don't work in public DNS for domains.

4
  • I understand that public DNS will not resolve it, but I'm not trying to access it from a normal SSH. It's torified, which is why I expected Tor to resolve it just as it resolves onion addresses even though public DNS does not. I do know about SSH config, and I have used that before even so much as to put the ncat proxy so that I don't need torify, but only on my own computer. In this case, I don't even know which computer I would be using, so adding to the config is just as inconvenient as using the onion address manually.
    – zondo
    Aug 16, 2019 at 0:13
  • The issue is because torsocks when you enter a .com address goes over General DNS. THAT fails to lookup properly, it's not a "Oh, go to this onion address", it's a "Go to the IP address that this other hostname references", torsocks never sees the .onion alias because that's not returned in a DNS lookup for a .com that's CNAME'd, only the A or AAAA record for the CNAME destination is actually 'returned', or NXDOMAIN (which is the case for .ONIONs). Which is why I gave you the crash-course in DNS mechanics here.
    – Thomas Ward
    Aug 16, 2019 at 0:23
  • Okay; that makes sense. So then if this were a website, I could use an A record to resolve to a server that then uses a 301 to the onion address, which is a common enough service from DNS providers. But there really isn't a way to do an alias like that for SSH, is there? I'm thinking what I want is probably just impossible, but I don't know if there's another option I haven't thought of.
    – zondo
    Aug 16, 2019 at 0:32
  • @zondo The end of my post gives you an SSH solution that should be able to automatically make the .com look to the .onion as the actual hostname. I can't guarantee it'll work, but you can try it. Otherwise, no, there's no other mechanism you have here to work with unfortunately.
    – Thomas Ward
    Aug 16, 2019 at 0:34
1

plain dns no.. how about saving in txt record and wrap the call like

torify ssh $(dig +short example.com -t txt)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .