3 cleaned up grammar and formatting
source | link

This post on unix.se explains how to tunnel SSH over shadowsocks.

This post on sec.se discusses some of the vulnerabilitysvulnerabilities of shadowsocks (namely its vulnerability to brute force).

After reading through the shadowsocks protocol and doing a quick overview of the code base ... it it seems that tunneling SSH over shadowsocks would provide a means of bypassing stateful packet inspection (shadowsocks) while still maintaining a decent level of security (OpenSSH).

EgFor example:

# ~/.bashrc 
export http_proxy=socks5://127.0.0.1:1080 
export https_proxy=socks5://127.0.0.1:1080 
export SOCKS5_PASSWORD=<superstrongpassword>

# ~/.ssh/config 
Host <hostname alias>
 HostName <ip or domain name>
 User <user>
 IdentityFile <path to ssh key>
 ProxyCommand connect -S 127.0.0.1:1080 %h %p

Is this a sound assumption or would using them together like this expose a vulnerability that I missed?

If someone was able to brute force the shadowsocks <superstrongpassword> ... would they have any access to my box beyond just using it as a proxy?

Note: I am also reading through the connect-proxy code now ... ifIf anyone knows of any issues w/with that I would be interested.

This post on unix.se explains how to tunnel SSH over shadowsocks.

This post on sec.se discusses some of the vulnerabilitys of shadowsocks (namely its vulnerability to brute force).

After reading through the shadowsocks protocol and doing a quick overview of the code base ... it seems that tunneling SSH over shadowsocks would provide a means of bypassing stateful packet inspection (shadowsocks) while still maintaining a decent level of security (OpenSSH).

Eg:

# ~/.bashrc 
export http_proxy=socks5://127.0.0.1:1080 
export https_proxy=socks5://127.0.0.1:1080 
export SOCKS5_PASSWORD=<superstrongpassword>

# ~/.ssh/config 
Host <hostname alias>
 HostName <ip or domain name>
 User <user>
 IdentityFile <path to ssh key>
 ProxyCommand connect -S 127.0.0.1:1080 %h %p

Is this a sound assumption or would using them together like this expose a vulnerability that I missed?

If someone was able to brute force the shadowsocks <superstrongpassword> ... would they have any access to my box beyond just using it as a proxy?

Note: also reading through the connect-proxy code now ... if anyone knows of any issues w/ that I would be interested

This post on unix.se explains how to tunnel SSH over shadowsocks.

This post on sec.se discusses some of the vulnerabilities of shadowsocks (namely its vulnerability to brute force).

After reading through the shadowsocks protocol and doing a quick overview of the code base it seems that tunneling SSH over shadowsocks would provide a means of bypassing stateful packet inspection (shadowsocks) while still maintaining a decent level of security (OpenSSH).

For example:

# ~/.bashrc 
export http_proxy=socks5://127.0.0.1:1080 
export https_proxy=socks5://127.0.0.1:1080 
export SOCKS5_PASSWORD=<superstrongpassword>

# ~/.ssh/config 
Host <hostname alias>
 HostName <ip or domain name>
 User <user>
 IdentityFile <path to ssh key>
 ProxyCommand connect -S 127.0.0.1:1080 %h %p

Is this a sound assumption or would using them together like this expose a vulnerability that I missed?

If someone was able to brute force the shadowsocks <superstrongpassword> would they have any access to my box beyond just using it as a proxy?

Note: I am also reading through the connect-proxy code now. If anyone knows of any issues with that I would be interested.

2 added 176 characters in body
source | link

This post on unix.se explains how to tunnel SSH over shadowsocks.

This post on sec.se discusses some of the vulnerabilitys of shadowsocks (namely its vulnerability to brute force).

After reading through the shadowsocks protocol and doing a quick overview of the code base ... it seems that tunneling SSH over shadowsocks would provide a means of bypassing stateful packet inspection (shadowsocks) while still maintaining a decent level of security (OpenSSH).

Eg:

# ~/.bashrc 
export http_proxy=socks5://127.0.0.1:1080 
export https_proxy=socks5://127.0.0.1:1080 
export SOCKS5_PASSWORD=<superstrongpassword>

# ~/.ssh/config 
Host <hostname alias>
 HostName <ip or domain name>
 User <user>
 IdentityFile <path to ssh key>
 ProxyCommand connect -S 127.0.0.1:1080 %h %p

Is this a sound assumption or would using them together like this expose a vulnerability that I missed?

If someone was able to brute force the shadowsocks <superstrongpassword> ... would they have any access to my box beyond just using it as a proxy?

Note: also reading through the connect-proxy code now ... if anyone knows of any issues w/ that I would be interested

This post on unix.se explains how to tunnel SSH over shadowsocks.

This post on sec.se discusses some of the vulnerabilitys of shadowsocks (namely its vulnerability to brute force).

After reading through the shadowsocks protocol and doing a quick overview of the code base ... it seems that tunneling SSH over shadowsocks would provide a means of bypassing stateful packet inspection (shadowsocks) while still maintaining a decent level of security (OpenSSH).

Eg:

# ~/.bashrc 
export http_proxy=socks5://127.0.0.1:1080 
export https_proxy=socks5://127.0.0.1:1080 
export SOCKS5_PASSWORD=<superstrongpassword>

# ~/.ssh/config 
Host <hostname alias>
 HostName <ip or domain name>
 User <user>
 IdentityFile <path to ssh key>
 ProxyCommand connect -S 127.0.0.1:1080 %h %p

Is this a sound assumption or would using them together like this expose a vulnerability that I missed?

If someone was able to brute force the shadowsocks <superstrongpassword> ... would they have any access to my box beyond just using it as a proxy?

This post on unix.se explains how to tunnel SSH over shadowsocks.

This post on sec.se discusses some of the vulnerabilitys of shadowsocks (namely its vulnerability to brute force).

After reading through the shadowsocks protocol and doing a quick overview of the code base ... it seems that tunneling SSH over shadowsocks would provide a means of bypassing stateful packet inspection (shadowsocks) while still maintaining a decent level of security (OpenSSH).

Eg:

# ~/.bashrc 
export http_proxy=socks5://127.0.0.1:1080 
export https_proxy=socks5://127.0.0.1:1080 
export SOCKS5_PASSWORD=<superstrongpassword>

# ~/.ssh/config 
Host <hostname alias>
 HostName <ip or domain name>
 User <user>
 IdentityFile <path to ssh key>
 ProxyCommand connect -S 127.0.0.1:1080 %h %p

Is this a sound assumption or would using them together like this expose a vulnerability that I missed?

If someone was able to brute force the shadowsocks <superstrongpassword> ... would they have any access to my box beyond just using it as a proxy?

Note: also reading through the connect-proxy code now ... if anyone knows of any issues w/ that I would be interested

1
source | link

Tunneling SSH over Shadowsocks

This post on unix.se explains how to tunnel SSH over shadowsocks.

This post on sec.se discusses some of the vulnerabilitys of shadowsocks (namely its vulnerability to brute force).

After reading through the shadowsocks protocol and doing a quick overview of the code base ... it seems that tunneling SSH over shadowsocks would provide a means of bypassing stateful packet inspection (shadowsocks) while still maintaining a decent level of security (OpenSSH).

Eg:

# ~/.bashrc 
export http_proxy=socks5://127.0.0.1:1080 
export https_proxy=socks5://127.0.0.1:1080 
export SOCKS5_PASSWORD=<superstrongpassword>

# ~/.ssh/config 
Host <hostname alias>
 HostName <ip or domain name>
 User <user>
 IdentityFile <path to ssh key>
 ProxyCommand connect -S 127.0.0.1:1080 %h %p

Is this a sound assumption or would using them together like this expose a vulnerability that I missed?

If someone was able to brute force the shadowsocks <superstrongpassword> ... would they have any access to my box beyond just using it as a proxy?