Search code examples
windowsauthenticationwindows-authenticationsocks

authentication method when using socks4


I have a socks4 server that I use to proxy requests from different kinds of applications (http, ftp, etc..) to their destination.

I know that socks4 does not define a way for applications to authenticate in any way (it specifies only an optional username when client connects to the server but it seems there is no way you can tell the client that is should send that information in order for the server to relay the request)

Is there a way to implement some kind of authentication over socks4 that is understood by the regular applications protocols: http, ftp, and others ?


Solution

  • Read up on how the SOCKS protocol works.

    The second byte of a SOCKS v4/4a response is a status value that indicates whether the client's request was accepted or rejected (and why). In this case, you would likely need to use status values 0x5C (request failed because client is not running identd or it is not reachable from the server) and 0x5D (request failed because client's identd could not confirm the user ID string in the request). That would make the request's username field have to contain a valid and recognizable value. This is not true authentication, of course, since a client can run an ident server that reports whatever it wants.

    Otherwise, switch to SOCKS v5 instead, which has support for true server-side authentication.