4 ms·

This looks great. Do you have any benchmarks that compare transfer speeds compared to SSH ? What is the canonical replacement to `tar czf - /some/folder | ssh

by zimbatm 11y ago

This looks great. Do you have any benchmarks that compare transfer speeds compared to SSH ? What is the canonical replacement to `tar czf - /some/folder | ssh user@host "tar xvf -C /some/folder -"` ? Key management could use a bit of doc, how do you generate all these keys ? It would be nice to have a ssf-keygen tool. Looking forward to see this gaining more traction.

e12e 11y ago
It doesn't look like there is a replacement for that - it does however come with a socks-server, appears to support both v4 and v5[1]. I wonder if there's still any real need to support both (but perhaps v5 layers on top of v4, so it makes sense to implement them in layers, and little overhead to provide both?). They have a howto-section on manually forwarding dns - but socks5 really should be enough for most applications. While a general forwarding tool will always be able to forward dns, from a security and usability standpoint, it would seem just providing socks5 (and 5 only) might be better. As for piping - as I mentioned it looks like there's no support built in - but it should be possible to make a wrapper. Would need something on the other end though - like a netcat that takes an output filename, and then spawns another listener and redirects to a file or something. I'd be interested in if there's any real performance differences between openssh socks5/forwarding and this project. Especially since they build on the same primitives. [1] https://github.com/securesocketfunneling/ssf/tree/master/src/services/socks https://github.com/securesocketfunneling/ssf/tree/master/src...
- ssfdeveloper 11y ago
  SSF supports SOCKS v4, v4a and v5 (only main SOCKS features that were implemented in SSH). All these versions are necessary for supporting as many web browsers as possible. Old browsers using SOCKS v4 would need to use UDP forwarding for DNS resolving (to avoid leaking DNS request locally). As you mentioned, there is a "how to" section on the website: https://securesocketfunneling.github.io/ssf/#how-to-browse-privately https://securesocketfunneling.github.io/ssf/#how-to-browse-p... For a simple comparison between SSH and SSF performances, you can take a look at the website (https://securesocketfunneling.github.io/ssf/#performances https://securesocketfunneling.github.io/ssf/#performances) Thanks for digging into the code
  - e12e 11y ago
    Which web browsers that aren't horribly outdated, doesn't support socks5?
    - ssfdeveloper 11y ago
      Older versions of Internet Explorer did not support SOCKS5 and Chrome uses SOCKS4 by default (although you can manually specify --proxy-server="socks5://" to force SOCKS5)
      - e12e 11y ago
        Actually, after some google-ing, I'm not sure any version of IE support socks5?
  - e12e 11y ago
    > For a simple comparison between SSH and SSF performances, you can take a look at the website (https://securesocketfunneling.github.io/ssf/#performances https://securesocketfunneling.github.io/ssf/#performances) I think the last time I tested scp (with a large media file) over gigabit ethernet, ssh managed to saturate the link. Odd if that only holds for scp. Almost sounds as if the version of openssh used didn't use hw acceleration?
ssfdeveloper 11y ago
Thank you for your interest for our project. There is a page on the website with a benchmark between SSF and SSH. It is a little bit basic. The test is done on TCP port forwarding. Concerning your use case, it would be interesting to support it. We will look into it. It might not be straightforward to make it crossplatform. Regarding the key generation, there is a tutorial on the website (https://securesocketfunneling.github.io/ssf/#security-features https://securesocketfunneling.github.io/ssf/#security-featur...). We also have our own script to generate test keys. We can make it more user-friendly and publish it.

by zimbatm 11y ago

e12e 11y ago

It doesn't look like there is a replacement for that - it does however come with a socks-server, appears to support both v4 and v5[1]. I wonder if there's still any real need to support both (but perhaps v5 layers on top of v4, so it makes sense to implement them in layers, and little overhead to provide both?). They have a howto-section on manually forwarding dns - but socks5 really should be enough for most applications. While a general forwarding tool will always be able to forward dns, from a security and usability standpoint, it would seem just providing socks5 (and 5 only) might be better. As for piping - as I mentioned it looks like there's no support built in - but it should be possible to make a wrapper. Would need something on the other end though - like a netcat that takes an output filename, and then spawns another listener and redirects to a file or something. I'd be interested in if there's any real performance differences between openssh socks5/forwarding and this project. Especially since they build on the same primitives. [1] https://github.com/securesocketfunneling/ssf/tree/master/src/services/socks https://github.com/securesocketfunneling/ssf/tree/master/src...

ssfdeveloper 11y ago
SSF supports SOCKS v4, v4a and v5 (only main SOCKS features that were implemented in SSH). All these versions are necessary for supporting as many web browsers as possible. Old browsers using SOCKS v4 would need to use UDP forwarding for DNS resolving (to avoid leaking DNS request locally). As you mentioned, there is a "how to" section on the website: https://securesocketfunneling.github.io/ssf/#how-to-browse-privately https://securesocketfunneling.github.io/ssf/#how-to-browse-p... For a simple comparison between SSH and SSF performances, you can take a look at the website (https://securesocketfunneling.github.io/ssf/#performances https://securesocketfunneling.github.io/ssf/#performances) Thanks for digging into the code
- e12e 11y ago
  Which web browsers that aren't horribly outdated, doesn't support socks5?
  - ssfdeveloper 11y ago
    Older versions of Internet Explorer did not support SOCKS5 and Chrome uses SOCKS4 by default (although you can manually specify --proxy-server="socks5://" to force SOCKS5)
    - e12e 11y ago
      Actually, after some google-ing, I'm not sure any version of IE support socks5?
- e12e 11y ago
  > For a simple comparison between SSH and SSF performances, you can take a look at the website (https://securesocketfunneling.github.io/ssf/#performances https://securesocketfunneling.github.io/ssf/#performances) I think the last time I tested scp (with a large media file) over gigabit ethernet, ssh managed to saturate the link. Odd if that only holds for scp. Almost sounds as if the version of openssh used didn't use hw acceleration?

ssfdeveloper 11y ago

Thank you for your interest for our project. There is a page on the website with a benchmark between SSF and SSH. It is a little bit basic. The test is done on TCP port forwarding. Concerning your use case, it would be interesting to support it. We will look into it. It might not be straightforward to make it crossplatform. Regarding the key generation, there is a tutorial on the website (https://securesocketfunneling.github.io/ssf/#security-features https://securesocketfunneling.github.io/ssf/#security-featur...). We also have our own script to generate test keys. We can make it more user-friendly and publish it.