HOWTO: Secure Firefox and IM with PuTTY

There are times when you want to connect to the Internet through unknown and/or insecure networks such as the local or other WiFi hotspot. If you aren’t careful, you might make it all too easy for someone to sniff your connection using .

One of the best ways to secure your connection is to , but that isn’t always practical. So here’s a way to securely connect to the net using only an SSH client and a remote box that you control/trust.

Requirements:

1. * loaded on your local machine
2. Remote host running (e.g. Linux box at home)
3. (obviously)
4. for all your IM needs

Just follow these steps…

1. Create a new PuTTY session
Run PuTTY and create a new session in PuTTY to connect to the remote host that is running OpenSSH. Fill in the hostname, the port (usually 22), make sure SSH is checked, give it a session name and hit Save:

2. Configure a secure tunnel
Click on “Tunnels” on the left and set up dynamic fowarding for a local port (e.g. 7070). Under “Add new forwarded port” type in 7070 for the source port, leave the destination blank, and check Auto and Dynamic. Then it the Add button. If you did it correctly, you’ll see D7070 listed in the Forwarded Ports box:

That’s it for tunnels, as there is no need to create more than one. Remember to save your session profile in PuTTY so you don’t have to set up the tunnel next time.

3. Connect to the remote SSH box
Double click on the connection profile and type in your username and password when prompted.

4. Configure Firefox
Go to Tools, Options, General, and then click on Connection Settings…

Check Manual Proxy Configuration, leave most of the fields blank, but fill in for the v5 host with a port of 7070 (or whatever you used in Step 2):

5. Configure Gaim
Fire up Gaim and hit the Preferences button:

Then select Network on the left and set up the Proxy Server. The Proxy Type should be SOCKS 5. The host is 127.0.0.1 and the port is 7070 (or whatever you chose in Step 2).

There’s no need for a user or password. Then hit close.

6. Enjoy
That’s it. From now on, as long as you first log into the remote ssh host with PuTTY, your Firefox and IM traffic will be routed over a secure tunnel to the remote host and then out to the Net. Good stuff.

* Yes, is available for Linux. It’s even in !

Update (Email): Actually, the setup for to securely proxy your email traffic is pretty much the same as it is for Firefox.

And then type in 127.0.0.1 and your port number:

That’s it.

Update: Getting some linkage from Digg.

Corrections/Addendum:

1. Note that this method will secure your connection between your remote location (e.g. WiFi hotspot) and the ssh host (e.g. Linux box at home). It is not secure from the ssh host to Internet. For the most part, that’s OK as it will provide reasonable protection from people running packet sniffers at the hotspot. But please recognize that if your ssh host is on your cable connection at home, your ISP can still (obviously) easily sniff all your packets.
2. Quite a few people have correctly pointed out that DNS queries will still be “leaked” to the untrusted network. So the names of any sites you visit will still get logged.

   Now if you don’t mind people knowing what sites your are connecting to, then there’s nothing to worry about. But if are running the current version of Firefox and would like to protect that information, you can open the about:config page, and change network.proxy.socks_remote_dns to true.

   You can do the same thing in Thunderbird if you would like.

   For a greater level of security on all your connections, you should consider running a full VPN (see also: ).

3. As Nate pointed out in the comments, if you have the command-line version of OpenSSH already installed on your computer, you don’t need to mess with PuTTY. Just run ssh -D 7070 [e-mail] and that will set up your tunnel. I’m not an Apple user, but I think OS X has everything you need.
4. There are of Firefox, Gaim, and Thunderbird, and PuTTY runs from a USB drive. So using this method (unlike using OpenVPN) there is no need to install anything on the computer you are using. Quite handy if you are borrowing someone’s computer or you are in a school computer lab.
5. How do you know if it’s working? Personally, I used to look at the packets and make sure they looked encrypted and were on the right ports. Of course, any packet sniffer would do.

   The other method (and I tried this one too) is to get all set up and running with the tunnels. And then after it is apparently working, kill PuTTY and see if you lose the connection.

   Of the two, the packet sniffer is the better way to go.

6. Apparently only does SOCK4. I didn’t personally try it, but this should work with SOCKS4 proxies as well as SOCKS5.
7. (non-commercial, home-use only) will let you run just about anything over a SOCKS5 proxy.

To add to what nathan suggested, on linux do

ssh -qTfnN -D 7070 remotehost.

All the added options are for a ssh session that’s used for tunneling.

-q :- be very quite, we are acting only as a tunnel.
-T :- Do not allocate a pseudo tty, we are only acting a tunnel.
-f :- move the ssh process to background, as we don’t want to interact with this ssh session directly.
-N :- Do not execute remote command.
-n :- redirect standard input to /dev/null.

In addition on a slow line you can gain performance by enabling compression with the -C option.