maemo.org - Talk - SOCKS5 Proxy and N800

Here's what I've got in my own personal webpage (not visible to the public at the moment). I'm not familiar with this site's associated Wiki, so I'm putting it here.

Caveats: This glosses over some stuff and is for OS2008. I'm also not sure if it's the best way to force tsocks for everything. What follows amounts basically to notes for myself with enough information to have some public use.

------

The built in browser doesn't have support for using a socks proxy, but you can change that through the use of tsocks.

For a build of tsocks for the armel, see this post:
http://www.internettablettalk.com/fo...31&postcount=8
http://packages.debian.org/lenny/tsocks (direct link)

Just wget and "dpkg -i" it.

------

My tsocks configuration file is as follows:

Quote:

Nokia-N810-50-2:/usr/bin# cat /etc/tsocks.conf
# ip addresses to consider as local (don't forward these)
local = 192.168.0.0/255.255.255.0
local = 10.0.0.0/255.0.0.0

# sample of a specific path to follow for certain routes - left so I don't
# forget it if I need to do this at a future date
# path {
# reaches = 150.0.0.0/255.255.0.0
# reaches = 150.1.0.0:80/255.255.0.0
# server = 10.1.7.25
# server_type = 5
# default_user = delius
# default_pass = hello
#}

# this is the place where my socks proxy is running
# I use openssh's client to provide "dynamic" port forwarding
# ssh -f -N -D9999 myuser@mysshserver
server = 127.0.0.1
server_type = 5 # socks 5
server_port = 9999

Nokia-N810-50-2:/usr/bin#

------

Until I determine a better solution (e.g., a daemon that reacts to dbus connection messages, I think), my SSH client is started manually using the command line. In ~/bin/startSOCKS I have this script:

Quote:

#!/bin/sh

# -f - Go into background (detach) once connection is established.
# - Implies -n (redirect input from /dev/null).
# -N - Do not execute a command. This is good for just forwarding
# - ports.
# -C - Compression. Might have negative impact all around and is
# - "guaranteed" to have negative impact on wifi. Perf benefit
# - over cell yet to be established.
# -D - Start "dynamic forwarding" - SOCKS proxy listening on port 9999
SSH_ARGS='-f -N -C -D9999'

# remove the preload of the tsocks library
LD_PRELOAD=

# try connecting to both servers - eliminate everything
# from the || to the end of the line if you only need one
ssh $SSH_ARGS username1@host1 || ssh $SSH_ARGS username2@host2

Generate and save a private/public key with ssh-keygen. Accept the defaults. Copy the public key to the proper place on the SSH server. See Google for information. If you don't do this, password authentication will be used.

To start SSH I just do:

Quote:

Nokia-N810-50-2:/usr/bin# ~/bin/startSOCKS
Nokia-N810-50-2:/usr/bin#

This will start the SSH client in background mode (it will detach from the terminal) and it should run as long as the connection is still valid.

It is strongly recommended that you don't use password authentication and use public/private keys instead.

------

To test, from the command line try:

* Start SSH tunnel.
* Close all browser windows.
* Type "tsocks browser"
* Go to http://www.whatismyip.com/ to verify IP addresss is that of proxy server.
* Kill SSH tunnel.
* Try going to another website. It shouldn't load.
* Restart SSH tunnel.
* Try going to another website it should load now.
* Rinse, repeat, until satisfied.

From the command line, this is easily done with the links textmode browser:

$ links http://whatismyip.com -dump | grep 'Your IP'
15:13:17 libtsocks(1416): Error 111 attempting to connect to SOCKS server (Connection refused)
15:13:17 libtsocks(1416): Error 111 attempting to connect to SOCKS server (Connection refused)
15:13:17 libtsocks(1416): Error 111 attempting to connect to SOCKS server (Connection refused)
Socket exception
$ ~/bin/startSOCKS
$ links http://whatismyip.com -dump | grep 'Your IP'
Your IP Address Is 10.23.118.37
$ killall ssh
$ links http://whatismyip.com -dump | grep 'Your IP'
15:13:29 libtsocks(1428): Error 111 attempting to connect to SOCKS server (Connection refused)
15:13:29 libtsocks(1428): Error 111 attempting to connect to SOCKS server (Connection refused)
15:13:29 libtsocks(1428): Error 111 attempting to connect to SOCKS server (Connection refused)
Socket exception
$

------

To force tsocks use for (almost all) outgoing network traffic, we need to define the LD_PRELOAD to force the tsocks library to load. Keep in mind this will NOT work for setuid programs when the setuid bit is actually used (ie, if you're not the program's owner). This is a security feature that can't be worked around.

The file to edit is /etc/osso-af-init/af-defines.sh

The comments make it sound like this gets called for pretty much everything that's started. I've already tested it on the browser and the telepathy (IM) stuff.

This will quite possibly cause issues with the VOIP software like gizmo and skype. I haven't tried either yet.

Add to the end this line:

export LD_PRELOAD=/usr/lib/libtsocks.so.1.8

Restart. (Is there a way around restarting?)

Test as above, but without calling "tsocks" explicitly.

It is also possible, apparently, to put it in the /etc/ld.so.preload file, but this has the potential of killing your system if you get it wrong. I'd prefer to not break things by changing that, as I'm not quite sure how to recover without just flashing from scratch.

------

The other option, to just force for the browser, is to move /usr/bin/browser to /usr/bin/browserexec and then make a shell script at /usr/bin/browser with two lines:

Quote:

#!/bin/sh
tsocks /usr/bin/browser

This works for me as well.