ssh-tunneling on S Anand

Surviving in prison

Fri, 12 Nov 2010 16:25:37 +0000

As promised, here are some tips from the trenches on surviving in prison. (For those who don’t follow my blog, prison is where your Internet access is restricted.)

There are two things you need to know better: software and people. I’ll try and cover the software in this post, and the more important topic in the next.

Portable apps

You’re often not in control of your laptops / PCs. You don’t have administrator access. You can’t install software. The solution is to install Portable Apps. Most popular applications have been converted into Portable Apps that you can install on to a USB stick. Just plug them into any machine and use them. I use Firefox and Skype quite extensively this way, but increasingly, I have a preference for Portable Apps for just about everything. It makes my bloated Start Menu a lot more manageable. Some of the other portable apps I have are: Audacity, Camstudio, GIMP, Inkscape and Notepad++.

Admin access

The other possibility is that you try and gain admin access. I did this once at a client site (a large bank). We didn’t have admin access. I wasn’t particularly thrilled. So I borrowed a floppy, installed an offline password recovery tool, rebooted, and got the admin password within a few minutes. This is with the full knowledge of the (somewhat worried) client. This is where the people part comes in, and I’ll talk about that later.

Proxies

But before you do any of these, you need to be able to download the files, most of which are executables. Those are probably blocked. Heck, the sites from which you can download these files are probably blocked in the first place.

Sometimes, internal proxies help. Proxies for different geographies may have different degrees of freedom. When I was at IBM, the Internet was accessible from most US proxies, just not from the Indian proxy. So it may just be a matter of finding the right internal proxy.

Or you can search for external public proxies. Sadly, many of these are blocked. Another option is for you to set up your own proxy. You can install mirrorrr on AppEngine for free, for example.

The most effective option, of course, is to use SSH tunnels. I’ve covered this is some detail earlier.

Google

Google has a wide range of tools that can help access blocked sites. If the site you’re accessing provides public RSS feeds, use Google Reader to access these. Public feeds for Twitter, for example, are available as RSS feeds.

Google’s cache is another way of getting the same information. Search for the URL, click on the “Cache” link to read the text even if it’s blocked.

To find more such help, Google for it!

Peopleware

… but all of this is, honestly, just a small part of it. The key, really, is to understand the people restricting your access. I’ll talk about this next.

Comments

Raghu 12 Nov 2010 7:53 pm: Hello Anand, First off, superb blog. I’ve been reading your stuff for the past year or so and I really enjoy your content. I am able to relate to the most part about this post, previous prison posts etc., as I was in a similar situation some time ago. And, as my friend once said, being engineers, we will devote all time to try and work around potential temporary barriers - thus defeating the purpose of proxies and web filters in the first place. When you talk about booting via a floppy, you’d first need BIOS access to modify the boot order. That is usually blocked with a password -is there a workaround that?
Deepak 13 Nov 2010 3:06 am: Portable apps - USB is disabled! Admin access - I have it. Doesn’t help much though! (This and the previous one seem to be mutually exclusive. USB is disabled by policy) Proxies - Not very helpful. Too many hoops to jump through! SSH Tunnels - This is the only one that has a way of working reliably. Is there a free reliable provider? Google - Reader works. But a lot of images are cropped off because of the same issues above. Somehow, even Google’s cache seems to be falling under the parent url’s restrictions.
Fibinse 9 Mar 2011 6:53 am: I honestly thought that you were gonna write about prison! :)

SSH Tunneling via Rackspacecloud

Thu, 11 Feb 2010 17:42:14 +0000

I wrote about SSH Tunneling through web filters using Amazon’s EC2 at 8 cents/hr. With Rackspacecloud, you can get that down to 1.5 cents/hr. This turns out to be a lot simpler than EC2 as well! Ingredients

Rackspacecloud account (sign up for free – you won’t be charged until you use it)
Putty (which may be available on your Intranet, if you’re lucky)

Directions

On the Rackspacecloud console, click on wordpress website hosting– Cloud Servers – Add Server and select Ubuntu 9.10 (Karmic Koala). Actually, you can pick any other instance. I’m going to talk through this using Ubuntu 9.10 as the example.
Type any server name, pick a 256MB RAM instance, and click on Create Server.
Once the server has started, you’ll get the screen below. Click on the Console to open a session.
Your password would have been e-mailed to the account you registered with. Log in as root with that password. Now type the following:

sed –i “s/^Port 22/Port 443/” /etc/ssh/sshd_config /etc/init.d/ssh restart

   [![ssh-4](/blog/assets/ssh4.webp "ssh-4")](/blog/assets/ssh4.webp)
5. Run Putty. Type in **[root@](mailto:root@<server-IP-address)**[**<server-IP-address**](mailto:root@<server-IP-address)**>** as the host name, and **443** as the port
   ![putty14](/blog/assets/putty14.webp "putty14")
6. Under **Connection > Proxy**, set **HTTP** as the proxy type. Type in the **Proxy hostname** and **Port** you normally use to access the Internet. Select **Yes** for **Do DNS name lookup at proxy end**. Type in your Windows login ID and password.
   ![putty22](/blog/assets/putty22.webp "putty22")
7. Under **Connection > SSH**, select **Enable Compression**.
   ![putty53](/blog/assets/putty53.webp "putty53")
8. Under **Connection > SSH > Tunnels**, type **9090** as the **Source port**, **Dynamic** as the **Destination**, and click **Add**.
   ![putty42](/blog/assets/putty42.webp "putty42")
9. Now click **Open**. You should get a terminal into your Rackspacecloud instance. Log in with the same password as before.
10. Open your Browser, and set the SOCKS server to localhost:9090. For Internet Explorer, go to **Tools – Options – Connections – LAN Settings**, select **Use a proxy ...**, click on **Advanced**, and type **localhost**:**9090** as the **Socks** server. Leave all other fields blank.
    ![ieconfig2](/blog/assets/ieconfig2.webp "ieconfig2")
11. For Firefox, go to **Tools – Options – Advanced – Network – Settings** and select **Manual proxy configuration**. Set the Socks Host to **localhost**:**9090** and leave all other fields blank.
    ![ffconfig2](/blog/assets/ffconfig2.webp "ffconfig2")
12. Also, go to URL **about:config**, and make sure that **network.proxy.socks\_remote\_dns** is set to **true**.

---

## Comments

<!-- wp-comments-start -->
- **Kishor Gandham** _28 Feb 2010 3:41 pm_:
  Excellent post Anand. I was able to connect to Gmail while at work through the SSH tunnel using the free shell account provided by CJB.
  One issue that I faced: Putty doesnt seem to be supporting HTTP proxies with NTLM authentication. To overcome, I use NTLMAPS (http://ntlmaps.sourceforge.net/) to create a local HTTP proxy.
  Cheers,
  Kishor
- **[S Anand](http://www.s-anand.net/)** _11 Feb 2010 9:48 pm_:
  Cool tip from Amit http://www.google.com/profiles/chakradeo
  There is another Free (and slow) option. Use http://www.cjb.net/shell.html
  They run ssh server on port 22 and 443. It is a basic account, and they run all outbound TCP traffic via the TOR network, which gives you anonymity too. But the downside is the slow speed!
- **pgt** _13 Feb 2010 3:39 pm_:
  The 1.5c/hour is just a teaser and for all practical purposes this works out to $10.95/month as there is no option to shutdown the machine.
  From their FAQ
  Currently the server would either be running or you would have to delete it altogether. There is no "suspension" mode where you are not charged while not receiving traffic to the server
- **[S Anand](http://www.s-anand.net/)** _14 Feb 2010 4:56 pm_:
  @pgt: well, not quite. You can use it hourly. That's how I do it. I just create an instance when I need to, use it for an hour or two, and then shut it down.
- **i** _31 Mar 2012 8:29 pm_:
  While you can't suspend, you can save a custom image of the server with your sshd config, usernames, passwords, RSA keys, etc. already set up. Then you can create an instance as needed and delete it when you're done, without duplication of effort.
<!-- wp-comments-end -->

SSH Tunneling through web filters

Sat, 09 Jan 2010 19:46:39 +0000

You can defeat most web filters by spending ~~around 8 cents/hr~~ 0 cents/hr on Amazon EC2. (It’s usually worth the money. It’s a fraction of the cost a phone call or a sandwich. And I usually end up wasting that money anyway on calling someone or eating my way out of the misery of corporate proxies.) Most web filters and proxies block all ports except the HTTP port (80) and the HTTPS port (443). But it’s used to carry encrypted traffic, and, as Mark explains:

since all the traffic that passed through the tunnel is supposed to be SSL encrypted (so as to form an unhindered SSL session between the browser and the HTTPS server), there are little or no access controls possible on such a tunnel

That means web filters can’t really block HTTPS traffic. So we can redirect web traffic to a local HTTPS server, and set up a server outside the firewall that redirects them back to the regular servers. Putty will be our local HTTPS server. Amazon EC2 gives us a server outside the firewall. So here’s a 16-step recipe to bypass your web filter. (This is the simplest I could make it.) In Steps 1-7, we’ll launch a server on Amazon EC2 with 2 tweaks. Step 1 enables Port 443, and step 6 re-configures SSH to run on Port 443 instead of on Port 22. (Remember: most proxies block all ports other than 80 and 443). Alestic’s article on how to Automate EC2 Instance Setup with user-data Scripts and this thread on running SSH on port 443 are invaluable. In Steps 8-13, we’ll set up Putty as our local HTTPS server. Read how to set up Putty as a SOCKS server and how to use Putty with a HTTP proxy. All I did was to combine the two. In steps 14-16, we’ll configure the browser to use the Putty as the SOCKS server. Ingredients

Amazon AWS account (sign up for free – you won’t be charged until you use it)
Putty (which may be available on your Intranet, if you’re lucky)

Directions

On the AWS EC2 Console, click on Security Groups and select the default security group. At the bottom, select HTTPS as the connection method, and save it.
Click on Key Pairs, select Create Key Pair and type in some name. Click on the Create button and you’ll be asked to download a key file. Save it somewhere safe.
Run PuttyGen (it comes with Putty), click Load and select the key file you just saved. Now click on Save private key and save it as privatekey.ppk.
Back on the AWS EC2 Console, click on Launch Instance.
Select Community AMIs and find ami-ccf615a5. It’s a Ubunty Jaunty 9.04 instance that’s been customised to run scripts passed as user-data. You may pick any other alestic instance. (The screenshot below picks a different instance. Ignore that.)
Continue until you get to Advanced Instance Options. Here, copy and paste the following under User Data. Do not make a mistake here!

#!/bin/bash mv /etc/ssh/sshd_config /etc/ssh/x sed “s/^#?Port.*/Port 443/” /etc/ssh/x > /etc/ssh/sshd_config /etc/init.d/ssh restart

   [![](/blog/assets/ec2userdata.webp)](/blog/assets/ec2userdata.webp)
7. Keep pressing **Continue** and **Launch** the instance. Once launched, click on “Instances” on the left, and keep refreshing the page until the status turns green (running). Now, copy the **Public DNS** of the instance.
   [![](/blog/assets/ec2instancerunning.webp)](/blog/assets/ec2instancerunning.webp)
8. Run Putty. Type in **root@****<the-public-DNS-you-just-copied>** as the host name, and **443** as the port
   [![](/blog/assets/putty1.webp)](/blog/assets/putty1.webp)
9. Under **Connection > Proxy**, set **HTTP** as the proxy type. Type in the **Proxy hostname** and **Port** you normally use to access the Internet. Select **Yes** for **Do DNS name lookup at proxy end**. Type in your Windows login ID and password.
   [![](/blog/assets/putty2.webp)](/blog/assets/putty2.webp)
10. Under **Connection > SSH**, select **Enable Compression**.
    [![](/blog/assets/putty5.webp)](/blog/assets/putty5.webp)
11. Under **Connection > SSH > Auth**, click **Browse** and select the **privatekey.ppk** file you’d saved earlier.
    [![](/blog/assets/putty3.webp)](/blog/assets/putty3.webp)
12. Under **Connection > SSH > Tunnels**, type **9090** as the **Source port**, **Dynamic** as the **Destination**, and click **Add**.
    [![](/blog/assets/putty4.webp)](/blog/assets/putty4.webp)
13. Now click **Open**. You should get a terminal into your Amazon EC2 instance.
14. Open your Browser, and set the SOCKS server to localhost:9090. For Internet Explorer, go to **Tools – Options – Connections – LAN Settings**, select **Use a proxy ...**, click on **Advanced**, and type **localhost**:**9090** as the **Socks** server. Leave all other fields blank.
    [![](/blog/assets/ieconfig.webp)](/blog/assets/ieconfig.webp)
15. For Firefox, go to **Tools – Options – Advanced – Network – Settings** and select **Manual proxy configuration**. Set the Socks Host to **localhost**:**9090** and leave all other fields blank.
    [![](/blog/assets/ffconfig.webp)](/blog/assets/ffconfig.webp)
16. Also, go to URL **about:config**, and make sure that **network.proxy.socks\_remote\_dns** is set to **true**.

That’s it. You should now be able to check [most blocked sites](http://www.moon-blog.com/2009/02/top-ten-most-blocked-websites.html) like [Facebook](http://www.facebook.com/) and [YouTube](http://www.youtube.com/).
Those who favour the command line may want to automate Steps 1-7 by downloading Amazon’s [EC2 API tools](http://developer.amazonwebservices.com/connect/entry.jspa?externalID=351). [EC2 API tools work from behind a proxy too](http://developer.amazonwebservices.com/connect/message.jspa?messageID=52178). The commands you’ll need to use to setup are:
`set EC2_HOME=your-ec2-home-directory
set EC2_CERT=your-ec2-certificate
set EC2_PRIVATE_KEY=your-ec2-private-key
ec2-add-keypair mykeypair
ec2-authorize default -p 443
set EC2_JVM_ARGS=-DproxySet=true -DproxyHost=yourproxy \
-DproxyPort=yourport -Dhttps.proxySet=true \
-Dhttps.proxyHost=yourproxy -Dhttps.proxyPort=yourport \
-Dhttp.proxyUser=yourusername -Dhttps.proxyUser=yourusername \
-Dhttp.proxyPass=yourpassword -Dhttps.proxyPass=yourpassword
ec2-run-instances ami-ccf615a5 --key mykeypair --user-data-file your-startup-file-containing-lines-in-step-6`
You can go further and use any software (such as Skype) if you install [FreeCap](http://www.freecap.ru/eng/). More details are in this article on [Secure Firefox and IM with Putty](http://thinkhole.org/wp/2006/05/10/howto-secure-firefox-and-im-with-putty/).
Linux users may want to check out [ProxyTunnel](http://proxytunnel.sourceforge.net/) and this article on [Tunneling SSH over HTTP(S)](http://dag.wieers.com/howto/ssh-http-tunneling/).
**Update**: Follow-ups on [hacker news comments](http://news.ycombinator.com/item?id=1043413), [twitter](http://tweetmeme.com/story/427812352/ssh-tunneling-through-web-filters-s-anandnet), [delicious](http://delicious.com/url/0a6b39e211f481515ae02cab92cec1e7) and [digg](http://digg.com/security/SSH_Tunneling_through_web_filters_s_anand_net).

---

## Comments

<!-- wp-comments-start -->
- **[SSH Tunneling via Rackspacecloud | s-anand.net](http://www.s-anand.net/blog/ssh-tunneling-via-rackspacecloud/)** _11 Feb 2010 5:42 pm_ _(pingback)_:
  [...] Tunneling via Rackspacecloud February 11th, 2010 How I do things S Anand I wrote about SSH Tunneling through web filters using Amazon’s EC2 at 8 cents/hr. With Rackspacecloud, you can get that down to 1.5 cents/hr. [...]
- **[Janitha](http://www.janitha.com)** _10 Jan 2010 7:36 pm_:
  Good writeup, ssh tunnels are something I can't live without...
  Step 9 can be skipped completely if no proxy is needed to be configured.
  Also don't forget, doing all of this still sends the DNS requests in the clear to the usual/old dns server and not through EC2. If the DNS server is also meant to filter and redirect, this can be a issue. To go around that, in firefox you can go to about:config and set network.proxy.socks\_remote\_dns = true
- **[Janitha](http://www.janitha.com)** _10 Jan 2010 7:38 pm_:
  And for linux folks, you can simply run the ssh command with the -D switch.
- **[uberVU - social comments](http://www.ubervu.com/conversations/www.s-anand.net/blog/ssh-tunneling-through-web-filters/)** _10 Jan 2010 8:42 pm_ _(trackback)_:
  **Social comments and analytics for this post...**
  This post was mentioned on Twitter by proactivedefend: News Update: SSH Tunneling through web filters http://ow.ly/16iWFp...
- **[SSH Tunneling through web filters | s-anand.net &laquo; Netcrema &#8211; creme de la social news via digg + delicious + stumpleupon + reddit](http://www.netcrema.com/?p=24319)** _10 Jan 2010 10:16 pm_ _(pingback)_:
  [...] SSH Tunneling through web filters | s-anand.nets-anand.net [...]
- **[=== popurls.com === popular today](http://popurls.com/pop)** _10 Jan 2010 10:40 pm_ _(trackback)_:
  **=== popurls.com === popular today...**
  yeah! this story has entered the popular today section on popurls.com...
- **Kiril** _10 Jan 2010 10:52 pm_:
  Thanks for great tutorial. I have set it all up and it works!
  The only thing is that step 6 commands didn't execute after I started new instance. I had to log in and execute each line from the terminal.
- **kyle** _11 Jan 2010 1:27 am_:
  If you have access to a webserver that has sshd running you can do this as well. You use the 'D' flag with ssh for dynamic port forwarding. Its the same thing you are doing here just without aws. I use:
  ssh -D 1080 username@site.com and set firefox to use a socks proxy localhost 1080
- **[SSH Tunneling through web filters | s-anand.net : Popular Links : eConsultant](http://popular.econsultant.com/ssh-tunneling-through-web-filters-s-anand-net/)** _11 Jan 2010 2:43 am_ _(pingback)_:
  [...] rest is here: SSH Tunneling through web filters | s-anand.net 10 January 2010 | Uncategorized | Trackback | del.icio.us | Stumble it! | View Count : 0 Next [...]
- **dataminer** _11 Jan 2010 5:29 pm_:
  Or you can use a cheap linode / slicehost / prgmr virtual server and openvpn
- **spif** _11 Jan 2010 8:09 pm_:
  Good endpoint security can prevent this sort of thing, and even more sophisticated methods. But many organizations don't implement endpoint security at all, and others don't block or even monitor for this sort of thing.
- **Andrew** _10 Jan 2010 6:50 pm_:
  You should make sure in Firefox to set "network.proxy.socks\_remote\_dns" to TRUE under about:config. Otherwise, DNS requests will not be passed through your proxy and it will still be pretty obvious which sites you're browsing.
- **[S Anand](http://www.s-anand.net/)** _29 Jan 2010 8:34 am_:
  Thanks Coop, I fixed it. (Actually, I changed it to "/etc/init.d/ssh restart" which works for me. Haven't tried reload.)
- **Coop** _28 Jan 2010 4:04 pm_:
  FYI. There's a typo in the instructions on step 6 for those of you trying to get this to work.
  The final line of the command reads:
  /etc/init.d/sshd reload
  It should read:
  /etc/init.d/ssh reload
  Change that and it'll work. Pretty speedy too. The only downside to this is the need to constantly stop and start instances because you're cheap like me. Wish I could somehow trigger a new instance and terminate it after a set amount of time whilst updating the public DNS entry in putty. Un-likely.
- **[TTA](http://www.tarunactivity.com)** _18 Jan 2010 3:49 pm_:
  Good .. except for the fact that ~most if not all offices would forbid tunnelling for this very reason :P ...
- **[&raquo; How to get through your office&#8230; Thej Live](http://thej.in/?p=4583)** _18 Jan 2010 4:02 pm_ _(pingback)_:
  [...] to get through your office proxy using AWS http://www.s-anand.net/blog/ssh-tunneling-through-web-filters/ [...]
- **[S Anand](http://www.s-anand.net/)** _3 Feb 2010 5:26 pm_:
  Incidentally, with Rackspace Cloud's 1.5 cents per hour pricing, this becomes significantly more attractive.
- **anderbill** _19 Jan 2010 11:05 am_:
  I use ssh tunnel easy, get it from http://www.networktunnel.net
  Ssh Tunnel Easy is an innovative ssh tunneling software, it can make an encrypted ssh tunnel between your machine and ssh server host, then tunnel your program TCP connection automatically through this encrypted tunnel to data forwarded. It help you unblock and surf securely in the internet.
  Main features
  All in One
  A simple all in one solution, you do not need a complex sockscap/firefox + autoproxy + myentunnel + putty combination, and only a few mouse click, all config completed. Auto reconnect, support https proxy and NTLM authentication.
  Multi channel load balancing
  Under normal circumstances, because the SSH server is limiting the number of simultaneous connections, if you have too much TCP concurrent connections in one tunnel, may be cause your SSH tunnel freeze. Therefore, Ssh Tunnel Easy use similar to IE's LCIE (Loosely-Coupled IE) multi-channel load-balancing technology to improve it. In other words, Ssh Tunnel Easy will automatically create multiple ssh tunnel, then your browser's tcp connections will automatically be distributed to each ssh channel average, so that each channel ssh connections will not be too much, solve this problem perfect, and it can also significantly speed up your browsing speed.
- **Morbius** _14 Feb 2010 12:28 am_:
  I have read with interest the articles related to SSH Tunneling (through Web Filters and RackSpaceCloud) published on this web site.
  The problem I am trying to solve is slightly different, but I believe that someone might be able to guide me towards a solution.
  DESCRIPTION OF MY PROBLEM
  I would like to connect to several multi-media web sites located in several countries (namely France, Netherlands and Germany) and access some of the contents present on those sites. However, I am located in another country (I am based in Asia), and the problem is that those websites filter the access to their contents based on location: for instance, the French web site only allows access to its contents to users located in France. The filtering seems to be done via the IP address.
  Are their any tools that I could use and which could allow me to bypass this filtering, by making me appear like someone being based in the said country (for instance, in the example given above, France) ? I imagine that I should be able to select the country I want to appear being in.
  Could someone kindly help me and guide me towards a possible solution to my problem ?
  Thanks for reading, and I would just like to add that I use a client platform based on Windows 7.
- **[S Anand](http://www.s-anand.net/)** _14 Feb 2010 4:56 pm_:
  @Morbius: Not sure... you'd need a server in each of those countries. EC2 has a Europe instance that's based in Dublin. Not sure which cloud vendors have servers in those places, though.
- **[S Anand](http://www.s-anand.net/)** _5 Mar 2010 2:24 pm_:
  http://www.mtu.net/~engstrom/ssh-proxy.php explains how to use corkscrew on Linux machines to use SSH via a proxy.
- **Morbius** _18 Feb 2010 1:11 pm_:
  Thank you for your answer, S.Anand.
  Do you think that using the Tor Network (I am afraid it might be a little slow, given that the data I need to access are video files...) or XeroBank (heard of it, but never used it...) could help?
- **[Ravi Atluri](http://blog.raviatluri.in)** _12 Nov 2010 5:19 pm_:
  I am having some problems with proxy authentication while SSH tunneling.
  Did you face any issue with ISA authentication ?
- **[Using sshuttle to remain Safe on Insecure Wi-Fi | Thejesh GN](http://thejeshgn.com/2012/06/28/using-sshuttle-to-remain-safe-on-insecure-free-wifi/)** _28 Jun 2012 12:57 pm_ _(pingback)_:
  [...] If you are on Windows try Anand’s method. [...]
- **[It&#8217;s Raining min()!: Running SEASR&#8217;s MEANDRE software as an Amazon Cloud Instance | devolution](http://www.devingriffiths.com/archive/2011/06/its-raining-min-running-seasrs-meandre-software-as-an-amazon-cloud-instance/)** _29 Jun 2011 6:07 pm_ _(pingback)_:
  [...] path viable.  But in the short term, all I needed to do was bind those ports on my local PC to an ssh tunnel, and configure my Firefox browser to use the linux box as a proxy using the ssh tunnel. [...]
- **[How to remain anonymous online | Thejesh GN](http://thejeshgn.com/2012/04/10/howto-remain-anonymous-online/)** _10 Apr 2012 9:23 am_ _(pingback)_:
  [...] is similar to the one explained in this blog title Tor on SSH. Its not very difficult to build an SSH tunnel yourself. [g] SSHing over Tor is very [...]
- **[Nikolay Kolev](http://nikolay.com)** _4 Dec 2011 8:21 pm_:
  I've been using Hamachi for the same purposes (now part of LogMeIn) and, just in case, I SSH over Hamachi's connection: [LogMeIn Hamachi](https://secure.logmein.com/products/hamachi/).
- **[Software for my new laptop 2 | s-anand.net](http://www.s-anand.net/blog/software-for-my-new-laptop-2/)** _27 Sep 2011 7:16 pm_ _(pingback)_:
  [...] Putty [new]: SSH for Windows, but can also act as an SSH tunnel [...]
- **[S Anand](http://www.s-anand.net/)** _17 Jul 2011 8:15 am_:
  @Lemming, as long as you have PuTTY running on your machine, others can use YOUR machine as a Socks proxy. Or you could create a non-root account for them on the EC2 server to log into.
- **Lemming** _15 Jul 2011 1:49 am_:
  Hi S Anand, I followed your instructions and the SOCKS server/proxy is working great on my machine. Thanks for the detailed instructions!
  I'm wondering if I could share the SSH server with some friends. A number of them face restrictive proxies like you described, while others have to travel to China for work. How would I share my SSH server, without giving away my private key and root access to the EC2 instance? My friends would also be using Windows/PuTTY.
- **Lemming** _20 Jul 2011 3:46 pm_:
  Hi S Anand, thanks for the info. I'll look into a non-root account solution.
- **Mohamed Infaz** _11 Jun 2012 3:40 am_:
  Sir, lets say i have successfully done this!! can i use this sock5 proxy to by pass torrent block in my university network?! We are using a proxy sever to connect to the internet in our university and otherwise we are not able to connect to the network! I have successfully used ultrasurf software to good effect to bypass download limits! so i am sure that i would be able to pent 9996 port. Can i use that port, as the source port for incoming connection in utorrent?! Please help! :)
<!-- wp-comments-end -->