Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The new Firefox extension Firesheep highlights the fact that HTTP login sessions can be easily hijacked if the data can be sniffed, which is trivial on an open WiFi network.

I would like to set up something to mitigate this risk for my family. I have a small VPS (256M, currently running lighttpd and SpamAssassin) which I can leverage for this purpose, the basic idea being that when we are using an untrusted network, traffic (at least HTTP) goes over an encrypted tunnel to the VPS before being released onto the open internet.

What are my options given these resources? The clients are all Macs, if that matters. The possibilities I'm aware of are OpenVPN (the key issue being that in the tunnel-all-traffic configuration, it destroys the route to the open network's DHCP server) and an HTTP proxy (of which I know nothing). Are there other options? What considerations and gotchas should I be aware of?

I'd like something on the clients that is easy to just turn on (I am a technical person but the rest of my family is not), and that works for all websites regardless of whether they support HTTPS.

share|improve this question
add comment

5 Answers

How about running HTTPS?

share|improve this answer
    
Thanks; it needs to work for all websites, even those that don't support HTTPS. Question clarified. –  Reid Oct 26 '10 at 19:09
    
If the clients are mainly Windows based, then PPTP may be easier and lighter. It may not past the "high security" muster, but it will keeps things secure outside of an organized attack/compromise. –  user48838 Oct 26 '10 at 21:39
add comment

sshuttle has better performance than SSH's own SOCKS proxy and requires far less configuration. Simply copy it to each Mac and run ./sshuttle -r user@sshserver 0.0.0.0/0 (as documented in README.md) before accessing the web.

It only tunnels TCP traffic, so DNS and DHCP still happen on the local network.

share|improve this answer
add comment

configure a saved putty session with ssh tunnelling enabled to your vps with localhost:8000 (or whatever) forwarding dynamically.

install proxybutton extension on firefox and configure your proxy for localhost:8000 (or whatever).

set them up two firefox shortcuts "firefox.exe -proxy 0" and another one which is a batch file containing the commands "putty.exe -load "saved session name"" and then "firefox -proxy 1"

firefox shortcut #1 is for secured networks, and behaves in the standard manner. #2 is for unsecured networks, and all traffic is routed through your encrypted ssh tunnel before being unencrypted at your VPS and becoming plain http traffic between your VPS and the webserver.

With this method, they will have to authenticate to your VPS in order for it to actually work. You can make the authentication automated with keys, but this presents it's own risks when you cannot guarantee the security of the endpoints.

Alternatively, you could set up something like OpenVPN. I'm not sure how your hosting provider would feel about that or even if it would be allowed, though.

share|improve this answer
add comment

If you are on GNU Linux/other *nix with the Openssh client installed,
Open a Terminal and run :

ssh -D 8080 -p YOURSSHPORT [-i optionalkeyfile] username@your_VPS_DomainName

if you're not using rsa/dsa keys and your ssh port is the default 22, this would work:

ssh -D 8080 username@myvps.com

Then in your browser,

eg Firefox, Preferences>Advanced>Network>Connection-Settings button>

  1. Choose Manual Proxy configuration.
  2. Enter 127.0.0.1 as the SOCKS HOST.
  3. Enter 8080 as the port number (You can use any free unused port on your Desktop/laptop)
  4. Press OK.

You're ready to tunnel all traffic over your local 8080 port through to your VPS's WAN link.

Additionally, to Tunnel DNS queries through your VPS as well (highly recommended):

  1. Open a new Tab in Firefox.
  2. Visit the about:config page
  3. Change the value of network.proxy.socks_remote_dns to true.

Above is my QuickGun solution to a secure tunnel using OpenSSH. Hope this helps.

share|improve this answer
add comment
up vote 0 down vote accepted

I ended up setting up OpenVPN with Tunnelblick on the clients. We'll see how well it holds up in practice.

share|improve this answer
    
This seems to more or less work. On some networks the connection is unreliable and must be restarted. I don't know if this is the VPN's fault or if the WiFi is just crappy. –  Reid Jan 19 '11 at 18:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.