Jump to Navigation

Blogs

xrayspx's picture

Simple location aware ssh tunneling for Chrome (Mac)

Music: 

Hall and Oates - Private Eyes (Seriously, it just came on randomly)
and really, just as I finished formatting the stupid script, Big Brother from Humanwine was playing.

This is both a nice toy to have in a Big Brother Is Watching sense, and a glaring example of why one should never log in and use a Mac (or any other system obviously) as an Administrator. Just have a Regular Guy account, and escalate to Administrator/Root when needed. For example, this tool could be inserted by a script to cause all your browsing traffic to route through a proxy server of an attackers choosing. If you're not running as an Administrator, you can't write the file without escalating. (Example of the risk, though it wouldn't help here, since there is LCE to root...goddammit Apple...)

I had a use case recently where I wanted to have multiple copies of Chromium start in different profiles and with different proxy settings. I'm getting to the point at which I don't think that's really feasible, in that any new instance will assume the proxy settings of any already running instance.

BUT, I did get some cool location aware-ish proxying set up. Since one use case involves laptops, I'd like to see it use a local proxy when I'm home, and a remote proxy when I'm not at home (hosted VPS for instance).

I'm using ssh to set up a SOCKS5 proxy, and push all traffic including DNS through the tunnel, ssh'ing to different hosts based on different local system IPs. I have it checking en0 and en1 and if their IPs match my home subnet, it ssh's to a local system, if they are anything else, it will run against a publicly hosted system to which I can ssh.

Next step is to clean up after itself, so when you run Chromium (or Chrome), it will detect IPs, ssh to the appropriate host, and connect using that tunnel. When Chromium closes, it cleans up the SSH session so it's not just hanging around.

To use - Have a local and remote host you can ssh to using keys, and which allow you to forward. On the Mac, navigate to /Applications/Chromium.app/Contents/MacOS/. Rename Chromium to Chromium-bin. Drop this script in, chmod appropriately, and name it Chromium. Now when the Chromium app is run, it runs our script to set up proxies and launch the browser:


#! /bin/bash

ip0=`ifconfig en0 | grep -v inet6 | grep inet | awk '{print $2}' | awk -F "." '{print $1"."$2"."$3}'`
ip1=`ifconfig en1 | grep -v inet6 | grep inet | awk '{print $2}' | awk -F "." '{print $1"."$2"."$3}'`

if [ -z "$ip0"  ]
  then
   if [ "$ip1" = "192.168.30" ]
     then
       ssh -C2qTnN -D 8181 username@192.168.30.241 &

       proxypid=`jobs -p`
       /Applications/Chromium.app/Contents/MacOS/Chromium-bin --proxy-server="socks5://127.0.0.1:8181" --host-resolver-rules="MAP * ~NOTFOUND, EXCLUDE 127.0.0.1" --profile-directory=Tunnl 2>&1 /dev/null

       kill $proxypid

      else

        ssh -C2qTnN -D 8181 username@publichost.com &

        proxypid=`jobs -p`
        /Applications/Chromium.app/Contents/MacOS/Chromium-bin --proxy-server="socks5://127.0.0.1:8181" --host-resolver-rules="MAP * ~NOTFOUND, EXCLUDE 127.0.0.1" --profile-directory=Tunnl 2>&1 /dev/null

        kill $proxypid

      fi

  elif [ "$ip0" = "192.168.30" ]
    then
      ssh -C2qTnN -D 8181 username@192.168.30.241 &

      proxypid=`jobs -p`
      /Applications/Chromium.app/Contents/MacOS/Chromium-bin --proxy-server="socks5://127.0.0.1:8181" --host-resolver-rules="MAP * ~NOTFOUND, EXCLUDE 127.0.0.1" --profile-directory=Tunnl 2>&1 /dev/null

      kill $proxypid

  else

      ssh -C2qTnN -D 8181 username@publichost.com &

      proxypid=`jobs -p`
      /Applications/Chromium.app/Contents/MacOS/Chromium-bin --proxy-server="socks5://127.0.0.1:8181" --host-resolver-rules="MAP * ~NOTFOUND, EXCLUDE 127.0.0.1" --profile-directory=Tunnl 2>&1 /dev/null

      kill $proxypid

fi

xrayspx's picture

In which I am annoyed at the radio

Music: 

"(Consumers are) getting their raise through the gas tank rather than their employers" - Sudeep Reddy, Marketplace

Sorry Kai, but yeah, that is a really weak statement. Between that quote last week, and all the stories about consumers already buying bigger more gas-guzzlin'er trucks and SUVs because pump prices have gone down, I just got annoyed enough to write this.

People don't really look at what's their ultimate best interest, they don't make math-based decisions. They think "Wow, gas just went down by 20%, so I can buy a car which uses 60% more fuel". Here is math:

At 90 miles/day, I drive somewhat more than the average person (78% of people have a less than 20 mile commute? DAMMIT). My 2005 Toyota gets a consistent 34MPG. Gas has gone down by 60 cents around these parts.

So what does that mean?

270mi per week (I work from home two days a week)
8 gallons of gas

$28.40 - 8 gallons of gas at $3.55

$23.60 - 8 gallons of gas at $2.95

$39.85 - What I'd pay at $2.95/gal for the 13.5 gallons of gas I'd use if I bought an SUV making 20mpg

(So all this means that I pay $7.80 every day to sit in traffic for > 3 hours, before factoring in maintenance / wear & tear)

That means that the difference caused by this precipitous drop in prices is $5 per week, for me. That's not even enough for a pack of smokes. So much for people "getting their raise through the gas tank". $260 per year, thanks a bunch guys, but I'm better off with even a 1% pay increase. Even with the 20MPG Jeep that I had prior to the Toyota, it would still only be a $9/week difference. Not exactly enough to finance payments on a new SUV, let alone the fact that you now burn much more gas than is offset by the price decrease.

Being able to do arithmetic also accounts for why I don't drive a Prius or whatever. There's no way the increased milage would pay off over the facts that a Prius costs $10000 more (base) than I paid for the Corolla which is fully paid for. Even if I were to get a new car, it's unlikely the Prius speicfically would be worth the extra cost for the extra 14MPG, that's not even factoring in battery changes, which aren't cheap, and which I'm sure I'd have needed a couple of to match the 220,000 miles on my Corolla.

I don't pretend to know or care why people make the choices they do, but it's almost certainly more that they "feel" things are "good", and so decide to splurge on some new car, telling themselves that gas is cheap, so it doesn't matter.

People probably feel this way because of glib statements by people they perceive as being subject matter experts.

Fixed Tags:
xrayspx's picture

TV Cabinet

Music: 

Curtis Mayfield - Superfly

Last winter we had some of our barn renovated into a new living room. Natalie has gone crazy with the retro look in here, and we just put in the second-to-last piece, a good looking spot for the TV (I'm still nagging her to just drop the hammer on an Eames lounge...).

We had been looking for a while for a '60s hi-fi console, but she found them too big, and they're really not deep enough to fit things like computers and large receivers. My requirements were 18" for the PC to fit comfortably, for instance. At one point I told her to give up on those, and just look for dressers that matched the depth requirement, here's what she found, for $55:

For reasons that aren't entirely clear to me, I decided that Step One was to rip the pressed board back off. We still have it, and it should honestly probably go back on with appropriate holes drilled. I really don't remember what I was thinking.

Anyway, we shimmed the drawer holes so things would fit flat without taking out the drawer track. The goal was to do as little damage to this thing as possible, just in the case we want to use it as a dresser, or re-sell it or whatever later. None of those things are going to happen. Here's that interim state:

And a wider view of how it fits in the room:

To cover the holes I had suggested some cool amp grille cloth fabric, but we actually had some pretty good stuff on-hand. It also has the advantage of not having a really tight pattern, so if it's stretched more in parts, you can't tell. The grilles are then held on by cabinet magnets. So the extent of the modification of the dresser is 12 screws to hold the metal plates the magnets stick to:

Done:

I may take some black cloth and add it to the inside, just to block 100% of the LED light when all the room-lights are off, but with the lights on, you can't see anything.

xrayspx's picture

Name your vulns better

Music: 

George Clinton - Yank My Doodle

Drupalgeddon is silly, but at least it gets the point across that something is wrong and you must go fix it right now. Heartbleed, Shellshock, POODLE... not so much. At least we all had a heads-up that "some horrible SSLv3 attack" was coming even if no one knew specifics.

We've had enough this year already. Who wants a do-over on 2014?

xrayspx's picture

George Clinton & PFunk, Plymouth NH

Music: 

Ball of Confusion - The Temptations

If you've never seen the beautiful chaos of a George Clinton show, you hate music, it's that simple.

Fixed Tags:
xrayspx's picture

GoFlex Headaches

Music: 

click-click-click-bzzzzzzzzzzzz-WHACK

A couple of weeks ago the drive in my GoFlex home finally died. It had had some filesystem corruption earlier this year, so I pretty much knew it was coming. I replaced the drive, and started making rash decisions. All the stupid factory junk software is disabled, but the big change was that I formatted New Drive with EXT3, since they were using NTFS (on Linux) for some unholy reason that I will probably never understand.

Well, now the drive seems not to sleep, and the drive LED blinks continuously. It doesn't vary at all, so I'm not convinced it's activity related, but there's also no LSOF on the machine, so I'm a tiny bit blind. I think a lot of the issue with Old Drive was that I was writing syslog to it from all my local hardware, which prevented it from ever spinning down. I'd like to prevent that with New Drive by sending all my shit to a Raspberry Pi instead (Raspberry Pi runs extremely well off the USB port from the GoFlex, and it also does a great job of running Privoxy).

I'm looking at ps and netstat -pnat output, and don't see anything which should necessarily be slamming the drive. Meanwhile, I need to go find an ARM lsof binary I can drop on this thing.

xrayspx's picture

I might have a concert problem

Music: 

Depeche Mode - Policy of Truth

Here is an annotated email from Ticketmaster:

Fixed Tags:
xrayspx's picture

Good Utility

Music: 

Natalie handed me this letter from PSNH last night. I had expected it to say something to the effect of "thank you for paying for all of our kids to go to college by installing baseboard electric". It started off mentioning something about snow.

I had my moment of: "OH AND YOU GUYS CAN GO FU... hey, this is nice", and so I share it:

Fixed Tags:
xrayspx's picture

T**e *h* S**n****s B***i**G, **k* ***m b****n*.

Music: 

Xebox - Bunker Buster

This week David Lowery grumpled many of the Interbutts as he published a list of 50 "undesirable" (read: "un-licensed") music lyrics sites to target for legal action by the National Music Publishers Association (NMPA). With some major exceptions (RapGenius!), many of these sites do, in fact, suck. They're undesirable from an Internet user standpoint as well what with pop-unders and malware.

The fact is, they are worried about lost revenue from the licensing fees these guys should be paying, and the fact that lyrics sites have tons of ads, and that it follows that their owners are sitting on massive piles of cash in the Caymans. So let's go sue 'em all and get that Scrooge McDuck money silo each of them has to have. Here's a better idea, why doesn't the industry run its own goddamn lyrics sites? Well hell, I bet since we live in The Future and all, you could even track how many times someone searches for a song and give Dave Lowry his quarter of a cent per 100 impressions for Euro-Trash Girl lyrics.

The claim that it's "ripping us off as artists" is unconvincing though. If someone's reading the lyrics, you must assume they're listening or have just listened to that song, which they either own or they don't (Keep going after those pirates, I can at least see the point kind of, best of luck). Very very few songs have lyrics that merit reading on their own without music surrounding them. No one is reading the lyrics to Dr. Heckyll & Mr. Jive who isn't also listening to that song right now.

The Musician as modern Shelley is in all but the most exceptional cases disingenuous at best (Fun fact: Search for Percy Shelley on Google, and the #3 hit after Wikipedia and Poets.org is poemhunter.com, one of the NMPA's targeted sites of IP thieves). Off the top of my head, I can think of four musicians whose lyrics I could just sit and read, and even that is only a handful of songs per artist. Also off the top of my head, I can think of zero musicians whose lyrics I have just sat and read as art for its own sake.

It certainly didn't take Tennyson to write Take The Skinheads Bowling.

"Industry Sues Morons, film at eleven". Fine. "Fragile snowflake genius loses livelihood when someone can search for their lyrics for /free(!)/". Well you lost me there pal.

xrayspx's picture

It Was The D&D Of Food

Music: 

Talking Heads - Once In A Lifetime

Tue, 01/01/2008 - 12:01pm - We picked 12lb of plums from one of our two plum trees this week.  We'll have jam, crumble, vodka/plum-stuff, and just like, normal casual eating plums.</p>
<p>Part of this blog entry on a food trade I made for some bitter melon:<br />
www.xrayspx.com/it-was-dd-food csFlickr Some time ago, one of my cow orkers sent me home with some Chinese bitter melon in trade for some of our plums. Natalie fell in love with it immediately, but I can't really get past just how strong it is. I was knocking it down with hot sauce, as I do.

Yesterday I showed up and what do you know? Three more bitter melons ready for me to take home, including one /monster/ of the species which just couldn't have been natural. Fortunately I found the answer at a farm stand tonight. They had bhut jolokia (improperly "ghost chili") peppers.

This was like two titans doing battle on my tongue! I'm fine with the heat of the jolokia by now, but what I love from it is the powerful fruity, citrusy flavor that just crushes you when you put it in your mouth, before it even touches your tongue. It pretty much perfectly set off the bitter melon.

I must have eaten 1.5lb of stir fry and my mouth is very very happy with me.

Fixed Tags:

Pages

Subscribe to RSS - blogs


by Dr. Radut