Sun, 17 Jan 2010
/Admin/SSH-Proxy:
Proxychains Allows Any Application to Use a Proxy
My SSH Socks5 proxy[1] works great, especially with the addition of
autossh, but unlike most web browsers and Pidgin, many applications
(particularly on the command line) just do not have proxy support built in.
Proxychains[2] is a wrapper that redirects all network traffic through a
designated proxy. To get it working is very simple. After installing, I made
this change to the bottom of /etc/proxychains.conf:
# defaults set to "tor"
# socks4 127.0.0.1 9050
socks5 127.0.0.1 1082
ie. I commented out the default Tor proxy and added my local SSH socks5
proxy which I have placed on port 1082.
Then, for instance, to send my gpodder podcatcher through the SSH tunnel,
I just start gpodder in a terminal as follows:
proxychains gpodder&
Then all of gpodder's network traffic (DNS queries included) go out via
SSH through my out-of-country server. And now I have restored access to many
blocked podcasts, PGP key servers, and no doubt many other things as they
come up. I have been looking for something like this for years.
[1] http://blog.langex.net/index.cgi/Admin/SSH-Proxy/
[2] http://proxychains.sourceforge.net/
posted at: 14:04 | path: /Admin/SSH-Proxy | permanent link to this entry
Fri, 08 Jan 2010
/Admin/SSH-Proxy:
Use autossh to Fix Frequent Disconnects
Sometimes the bandwidth is so bad here (or is it the "Great Firewall"
deliberately trying to break my connection?) that my SSH tunnel will
frequently fail. Very inconvenient, as I do not notice until I need it,
then I have to do a manual restart and wait for it to connect (and said
wait can sometimes be significant when bandwidth sucks...)
Enter autossh[1].
I have setup an alias in my .bashrc as follows:
alias tunnel="autossh -M 0 -v -CND 1082 username@hostname.com"
To start the tunnel at the beginning of the day, I just type "tunnel"
in any terminal. And whenever the ssh connection is broken, autossh
automatically (and apparently intelligently) restarts it. So far, so
good.
[1] http://www.harding.motd.ca/autossh/
posted at: 06:11 | path: /Admin/SSH-Proxy | permanent link to this entry
Wed, 29 Jul 2009
/Admin/SSH-Proxy:
A Do-It-Yourself Proxy For Those Who Need to Circumvent a Firewall
Thanks to Jon[2] for reminding me that there is something better then
flaky public proxies and the over-taxed Tor network[1]. Tor is still
better if you want end-to-end security and anonymity, but if you just
want a secure hop out of the local censored network and after that you
do not care, renting a cheap server (as little as $8/month at
vpslink[3], 100G of bandwidth included) is a simple and easy option.
Assuming your remote server is called hostname.com, setting up an
encrypted tunnel is as simple as executing this on a local terminal
(must be root):
ssh -vv -CND 1080 username@hostname.com
Note that for my own Debian server on the other end of the SSH proxy
tunnel, I have found that "username" cannot be "root". I am not sure why
this is (and it is definitely counter-intuitive) but if I try to tunnel
to the root account on my server, when I try to use the tunnel to browse
to a website it does not work and the following error is reported:
channel 1: open failed: administratively prohibited: open failed
If I tunnel to an ordinary user account on my server, I get no error
and everything works. Go figure.....
To semi-automate this I created a script file containing:
#!/bin/sh
xterm -e ssh -vv -CND 1082 username@hostname.com
plus an icon on my KDE desktop pointing to this script. Thereafter,
one click on the icon followed by an account password prompt for the
server in the terminal window, and my tunnel is started. (To
eliminate the password prompt, setup passwordless authentication[6].)
Any browser can use this proxy, by pointing its proxy setting at
localhost and port 1080, with SOCKS 5 turned on. The Firefox
FoxyProxy[4] plugin makes this infinitely more flexible by allowing the
simultaneous configuration of multiple proxies, and providing
fine-grained control over which websites are accessed using which
proxies.
Once FoxyProxy is installed into Firefox, you have the option of
selecting any one proxy (or none) for all of your surfing, or
associating certain websites with certain proxies and running FoxyProxy
in "Patterns" mode. Since youtube is often getting itself blocked, a
pattern for youtube would be:
*.youtube.com/*
While you are at it, install privoxy[5] and make it your default
proxy for websites that have not been diverted to Tor or your just
created personal proxy. Privoxy blocks a lot of advertisements and
information gathering by nosy websites.
[1] http://www.torproject.org/
[2] http://rejon.org/2009/07/access-facebook-through-the-great-firewall-second-line-ssh-tunnel/
[3] http://blog.langex.net/index.cgi/Hosting/vpslink/
[4] https://addons.mozilla.org/en-US/firefox/addon/2464
[5] http://www.privoxy.org/
[6] http://blog.langex.net/index.cgi/Admin/SSH-SSL/passwordless-ssh-authentication.html
posted at: 16:00 | path: /Admin/SSH-Proxy | permanent link to this entry
