Yeah, which is something I routinely do with .ssh&#x2F;config aliases including &quot;proxyCommand ncat --proxy 127.0.0.1:9050 --proxy-type socks5 %h %p&quot;<p>Also hidden service even has a way to obscure the descriptor using HiddenServiceAuthorizeClient&#x2F;HidServAuth which basically offers a layer of authentication, too.