先日､CentOS 7にGhettoForge repositoryからSOCKS Proxy server Danteをインストールしました｡
Dante – A free SOCKS server
https://www.inet.no/dante/
Install SOCKS proxy server(Dante) on CentOS 7 with GhettoForge repo
このDanteにPAM認証を設定してみました｡
PAM Authentication
https://www.inet.no/dante/doc/1.4.x/config/auth_pam.html
- /etc/pam.d/sockdの作成
- /etc/sockd.confの設定
- sockdの再起動
/etc/pam.d/sockdを作成しますが/etc/pam.d/sshdをそのまま流用します｡
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
# cp /etc/pam.d/sshd /etc/pam.d/sockd # cat /etc/pam.d/sockd #%PAM-1.0 auth required pam_sepermit.so auth substack password-auth auth include postlogin # Used with polkit to reauthorize users in remote sessions -auth optional pam_reauthorize.so prepare account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth session include postlogin # Used with polkit to reauthorize users in remote sessions -session optional pam_reauthorize.so prepare |
/etc/sockd.confにPAM認証の設定を行います｡
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
logoutput: /var/log/sockd.log internal: eno16777736 port = 1080 external: eno16777736 clientmethod: none socksmethod: pam.username user.privileged: root user.unprivileged: sockd client pass { from: 192.168.1.0/24 port 1-65535 to: 0.0.0.0/0 log: error connect disconnect } socks pass { from: 192.168.1.0/24 to: 0.0.0.0/0 protocol: tcp udp log: error connect disconnect } |
|
1 |
# systemctl restart sockd |
- Tera Term
- MobaXterm
SOCKS Proxy設定はユーザー名､パスワード共に設定しないと接続できませんでした｡パスワードは後で入力できればいいのですが｡
MobaXtermではユーザー名だけの設定で接続時にSOCKSサーバの認証パスワードに入力が必要になります｡
ログにも記録されていました｡
|
1 2 3 4 |
Jun 20 21:36:21 (1498048581.213332) sockd[9325]: info: pass(1): tcp/accept [: 192.168.1.2.63242 192.168.1.1.1080 Jun 20 21:36:21 (1498048581.245482) sockd[9342]: info: pass(1): tcp/connect [: pam.username%guest01@192.168.1.2.63242 192.168.1.1.1080 -> 192.168.1.1.63242 192.168.1.254.22 Jun 20 21:36:26 (1498048586.422677) sockd[9342]: info: pass(1): tcp/connect ]: 6787 -> pam.username%guest01@192.168.10.2.63242 192.168.1.1.1080 -> 4320, 4320 -> 192.168.1.1.63242 192.168.1.254.22 -> 6787: local client closed. Session duration: 5s Jun 20 21:36:26 (1498048586.422733) sockd[9342]: info: pass(1): tcp/accept ]: 6787 -> 192.168.10.2.63242 192.168.1.1.1080 -> 4320: local client closed. Session duration: 5s |
WebブラウザではこのSOCKSの認証機能が無いので繋がりません｡別途拡張機能などを利用すれば出来そうですが｡