This post on sec.se discusses some of the vulnerabilities of shadowsocks (namely its vulnerability to brute force).
After reading through the shadowsocks protocol and doing a quick overview of the code base it seems that tunneling SSH over shadowsocks would provide a means of bypassing stateful packet inspection (shadowsocks) while still maintaining a decent level of security (OpenSSH).
# ~/.bashrc export http_proxy=socks5://127.0.0.1:1080 export https_proxy=socks5://127.0.0.1:1080 export SOCKS5_PASSWORD=<superstrongpassword> # ~/.ssh/config Host <hostname alias> HostName <ip or domain name> User <user> IdentityFile <path to ssh key> ProxyCommand connect -S 127.0.0.1:1080 %h %p
Is this a sound assumption or would using them together like this expose a vulnerability that I missed?
If someone was able to brute force the shadowsocks
<superstrongpassword> would they have any access to my box beyond just using it as a proxy?
Note: I am also reading through the connect-proxy code now. If anyone knows of any issues with that I would be interested.