Quick answer
How do I SSH into my VPS over Tor?
To SSH into your VPS over Tor, install tor on your computer and run torsocks ssh user@your-vps, or add an onion service on the VPS with HiddenServicePort 22 127.0.0.1:22 and connect to its .onion name. Gloamport’s Dusk plan, 1 vCPU, 2 GB RAM, 40 GB NVMe, 2 TB traffic at $5.25 a month on 12 months, fits both.
Which route fits which goal?
| Route | What you install | Who sees what | Main cost |
|---|---|---|---|
| Client route: torsocks ssh to the VPS address | tor and torsocks on your computer | The VPS sees a Tor relay address, not your home address; your ISP sees only Tor traffic | Slower connections; the VPS still has a public SSH port |
| Onion route: SSH as an onion service | tor on the VPS and on your computer | Neither side learns the other’s IP address; the SSH port can be closed to the internet | A second thing to keep running and secure |
| Onion route with client authorization | Same, plus an x25519 key pair | Only holders of the key can even resolve the service | Key to back up |
Routes as described in the Tor Project documentation; see the sources below.
Why would you SSH over Tor?
You would do it to keep your own network address out of the server’s records. Without Tor, the server sees the address you connect from; over Tor it sees a Tor relay’s address. The route does not hide who you are from your VPS: you log in with your key, which is your identity there.
Tor also adds delay. A shell over Tor is usable but slower than a direct one, and a bulk copy is slow. Treat Tor as the way in when your direct address matters, and keep a direct route for large transfers. Root over SSH. Paste a public key at checkout and password login stays switched off; leave it empty and the team sets a temporary root password, shown in your dashboard, that you change at first login. If you have not made a key yet, read How do I generate an SSH key for my VPS? first.
How do I SSH into a VPS over Tor with the client route?
Nothing is needed on the VPS. Commands are for Debian 13 and Ubuntu 24.04.
Install Tor and torsocks on your computer
Run apt install tor torsocks netcat-openbsd. Tor listens as a SOCKS proxy on 127.0.0.1:9050 by default, which is the address torsocks uses without configuration.
Start Tor
Run systemctl enable --now tor and wait for the service to bootstrap. The Tor log in journalctl shows when it is ready.
Connect with torsocks
Run torsocks ssh and the user and address of your VPS. torsocks sends the connection through the Tor SOCKS port.
Or make it permanent in ssh_config
Add a Host entry with ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p. SSH expands %h and %p into the host name and port, and nc speaks SOCKS5 to Tor.
Check the address the server sees
Once logged in, run the who command, or last, and look at the source address. It is a Tor relay, not your own address.
sudo apt install tor torsocks netcat-openbsd
sudo systemctl enable --now tor
torsocks ssh root@YOUR_VPS_IP
# ~/.ssh/config alternative
Host gloam-tor
HostName YOUR_VPS_IP
User root
ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %pHow do I make the VPS reachable as an onion service?
Do this while your normal SSH route still works. If you close port 22 first and the onion service fails, you have no shell.
Install Tor on the VPS
Log in over normal SSH and run apt install tor.
Add the hidden service to torrc
Append HiddenServiceDir and HiddenServicePort lines to /etc/tor/torrc. The manual says each hidden service needs its own directory, and that HiddenServicePort maps a virtual port to a target, by default on 127.0.0.1.
Restart Tor and read the address
Run systemctl restart tor, then cat the hostname file inside the HiddenServiceDir. It holds your .onion address.
Connect from your computer
With Tor running on your computer, run torsocks ssh [email protected]. Compare the host key fingerprint with the one you know from the normal route.
Restrict who can find it (optional)
Add client authorization: put a one-line .auth file in authorized_clients/ on the VPS and a matching .auth_private file in the client’s ClientOnionAuthDir, as in the onion-services client-authorization page.
Only then close the public port
When the onion login works from a second session, restrict sshd or the firewall so the public address no longer answers SSH, if that is what you want.
# /etc/tor/torrc (append)
HiddenServiceDir /var/lib/tor/ssh_service/
HiddenServicePort 22 127.0.0.1:22
sudo systemctl restart tor
sudo cat /var/lib/tor/ssh_service/hostname
# On your computer
torsocks ssh root@YOUR_ADDRESS.onion# VPS: /var/lib/tor/ssh_service/authorized_clients/alice.auth (one line)
descriptor:x25519:BASE32_PUBLIC_KEY
# Your computer: torrc
ClientOnionAuthDir /var/lib/tor/onion_auth
# Your computer: /var/lib/tor/onion_auth/alice.auth_private (one line)
ONION_ADDRESS_WITHOUT_.onion:descriptor:x25519:BASE32_PRIVATE_KEYWhat are the limits of SSH over Tor?
The limits are speed, the login itself and the second service. Speed first: the circuit adds delay to every keystroke. Then the login: your SSH key still proves who you are to the VPS, so never reuse one key for a server tied to your name. Last, the onion service is a second program to patch; Tor’s own manual says every hidden service needs a separate directory and that the hostname file in it holds the address, so protect that directory as you would a key.
Tor does not stop mistakes. A shell that opens a web page from your own browser, or a file you copy over the clear route, still ties you to the server. For more on onion services themselves read What is an onion service, and how does it work?.
Which Gloamport plan do you need for an onion service?
Dusk is the plan listed for it: 1 vCPU, 2 GB RAM, 40 GB NVMe, 2 TB traffic, $5.25 a month on the 12-month term, $10.50 on a single month. Gloamport describes it as A VPN plus a Tor relay or an onion site. An SSH onion service alone is light, so Ember ($3.74 a month on the 12-month term) also works; we have not benchmarked either.
According to Gloamport’s survey of 10 November 2026, 10 of the 49 providers listed publish an onion address for their own site. If you also want to publish a site, see How do I host an onion site on a VPS?, and lock the base system first with How do I harden SSH on a new VPS?.
In summary
- Client route: install tor and torsocks, then run torsocks ssh user@vps.
- Tor listens on SOCKS port 9050 by default; ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p does the same from ssh_config.
- Onion route: HiddenServiceDir plus HiddenServicePort 22 127.0.0.1:22 in the VPS torrc.
- The .onion address is in the hostname file of the HiddenServiceDir.
- Client authorization uses a descriptor:x25519 line in authorized_clients/*.auth.
- Close the public SSH port only after the onion login works.
- Dusk, $5.25 a month on 12 months, is the matching plan.
SSH over Tor: common questions
Does SSH over Tor hide my identity from the VPS?
No. It hides your network address, but you still sign in with your key and your account. Use a separate key for a server you do not want tied to other work.
Why does torsocks ssh say connection refused?
Tor is probably not running, or has not finished bootstrapping. Check the service, then wait until it is ready. torsocks uses the SOCKS port 127.0.0.1:9050 unless you configure another.
Can I use the VPS dashboard if I lock out SSH?
Yes for reboots and reinstalls: Reboots and reinstalls are requested from the dashboard and carried out by the team; a reinstall erases the disk. A reinstall wipes the disk, so keep a working SSH route and a copy of what you need.
Where is my onion address stored?
In the hostname file inside the HiddenServiceDir on the VPS, together with the keys that make up the service. Back the directory up if you want to keep the same address.
Is the client route or the onion route safer?
The onion route keeps the SSH port off the public internet, which removes a target. The client route needs nothing installed on the VPS and is quicker to try.
Sources (5)
- Tor manual: HiddenServiceDir, HiddenServicePort, SocksPort, client authorization 2019.www.torproject.org/docs/tor-manual.html.en — The Tor Project (checked 2026-11-10)
- Onion services: setup community.torproject.org/onion-services/setup — The Tor Project (checked 2026-11-10)
- Onion services: client authorization community.torproject.org/onion-services/advanced/client-auth — The Tor Project (checked 2026-11-10)
- torsocks(1) manual page — Arch Linux manual pages (checked 2026-11-10)
- ssh_config(5) manual page: ProxyCommand — OpenBSD / OpenSSH (checked 2026-11-10)