Skip to content

Latest commit

 

History

History
60 lines (40 loc) · 1.96 KB

Securing-Public-Shadowsocks-Server.md

File metadata and controls

60 lines (40 loc) · 1.96 KB

If you share your server with strangers, you need to be careful. The numbers used below are just examples.

  1. Optimize your server

  2. Limit bandwidth

     apt-get install wondershaper
     # limit bandwidth to 10Mb/10Mb on eth0
     wondershaper eth0 10000 10000
    
  3. Limit connections

     iptables -A INPUT -p tcp --syn --dport ${SHADOWSOCKS_PORT} -m connlimit --connlimit-above 32 -j REJECT --reject-with tcp-reset
    
  4. Prevent ssh password cracking

     apt-get install denyhosts
    
  5. Prevent Shadowsocks password cracking

  6. Block connection to localhost

  7. Run Shadowsocks server as nonroot user

     sudo useradd ssuser
     sudo ssserver [other options] --user ssuser
    
  8. Block traffic to non-HTTP port

     iptables -t filter -m owner --uid-owner ssuser -A OUTPUT -p tcp --dport 80 -j ACCEPT
     iptables -t filter -m owner --uid-owner ssuser -A OUTPUT -p tcp --dport 443 -j ACCEPT
     iptables -t filter -m owner --uid-owner ssuser -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset
    
  9. Block BitTorrent trackers

     apt-get install nginx
    

    Edit nginx configuration:

     server {
         listen 0.0.0.0:3128;
         resolver 8.8.8.8;
         location / {
             set $upstream_host $host;
         if ($request_uri ~ "^/announce.*") {
                 return 403;
             }
             if ($request_uri ~ "^.*torrent.*") {
                 return 403;
             }
             proxy_set_header Host $upstream_host;
             proxy_pass http://$upstream_host;
             proxy_buffering off;
         }
     }
    

Redirect 80 port to nginx:

    iptables -t nat -m owner --uid-owner ssuser -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port 3128