Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

i have a centos 6 VPS.

  • I use ssh -p 443 -D 8080 -f -C -N root@ip on mac terminal for SSH tunneling but with wireshark when i sniff my traffic i can see DNS requests are not encrypted ! (i use proxifier to cover my all traffic thru socks proxy). how i can secure DNS requests and UDP traffic by SSH tunnel ?
  • Also how can i disable SSH logs (it log all IP addresses using SSH) ? and how to remove old logs ?
share|improve this question
    
You might be better off in breaking this up into multiple quesitons. 1. How do I secure my DNS quereies, 2. How can I disable SSH logs, for example. –  slm Dec 27 '12 at 18:36
    
Also you shouldn't really cross post questions on multiple stackexchange websites, it's discouraged! serverfault.com/questions/461237/… –  slm Dec 27 '12 at 18:41
add comment

1 Answer

SSH tunnels aren't VPNs

First and foremost, let me say say that you should install OpenVPN (or similar) on your VPS and save you a lot of headaches. When connected to a VPN, you can easily make sure that all traffic will get routed through it.

DNS requests

Normally, DNS requests do not get routed through the proxy. Your ISP is (supposed to be) your DNS server, and there's no need for it.

You can specify a local address as your DNS server (system wide), e.g., 127.0.0.3 and set up port forwarding to a suitable DNS server:

ssh -p 443 -D 8080 -L 127.0.0.3:53:8.8.8.8:53 -f -C -N root@ip

Some applications also let you specify this. In Firefox, e.g., all you have to do is enter about:config set network.proxy.socks_remote_dns to true

Logging

In /etc/ssh/sshd_config, change the line

LogLevel INFO

to

LogLevel QUIET

This prevents sshd from sending data to the system log.

However, other processes might still log your IP address. For example, lastlog and last both store IP addresses you logged in from (using SSH is asically logging in) /var/log/lastlog and /var/log/wtmp, respectively.

If you're really that worried about logs, you can erase all files in /var/log periodically. But keep in mind that if somebody gets access to your VPS, he probably can get access to the purchase information as well.

share|improve this answer
    
what about ssh -w vpn ? (openvpn blocked by my isp) –  WhyFy Dec 27 '12 at 19:20
    
Tunneling the VPN traffic through SSH might work, but I haven't tried it and I'm not sure how to accomplish it. Unless your ISP does deep packet inspection (since port 443 works for SSH, there a chance it doesn't), you can configure your VPN to use a well-known port as well. Make sure your SSH server listens to a different port if you try 443 for the VPN! –  Dennis Dec 27 '12 at 19:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.