TWiki> Main Web>Computing>WebProxy (revision 1)EditAttach

Nevis web proxy

The information on this page is of use to you only if:

  • You have a computer running on an insecure network; e.g., a laptop on a wireless network at an airport; and
  • You have an account on the Nevis Linux cluster.

Warning: This procedure described on this page is not difficult, but it is certainly not trivial. Eventually, the web-browser developers will make this procedure automatic. Until then, if you want a secure web connection, you have to configure it manually.

What it's for

It has now become trivially easy to "hijack" an insecure network connection on a public network. Here is an example.

In particular, laptops that connect using public wireless networks are especially vulnerable to having their web sessions "hijacked." As the article states, one way to solve this problem is through a web proxy, that is, an intermediate server that re-directs all the network traffic from your web browser. Since a good fraction of the scientists associated with Nevis have laptops that they use on public networks such as those at airports, it makes sense to have a web proxy server at Nevis.

How to use it

To make a secure connection to a web proxy requires two steps:

Forward a secure port from your laptop to the web proxy

The simplest way to accomplish this step is to use SSH.

Important: The following commands create an SSH session that runs as a background process. It can be cut off by anything that would cut off a regular SSH session; e.g., closing the lid of your laptop to put it in hibernation, then going to another airport. You must enter the following command every time you want to set up port forwarding. (Yes, this is the biggest pain of this entire process. This may be a good time to learn about command aliases.)

Mac or Linux

If your laptop runs Mac OS X or Linux, ssh will already be installed. Open a terminal window and type the following command:

ssh -fxNL 8888:proxy.nevis.columbia.edu:3128 <user>@proxy.nevis.columbia.edu
where <user> is the name of your account on the Nevis Linux cluster. You will be prompted to enter your Nevis password (unless you've set up an ssh private key).

Windows

Install PuTTY if you have not already done so. Assuming you've installed the program in its default location C:\Program Files\PuTTY:

  • Select "Run..." from the Start menu.
  • Type "cmd" in the dialog box.
  • At the terminal prompt, type:
"c:\Program Files\PuTTY\putty.exe" -ssh -x -N -L 8888:proxy.nevis.columbia.edu:3128 <user>@proxy.nevis.columbia.edu
where <user> is the name of your account on the Nevis Linux cluster. A new window will open, and you will be prompted to enter your Nevis password. If everything works, you won't see anything more happen in the new window.

Set up the proxy in your web browser

This is a one-time procedure. You may want to turn off the proxy setting off (for example, if you've lost the SSH connection or you're on a secure network) but you normally don't have to type it into your browser preferences again.

Firefox (or any Mozilla-style browser)

  • Go into the browser preferences:
    • On Linux, this is "Preferences..." from the Edit menu.
    • On Mac OS X, this "Preferences..." from the Firefox menu.
    • On Windows, this is "Options..." from the Tools menu.
  • Click on the "Advanced" button.
  • Click on the "Network" tab.
  • Next to "Configure how Firefox connects to the Internet" click "Settings"
  • Click on the radio button next to "Manual Proxy configuration".
  • In the box next to "HTTP Proxy:", type localhost
  • In the next box to the right, next to "Port:", type 8888
  • Click on the box next to "Use this proxy server for all protocols"
  • Click "OK" at the bottom of the pane to accept these settings.

The next time you load a web page, your browser will prompt you for your Nevis account name and password.

Safari on Mac OS X

  • Start up "System Preferences" under the Apple menu.
  • Select the "Network" preference panel.
  • Click on the "Advanced..." button near the bottom of the panel.
  • Click on the "Proxies" tab.
  • Click on the line "Web Proxy (HTTP)" to turn it on.
  • Under "Web Proxy Server" type localhost; enter 8888 in the box after the colon.
  • Click on the box next to "Web proxy server requires password"
  • Enter your Nevis account name and password in the appropriate fields.
  • Go back to the left-hand part of the pane and click on "Secure Web Proxy (HTTPS)" and fill out that pane in the same way.
  • Click "OK" at the bottom of the pane.
  • Click "Apply" at the bottom of the panel.

The next time you load a web page, the Keychain program will ask for permission to access your account information; click on "Always allow".

Internet Explorer on Windows

  • Select "Internet Options" under Tools.
  • Click on the "Connections" tab.
  • Click on the "LAN settings" button near the bottom of the panel.
  • Click on the button next to "Use a proxy server for your LAN"
  • In the "Address" field, enter localhost
  • In the "Port" field, enter 8888
  • Click on the "OK" button near the bottom of the panel.
  • Click on "OK" again.

The next time you load a web page, your browser will prompt you for your Nevis account name and password.

Skip SSH?

If you're technically inclined, you might have realized that it's not "mechanically" necessary to do port-forwarding via SSH. It far simpler just to put in proxy.nevis.columbia.edu for the proxy server, and 3128 for the proxy port.

This will work. It's also foolish. If you do this, you will still be prompted for your Nevis account name and password when you access web pages, and that information will be sent over the network in clear text. It's also possible that this will still enable a sniffer to capture your web session cookies, which is the point of this exercise.

So don't skip the SSH port forwarding.

Edit | Attach | Watch | Print version | History: r10 | r4 < r3 < r2 < r1 | Backlinks | Raw View | Raw edit | More topic actions...
Topic revision: r1 - 2010-11-04 - WilliamSeligman
 
This site is powered by the TWiki collaboration platform Powered by PerlCopyright © 2008-2020 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback