Sohail Riaz, Linux and Open Source Blog » Proxy http://www.sohailriaz.com Sohail Riaz, Linux and Open Source Blog Sat, 17 Jul 2010 07:38:36 +0000 http://wordpress.org/?v=2.9 en hourly 1 HowTo SSH outside using Authenticated Proxy http://www.sohailriaz.com/howto-ssh-outside-using-authenticated-proxy/ http://www.sohailriaz.com/howto-ssh-outside-using-authenticated-proxy/#comments Sun, 04 Jan 2009 07:19:43 +0000 Sohail Riaz http://www.sohailriaz.com/?p=40 This howto describe how to ssh outside another network / server using authenticated proxy. SSH (Secure Shell) is typically used to log into a remote machine and execute commands, but it also supports tunneling, forwarding TCP ports and X11 connections; it can transfer files using the associated SFTP or SCP protocols. Normally we use NetCat to [...]]]> This howto describe how to ssh outside another network / server using authenticated proxy. SSH (Secure Shell) is typically used to log into a remote machine and execute commands, but it also supports tunneling, forwarding TCP ports and X11 connections; it can transfer files using the associated SFTP or SCP protocols.

Normally we use NetCat to ssh outside using proxy server but if its not support proxy user / pass to authenticate by proxy server and then ssh outside. Here we will use a package called connect.c.

connect.c is the simple relaying command to make network connection via SOCKS and https proxy. It is mainly intended to be used as proxy command of OpenSSH. You can make SSH session beyond the firewall with this command.

This can be achieved by other methods too but this works for me.

1) Download connect.c software.

wget http://www.meadowy.org/~gotoh/ssh/connect.c

2) Compile connect.c Using GCC

gcc connect.c -o connect

and then copy to directory in your PATH i.e /usr/bin or /usr/local/bin

cp connect /usr/bin

3) Congiure ssh_config

append following line

ProxyCommand /usr/bin/connect -H proxy01.sohailriaz.com:8080 %h %p

4) Export Proxy User / Pass as variable

It is insecure but we have to used it. If your proxy doesnt use user/pass for authenticatio, you can skip this.

export HTTP_PROXY_USER=your_username
export HTTP_PROXY_PASSWORD=your_password

Thats it now you can ssh outside without any restriction :)

pixelstats trackingpixel]]> http://www.sohailriaz.com/howto-ssh-outside-using-authenticated-proxy/feed/ 0 HowTo Wget behind Authenticated Proxy http://www.sohailriaz.com/howto-wget-behind-authenticated-proxy/ http://www.sohailriaz.com/howto-wget-behind-authenticated-proxy/#comments Sun, 04 Jan 2009 07:15:38 +0000 Sohail Riaz http://www.sohailriaz.com/?p=38 This howto describe how to run wget behind authenticated proxy to download files. GNU Wget is a package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc. GNU Wget comes as [...]]]> This howto describe how to run wget behind authenticated proxy to download files. GNU Wget is a package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.

GNU Wget comes as default software with almost every distribution, so we are going to just configure it to start downloading using authenticated proxy.

1) Export http_proxy variable

export http_proxy=”http://yourproxyaddress.com:port/”

2) Export http_proxy variable in bash login script

vi ~/.bash_profile

export http_proxy=”http://yourproxyaddress.com:port/”

3) Define Proxy User / Pass in .wgetrc

vi ~/.wgetrc

proxy_user=your_username
proxy_pass=your_password

4) Test

[root@centos1 ~]# wget http://www.rarlab.com/rar/rarlinux-3.8.0.tar.gz
–08:46:50–  http://www.rarlab.com/rar/rarlinux-3.8.0.tar.gz
Resolving proxy01.sohailriaz.com… 10.1.59.81
Connecting to proxy01.sohailriaz.com|10.1.59.81|:80… connected.
Proxy request sent, awaiting response… 200 OK
Length: 791915 (773K) [application/x-gzip]
Saving to: `rarlinux-3.8.0.tar.gz’

100%[=======================================>] 791,915     88.8K/s   in 11s

08:47:04 (70.7 KB/s) – `rarlinux-3.8.0.tar.gz’ saved [791915/791915]

Enjoy Brothers :)

pixelstats trackingpixel]]> http://www.sohailriaz.com/howto-wget-behind-authenticated-proxy/feed/ 3 How To Configure Yum Behind Authenticated Proxy Server http://www.sohailriaz.com/how-to-configure-yum-behind-authenticated-proxy-server/ http://www.sohailriaz.com/how-to-configure-yum-behind-authenticated-proxy-server/#comments Mon, 01 Dec 2008 07:12:03 +0000 Sohail Riaz http://www.sohailriaz.com/?p=36 This how to describe to configure YUM to work behind proxy server using username / password for authentication. YUM is great tool available in RHEL/Fedora/CentOS to install/update/remove packages easily from local and internet repositories. In the most offices / schools / colleges where proxies are implemented and direct connection to the internet is not possible [...]]]> This how to describe to configure YUM to work behind proxy server using username / password for authentication. YUM is great tool available in RHEL/Fedora/CentOS to install/update/remove packages easily from local and internet repositories. In the most offices / schools / colleges where proxies are implemented and direct connection to the internet is not possible and all internet traffic goes through proxy servers. Same as in my office we have to use proxy server with username / password to authenticate ourself to get internet access. So we are going to configure my YUM software to use proxy to get my LINUX updated with new softwares all the times with repositories available on internet.

OS = Fedora 10

1) Configure yum.conf

vi /etc/yum.conf

enter following lines at bottom of [main] section

proxy=http://yourproxyaddress:port/
proxy_username=youruser
proxy_password=yourpassword

2) Export http_proxy variable

export http_proxy=”http://yourproxyaddress:80/”

3) Export http_proxy variable in bash login script

vi /root/.bash_profile

export http_proxy=”http://yourproxyaddress:80/”

This will help you to export http_proxy variable automatically everytime you login.

Now use “yum list” command to check for its working.

yum list

Enjoy Brothers :)

pixelstats trackingpixel]]> http://www.sohailriaz.com/how-to-configure-yum-behind-authenticated-proxy-server/feed/ 4 Anonymous Proxy using SQUID 3 http://www.sohailriaz.com/anonymous-proxy-using-squid-3/ http://www.sohailriaz.com/anonymous-proxy-using-squid-3/#comments Sat, 15 Nov 2008 12:06:54 +0000 Sohail Riaz http://www.sohailriaz.com/?p=16 This howto describe step by step method to install SQUID 3 server as Anonymous Proxy. An anonymous proxy is a tool that attempts to make activity on the Internet untraceable. It accesses the Internet on the user’s behalf, protecting personal information by hiding the source computer’s identifying information. Simply say to hide your IP.The following [...]]]> This howto describe step by step method to install SQUID 3 server as Anonymous Proxy. An anonymous proxy is a tool that attempts to make activity on the Internet untraceable. It accesses the Internet on the user’s behalf, protecting personal information by hiding the source computer’s identifying information. Simply say to hide your IP.The following How To setups CentOS 5 as OS but it can be implemented on CentOS 4, Fedora Core 5-9 with same steps and SQUID version 3. Bydefault SQUID only uses default IP to communicate on internet but we will make use of all IPs available on server to act as anonymous proxy i.e if user connects to IP1 of server then IP1 will be act as proxy and forward same IP, if user connects to IP2 then IP2 will be act proxy and foward same IP and so on and also we will implement ncsa user based authentication to protect server from unauthorized used.

Server = CentOS 5.2, SQUID = version 3, IPs = 192.168.0.1 – 192.168.0.5

1 Installation Of Squid 3:

CentOS 5 comes with SQUID 2.6 but we need squid 3, so we will download source rpm of squid 3 and compile for our OS.

1.1  Install Pre-requisite

Install pre-requisite softwares i.e Development Tools to get all the compilers, libraries and other rpms for compilation of SQUID 3.

yum -y groupinstall “Development Tools”
yum -y install rpm-build openjade linuxdoc-tools openldap-devel pam-devel openssl-devel httpd rpm-devel

1.2 Download Squid 3 Source RPM

Download source rpm of Squid 3 from FEDORA website and install it.

cd /usr/src
wget http://download.fedora.redhat.com/pub/fedora/linux/releases/10/Fedora/source/SRPMS/squid-3.0.STABLE10-1.fc10.src.rpm
rpm -ivh squid-3.0.STABLE10-1.fc10.src.rpm

1.3 Compile Squid 3

Use following commands to start compilation, at end it will generate rpm file to install

cd /usr/src/redhat/SPECS
rpmbuild -bb squid.spec

1.4 Install Squid 3

Install newly build rpm, which will be found in /usr/src/redhat/RPMS/i386 for i686 and /usr/src/redhat/RPMS/x86_64 for x86_64.

rpm -Uvh /usr/src/redhat/RPMS/i386/squid-3.0.STABLE10-1.i386.rpm

2 Configuration

I will use default squid.conf to edit.

vi /etc/squid/squid.conf

2.1 Configure auth_param

We will enable ncsa authentication to access our squid server. Find following lines

#auth_param basic program <uncomment and complete this line>
#auth_param basic childred 5
#auth_param basic realm Squid proxy-caching web server
#auth_param basic credentialsttl 2 hours

Change to

auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/squid_passwd
auth_param basic childred 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours

2.2 Create proxy_auth acl

Here we will create proxy_auth acl to prompt user/pass to everyone want to use anonymous proxy. Find following line

#INSERT YOUR OWN RULES(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS

We will insert our proxy_auth rule under above line.

#INSERT YOUR OWN RULES(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
acl ncsaauth proxy_auth REQUIRED
http_access allow ncsaauth

2.3 Disable Forwarded Client IP

Bydefault squid forward client IP to respective website, but to setup anonymous proxy we will disable it to hide client IPs and send only IPs which are configured on squid server. Find following line squid.conf

forwarded_for on

Change to

forwarded_for off

2.4 Configure IPs

Now we will generate rules for outgoing IP i.e if any one connects to any IP of my server, so it will go with same IP to destination server. In this way we can connect several clients on different IPs and all IPs act as anonymous proxy. Find following line

# TAG: tcp_outgoing_address

add following lines under it.

acl ip1 myip 192.168.0.1
tcp_outgoing_address 192.168.0.1 ip1
acl ip2 myip 192.168.0.2
tcp_outgoing_address 192.168.0.2 ip2
acl ip3 myip 192.168.0.3
tcp_outgoing_address 192.168.0.4 ip3
acl ip4 myip 192.168.0.4
tcp_outgoing_address 192.168.0.4 ip4
acl ip5 myip 192.168.0.5
tcp_outgoing_address 192.168.0.5 ip5

You can add as many IPs you like, just use the same pattern above.

2.5 Enable Anonymizer (Anonymous Proxy)

Put following lines at the bottom of your squid.conf

request_header_access Allow allow all
request_header_access Authorization allow all
request_header_access WWW-Authenticate allow all
request_header_access Proxy-Authorization allow all
request_header_access Proxy-Authenticate allow all
request_header_access Cache-Control allow all
request_header_access Content-Encoding allow all
request_header_access Content-Length allow all
request_header_access Content-Type allow all
request_header_access Date allow all
request_header_access Expires allow all
request_header_access Host allow all
request_header_access If-Modified-Since allow all
request_header_access Last-Modified allow all
request_header_access Location allow all
request_header_access Pragma allow all
request_header_access Accept allow all
request_header_access Accept-Charset allow all
request_header_access Accept-Encoding allow all
request_header_access Accept-Language allow all
request_header_access Content-Language allow all
request_header_access Mime-Version allow all
request_header_access Retry-After allow all
request_header_access Title allow all
request_header_access Connection allow all
request_header_access Proxy-Connection allow all
request_header_access User-Agent allow all
request_header_access Cookie allow all
request_header_access All deny all

Configuration is finished, save the file.

3 User Management

Now its time to create squid_passwd file, in which we will put our users for authentication using ncsa. For this we need htpasswd command to generate user/pass.

create file to hold username and password

touch /etc/squid/squid_passwd

3.1 Create New User

htpasswd /etc/squid/squid_passwd proxyadmin

Where /etc/squid/squid_passwd is a file, in which all users goes and proxyadmin is a username which will be added with the password given

4 Service Management

Run the squid service and add it up at startup.

service squid start
chkconfig squid on

5 Troubleshooting

5.1 visible_hostname error

If you see visible_hostname error after starting service, then again edit /etc/squid/squid.conf file and give visible_hostname tag with your server hostname.

visible_hostname server1

Your server is ready now and you can use Firefox or IExplorer on your client to check its working. I have used default port 3128 for squid, so put any of the above IP and port to connect. As it connects it will prompt you for user/pass, give the right user/pass and you will start browsing the site. To check the anonymity open http://www.whatsmyipaddress.com. If you have done anything wrong in request_header_access, you proxy can be dedect but if everything is fine. It will just show IP and assume its a direct connection without proxy.

pixelstats trackingpixel]]> http://www.sohailriaz.com/anonymous-proxy-using-squid-3/feed/ 5