Puoi riprodurlo impostando il port forwarding dinamico SSH:
man ssh:
-D [bind_address:]port
Specifies a local “dynamic” application-level port forwarding. This works by allocating a socket
to listen to port on the local side, optionally bound to the specified bind_address. Whenever a
connection is made to this port, the connection is forwarded over the secure channel, and the
application protocol is then used to determine where to connect to from the remote machine. Cur‐
rently the SOCKS4 and SOCKS5 protocols are supported, and ssh will act as a SOCKS server. Only
root can forward privileged ports. Dynamic port forwardings can also be specified in the configu‐
ration file.
IPv6 addresses can be specified by enclosing the address in square brackets. Only the superuser
can forward privileged ports. By default, the local port is bound in accordance with the
GatewayPorts setting. However, an explicit bind_address may be used to bind the connection to a
specific address. The bind_address of “localhost” indicates that the listening port be bound for
local use only, while an empty address or ‘*’ indicates that the port should be available from all
interfaces.
Avviare un proxy SOCKS su localhost, porta 2302:
$ ssh -v -ND 2302 user@host
Per instradare il traffico HTTP tramite questo tunnel, in Firefox:
Modifica -> Preferenze -> Avanzate -> scheda Rete -> Impostazioni -> Configurazione proxy manuale -> Host SOCKS: localhost e porta: 2302
Per utilizzare il proxy SOCKS con altro traffico, è possibile utilizzare un programma socksifier come tsocks:
[I] net-proxy/tsocks
Available versions: 1.8_beta5-r3 ~1.8_beta5-r4 1.8_beta5-r5 ~1.8_beta5-r6 {tordns}
Installed versions: 1.8_beta5-r5(10:08:28 AM 06/15/2010)(-tordns)
Homepage: http://tsocks.sourceforge.net/
Description: Transparent SOCKS v4 proxying library
Sul mio Gentoo, modifica /etc/socks/tsocks.confcome belows:
# Otherwise we use the server
server = 127.0.0.1
server_port = 2302
test:
$ tsocks telnet 255.255.255.255 25
Vedrai qualcosa del genere nel /var/log/secureserver SSH:
sshd[28491]: error: connect_to 255.255.255.255 port 25: failed.
La parte che non capisco è chi sta esattamente cercando di connettersi a quegli indirizzi
Per restringere il campo, dai un'occhiata a /var/log/secure( auth.logsulla tua distribuzione) ed esamina chi ha effettuato l'accesso prima di questo:
sshd[26898]: pam_unix(sshd:session): session opened for user quanta