15 ms·
For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh
by gaoshan 16y ago
For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix...
Open an ssh connection to a server you have access to using something like the following:
ssh -ND 8887 -p 22 rufus@12.120.186.8
where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a different port so I am used to specifying this) and the rest is your username and the address of the server
Set your network to point to the proxy. On a Mac that would be…
... Open Network Preferences…
... Click Advanced…
... Click Proxies…
... Check the SOCKS Proxy box then in the SOCKS Proxy Server field enter localhost and the port you used (8887)
... OK and Apply and you are done!
Now you can surf safely.
- chrisbroadfoot 16y agoAnd, make sure you already have the key in your known_hosts, otherwise you could be subject to a MITM attack :)
- alanstorm 16y agoAlso, remember that some programs don't respect the system's proxy settings and instead use their own. Firefox is one of those, you can find its proxy settings in "Advanced -> Network -> Settings"
- mfukar 16y agoAfter Firefox 3.6.4, the default proxy selection policy is to use the system default, instead of no proxy.
- imurray 16y agoAlso Firefox doesn't put DNS through a socks proxy by default, which has some security implications and doesn't allow you to reach internal-only names. In about:config set: network.proxy.socks_remote_dns to True.
- subbu 16y agohttp://lifehacker.com/237227/geek-to-live--encrypt-your-web-browsing-session-with-an-ssh-socks-proxy http://lifehacker.com/237227/geek-to-live--encrypt-your-web-... That link has screenshots to help you configure Firefox to use the ssh proxy.
- gaoshan 16y agoalanstorm of stackoverflow answers that deal with Magento fame (well, fame being a relative term but famous to me, anyway)?
- alanstorm 16y agoYeah, I'm that Alan Storm. NOT the WCW scrub wrestler.
- staktrace 16y agoUnfortunately Opera doesn't support SOCKS proxies. http://www.opera.com/support/kb/view/194/ http://www.opera.com/support/kb/view/194/
- seanalltogether 16y agoAlso unfortunately I think Flash and Silverlight media streaming don't respect proxies, leaving me unable to stream Hulu and Netflix when I'm in the UK.
- enneff 16y agoThey _should_, and do for me typically using Chrome.
- gasull 16y agohttp://silenceisdefeat.com/ http://silenceisdefeat.com/ Silence Is Defeat provides SSH accounts for a small donation. (I am not affiliated with them)
- sswam 16y agoI provide ssh accounts on 2 VPSs (and growing), free of charge. http://nipl.net/ http://nipl.net/ http://ai.ki/ http://ai.ki/
- pmjordan 16y agoIn case this isn't clear: if you ssh to someone else's machine and use it as a proxy or VPN, the owner of said machine can of course still steal your HTTP cookies. (not trying to say anything about the trustworthiness of the above 2 posters, just a general statement)
- cturner 16y agoAlso, if you host your ssh server on 443 rather than 22, you can also tunnel through most corporate firewalls.
- cpach 16y agoAnd if the firewall does protocol blocking, solutions like http://dag.wieers.com/howto/ssh-http-tunneling/ http://dag.wieers.com/howto/ssh-http-tunneling/ might be able to get through.
- conanite 16y agossh -ND 8887 -p 22 rufus@12.120.186.8 just hangs and doesn't look like it's doing anything ... if you want to see stuff happening, so you know it's working, use verbose mode: ssh -vND 8887 -p 22 rufus@12.120.186.8 and you'll see delightful ssl debug information scroll by every time you hit a page in your browser.
- pygy_ 16y agoI'd like to buy such a server at low purchase and maintenance cost. The Pandaboard[1] looks like a good fit, but the instructions to install a Linux distro are a bit scary [2]. I guess I could do it, from my Mac, but I'm a bit afraid to mess things up with the low-level disk utilities. Does someones sells SD cards with a distro pre-installed? Or an equivalent device with an easier setup? If not, there's probably a market for that... [1] http://pandaboard.org/ http://pandaboard.org/ [2] http://omappedia.org/wiki/OMAP_Pandroid_Main#Getting_Started http://omappedia.org/wiki/OMAP_Pandroid_Main#Getting_Started
- pmjordan 16y agoThere are lots of dirt-cheap Atom-based Mini-ITX systems out there. A basic motherboard with CPU will cost you about €60, a bit more for a dual-core. You can probably scavenge some DDR2 ram from an upgraded laptop and install the OS on a USB stick. Mini-ITX cases/PSUs tend to be cheap too. If this going to sit in your office or home, you might want to watch out for noise/heat with both motherboard and PSU and pay a bit more for a fanless motherboard & PSU and get a case with a large, slow-rotating fan. All in all you can probably come in under €200 plus a multiple of that for your time for research, assembly and installation. Or just rent a VPS.
- blntechie 16y agoExactly my question. Are there any cheap and reliable(very important in this case) VPS service I can use to do this? Using ssh thru internet as proxy seems to be the best approach. Unfortunately I cannot setup my own ssh server to do this as both power and internet connectivity is not reliable where i live.
- unfasten 16y agoYou might want to look at http://prgmr.com/xen/ http://prgmr.com/xen/ It's run by a Hacker News member, lsc. He has plans starting at $5/mo but you'll want to take notice of the of the monthly transfer limit. The $5/mo plan is 10GB transfer a month (which will come to 5GB in/5GB out if you're using it as a proxy) so you won't want to tunnel video or downloads through it. If you go for the $8/mo plan though you can get 40GB data transfer. I've never had an account with him so I'm not sure if there's a way to check how much of your data allowance you've used for the month. Someone else might be able to chime in about a program you could run on the server to notify you when you've reached a transfer threshold.
- hdeshev 16y agoYou, sir, made my day! I just set this up with my home Linksys router which is reachable from the internet and it works like a charm. I am using the Tomato firmware (http://www.polarcloud.com/tomato http://www.polarcloud.com/tomato) which has an SSH daemon.
- dhyasama 16y agoAre there public SSH servers that are safe?
- someone_here 16y agoSurely you jest, sir!
- artlogic 16y agoNot that I know of, but decent VPSes are relatively cheap - for instance: $5/mo - http://prgmr.com/ http://prgmr.com/ If you can't afford that, you can always run a SSH server from your residence and use that.
- jonknee 16y agoOn a similar note, I have this aliased in my shell (.profile) so I don't have to think before getting a proxy up: alias socks="ssh -ND 8887 -p 22 rufus@12.120.186.8" That way I can just open a shell and type "socks" and be good to go (well and then do the system preferences deal, but I have an AppleScript that does that automatically).
- deleted 16y ago[deleted]
- 16s 16y agoClient -> SSH_Server == Encrypted SSH_Server -> FaceBook == Unencrypted SSH proxies are not end to end encryption. They only protect part of the path. Not sure why this is being down voted. It's true. The tunnel is only between the client and the SSH server. The HTTP websites that you visit beyond the SSH server see your clear text packets.
- ars 16y agoSo? The problem is insecure WiFi and local networks. The network from the SSH_Server to Facebook and much larger and more secure.
- daten 16y agoThis is true but not relevant to the discussion because the attack in question depends sniffing clear-text wireless traffic at the local access point. Tunneling over SSH protects your traffic for that portion of the network (and out past your ISP as far as the remote end of the SSH tunnel). An attacker would need different tools and resources to intercept your traffic between remote hosts.
- someone_here 16y agoYou proxy through the NSA? How brave!
- gaoshan 16y agoYou win a cookie! I was wondering how long it would take for someone to comment on that. :)
- Dornkirk 16y agoThis is a stupid question, but what about a guy like me who has no access to a server? I'm going traveling for all of next month, the only sites I'll be checking where I'll be logged in is my hotmail account, and I might check my bank account (Chase) - both use https, so I suppose I'm in the clear then? (also when I click "log out" on these sites, it logs me out, but if my session has been hijacked, will it log the hijacker out of the session he's hijacked of mine as well?)
- seabee 16y agoGenerally websites will delete the login token on their side, leaving hijackers with an invalid token and a 'log in again' page.
- robryan 16y agoGenerally, watch out for older sites or sites made by people that haven't learnt much in this area which may store some kind of account id in place of a key generated on each login. In that case just because the website invalidated/deleted your cookie the hijacked cookie would still be good.
- retroafroman 16y agoA cheap linux VPS is a couple bucks a month. Mine is three. If you aren't looking for a deal, there are many many options at the 5 dollar price point. If five bucks is worth peace of mind for the next month, then that's your answer. This will also have the benefit of getting around filters that are operating on WiFi network you are on.
- dpritchett 16y agoWow, three? I thought prgmr.com's $5 system was the best deal I'd be able to find.
- retroafroman 16y agoIt was a special deal featured on http://www.lowendbox.com/ http://www.lowendbox.com/. If you can pay by the year, there are even cheaper deals.