Dante

https://www.inet.no/dante/doc/1.4.x/
Admin
Dante is an open-source SOCKS server and client implementation that provides secure network proxying...
Tokens:114,042
Snippets:790
Trust Score:9.2
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Example PAM configuration file for sockd

Source: https://www.inet.no/dante/doc/1.4.x/config/auth_pam.html

A sample PAM configuration file for the default Dante PAM service name 'sockd'. This file should not be copied verbatim; use an existing file like the one for sshd as a starting point and adjust for your operating system.

```text
%PAM-1.0
#auth      required     pam_sepermit.so
auth       include      system-auth
account    required     pam_nologin.so
account    include      system-auth
password   include      system-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be
executed in the 
user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      system-auth
session    required     pam_limits.so

```

--------------------------------

### Install new Dante binaries

Source: https://www.inet.no/dante/doc/1.4.x/config/upgradesteps.html

Installs the new Dante binaries from the source code directory. The new binary should be present under /usr/local/sbin.

```bash
make install
```

--------------------------------

### Start new Dante server

Source: https://www.inet.no/dante/doc/1.4.x/config/upgradesteps.html

Starts the new Dante server in daemon mode with the specified configuration file. This normally works if the site does not use special options.

```bash
/usr/local/sbin/sockd -D -f /etc/sockd.conf
```

--------------------------------

### Install new sockd.conf

Source: https://www.inet.no/dante/doc/1.4.x/config/upgradesteps.html

Replace the current /etc/sockd.conf with the new configuration file after it has been validated and no errors or warnings were reported.

```shell
cp sockd.conf_new /etc/sockd.conf
```

--------------------------------

### Dante socksmethod gssapi configuration example

Source: https://www.inet.no/dante/doc/1.4.x/config/auth_gssapi.html

Dante configuration example for using the gssapi socks method. The template can be used directly for outgoing traffic; only the method name needs to be specified. The gssapi socks method cannot be used for incoming traffic (bindreply, udpreply).

```plaintext
#authentication methods
socksmethod: gssapi

client pass {
        from: 0.0.0.0/0 to: 0.0.0.0/0
	log: error # connect disconnect

        ## gssapi defaults
        #gssapi.enctype: clear integrity confidentiality
        #gssapi.keytab: /etc/sockd.keytab
        #gssapi.servicename: rcmd
}

#generic pass statement - bind/outgoing traffic
socks pass {  
        from: 0.0.0.0/0 to: 0.0.0.0/0
        command: bind connect udpassociate
        log: error # connect disconnect iooperation
        socksmethod: gssapi
}

```

--------------------------------

### Start Dante with debug logging

Source: https://www.inet.no/dante/doc/1.4.x/ldap.html

Start Dante manually with debug level 1 and the specified configuration file. This is useful when debugging GSSAPI and LDAP issues because it allows Ctrl-c termination and shows stderr output from linked libraries. Run it as the user that normally starts Dante (root or a dedicated user).

```bash
/usr/sbin/sockd -d1 -f /etc/sockd.conf
```

--------------------------------

### Send log output example

Source: https://www.inet.no/dante/doc/1.4.x/config/capacity.html

Example of the send log file _log-0-send-bw-0.dat_ generated by multiclient.pl. Each line contains timestamp, connection id, file descriptor, read bytes, and wrote bytes.

```text
1423021036.90436 grande.inet.no:send:0 9 0 7864320
1423021037.90442 grande.inet.no:send:0 9 0 104857600
1423021038.90468 grande.inet.no:send:0 9 0 117112832
1423021039.90535 grande.inet.no:send:0 9 0 118030336
1423021040.9062 grande.inet.no:send:0 9 0 117309440
```

--------------------------------

### Configure output when PAM is enabled

Source: https://www.inet.no/dante/doc/1.4.x/config/auth_pam.html

This output from the configure script indicates that PAM support is enabled. After this, compile the source to get a sockd binary with PAM support.

```text
PAM:               Enabled

```

--------------------------------

### Run a program through SOCKS with socksify

Source: https://www.inet.no/dante/doc/1.4.x/socksify.1.html

Prefix a program and its arguments with the socksify script to run it through a SOCKS proxy. This example socksifies an FTP session to ftp.example.org.

```shell
$ socksify ftp ftp.example.org
```

--------------------------------

### Dante monitor syntax example

Source: https://www.inet.no/dante/doc/1.4.x/config/monitors.html

Shows the general monitor syntax in Dante. The monitor object has the same general format as access control rules but is independent and only performs passive monitoring of network traffic or the lack of it. This example defines a monitor without any actual monitoring operations.

```dante
monitor {
   from: 0.0.0.0/0 to: www.example.org port = 80
   protocol: tcp
}
```

--------------------------------

### maxconn.pl example output

Source: https://www.inet.no/dante/doc/1.4.x/config/capacity.html

Example output from maxconn.pl. The number of opened connections (1952) indicates the maximum concurrent client sessions the current Dante configuration can handle. Actual numbers may vary by client type.

```text
...
maxconn.pl: opened 1952/2000 connection(s)
maxconn.pl: sleeping
maxconn.pl: terminating, 1958 connections accepted in total
```

--------------------------------

### Dante session limit configuration example

Source: https://www.inet.no/dante/doc/1.4.x/config/session.html

Example configuration showing session limits in a client rule and a socks rule. The client rule limits total sessions to 10000, throttles new sessions to 100 per second, and sets per-IP limits of 100 sessions and 10 new sessions every 2 seconds. The socks rule does not override session values, so the limits apply to all connections.

```dante
#pass all requests but limit the number of sessions and connect rate
client pass {
   from: 0.0.0.0/0 to: 0.0.0.0/0
   log: connect disconnect error

   #limit for all clients
   session.max: 10000
   session.throttle: 100/1

   #per-ip limit
   session.state.key: from
   session.state.max: 100
   session.state.throttle: 10/2
}

socks pass {
   from: 0.0.0.0/0 to: 10.0.0.0/8
   log: connect disconnect error
}

```

--------------------------------

### Backup Dante server binary and config

Source: https://www.inet.no/dante/doc/1.4.x/config/upgradesteps.html

Backs up the Dante server binary and configuration file before upgrading. These commands are part of the preparation steps and should be run before starting the update.

```bash
cp /usr/local/sbin/sockd /usr/local/sbin/sockd.old
```

```bash
cp /etc/sockd.conf /etc/sockd.conf.old
```

--------------------------------

### Configure output when PAM is disabled

Source: https://www.inet.no/dante/doc/1.4.x/config/auth_pam.html

This output from the configure script indicates that PAM support is disabled because the header file security/pam_appl.h is missing. Ensure that the pam-devel package is installed.

```text
PAM:               Disabled, security/pam_appl.h missing

```

--------------------------------

### Pacemaker active/active resource creation and cloning

Source: https://www.inet.no/dante/doc/1.4.x/config/redundancy_layer2.html

Commands to add and clone the shared IP and Dante SOCKS server resources in a Pacemaker cluster for active/active load balancing. Assumes the cluster is created, nodes are added, and the Dante OCF Resource Agent script is installed. The shared IP uses sourceip hashing for persistent client-to-node mapping, and an order constraint ensures the address is configured before sockd starts.

```bash
##create resources - (loadbalance, cloned)
pcs resource create SharedIP ocf:heartbeat:IPaddr2 ip=10.0.0.1 \
    cidr_netmask=8 op monitor interval=30s
pcs resource create SOCKDloadbalance ocf:dante:sockd op monitor interval=30s

#clone address to make it run on all nodes, with sourceip hashing
pcs resource clone SharedIP globally-unique=true clone-node-max=1
pcs resource update SharedIP clusterip_hash=sourceip

#clone sockd service
pcs resource clone SOCKDloadbalance

#ensure address is configured before sockd is started
pcs constraint order SharedIP-clone then SOCKDloadbalance-clone
```

--------------------------------

### Client configuration file with route and proxyprotocol

Source: https://www.inet.no/dante/doc/1.4.x/config/auth.html

Example client configuration file that routes traffic to a SOCKS server supporting both SOCKS v4 and v5. The method keyword is commented out to allow the client to offer all supported authentication methods, which is recommended.

```plaintext
#route to SOCKS server, (which supports both SOCKS version 4 and 5)
route {                                                                        
        from: 0.0.0.0/0 to: 0.0.0.0/0 via: 192.0.2.1 port = 1080            
        proxyprotocol: socks_v4 socks_v5
#        method: _authmethod_
}

```

--------------------------------

### Use different IP-addresses for different clients

Source: https://www.inet.no/dante/doc/1.4.x/redirect.html

Shows two rules that assign different IP-addresses to clients from different networks: 10.1/16 gets 192.168.0.1 and 10.2/16 gets 192.168.0.2.

```plaintext
# clients from the 10.1/16-net will be assigned IP-address 192.168.0.1
pass {
   from: 10.1.0.0/16 to: 0.0.0.0/0
   redirect from: 192.168.0.1/32
}

# clients from the 10.2/16-net will be assigned IP-address 192.168.0.2
pass {
   from: 10.2.0.0/16 to: 0.0.0.0/0
   redirect from: 192.168.0.2/32
}
  
```

--------------------------------

### Full sockd.conf for GSSAPI with load balancing

Source: https://www.inet.no/dante/doc/1.4.x/config/redundancy.html

A full sockd.conf example configured for GSSAPI authentication with a load-balanced internal interface (carp0) and a shared external address. The commented clientcompatibility line may be needed for some clients.

```plaintext
errorlog: syslog
logoutput: /var/log/sockd.log
debug: 0

internal: carp0 #loadbalance interface
external: 10.0.0.1 #external address

socksmethod: gssapi

user.privileged: root
user.notprivileged: _sockd

client pass {
        from: 0/0 to: 0/0
        log: error connect disconnect
        gssapi.keytab: /etc/sockd.keytab-carploadbalance
        gssapi.servicename: rcmd/carploadbalance.example.com
#        clientcompatibility: necgssapi #might be needed for some clients
}

socks pass {
        from: 0/0 to: 0/0
        log: error connect disconnect
}
```

--------------------------------

### Server configuration: block and pass for bindreply and udpreply

Source: https://www.inet.no/dante/doc/1.4.x/config/auth.html

Example configuration for handling incoming connections/packets with bindreply and udpreply commands. The block statement is commented out, and the pass statement allows all other incoming traffic without authentication.

```plaintext
# block incoming connections/packets from ftp.example.org 
# socks block {
#        from: ftp.example.org to: 0.0.0.0/0 
#        command: bindreply udpreply
#        log: error # connect disconnect iooperation
# }

# generic pass statement for all other incoming connections/packets
socks pass {
        from: 0.0.0.0/0 to: 0.0.0.0/0
        command: bindreply udpreply
        log: error # connect disconnect iooperation
}

```

--------------------------------

### RTT log output example

Source: https://www.inet.no/dante/doc/1.4.x/config/capacity.html

Example of the RTT log file _log-0-rtt-rtt-0.dat_ generated by multiclient.pl. Each line contains timestamp, connection id, file descriptor, median, average, stddev, minimum, and maximum RTT in seconds.

```text
1423020577.64567 grande.inet.no:rtt:0 10 0.000288 0.000294 0.000164 0.000188 0.001806
1423020578.64586 grande.inet.no:rtt:0 10 0.000288 0.000312 0.000226 0.000171 0.004561
1423020579.64588 grande.inet.no:rtt:0 10 0.000287 0.000295 0.000191 0.000216 0.009559
```

--------------------------------

### Create Dante SOCKS server resource with all options

Source: https://www.inet.no/dante/doc/1.4.x/config/redundancy_layer2.html

Creates the Dante SOCKS server resource with all options specified: the sockd binary path, configuration file, and PID file, plus a monitor operation every 30 seconds.

```bash
pcs resource create SOCKDfailover ocf:dante:sockd \
    sockd=/usr/local/sbin/sockd-1.4.2 \
    sockd_config=/etc/sockd-failover.conf \
    sockd_pidfile=/var/run/sockd-failover.pid op monitor interval=30s
```

--------------------------------

### Copy existing sockd.conf to new file

Source: https://www.inet.no/dante/doc/1.4.x/config/upgradesteps.html

Create a new sockd.conf file based on the existing server configuration file. This step assumes the Preparation section has been executed and a backup of the old configuration file has been made.

```shell
cp /etc/sockd.conf sockd.conf_new
```

--------------------------------

### Data alarm monitor example

Source: https://www.inet.no/dante/doc/1.4.x/config/monitors.html

Example monitor configuration that triggers a data alarm when less than 1 byte is received in 2 seconds on either the internal or external interface. The warning message shows the alarm triggered because no data was received in the last two seconds and no sessions were active.

```dante
monitor {
   from: 0.0.0.0/0  to: 0.0.0.0/0 
   protocol: tcp

   internal.alarm.data.recv: 1 in 2
   external.alarm.data.recv: 1 in 2
}

```

--------------------------------

### Start Dante with -N 4 for process level redundancy

Source: https://www.inet.no/dante/doc/1.4.x/config/redundancy_process.html

Start Dante with the -N option to fork four mother processes instead of the default single one. This enables process level redundancy, allowing any of the forked processes to accept new client requests. The special mother process will replace terminated mother processes, but if it terminates, it will not be replaced.

```bash
   sockd ... -N 4

```

--------------------------------

### Run maxconn.pl to test SOCKS server capacity

Source: https://www.inet.no/dante/doc/1.4.x/config/capacity.html

Shell script to configure and run maxconn.pl, which creates a specified number of SOCKS sessions and holds them for a duration. Set the INTIP, SOCKSSERVER, and SOCKSPORT variables to your environment. The script creates 2000 connections and waits 100 seconds before terminating.

```shell
#INTIP="..."       # IP address of host maxconn.pl is run on.
#SOCKSSERVER="..." # IP address of Dante SOCKS server.
#SOCKSPORT="..."   # port number of Dante SOCKS server.
CONNCNT=2000       # number of SOCKS sessions to create.
WAITDUR=100        # number of seconds to wait before terminating.

SOCKS="-s $SOCKSSERVER:$SOCKSPORT"
maxconn.pl -w $WAITDUR -b $INTIP -c $CONNCNT $SOCKS
```

--------------------------------

### Configure external.alarm.disconnect alarm with MINCOUNT/RATIO and INTERVAL

Source: https://www.inet.no/dante/doc/1.4.x/config/monitors.html

Configuration examples for the external.alarm.disconnect alarm. The first triggers when at least 1000 connections (MINCOUNT) out of 3000 (RATIO) are disconnected within 15 seconds (INTERVAL). The second is a cautionary example that would likely cause many false alarms because it requires only one disconnect out of one connection within one second.

```text
external.alarm.disconnect: 1000/3000 in 15
```

```text
external.alarm.disconnect: 1/1 in 1
```

--------------------------------

### Check new Dante version

Source: https://www.inet.no/dante/doc/1.4.x/config/upgradesteps.html

Verifies the new Dante binary is installed by printing its version number.

```bash
/usr/local/sbin/sockd -v
```

--------------------------------

### Full Dante SOCKS server template with authentication

Source: https://www.inet.no/dante/doc/1.4.x/config/auth.html

Full recommended Dante SOCKS server configuration template with authentication. Replace authmethod1, authmethod2, and authmethod3 with the desired authentication methods; some methods may require minor file changes. Both clientmethod and socksmethod are specified, but clientmethod-based authentication is generally not needed and those parts can be ignored.

```dante
#logging
#errorlog: /var/log/sockd.errlog
logoutput: /var/log/sockd.log
#debug: 2

#server address specification
internal: 192.0.2.1 port = 1080
external: eth1

#server identities (not needed on solaris)
#user.privileged: root
user.notprivileged: socks
#user.libwrap: libwrap

#authentication methods
clientmethod: authmethod1
socksmethod: authmethod2 authmethod3

##
## SOCKS client access rules
##
#rule processing stops at the first match, no match results in blocking

#block connections from specified user
# client block {
#         from: 192.0.2.0/24 to: 0.0.0.0/0
#         log: error # connect disconnect
#         user: baduser
#         clientmethod: authmethod1
# }

#allow connections from authenticated users on internal 192.0.2.0/24 network
client pass {
        from: 192.0.2.0/24 to: 0.0.0.0/0
#         log: error # connect disconnect
        socksmethod: authmethod1
}

##
## SOCKS command rules
##
#rule processing stops at the first match, no match results in blocking

#block communication with www.example.org
# socks block {
#        from: 0.0.0.0/0 to: www.example.org
#        command: bind connect udpassociate
#        log: error # connect disconnect iooperation
#        user: baduser
#        socksmethod: authmethod3
# }

#generic pass statement - bind/outgoing traffic
socks pass {  
        from: 0.0.0.0/0 to: 0.0.0.0/0
        command: bind connect udpassociate
#        log: error # connect disconnect iooperation
        socksmethod: authmethod2
}

# block incoming connections/packets from ftp.example.org 
# socks block {
#        from: ftp.example.org to: 0.0.0.0/0 
#        command: bindreply udpreply
#        log: error # connect disconnect iooperation
# }

# generic pass statement for incoming connections/packets
socks pass {
        from: 0.0.0.0/0 to: 0.0.0.0/0
        command: bindreply udpreply
#        log: error # connect disconnect iooperation
}
```

--------------------------------

### Configure send client for transfer rate measurement

Source: https://www.inet.no/dante/doc/1.4.x/config/capacity.html

Configuration to run a single send client for 60 seconds measuring transfer rate to a discard server. The first few seconds should be ignored due to TCP buffering.

```bash
#start single client sending steady stream of data to a discard server
SOCKSSERVER="..."            #address of socks server to test
SOCKSPORT="1080"             #port number of socks server
DUR="60"                     #number of seconds to run clients
SOCKS="-s $SOCKSSERVER:$SOCKSPORT" #comment out to connect directly to target

CLIENTS="1"                  #number of client connections to generate
RATE="1"                     #number of connections to open each second
TARGETSERVER="$TESTSERVIP"   #address of target server
TARGETPORT="discard"         #target server port
CLIENTSPERPROC="1"           #number of client connections per process

SPEC="send:$CLIENTS:tcp:$RATE:$TARGETSERVER:$TARGETPORT:$CLIENTSPERPROC"
multiclient.pl -v $SOCKS -l $DUR $SPEC 2>mc.out >>_info.txt
```
Tokens:
Raw