Git clone over ssh socks proxy

This is useful for a machine that needs to clone some repository from github, but does not having internet connection.

First, we must identify another machine that can access github.com, we can call this server proxy-server.

Then, establish a socks proxy from our no-internet-server

$ ssh -qN -D 1234 proxy-server

The above command will create a socks proxy at localhost port 1234

Use the git command with socks proxy. Let's say we want to clone the 30-seconds-of-code repository, run below command in a new shell

$ git -c http-proxy=socks5h://localhost:1234 clone https://github.com/30-seconds/30-seconds-of-code

Once done, press ctrl-c in the first shell, to terminate the socks proxy

Using yum through socks5 proxy

This is useful when you have a server that is not allowed to go to the internet, but have an ssh connection to another server that is able to go to the internet (we can call it jumphost).

1. Setup a socks proxy on port 8888 (any port will do, 8888 is just my preference) via the jumphost

# ssh -D 8888 -fN user@jumphost

2. Append below line into yum.conf

# cat  >> /etc/yum.conf <<EOF

proxy=socks5h://localhost:8888

EOF

3. Yum away (or run the yum command). All yum command will now tunneled through jumphost

# yum update

4. Once done, kill the socks proxy connection

# kill -9 $(ps -ef | grep fN | grep -v grep | awk '{print $2}')

5. And remove the proxy setting in /etc/yum.conf

# sed -i '$d' /etc/yum.conf

Using socks proxy to tunnel apt command in ubuntu 18.04

This is useful when we have a machine (m1) that does not have an internet connection to do apt update/upgrade, but we have another machine (m2) that is able to access internet, and accessible via ssh from the m1.

Create a dynamic tunnel (socks5 proxy) from m1 to m2, using port 8888
$ ssh myuser@m2 -fN -D 8888

Set apt to use the socks proxy created above
$ echo "Acquire::http::proxy "socks5h://localhost:8888";"  | sudo tee -a /etc/apt/apt.conf.d/12proxy

Run apt command as usual in m1, and your apt command will be tunneled via the socks5h proxy
$ sudo apt update
...
0% [Connecting to SOCKS5h proxy (socks5h://localhost:8888)] [Connecting to SOCKS5h proxy (socks5h://localhost:8888)]

...

Once you are done, do not forget to kill the tunnel

$ kill `pidof ssh`

and remove the proxy option from apt
$ sudo sed -i 's/Acquire/#Acquire/' /etc/apt/apt.conf.d/12proxy 

Using tsocks with apt to bypass proxy

Recently, I encountered an error while trying to update ubuntu server 16.04. The error is as below:

E: Failed to fetch http://my.archive.ubuntu.com/ubuntu/dists/xenial/InRelease  Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)

It seems there is a proxy somewhere in the network, that I do not know. Asking around, even the owner of the server does not even know any proxy server inside their network. So, what I did was, create a socks proxy on my own, to a server outside of the network, and tunnel the apt connection using an application called tsocks.

First, you need to install tsocks. This is a bit tricky since we cannot use the apt command to download and install it from the internet. So I downloaded the deb file, using wget.

$ wget -c http://archive.ubuntu.com/ubuntu/pool/universe/t/tsocks/tsocks_1.8beta5-9.3_amd64.deb

Once downloaded, install using apt on the local file.

$ sudo apt install ./tsocks*.deb

Once installed, create a socks proxy to a server outside of the network, on localhost port 8888 (this is just my favorite number for socks proxy, you can use any number above 1000). You need to be able to ssh to the outside server for this to be possible.

$ ssh foo@server.outside -D 8888

Change the tsocks config file, to suite your new socks proxy

$ sudo cat /etc/tsocks.conf

# You just need to change these 3 lines

server = 127.0.0.1

server_type = 5

server_port = 8888

$ sudo -i 

# tsocks apt update

# tsocks apt upgrade

P/S: You can also set an environment variable called http_proxy, if you do not want to install tsocks, but this setting will be only active on your current bash session. This can be accomplished by:

# export http_proxy='socks5://localhost:8888'

# apt update && apt upgrade

Using yum via socks proxy using proxychains

This is useful when you have a CentOS/Redhat server that needs to be updated, but does not have internet connection to get app from the repo. The only requirement is that the server need to be able to ssh into another server that have internet connection. Let's begin.

Download source for proxychain. You can use the server that have internet connection to do this
# wget -c https://github.com/rofl0r/proxychains-ng/archive/master.zip

Transfer the downloaded file into the server without internet, and unzip the file into /usr/local/src
# unzip master.zip -d /usr/local/src

Change directory to /usr/local/src/proxychains-ng-master
# cd /usr/local/src/proxychains-ng-master

Compile, configure and make
# ./configure && make && make install && make install-config

Setup a dynamic socks proxy on port 8888 by ssh'ing into the server that has internet connection:
# ssh foo@server.with.internet -D 8888

Set proxychains to use the dynamic tunnel, by changing the last line of /usr/local/etc/proxychains.conf to "socks4 127.0.0.1 8888"
# tail -1 /usr/local/etc/proxychains.conf 
socks4  127.0.0.1 8888

Open a new terminal, and run yum command with proxychains. You can see that your yum is tunneled via localhost port 8888:
# proxychains4 yum update
[proxychains] config file found: /usr/local/etc/proxychains.conf
[proxychains] preloading /usr/local/lib/libproxychains4.so
[proxychains] DLL init: proxychains-ng 4.12
...

Use apt-get through http proxy

This issue happened when one day, my lovely company decided that they want to implement a proxy server, and without me realizing, not just browser will be affected, apt-get also will be affected.

How do you know that you apt-get command encounter proxy issue, when ypu received "401 authenticationrequired" error after running your apt-get command, like below:

$ sudo apt-get update
...
W: Failed to fetch http://my.archive.ubuntu.com/ubuntu/dists/raring-updates/universe/binary-i386/Packages  401  authenticationrequired
...

How to encounter this?

Method 1 (if you have GUI)

1. Simply open your browser, and the proxy will ask for authentication
2. Fill up your authentication.
3. Rerun your apt-get command

Method 2 (if you have GUI)

1. Go to System -> preferences -> Network Proxy
2. Under Proxy Configuration, put in you proxy details
3. Rerun apt-get

Method 3 (without GUI) - temporary proxy session

1. export the http_proxy environment variable using this command:

   $ sudo export http_proxy='http://myusername:mypassword@myproxyaddress:myproxyport'

2. Rerun apt-get

Method 4 (without GUI) - temporary proxy session

1. run the apt-get command with proxy in one line:

   $ sudo bash -c 'http_proxy="http://myusername:mypassword@myproxyaddress:myproxyport/" apt-get update'

Method 5 (without GUI) - permanent proxy setting on .bashrc

1. Put the settings into .bashrc:

   $ echo "http_proxy='http://myusername:mypassword@myproxyaddress:myproxyport'" >> .bashrc

2. Activate the change:

   $ source .bashrc

3. Rerun apt-get

Method 6 (without GUI) - permanent settings on apt.conf ~ need sudo

1. Append your proxy settings to /etc/apt/apt.conf (choose your proxy, either http, https, ftp, or socks:

   $ sudo echo -e 'Acquire::http::proxy "http://myusername:mypassword@myproxyaddress:myproxyport/";\nAcquire::https::proxy "https://myusername:mypassword@myproxyaddress:myproxyport/";\nAcquire::ftp::proxy "ftp://myusername:mypassword@myproxyaddress:myproxyport/";\nAcquire::socks::proxy "socks://myusername:mypassword@myproxyaddress:myproxyport/";' >> /etc/apt/apt.conf

2. Rerun apt

You can refer to here, on how to determine your proxy ip address and port using curl.

ssh through socks proxy

This technique is very useful if you have a firewall between you and your destination, and somehow the only way you could get in to the destination is by ssh'ing into a jumpbox and ssh again to the destination. In this scenario example, I'll call the machine we initiate this technique as A.local, the jumpbox as B.local and the destination server as C.local, and we will use a user called aladdin.

A.local -> B.local (jumpbox) -> C.local

To do this, please follow below steps:

Add below settings to your ssh config in A.local, the file is usually ~/.ssh/config

Host B.local 

DynamicForward localhost:1080 

Host C.local 

ProxyCommand /usr/bin/nc -x localhost:1080 %h %p

Initiate a socks proxy connection, and leave it open (-D is for dunamic application-level port forwarding and 1080 can be any port of your choice, 1080 is socks proxy default port for nc):

[A.local]$ ssh -D 1080 aladdin@B.local

Open another terminal, and run ssh as if you have direct connection to C.local

[A.local]$ ssh aladdin@C.local

Voila, your ssh session will go through as if you have direct connection to C.local.


If you just doesn't want to put it into your config, you can use it on the fly by using below command after you have initiate the socks proxy:

[A.local]$ ssh -o "ProxyCommand /usr/bin/nc -x localhost:1080 %h %p" aladdin@C.local

Or you can also put it as alias for easy usage:

[A.local]$ alias 

alias proxyssh='ssh -o "ProxyCommand /usr/bin/nc -x localhost:1080 %h %p"'