My personal notes on all things technical and factual....

Clayton's Tech Bits

Search this site:

Custom Search

Wed, 29 Jul 2009

/Admin/SSH-Proxy: A Do-It-Yourself Proxy For Those Who Need to Circumvent a Firewall

Thanks to Jon[2] for reminding me that there is something better then flaky public proxies and the over-taxed Tor network[1]. Tor is still better if you want end-to-end security and anonymity, but if you just want a secure hop out of the local censored network and after that you do not care, renting a cheap server (as little as $8/month at vpslink[3], 100G of bandwidth included) is a simple and easy option.

Assuming your remote server is called hostname.com, setting up an encrypted tunnel is as simple as executing this on a local terminal (must be root):

ssh -vv -CND 1080 username@hostname.com

Note that for my own Debian server on the other end of the SSH proxy tunnel, I have found that "username" cannot be "root". I am not sure why this is (and it is definitely counter-intuitive) but if I try to tunnel to the root account on my server, when I try to use the tunnel to browse to a website it does not work and the following error is reported:

channel 1: open failed: administratively prohibited: open failed

If I tunnel to an ordinary user account on my server, I get no error and everything works. Go figure.....

To semi-automate this I created a script file containing:

#!/bin/sh
xterm -e ssh -vv -CND 1082 username@hostname.com

plus an icon on my KDE desktop pointing to this script. Thereafter, one click on the icon followed by an account password prompt for the server in the terminal window, and my tunnel is started. (To eliminate the password prompt, setup passwordless authentication[6].)

Any browser can use this proxy, by pointing its proxy setting at localhost and port 1080, with SOCKS 5 turned on. The Firefox FoxyProxy[4] plugin makes this infinitely more flexible by allowing the simultaneous configuration of multiple proxies, and providing fine-grained control over which websites are accessed using which proxies.

Once FoxyProxy is installed into Firefox, you have the option of selecting any one proxy (or none) for all of your surfing, or associating certain websites with certain proxies and running FoxyProxy in "Patterns" mode. Since youtube is often getting itself blocked, a pattern for youtube would be:

*.youtube.com/*

While you are at it, install privoxy[5] and make it your default proxy for websites that have not been diverted to Tor or your just created personal proxy. Privoxy blocks a lot of advertisements and information gathering by nosy websites.

[1] http://www.torproject.org/
[2] http://rejon.org/2009/07/access-facebook-through-the-great-firewall-second-line-ssh-tunnel/
[3] http://blog.langex.net/index.cgi/Hosting/vpslink/
[4] https://addons.mozilla.org/en-US/firefox/addon/2464
[5] http://www.privoxy.org/
[6] http://blog.langex.net/index.cgi/Admin/SSH-SSL/passwordless-ssh-authentication.html

posted at: 11:00 | path: /Admin/SSH-Proxy | permanent link to this entry

Home

Contact

Resumé / C.V.

Links

Categories:

Archives:

Subscribe XML RSS Feed

Wed, 29 Jul 2009