HOWTO: Set up a ssh proxy server

Description This will guide you through how to set up a ssh proxy server on ubuntu (tested on Ubuntu 8.10) and connect to it through PuTTY on a windows client machine.

Procedure 1. Deciding what port to use. The first step is to decide what port your connection will run through. The port needs to be open on a client machine so you can connect to your server. In this tutorial, I will use port 443, it is usually open on most machines, and it will make your traffic look like an ordinary HTTPS connection. The default for ssh connections is 22, however it is a good idea to change this for security reasons.

2. Configuring your router. If you have a router you need to configure it to open port 443 (https) Refer to your router manual or search for the model number on line to find out how.

3. Installing the Openssh server. To install the Openssh server, run this command in the terminal:

sudo apt-get install openssh-server

4. Configure the Openssh Server Next you have to configure the server to listen on the right port. Run this command in the terminal to open the configuration file:

sudo gedit /etc/ssh/sshd_config

Look in the file for:

What ports, IPs and protocols we listen for

Port 22

Change this to:

Port 443

or the port of your choosing.

Next, look for:

PermitRootLogin yes

and change it to:

PermitRootLogin no

This increases the security of the server.

5. Generating the keys SSH keys allow authentication between two hosts without the need of a password. SSH key authentication uses two keys a private key and a public key.

To generate the keys, run this command:

ssh-keygen -t dsa

When you are asked where to save them, press enter to use the default. When asked for a password, press enter to skip it.

You then need to move the contents of "id_dsa.pub" to "authorized_keys2" To do this, run the command:

cat ~/.ssh/id_dsa.pub >> ~/.ssh/authorized_keys2

6. Check the permissions of key files. Press Alt+F2 on your keyboard and type:

gksudo nautilus

Change the location to:

/etc/ssh

Now locate the files:

ssh_host_dsa_key, ssh_host_dsa_key.pub, ssh_host_rsa_key, ssh_host_rsa_key.pub

Right click on each file and select "Properties." In the "Permissions" tab, change the owner and group name to your login name. For the owner, make it "Read and write" and for the group, "Read only."

7. Test the server. Run the command:

sudo /etc/init.d/ssh restart

To use the changes you made earlier to the configuration file.

Then run:

sshd -t

If that returns no errors, continue on to the next command:

ssh -p 443 YOUR_IP_ADRESS

If you don't know your ip address, you can find it by going here: http://www.myipaddress.com/show-my-ip-address/

_Using PuTTY_ Notice: It is recommended that use a flash drive.

8. Downloading PuTTY and the key converter. PuTTY is used to connect the client to your ssh server on windows.

Grab putty.exe and puttygen.exe here.

Place it on your flash drive. You will also need the file *id_rsa* that can be located in */home/USERNAME/.ssh* Place that on your flash drive as well.

9. Converting the key Because putty can't use the key generated by Openssh, you need to run it through the converter program.

Open up the converter program and go to File>Load Private Key [IMG]http://linux-sxs.org/images/openssh.putty.0.jpg[/IMG]

Locate the file *id_rsa* (you will need to change the open option to All Files)

Press the "Save private key" button and save it to your flash drive.

10. Configuring PuTTY

_Location: Session_

Field: Host Name Info: Here you enter the ip address of your server.

Field: Port Info: Change this to 443

_Location: Connection>SSH>Auth_ Field: "Private key for authentication" Info: Load the ppk file outputted by the key converter.

_Location: Connection>SSH>Tunnels_

Field: Source Port Info: Put in 443 here.

Then change the radio button from "Local" to "Dynamic." Then press the "Add" button.

Finally, press "Open." When prompted for a username, just type your name in.

This is a bit of a bump on a dead topic, but I'm having a bit of trouble with the tutorial outlined. I'm on Intrepid, and when I get to the "sshd -t" step, I get this error:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0640 for '/etc/ssh/ssh_host_rsa_key' are too open.
It is recommended that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: /etc/ssh/ssh_host_rsa_key
Could not load host key: /etc/ssh/ssh_host_rsa_key
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0640 for '/etc/ssh/ssh_host_dsa_key' are too open.
It is recommended that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: /etc/ssh/ssh_host_dsa_key
Could not load host key: /etc/ssh/ssh_host_dsa_key

If I try to continue after that step, I just get "connection refused" with the next one. Are the permissions set correctly? I followed it to your tutorial...

Apperantly this topic finally found it's way to Google ;)

I tried this, and I got the same error as Karl. I'm running Ubuntu 8.04.2. I'm going to try some things, because the rest of the tutorial is one of the best I found so far.

---- edit: before I changed the permissions I tried sshd -t and it said: me@server:~$ /usr/sbin/sshd -t Could not load host key: /etc/ssh/ssh_host_rsa_key Could not load host key: /etc/ssh/ssh_host_dsa_key

So the default settings arent right as well.

I managed to get past the previous error by chmoding the key files to 600, rather than going through Nautilus. I also chmoded the ~/.ssh folder to 700. sshd -t now returns no errors. However, upon carrying out

ssh -p 443 *<My IP Address>*

I get a connection refused error. Any idea what's up there? (and yes, I have a real IP address in there, I just don't want to publicise it over the Internet :P)

and where is the proxy? because I only see an ssh listen port changed and authentication using private/public keys.