Proxy Web Traffic Through SSH

[lilrofl]

Mabs and I were discussing using an SSH tunnel to proxy a secure web connection over untrusted networks.

I told him I’d write up how I’ve been doing it using Firefox on Windows and my Ubuntu home server because it’s a good practice for anyone, and it’s so simple that there’s really no reason not to.

The instructions are pretty flexible though and you can probably find alternatives with all browsers, client OS’s and Server flavors.

Steps I will not cover:
Set up an SSH server on the Linux flavor of your choice. There are enough places that explain this step that I do not feel like I need to.
Punch a hole through firewall connecting an external port to your SSH server. This will be a matter of router configuration.
Set up Dynamic DNS. I use

Code: Select all

http://freedns.afraid.org/

but any dynamic DNS service will do.

Steps I will cover:
Make a proxy user account on your server and secure it.
Set up putty and your browser to proxy web traffic through your home server.

Make a proxy user account on your server and secure it:
Because the only need for SSH tunneling is the ability to log into SSH, and because we might want to extend the service to friends and family, we should create a limited user whos only ability is to login and logout.

Code: Select all

useradd sshproxy –m –d /home/sshproxy –s /bin/rbash
passwd sshproxy

Setting up the proxy users shell as rbash will prevent the user from setting environmental variables; however, they will still have access to all of the power of bash… which is considerable. To put a stop to this we want to eliminate bash’s ability to find any commands to run, we can accomplish that by editing the .profile file in /home/sshproxy.

Edit as follows:

Code: Select all

vim  + /home/sshproxy/.profile
o
PATH=””
<optional echo line to greet tunnel users>

To keep tunneling users from changing the .profile file later we should also change the permissions on the home files.

Code: Select all

chmod 555 /home/sshproxy/
cd /home/sshproxy
chmod 444 *

Set up Putty and your browser to proxy web traffic through your home server:
Download and install putty from

Code: Select all

http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html

Run putty
Putty opens in the session window.
In the Host Name (or IP address) area, enter the address of your home server with appropriate port.

In the left window go to Connection > SSH > Tunnels

In the “Source Port” field enter a local unused port. I’m using 8080 because I feel like it, but you can use most numbers between 1000 and 65535.

Select the Dynamic radial button and click add, an entry should show up in the Forwarded Ports box
D8080

Go back to the Session tab to name and save your settings for future recall.

Configuring Firefox is pretty simple:
Press ALT to bring up the top menu if it is not already visible.
Go to Tools > Options > Advanced Tab > Connection area > click setting s
Select Manual proxy configuration
In the SOCKS Host add 127.0.0.1 port 8080 (or whatever port you configured putty to tunnel toward)
Select the SOCKSv5 radial button.
Remove all entries in all other fields (HTTP Proxy, SSL Proxy, FTP Proxy)

Click OK twice to save settings.

The Swap Proxy add-on for Firefox makes switching between proxy connections and normal connections no more complicated that a press of a button.

To test you proxy:
Connect to your SSH server with you PUTTY proxy connection.
Through your browser, check you IP address at a service like

Code: Select all

http://www.whatismyip.com/

Turn your proxy connection on (or off if you’re not using a proxy toggle like Proxy Swap)
Check your IP address again.

EDIT: I put this in pending submissions because I am pretty drunk and can't be certain that the instructions are properly illustrated... or even accurate

I'll give it a look tomorrow and clean it up if necessary.

[bad_brain]

good work....and looks proper, so it should be safe to move it to the tuts....

P.S. why rbash?

[maboroshi]

Nice tutorial!

Thanks for writing it up man

*cheers

Mabo

[lilrofl]

no problem bud. I meant to add that to connect from a Linux machine you would skip the whole Putty part and just run an ssh redirect from command line:

Code: Select all

ssh -fCND localhost:8080 <server@address.com> -p <port number SSH server>

Also I think I don't have access to moderator controls, which I believe are needed to move this to an appropriate heading, so bump it up there if you would Mr. Mabs

[maboroshi]

As an alternative to this for a relatively quick set up I can also recommend running a OpenVPN AS server. It's relatively easy to set up as well. Although I didn't realize it wasn't free when I had set it up... But thugz is the only one using mine. So it's all good (two connections are free it seems).

I might spend a bit of time one day figuring out how to set uyp OpenVPN Server without this. So much to do and so little time

*cheers