Rocky Linux 9에 Dante SOCKS Proxy 서버 설치 및 설정 방법

Rocky Linux 9에 SOCKS5 Proxy 서버를 구축하기 위해 Dante-1.4.3 패키지를 소스 컴파일 설치 후 로그와 프록시 설정 및 서비스 등록까지 전체 과정을 알아보고, 실습을 통해 쉽게 Proxy 서버를 설치하여 사용할 수 있습니다.

SOCKS5 프로토콜을 사용하여 로컬 사용자 계정 및 LDAP 계정으로 프록시 서버에 로그인 인증 후 다른 리눅스 서버에 SSH 접속할 수 있도록 SSH Proxy 서버를 구성해보겠습니다.

일종의 게이트 서버로 볼 수 있는데요. 사용자는 프록시 서버에 로그인하고, 프록시 서버 IP로 다른 리눅스 서버에 SSH로 로그인할 수 있습니다.

PC에서 SOCKS5 Proxy 서버로 TCP 1080 포트 접속 허용 정책을 생성하고, 접속이 필요한 리눅스 서버에서는 SOCKS5 Proxy 서버에서만 SSH 접속이 가능하도록 방화벽 정책을 적용하면 되므로, 방화벽 정책이 간소화됩니다.

실습 환경

• 운영 체제 : Rocky Linux 9.2
• 로그인 계정 : root
• SSH 접속 및 외부 인터넷이 가능한 네트워크 구성
• 리눅스 firewalld 및 iptables 방화벽 비활성화

설치 전 요구 사항

dante proxy서버를 컴파일 설치하기 위해 리눅스 패키지 매니저(yum)을 사용하여 gcc와 make 패키지를 설치합니다.

그리고 Dante SOCKS Proxy 소스 파일을 다운받기 위해 wget 패키지와 SOCKS Proxy 서비스에서 PAM 모듈 인증을 사용하기 위해 pam-devel 패키지를 설치합니다.

yum -y install gcc make wget pam-devel

실행 결과

---

Last metadata expiration check: 0:05:04 ago on Thu 16 Nov 2023 01:39:18 PM KST. Dependencies resolved. ==================================================================================================================================================================================================================================== Package Architecture Version Repository Size ==================================================================================================================================================================================================================================== Installing: gcc x86_64 11.3.1-4.3.el9 appstream 32 M make x86_64 1:4.3-7.el9 baseos 530 k pam-devel x86_64 1.5.1-14.el9 appstream 140 k wget x86_64 1.21.1-7.el9 appstream 769 k Installing dependencies: binutils x86_64 2.35.2-37.el9 baseos 4.5 M binutils-gold x86_64 2.35.2-37.el9 baseos 731 k cpp x86_64 11.3.1-4.3.el9 appstream 11 M elfutils-debuginfod-client x86_64 0.188-3.el9 baseos 37 k glibc-devel x86_64 2.34-60.el9_2.7 appstream 46 k glibc-headers x86_64 2.34-60.el9_2.7 appstream 446 k kernel-headers x86_64 5.14.0-284.30.1.el9_2 appstream 4.8 M libmpc x86_64 1.2.1-4.el9 appstream 61 k libpkgconf x86_64 1.7.3-10.el9 baseos 35 k libxcrypt-devel x86_64 4.4.18-3.el9 appstream 28 k pkgconf x86_64 1.7.3-10.el9 baseos 40 k pkgconf-m4 noarch 1.7.3-10.el9 baseos 14 k pkgconf-pkg-config x86_64 1.7.3-10.el9 baseos 10 k Transaction Summary ==================================================================================================================================================================================================================================== Install 17 Packages Total download size: 55 M Installed size: 153 M Downloading Packages: (1/17): pkgconf-pkg-config-1.7.3-10.el9.x86_64.rpm 42 kB/s | 10 kB 00:00 (2/17): pkgconf-m4-1.7.3-10.el9.noarch.rpm 1.5 MB/s | 14 kB 00:00 (3/17): pkgconf-1.7.3-10.el9.x86_64.rpm 4.3 MB/s | 40 kB 00:00 (4/17): libpkgconf-1.7.3-10.el9.x86_64.rpm 3.0 MB/s | 35 kB 00:00 (5/17): binutils-gold-2.35.2-37.el9.x86_64.rpm 2.5 MB/s | 731 kB 00:00 (6/17): elfutils-debuginfod-client-0.188-3.el9.x86_64.rpm 2.1 MB/s | 37 kB 00:00 (7/17): libmpc-1.2.1-4.el9.x86_64.rpm 4.6 MB/s | 61 kB 00:00 (8/17): make-4.3-7.el9.x86_64.rpm 19 MB/s | 530 kB 00:00 (9/17): libxcrypt-devel-4.4.18-3.el9.x86_64.rpm 1.9 MB/s | 28 kB 00:00 (10/17): binutils-2.35.2-37.el9.x86_64.rpm 12 MB/s | 4.5 MB 00:00 (11/17): wget-1.21.1-7.el9.x86_64.rpm 9.2 MB/s | 769 kB 00:00 (12/17): pam-devel-1.5.1-14.el9.x86_64.rpm 4.7 MB/s | 140 kB 00:00 (13/17): kernel-headers-5.14.0-284.30.1.el9_2.x86_64.rpm 26 MB/s | 4.8 MB 00:00 (14/17): glibc-headers-2.34-60.el9_2.7.x86_64.rpm 11 MB/s | 446 kB 00:00 (15/17): glibc-devel-2.34-60.el9_2.7.x86_64.rpm 1.7 MB/s | 46 kB 00:00 (16/17): cpp-11.3.1-4.3.el9.x86_64.rpm 33 MB/s | 11 MB 00:00 (17/17): gcc-11.3.1-4.3.el9.x86_64.rpm 44 MB/s | 32 MB 00:00 ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Total 25 MB/s | 55 MB 00:02 Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Installing : libmpc-1.2.1-4.el9.x86_64 1/17 Installing : elfutils-debuginfod-client-0.188-3.el9.x86_64 2/17 Installing : binutils-2.35.2-37.el9.x86_64 3/17 Running scriptlet: binutils-2.35.2-37.el9.x86_64 3/17 Installing : binutils-gold-2.35.2-37.el9.x86_64 4/17 Installing : cpp-11.3.1-4.3.el9.x86_64 5/17 Installing : glibc-headers-2.34-60.el9_2.7.x86_64 6/17 Installing : kernel-headers-5.14.0-284.30.1.el9_2.x86_64 7/17 Installing : make-1:4.3-7.el9.x86_64 8/17 Installing : libpkgconf-1.7.3-10.el9.x86_64 9/17 Installing : pkgconf-1.7.3-10.el9.x86_64 10/17 Installing : pkgconf-m4-1.7.3-10.el9.noarch 11/17 Installing : pkgconf-pkg-config-1.7.3-10.el9.x86_64 12/17 Installing : glibc-devel-2.34-60.el9_2.7.x86_64 13/17 Installing : libxcrypt-devel-4.4.18-3.el9.x86_64 14/17 Installing : gcc-11.3.1-4.3.el9.x86_64 15/17 Installing : pam-devel-1.5.1-14.el9.x86_64 16/17 Installing : wget-1.21.1-7.el9.x86_64 17/17 Running scriptlet: wget-1.21.1-7.el9.x86_64 17/17 Verifying : binutils-gold-2.35.2-37.el9.x86_64 1/17 Verifying : binutils-2.35.2-37.el9.x86_64 2/17 Verifying : pkgconf-pkg-config-1.7.3-10.el9.x86_64 3/17 Verifying : pkgconf-m4-1.7.3-10.el9.noarch 4/17 Verifying : pkgconf-1.7.3-10.el9.x86_64 5/17 Verifying : libpkgconf-1.7.3-10.el9.x86_64 6/17 Verifying : elfutils-debuginfod-client-0.188-3.el9.x86_64 7/17 Verifying : make-1:4.3-7.el9.x86_64 8/17 Verifying : libmpc-1.2.1-4.el9.x86_64 9/17 Verifying : libxcrypt-devel-4.4.18-3.el9.x86_64 10/17 Verifying : wget-1.21.1-7.el9.x86_64 11/17 Verifying : kernel-headers-5.14.0-284.30.1.el9_2.x86_64 12/17 Verifying : pam-devel-1.5.1-14.el9.x86_64 13/17 Verifying : gcc-11.3.1-4.3.el9.x86_64 14/17 Verifying : cpp-11.3.1-4.3.el9.x86_64 15/17 Verifying : glibc-headers-2.34-60.el9_2.7.x86_64 16/17 Verifying : glibc-devel-2.34-60.el9_2.7.x86_64 17/17 Installed: binutils-2.35.2-37.el9.x86_64 binutils-gold-2.35.2-37.el9.x86_64 cpp-11.3.1-4.3.el9.x86_64 elfutils-debuginfod-client-0.188-3.el9.x86_64 gcc-11.3.1-4.3.el9.x86_64 glibc-devel-2.34-60.el9_2.7.x86_64 glibc-headers-2.34-60.el9_2.7.x86_64 kernel-headers-5.14.0-284.30.1.el9_2.x86_64 libmpc-1.2.1-4.el9.x86_64 libpkgconf-1.7.3-10.el9.x86_64 libxcrypt-devel-4.4.18-3.el9.x86_64 make-1:4.3-7.el9.x86_64 pam-devel-1.5.1-14.el9.x86_64 pkgconf-1.7.3-10.el9.x86_64 pkgconf-m4-1.7.3-10.el9.noarch pkgconf-pkg-config-1.7.3-10.el9.x86_64 wget-1.21.1-7.el9.x86_64 Complete!

Dante SOCKS Proxy 서버 설치하기

아래 명령어들을 통해 /usr/local/src 디렉터리에 소스 파일을 다운로드하고, 컴파일하여 설치합니다.

cd /usr/local/src

wget https://www.inet.no/dante/files/dante-1.4.3.tar.gz

tar -zxvf dante-1.4.3.tar.gz

cd dante-1.4.3

소스 코드를 컴파일하기 전에 컴파일 환경을 검사하고, 소스 코드를 빌드하기 위한 Makefile을 생성합니다.

./configure

실행 결과

---

Configuring Dante 1.4.3: checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /usr/bin/mkdir -p checking for gawk... gawk checking whether make sets $(MAKE)... yes checking whether make supports nested variables... yes checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking how to print strings... printf checking for style of include used by make... GNU checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking dependency style of gcc... gcc3 checking for a sed that does not truncate output... /usr/bin/sed checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for fgrep... /usr/bin/grep -F checking for ld used by gcc... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B checking the name lister (/usr/bin/nm -B) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 1572864 checking whether the shell understands some XSI constructs... yes checking whether the shell understands "+="... yes checking how to convert x86_64-unknown-linux-gnu file names to x86_64-unknown-linux-gnu format... func_convert_file_noop checking how to convert x86_64-unknown-linux-gnu file names to toolchain format... func_convert_file_noop checking for /usr/bin/ld option to reload object files... -r checking for objdump... objdump checking how to recognize dependent libraries... pass_all checking for dlltool... no checking how to associate runtime and link libraries... printf %s\n checking for ar... ar checking for archiver @FILE support... @ checking for strip... strip checking for ranlib... ranlib checking command to parse /usr/bin/nm -B output from gcc object... ok checking for sysroot... no checking for mt... no checking if : is a manifest tool... no checking how to run the C preprocessor... gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes ...(중략) checking that generated files are newer than configure... done configure: creating ./config.status config.status: creating bin/socksify config.status: creating capi/socks.h config.status: creating sockd/Makefile config.status: creating include/Makefile config.status: creating lib/Makefile config.status: creating dlib/Makefile config.status: creating Makefile config.status: creating example/Makefile config.status: creating doc/Makefile config.status: creating bin/Makefile config.status: creating capi/Makefile config.status: creating SPECS/Makefile config.status: creating SPECS/dante.spec config.status: creating libscompat/Makefile config.status: creating contrib/Makefile config.status: creating unlicensed/Makefile config.status: creating VERSION config.status: creating dlib64/Makefile config.status: creating include/autoconf.h config.status: linking unlicensed/bandwidth.c to sockd/bandwidth.c config.status: linking unlicensed/bandwidth_key.c to sockd/bandwidth_key.c config.status: linking unlicensed/redirect.c to sockd/redirect.c config.status: linking unlicensed/redirect_key.c to sockd/redirect_key.c config.status: linking unlicensed/ldap.c to sockd/ldap.c config.status: linking unlicensed/ldap_key.c to sockd/ldap_key.c config.status: linking unlicensed/pac.c to sockd/pac.c config.status: linking unlicensed/pac_key.c to sockd/pac_key.c config.status: linking unlicensed/checkmodule.c to sockd/checkmodule.c config.status: linking unlicensed/convert_sid.c to bin/convert_sid.c config.status: executing depfiles commands config.status: executing libtool commands Configure status: Client: Enabled Server: Enabled Preloading: Enabled Libwrap: Disabled, tcpd.h missing BSD Auth: Disabled, usable bsd_auth.h not found PAM: Enabled GSSAPI: Not found/disabled KRB5: Not found/disabled SASL: Not found/disabled UPNP: Not found/disabled Compatability: issetugid setproctitle strlcpy strvis Modules: redirect: Not found bandwidth: Not found ldap: Not found pac: Not found

컴파일러를 실행하고, 소스 코드를 컴파일하여 실행 파일을 생성합니다.

make

실행 결과

---

Making all in include make[1]: Entering directory '/usr/local/src/dante-1.4.3/include' make all-am make[2]: Entering directory '/usr/local/src/dante-1.4.3/include' make[2]: Leaving directory '/usr/local/src/dante-1.4.3/include' make[1]: Leaving directory '/usr/local/src/dante-1.4.3/include' Making all in lib make[1]: Entering directory '/usr/local/src/dante-1.4.3/lib' CC config_parse.lo CC config_scan.lo CC Raccept.lo CC Rbind.lo CC Rbindresvport.lo CC Rcompat.lo ...(중략) make[1]: Leaving directory '/usr/local/src/dante-1.4.3/sockd' Making all in unlicensed make[1]: Entering directory '/usr/local/src/dante-1.4.3/unlicensed' make[1]: Nothing to be done for 'all'. make[1]: Leaving directory '/usr/local/src/dante-1.4.3/unlicensed' Making all in example make[1]: Entering directory '/usr/local/src/dante-1.4.3/example' make[1]: Nothing to be done for 'all'. make[1]: Leaving directory '/usr/local/src/dante-1.4.3/example' Making all in doc make[1]: Entering directory '/usr/local/src/dante-1.4.3/doc' make[1]: Nothing to be done for 'all'. make[1]: Leaving directory '/usr/local/src/dante-1.4.3/doc' Making all in bin make[1]: Entering directory '/usr/local/src/dante-1.4.3/bin' make[1]: Nothing to be done for 'all'. make[1]: Leaving directory '/usr/local/src/dante-1.4.3/bin' Making all in SPECS make[1]: Entering directory '/usr/local/src/dante-1.4.3/SPECS' make[1]: Nothing to be done for 'all'. make[1]: Leaving directory '/usr/local/src/dante-1.4.3/SPECS' Making all in capi make[1]: Entering directory '/usr/local/src/dante-1.4.3/capi' make[1]: Nothing to be done for 'all'. make[1]: Leaving directory '/usr/local/src/dante-1.4.3/capi' Making all in contrib make[1]: Entering directory '/usr/local/src/dante-1.4.3/contrib' make[1]: Nothing to be done for 'all'. make[1]: Leaving directory '/usr/local/src/dante-1.4.3/contrib' make[1]: Entering directory '/usr/local/src/dante-1.4.3' make[1]: Nothing to be done for 'all-am'. make[1]: Leaving directory '/usr/local/src/dante-1.4.3'

빌드된 실행 파일과 관련 파일을 시스템에 설치합니다.

make install

실행 결과

---

Making install in include make[1]: Entering directory '/usr/local/src/dante-1.4.3/include' make[2]: Entering directory '/usr/local/src/dante-1.4.3/include' make[2]: Nothing to be done for 'install-exec-am'. make[2]: Nothing to be done for 'install-data-am'. make[2]: Leaving directory '/usr/local/src/dante-1.4.3/include' make[1]: Leaving directory '/usr/local/src/dante-1.4.3/include' Making install in lib make[1]: Entering directory '/usr/local/src/dante-1.4.3/lib' make[2]: Entering directory '/usr/local/src/dante-1.4.3/lib' /usr/bin/mkdir -p '/usr/local/lib' /bin/sh ../libtool --mode=install /usr/bin/install -c libsocks.la '/usr/local/lib' libtool: install: /usr/bin/install -c -m 644 .libs/libsocks.so.0.1.1 /usr/local/lib/libsocks.so.0.1.1 libtool: install: (cd /usr/local/lib && { ln -s -f libsocks.so.0.1.1 libsocks.so.0 || { rm -f libsocks.so.0 && ln -s libsocks.so.0.1.1 libsocks.so.0; }; }) libtool: install: (cd /usr/local/lib && { ln -s -f libsocks.so.0.1.1 libsocks.so || { rm -f libsocks.so && ln -s libsocks.so.0.1.1 libsocks.so; }; }) libtool: install: /usr/bin/install -c -m 644 .libs/libsocks.lai /usr/local/lib/libsocks.la libtool: install: /usr/bin/install -c .libs/libsocks.a /usr/local/lib/libsocks.a libtool: install: chmod 644 /usr/local/lib/libsocks.a libtool: install: ranlib /usr/local/lib/libsocks.a libtool: finish: PATH="/root/.local/bin:/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin" ldconfig -n /usr/local/lib make[2]: Nothing to be done for 'install-data-am'. make[2]: Leaving directory '/usr/local/src/dante-1.4.3/lib' make[1]: Leaving directory '/usr/local/src/dante-1.4.3/lib' Making install in dlib make[1]: Entering directory '/usr/local/src/dante-1.4.3/dlib' make[2]: Entering directory '/usr/local/src/dante-1.4.3/dlib' /usr/bin/mkdir -p '/usr/local/lib' /bin/sh ../libtool --mode=install /usr/bin/install -c libdsocks.la '/usr/local/lib' libtool: install: /usr/bin/install -c -m 644 .libs/libdsocks.so /usr/local/lib/libdsocks.so libtool: install: /usr/bin/install -c -m 644 .libs/libdsocks.lai /usr/local/lib/libdsocks.la libtool: finish: PATH="/root/.local/bin:/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin" ldconfig -n /usr/local/lib make[2]: Nothing to be done for 'install-data-am'. make[2]: Leaving directory '/usr/local/src/dante-1.4.3/dlib' make[1]: Leaving directory '/usr/local/src/dante-1.4.3/dlib' Making install in sockd make[1]: Entering directory '/usr/local/src/dante-1.4.3/sockd' make[2]: Entering directory '/usr/local/src/dante-1.4.3/sockd' /usr/bin/mkdir -p '/usr/local/sbin' /bin/sh ../libtool --mode=install /usr/bin/install -c sockd '/usr/local/sbin' libtool: install: /usr/bin/install -c sockd /usr/local/sbin/sockd make[2]: Nothing to be done for 'install-data-am'. make[2]: Leaving directory '/usr/local/src/dante-1.4.3/sockd' make[1]: Leaving directory '/usr/local/src/dante-1.4.3/sockd' Making install in unlicensed make[1]: Entering directory '/usr/local/src/dante-1.4.3/unlicensed' make[2]: Entering directory '/usr/local/src/dante-1.4.3/unlicensed' make[2]: Nothing to be done for 'install-exec-am'. make[2]: Nothing to be done for 'install-data-am'. make[2]: Leaving directory '/usr/local/src/dante-1.4.3/unlicensed' make[1]: Leaving directory '/usr/local/src/dante-1.4.3/unlicensed' Making install in example make[1]: Entering directory '/usr/local/src/dante-1.4.3/example' make[2]: Entering directory '/usr/local/src/dante-1.4.3/example' make[2]: Nothing to be done for 'install-exec-am'. make[2]: Nothing to be done for 'install-data-am'. make[2]: Leaving directory '/usr/local/src/dante-1.4.3/example' make[1]: Leaving directory '/usr/local/src/dante-1.4.3/example' Making install in doc make[1]: Entering directory '/usr/local/src/dante-1.4.3/doc' make[2]: Entering directory '/usr/local/src/dante-1.4.3/doc' make[2]: Nothing to be done for 'install-exec-am'. /usr/bin/mkdir -p '/usr/local/share/man/man1' /usr/bin/install -c -m 644 socksify.1 '/usr/local/share/man/man1' /usr/bin/mkdir -p '/usr/local/share/man/man5' /usr/bin/install -c -m 644 sockd.conf.5 socks.conf.5 '/usr/local/share/man/man5' /usr/bin/mkdir -p '/usr/local/share/man/man8' /usr/bin/install -c -m 644 sockd.8 '/usr/local/share/man/man8' make[2]: Leaving directory '/usr/local/src/dante-1.4.3/doc' make[1]: Leaving directory '/usr/local/src/dante-1.4.3/doc' Making install in bin make[1]: Entering directory '/usr/local/src/dante-1.4.3/bin' make[2]: Entering directory '/usr/local/src/dante-1.4.3/bin' /usr/bin/mkdir -p '/usr/local/bin' /usr/bin/install -c socksify '/usr/local/bin' make[2]: Nothing to be done for 'install-data-am'. make[2]: Leaving directory '/usr/local/src/dante-1.4.3/bin' make[1]: Leaving directory '/usr/local/src/dante-1.4.3/bin' Making install in SPECS make[1]: Entering directory '/usr/local/src/dante-1.4.3/SPECS' make[2]: Entering directory '/usr/local/src/dante-1.4.3/SPECS' make[2]: Nothing to be done for 'install-exec-am'. make[2]: Nothing to be done for 'install-data-am'. make[2]: Leaving directory '/usr/local/src/dante-1.4.3/SPECS' make[1]: Leaving directory '/usr/local/src/dante-1.4.3/SPECS' Making install in capi make[1]: Entering directory '/usr/local/src/dante-1.4.3/capi' make[2]: Entering directory '/usr/local/src/dante-1.4.3/capi' make[2]: Nothing to be done for 'install-exec-am'. /usr/bin/mkdir -p '/usr/local/include' /usr/bin/install -c -m 644 socks.h '/usr/local/include' make[2]: Leaving directory '/usr/local/src/dante-1.4.3/capi' make[1]: Leaving directory '/usr/local/src/dante-1.4.3/capi' Making install in contrib make[1]: Entering directory '/usr/local/src/dante-1.4.3/contrib' make[2]: Entering directory '/usr/local/src/dante-1.4.3/contrib' make[2]: Nothing to be done for 'install-exec-am'. make[2]: Nothing to be done for 'install-data-am'. make[2]: Leaving directory '/usr/local/src/dante-1.4.3/contrib' make[1]: Leaving directory '/usr/local/src/dante-1.4.3/contrib' make[1]: Entering directory '/usr/local/src/dante-1.4.3' make[2]: Entering directory '/usr/local/src/dante-1.4.3' make[2]: Nothing to be done for 'install-exec-am'. make[2]: Nothing to be done for 'install-data-am'. make[2]: Leaving directory '/usr/local/src/dante-1.4.3' make[1]: Leaving directory '/usr/local/src/dante-1.4.3'

Dante SOCKS5 Proxy 서버 설정하기

Dante SOCKS Proxy 서버 설치 후 설정 파일을 생성합니다.

아래 /etc/sockd.conf 파일은 외부에서 프록시 서버에 로그인 인증 후 리눅스 서버에 SSH, FTP 접속을 위한 설정입니다.

Dante SOCKS Proxy 서버는 logoutput 및 errorlog 라는 두 가지 로그 파일 옵션을 지원합니다 . logoutput은 심각도에 관계없이 모든 syslog 유형 메시지를 기록하고, errorlog는 경고, 오류 등을 기록하는 데만 사용됩니다. 경고 로그는 logoutput, errorlog 둘 다 기록되지만, 디버그 및 정보 수준은 메시지는 logoutput 로그 파일에만 기록됩니다.

만약 프록시 서버에서 로그인 인증을 사용하지 않으려면 socksmethod: pam.username 라인을 주석 처리하면 인증 없이 접속할 수 있습니다.

또한 접속 IP 대역을 192.168.100.0/24로 제한하고 있으므로 접속을 제한하지 않으려면 0.0.0.0/0로 수정하면 됩니다.

vi /etc/sockd.conf

# sockd 데몬의 로그 설정
logoutput: /var/log/sockd.log

# sockd 데몬이 수신할 네트워크 장치명과 포트 번호
internal: 0.0.0.0 port = 1080

# sockd 데몬이 발신할 네트워크 장치명이나 IP 주소
external: ens192

# sockd 데몬이 root 권한으로 실행될 때 사용할 사용자 계정
user.privileged: root

# sockd 데몬이 일반 사용자 권한으로 실행될 때 사용할 사용자 계정
user.notprivileged: nobody

#sockd 데몬이 인증을 수행할 때 PAM 모듈을 사용하여 사용자 이름으로 인증
socksmethod: pam.username

# SSH 접속을 허용하는 클라이언트 설정
client pass {
        from: 192.168.100.0/24 to: 0.0.0.0/0 port: 22
        log: error connect disconnect

}

# FTP 요청을 허용하는 클라이언트 설정
client pass {
        from: 192.168.100.0/24 to: 0.0.0.0/0 port: 21
        log: error connect disconnect
}

# FTP 요청을 허용하는 클라이언트 설정
client pass {
        from: 192.168.100.0/24 to: 0.0.0.0/0 port: 59980#-60000#
        log: error connect disconnect
}

# SSH 접속 요청을 SOCKS5 프로토콜로 전달
socks pass {
        from: 192.168.100.0/24 to: 0.0.0.0/0 port: 22
        log: error connect disconnect
        proxyprotocol: socks_v5
}

# FTP 접속 요청을 SOCKS5 프로토콜로 전달
socks pass {
        from: 192.168.100.0/24 to: 0.0.0.0/0 port: 21
        log: error connect disconnect
        proxyprotocol: socks_v5

}

# FTP 접속 요청을 SOCKS5 프로토콜로 전달
socks pass {
        from: 192.168.100.0/24 to: 0.0.0.0/0 port: 59980#-60000#
        log: error connect disconnect
        proxyprotocol: socks_v5

}

로컬 사용자 계정 및 LDAP 계정 로그인 설정하기

/etc/sockd.conf 설정 파일에서 사용자 계정 인증을 PAM 모듈을 사용하도록 설정했습니다.

시스템 계정 인증 설정 파일을 사용하여 sockd 라는 이름으로 심볼링 링크 파일을 생성합니다.

ln -s /etc/pam.d/system-auth /etc/pam.d/sockd

Dante SOCKS Proxy 서비스 등록하기

sockd라는 이름으로 서비스 등록을 위해 아래와 같이 서비스 파일을 생성합니다.

vi /etc/systemd/system/sockd.service

[Unit]
Description=SOCKS5 Proxy Server
After=network.target

[Service]
Type=forking
ExecStart=/usr/local/sbin/sockd -D
Restart=on-failure

[Install]
WantedBy=multi-user.target

그리고 sockd 데몬을 활성화 시켜줍니다.

systemctl enable sockd

Dante SOCKS Proxy 서비스 로그 설정하기

/etc/sockd.conf 파일의logoutput: /var/log/sockd.log 설정을 통해 파일에 로그를 남기도록 했는데요.

sockd 로그의 로테이션 설정 파일을 아래와 같이 생성합니다.

vi /etc/logrotate.d/sockd

/var/log/sockd.log {
    daily
    rotate 30
    compress
    missingok
    dateext
    create
    postrotate
        /usr/bin/systemctl restart sockd.service > /dev/null 2>&1 || true
    endscript
}

그리고 rsyslog 수집 서버가 있다면 아래와 같이 sockd 데몬의 로그 파일 내용을 수집할 수 있도록 rsyslog 설정 파일을 생성합니다.

vi /etc/rsyslog.d/50-sockd.conf

# Load the imfile module to monitor log files
module(load="imfile" PollingInterval="10")

# Define an input for each Dante sockd log file
input(type="imfile"
      File="/var/log/sockd.log"
      Tag="sockd"
      Severity="info"
      Facility="local7")

rsyslog 로그 수집 서버에서는 아래와 같이 설정 파일을 생성합니다.

vi /etc/rsyslog.d/50-sockd.conf

:programname, isequal, "sockd" -?tpl_applog
&stop

rsyslog 설정 파일 생성 후 서비스를 재시작합니다.

systemctl restart rsyslog

Dante SOCKS Proxy 서비스 시작하기

sockd 서비스를 실행하기 위해 아래 명령어를 실행합니다.

systemctl start sockd

systemctl status sockd

실행 결과

---

● sockd.service - SOCKS5 Proxy Server Loaded: loaded (/etc/systemd/system/sockd.service; enabled; preset: disabled) Active: active (running) since Thu 2023-11-16 14:02:29 KST; 3s ago Process: 18895 ExecStart=/usr/local/sbin/sockd -D (code=exited, status=0/SUCCESS) Main PID: 18896 (sockd) Tasks: 20 (limit: 24740) Memory: 8.5M CPU: 421ms CGroup: /system.slice/sockd.service ├─18896 /usr/local/sbin/sockd -D ├─18897 "sockd: monitor-child" ├─18898 "sockd: negotiate-child:" ├─18899 "sockd: request-child: 0" ├─18900 "sockd: request-child: 0" ├─18901 "sockd: request-child: 0" ├─18902 "sockd: request-child: 0" ├─18903 "sockd: request-child: 0" ├─18904 "sockd: request-child: 0" ├─18905 "sockd: request-child: 0" ├─18906 "sockd: request-child: 0" ├─18907 "sockd: request-child: 0" ├─18908 "sockd: request-child: 0" ├─18909 "sockd: request-child: 0" ├─18910 "sockd: request-child: 0" ├─18911 "sockd: request-child: 0" ├─18912 "sockd: request-child: 0" ├─18913 "sockd: request-child: 0" ├─18914 "sockd: request-child: 0" └─18915 "sockd: io-child: 0/32 (" Nov 16 14:02:29 test-33.38 systemd[1]: Starting SOCKS5 Proxy Server... Nov 16 14:02:29 test-33.38 systemd[1]: Started SOCKS5 Proxy Server.

sockd 서비스의 1080 포트도 확인해봅니다.

ss -nlput | grep sockd

실행 결과

---

tcp LISTEN 0 511 0.0.0.0:1080 0.0.0.0:* users:(("sockd",pid=1404,fd=7))

Dante SOCKS Proxy 접속 테스트

PuTTY Proxy 설정 및 SSH 접속하기

PuTTY의 Connection - Proxy 메뉴에서 SOCKS5 Proxy 서버 설정을 입력합니다.

신규 계정을 생성하지 않았기 때문에 root 계정을 사용합니다. 로컬 사용자 계정이나 LDAP 계정으로 설정하여 사용하면 됩니다.

로그 파일을 실시간 확인하여 SOCKS5 Proxy를 통해 SSH 접속이 정상적으로 연결되는지 확인합니다.

tail -n0 -f /var/log/secure /var/log/sockd.log

PuTTY에서 SOCKS5 설정 후 192.168.33.38 IP로 SSH 접속하여 root 계정으로 로그인합니다.

그럼 아래와 같이 /var/log/secure 파일에 Accepted password for root from 192.168.33.38 port 20759 ssh2로그 내용처럼 PC IP가 아니라 SOCKS5 Proxy 서버 IP로 SSH 접속된 것을 확인할 수 있습니다.

실행 결과

---

=> SSH 로그인 로그 ==> /var/log/sockd.log <== Nov 16 16:56:50 (1700121410.667287) sockd[1425]: info: pass(1): tcp/accept [: 192.168.100.109.20759 192.168.33.38.1080 Nov 16 16:56:50 (1700121410.857581) sockd[1431]: info: pass(1): tcp/connect [: pam.username%root@192.168.100.109.20759 192.168.33.38.1080 -> 192.168.33.38.20759 192.168.33.38.22 ==> /var/log/secure <== Nov 16 16:56:55 test-33 sshd[1473]: Accepted password for root from 192.168.33.38 port 20759 ssh2 Nov 16 16:56:55 test-33 sshd[1473]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0) => SSH 로그 아웃 로그 ==> /var/log/sockd.log <== Nov 16 16:57:09 (1700121429.087279) sockd[1431]: info: pass(1): tcp/connect ]: 3661 -> pam.username%root@192.168.100.109.20759 192.168.33.38.1080 -> 2980, 2980 -> 192.168.33.38.20759 192.168.33.38.22 -> 3661: local client closed. Session duration: 19s Nov 16 16:57:09 (1700121429.087430) sockd[1431]: info: pass(1): tcp/accept ]: 3661 -> 192.168.100.109.20759 192.168.33.38.1080 -> 2980: local client closed. Session duration: 19s ==> /var/log/secure <== Nov 16 16:57:09 test-33 sshd[1473]: pam_unix(sshd:session): session closed for user root

FileZilla Proxy 설정 및 SFTP 접속하기

FTP와 SFTP 접속을 위해 사용하는 파일질라에서 SOCKS5 Proxy 설정하여 SFTP로 접속해봅니다.

편집 - 설정 (s) - 일반 프록시 메뉴를 클릭하여 아래와 같이 설정합니다.

로그 파일을 실시간 확인하여 SOCKS5 Proxy를 통해 SFTP 접속이 정상적으로 연결되는지 확인합니다.

tail -n0 -f /var/log/secure /var/log/sockd.log

프록시 설정이 끝났으면, 아래와 같이 Dante SOCKS5 Proxy 서버를 통해 SFTP로 접속합니다.

실행 결과

---

=> SFTP 로그인 로그 ==> /var/log/sockd.log <== Nov 17 13:01:26 (1700193686.914540) sockd[2040]: info: pass(1): tcp/accept [: 192.168.100.109.1326 192.168.33.38.1080 Nov 17 13:01:27 (1700193687.094584) sockd[2045]: info: pass(1): tcp/connect [: pam.username%root@192.168.100.109.1326 192.168.33.38.1080 -> 192.168.33.38.1326 192.168.33.38.22 ==> /var/log/secure <== Nov 17 13:01:27 test-33 sshd[2086]: Accepted password for root from 192.168.33.38 port 1326 ssh2 Nov 17 13:01:27 test-33 sshd[2086]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0) => SFTP 로그 아웃 로그 ==> /var/log/sockd.log <== Nov 17 13:03:51 (1700193831.763232) sockd[2045]: info: pass(1): tcp/connect ]: 4413 -> pam.username%root@192.168.100.109.1326 192.168.33.38.1080 -> 2544, 2544 -> 192.168.33.38.1326 192.168.33.38.22 -> 4413: local client error (Connection reset by peer). Session duration: 145s Nov 17 13:03:51 (1700193831.763333) sockd[2045]: info: pass(1): tcp/accept ]: 4413 -> 192.168.100.109.1326 192.168.33.38.1080 -> 2544: local client error (Connection reset by peer). Session duration: 145s ==> /var/log/secure <== Nov 17 13:03:51 test-33 sshd[2086]: pam_unix(sshd:session): session closed for user root

마무리

Dante SOCKS Proxy 서버 설치와 프록시 설정, 로그 설정과 서비스 등록과 시작까지 모든 과정에 대해 알아보았습니다.

예제로 SOCKS5 Proxy 서버를 사용하여 SSH, SFTP 접속 시 클라이언트 PC IP가 아닌 SOCKS5 Proxy 서버 IP로 접속되는지 확인해보았으며, 실습 내용을 통해 SOCKS5 Proxy 서버를 쉽게 설치하여 사용할 수 있습니다.