Ssh dynamic port forwarding and tcpdump shows cleartext

dumpport-forwardingssh

I'm trying to encrypt my web traffic using SSH dynamic port forwarding in case I happen to be in moot places such as internet cafes, hotels and so on.

On my laptop I installed an SSH server and executed:

ssh -C -D 1080 myuser@localost

I then configure my browser to use a socks proxy on localhost:1080

I tried to browse a few sites to see what was sent but I guess I'm doing clearly something wrong because upon a tcpdump:

sudo tcpdump -A -i eth0 dst www.example.com

I see everything in clear text, even some fake password I tried on forms.

I thought I was setting up and encrypted tunnel, impossible to snoop.

What am I doing wrong?

Thanks for your time.

Best Answer

You are creating SOCKS proxy with tunnel from your local computer to your localhost. But from the localhost to the target server (example.com), the data re not encrypted anymore. Diagram:

[browser] ==SOCKS== [localhost:1080] ==SSH== [localhost] ==HTTP== [example.com]

(where only the SSH part, meaning SSH tunnel, is encrypted)

You can encrypt this SOCKS proxy only point-to-point (from your client to your ssh server) and not further. The HTTP server expects normal HTTP requests and not SOCKS messages.

If you would like to be safe from the snooping in the hotel or somewhere else, you need to have an SSH server in some location other than on your computer (e.g. VPS, home). But it won't protect you from snooping "around" the other computer.

Related Question