Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know how to setup a simple proxy using ssh -D ,but I want to use username and password based authentication for this case. Is there any way?

share|improve this question

ssh -D doesn't require require a password for access, and with the current implementation can't be made to require a password. If you want, you could set up a multi-stage proxy using an exiting http server (e.g. apache) which then uses the ssh tunnel for its outbound connection.

Then again, if you get that far into the weeds, then you're probably going down the wrong road and perhaps may need to re-think what you're trying to accomplish.

share|improve this answer

Dynamic application-level port forwarding (ssh -D) doesn't support this feature. Take a look at the Dante for instead:

[I] net-proxy/dante
     Available versions:  1.1.19-r4 (~)1.2.3 (~)1.3.0 (~)1.3.1 (~)1.3.1-r1 (~)1.3.2 {debug kerberos pam selinux static-libs tcpd}
     Installed versions:  1.3.2(04:14:03 PM 11/08/2011)(pam static-libs tcpd -debug -kerberos -selinux)
     Description:         A free socks4,5 and msproxy implementation

But note that the password is transmitted in cleartext.

To configure username based authentication, open the /etc/sockd.conf file and add/change the following:

logoutput: syslog /var/log/dante.log

# methods for socks-rules.
method: username #rfc931

# when doing something that can require privilege, 
# it will use the userid "sockd".
user.privileged: root

# when running as usual, 
# it will use the unprivileged userid of "sockd".
user.notprivileged: sockd

pass {
    from: to:
    protocol: tcp udp
    command: bind connect udpassociate
    log: error
    method: username

Check the listening sockets after starting:

# netstat -nlp | grep sockd
tcp        0      0*               LISTEN      5463/sockd          
tcp        0      0*               LISTEN      5463/sockd        

Take a look at the logs file (/var/log/messages or /var/log/dante.log) if you get something wrong.

PS: the system password file (/etc/passwd) is used to verify a username and password combination.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.