Merge pull request #2 from dan-v/ssh-auth

Security improvements

Author: dan-v

README.md

@@ -1,20 +1,20 @@
-<b>awslambdaproxy</b> is an [AWS Lambda](https://aws.amazon.com/lambda/) powered HTTP(s)/SOCKS web proxy. It provides a constantly rotating IP address for your web traffic from all regions where AWS Lambda is available. The goal is to obfuscate your web traffic and make it harder to track you as a user.
+<b>awslambdaproxy</b> is an [AWS Lambda](https://aws.amazon.com/lambda/) powered SOCKS web proxy. It provides a constantly rotating IP address for your web traffic from all regions where AWS Lambda is available. The goal is to obfuscate your web traffic and make it harder to track you as a user.
 
 ![](/images/overview.gif?raw=true)
 
 ## Features
-* HTTP(s) and SOCKS5 proxy support.
-* No special software required. Just configure your system to use an HTTP or SOCKS proxy.
+* SOCKS5 proxy support with username/password authentication.
+* No special software required. Just configure your system to use a SOCKS proxy.
 * Each AWS Lambda region provides 1 outgoing IP address that gets rotated roughly every 4 hours. That means if you use 10 AWS regions, you'll get 60 unique IPs per day.
-* Configurable IP rotation frequency between multiple regions. By default IP will rotate to new region every 3 minutes.
+* Configurable IP rotation frequency between multiple regions.
 * Personal proxy server not shared with anyone else.
 * Mostly [AWS free tier](https://aws.amazon.com/free/) compatible (see FAQ below).
 
 ## Project status
-Current code status: <b>proof of concept</b>. This is the first Go application that I've ever written. It has no tests. Listening endpoints have no security yet. It may not work. It may blow up. Use at your own risk.
+Current code status: <b>proof of concept</b>. This is the first Go application that I've ever written. It has no tests. It may not work. It may blow up. Use at your own risk.
 
 ## How it works
-At a high level, awslambdaproxy proxies HTTP(s) traffic through AWS Lambda regional endpoints. To do this, awslambdaproxy is setup on a publicly accessible host (e.g. EC2 instance) and it handles creating Lambda resources that run a simple HTTP ([elazarl/goproxy](https://github.com/elazarl/goproxy)) or SOCKS ([armon/go-socks5](https://github.com/armon/go-socks5)) proxy. Since Lambda does not allow you to bind ports in your executing functions, the proxy server is bound to a unix socket and a reverse tunnel is established from the Lambda function to port 8081 on the host running awslambdaproxy. Once a tunnel connection is established, all user web traffic is forwarded from port 8080 through this proxy. Lambda functions have a max execution time of 5 minutes, so there is a goroutine that continuously executes Lambda functions to ensure there is always a live tunnel in place. If multiple regions are specified, user traffic will be routed in a round robin fashion across these regions.
+At a high level, awslambdaproxy proxies TCP traffic through AWS Lambda regional endpoints. To do this, awslambdaproxy is setup on a publicly accessible host (e.g. EC2 instance) and it handles creating Lambda resources that run a simple SOCKS ([armon/go-socks5](https://github.com/armon/go-socks5)) proxy server. Since Lambda does not allow you to bind ports in your executing functions, the proxy server is bound to a unix socket and a reverse SSH tunnel is established from the Lambda function to the host running awslambdaproxy. Once a tunnel connection is established, all user web traffic is forwarded from port 8080 through this reverse tunnel to the proxy server. Lambda functions have a max execution time of 5 minutes, so there is a goroutine that continuously executes Lambda functions to ensure there is always a live tunnel in place. If multiple regions are specified, user traffic will be routed in a round robin fashion across these regions.
 
 ![](/images/how-it-works.png?raw=true)
 
@@ -48,17 +48,17 @@ The easiest way is to download a pre-built binary from the [GitHub Releases](htt
 1. Copy `awslambdaproxy` binary to a publicly accessible linux host (e.g. EC2 instance). You will need to open the following ports on this host:
 
     * Port 8080 - this port listens for user proxy connections and needs to only be opened to whatever your external IP address is where you plan to browse the web.
-    * Port 8081 - this port listens for tunnel connections from executing Lambda functions and needs to be opened to the world. <b>This is a security concern and will be locked down in the future.</b>
+    * Alternatively, a more secure option would be to not open any ports and setup a VPN connection to this host. A quick VPN solution for a setup like this may be [algo](https://github.com/trailofbits/algo).
 
 2. On publicly accessible host, run `awslambdaproxy`. You'll need to ensure AWS access key and secret key environment variables are defined. For now, this access key should have AdministratorAccess.
 
     ```sh
     export AWS_ACCESS_KEY_ID=XXXXXXXXXX
     export AWS_SECRET_ACCESS_KEY=YYYYYYYYYYYYYYYYYYYYYY
-    ./awslambdaproxy -regions us-west-2,us-west-1,us-east-1,us-east-2 -proxy-type socks
+    ./awslambdaproxy -lambda-regions us-west-2,us-west-1,us-east-1,us-east-2
     ```
 
-3. Configure your web browser (or OS) to use the HTTP/HTTPS or SOCKS5 proxy (depending on -proxy-type selection) on the publicly accessible host running `awslambdaproxy` on port 8080.
+3. Configure your web browser (or OS) to use the SOCKS5 proxy on the publicly accessible host running `awslambdaproxy` on port 8080.
 
 ## FAQ
 1. <b>Should I use awslambdaproxy?</b> That's up to you. Use at your own risk.
@@ -67,16 +67,14 @@ The easiest way is to download a pre-built binary from the [GitHub Releases](htt
 4. <b>Will this make me completely anonymous?</b> No, absolutely not. The goal of this project is just to obfuscate your web traffic by rotating your IP address. All of your traffic is going through AWS which could be traced back to your account. You can also be tracked still with [browser fingerprinting](https://panopticlick.eff.org/), etc. Your [IP address may still leak](https://ipleak.net/) due to WebRTC, Flash, etc.
 5. <b>How often will my external IP address change?</b> For each region specified, the IP address will change roughly every 4 hours. This of course is subject to change at any moment as this is not something that is documented by AWS Lambda.
 6. <b>How much does this cost?</b> awslambdaproxy should be able to run mostly on the [AWS free tier](https://aws.amazon.com/free/) minus bandwidth costs. It can run on a t2.micro instance and the default 128MB Lambda function that is constantly running should also fall in the free tier usage. The bandwidth is what will cost you money; you will pay for bandwidth usage for both EC2 and Lambda.
-7. <b>Why does my connection drop periodically?</b> AWS Lambda functions can currently only execute for a maximum of 5 minutes. In order to maintain an ongoing HTTP proxy a new function is executed and all new traffic is cut over to it. Any ongoing connections to previous Lambda function will hard stop after a timeout period. You generally won't see any issues for normal web browsing as connections are very short lived, but for any long lived connections you may see issues.
+7. <b>Why does my connection drop periodically?</b> AWS Lambda functions can currently only execute for a maximum of 5 minutes. In order to maintain an ongoing HTTP proxy a new function is executed and all new traffic is cut over to it. Any ongoing connections to the previous Lambda function will hard stop after a timeout period. You generally won't see any issues for normal web browsing as connections are very short lived, but for any long lived connections you may see issues.
 
 # Powered by
-* [goproxy](https://github.com/elazarl/goproxy) - An HTTP proxy server written in Go.
 * [go-socks5](https://github.com/armon/go-socks5) - A SOCKS5 proxy written in Go.
 * [yamux](https://github.com/hashicorp/yamux) - Golang connection multiplexing library.
 * [goad](https://github.com/goadapp/goad) - Code was borrowed from this project to handle AWS Lambda zip creation and function upload.
 
 # Future work
-* Add security to proxy and tunnel connections
 * Fix connections dropping each time a new tunnel is established
 * Create minimal IAM policy
-* Rewrite code to be testable and write tests
+* Refactor code and write tests

cmd/awslambdaproxy/awslambdaproxy.go

@@ -5,59 +5,102 @@ import (
 	"flag"
 	"os"
 	"strings"
-	"fmt"
 	"time"
+	"os/user"
+	"log"
+	"strconv"
 )
 
 const (
-	maxFrequency = "255"
+	// Max execution time on lambda is 300 seconds currently
+	lambdaMaxFrequencySeconds = 290
+	lambdaMinMemorySize       = 128
+	lambdaMaxMemorySize       = 1536
+	lambdaDefaultMemorySize   = lambdaMinMemorySize
 )
 
 func main() {
-	regionsPtr := flag.String("regions", "us-west-2", "Regions to run proxy (e.g. us-west-2) (can be comma separated list)")
-	frequencyPtr := flag.Int( "frequency", 180, "Frequency in seconds to execute Lambda function. If multiple regions are specified, this will cause traffic to rotate round robin at the interval specified here")
-	proxyTypePtr := flag.String("proxy-type", "http", "Proxy type to setup: 'http' or 'socks'")
-	proxyPortPtr := flag.String("proxy-port", "8080", "Port to listen for proxy connections")
-	tunnelPortPtr := flag.String("tunnel-port", "8081", "Port to listen for reverse connection from Lambda")
+	user, err := user.Current()
+	if err != nil {
+		log.Println("Failed to get current username")
+		os.Exit(1)
+	}
+
+	lambdaRegionsPtr := flag.String("lambda-regions", "us-west-2", "Regions to run proxy " +
+		"(e.g. us-west-2) (can be comma separated list)")
+	lambdaFrequencyPtr := flag.Int("lambda-frequency", lambdaMaxFrequencySeconds, "Frequency in " +
+		"seconds to execute Lambda function.  Max=" + strconv.Itoa(lambdaMaxFrequencySeconds) + ". If multiple " +
+		"lambda-regions are specified, this will cause traffic to rotate round robin at the interval " +
+		"specified here")
+	lambdaMemorySizePtr := flag.Int("lambda-memory", lambdaDefaultMemorySize, "Memory size in MB "+
+		"for Lambda function. Higher memory may allow for faster network throughput.")
+	sshUserPtr := flag.String("ssh-user", user.Username, "SSH user for tunnel connections from Lambda")
+	sshPortPtr := flag.String("ssh-port", "22", "SSH port for tunnel connections from Lambda")
+	proxyPortPtr := flag.String("proxy-port", "8080", "Port to listen for client socks proxy "+
+		"connections")
+	proxyUsernamePtr := flag.String("proxy-username", "admin", "Username for proxy authentication")
+	proxyPasswordPtr := flag.String("proxy-password", "admin", "Password for proxy authentication")
 	flag.Parse()
 
 	if *proxyPortPtr == "" {
 		flag.PrintDefaults()
 		os.Exit(1)
 	}
-	if *tunnelPortPtr == "" {
+	if *lambdaRegionsPtr == "" {
+		flag.PrintDefaults()
+		os.Exit(1)
+	}
+	if *sshUserPtr == "" {
+		flag.PrintDefaults()
+		os.Exit(1)
+	}
+	if *sshPortPtr == "" {
 		flag.PrintDefaults()
 		os.Exit(1)
 	}
-	if *regionsPtr == "" {
+	if *proxyUsernamePtr == "" {
 		flag.PrintDefaults()
 		os.Exit(1)
 	}
-	if *proxyTypePtr != "http" && *proxyTypePtr != "socks" {
+	if *proxyPasswordPtr == "" {
 		flag.PrintDefaults()
 		os.Exit(1)
 	}
 
-	// handle frequency
-	if *frequencyPtr > 255 {
-		fmt.Println("Maximum freqency is " + maxFrequency + " seconds")
+	// check memory
+	if *lambdaMemorySizePtr > lambdaMaxMemorySize {
+		log.Println("Maximum lambda memory size is " + strconv.Itoa(lambdaMaxMemorySize) + " MB")
+		os.Exit(1)
+	}
+	if *lambdaMemorySizePtr < lambdaMinMemorySize {
+		log.Println("Minimum lambda memory size is " + strconv.Itoa(lambdaMinMemorySize) + " MB")
+		os.Exit(1)
+	}
+	lambdaMemorySize := int64(*lambdaMemorySizePtr)
+
+	// check frequency
+	if *lambdaFrequencyPtr > lambdaMaxFrequencySeconds {
+		log.Println("Maximum lambda frequency is " + strconv.Itoa(lambdaMaxFrequencySeconds) + " seconds")
 		os.Exit(1)
 	}
-	frequencySeconds := time.Second * time.Duration(*frequencyPtr)
+	lambdaFrequencySeconds := time.Second * time.Duration(*lambdaFrequencyPtr)
+	lambdaExecutionTimeout := int64(lambdaFrequencySeconds.Seconds()) + int64(10)
 
-	// handle aws env variables
+	// check for required aws keys
 	access := os.Getenv("AWS_ACCESS_KEY_ID")
 	if access == "" {
-		fmt.Println("Must specify environment variable AWS_ACCESS_KEY_ID")
+		log.Println("Must specify environment variable AWS_ACCESS_KEY_ID")
 		os.Exit(1)
 	}
 	secret := os.Getenv("AWS_SECRET_ACCESS_KEY")
 	if secret == "" {
-		fmt.Println("Must specify environment variable AWS_SECRET_ACCESS_KEY")
+		log.Println("Must specify environment variable AWS_SECRET_ACCESS_KEY")
 		os.Exit(1)
 	}
 
-	regions := strings.Split(*regionsPtr, ",")
-	awslambdaproxy.ServerInit(*proxyPortPtr, *tunnelPortPtr, regions, frequencySeconds, *proxyTypePtr)
-}
+	// handle regions
+	lambdaRegions := strings.Split(*lambdaRegionsPtr, ",")
 
+	awslambdaproxy.ServerInit(*proxyPortPtr, *sshUserPtr, *sshPortPtr, *proxyUsernamePtr, *proxyPasswordPtr,
+		lambdaRegions, lambdaMemorySize, lambdaFrequencySeconds, lambdaExecutionTimeout)
+}

data/lambda/main.py

@@ -9,9 +9,17 @@ def handler(event, context):
     logger.info("Event: {}".format(event))
     logger.info("Context: {}".format(context))
     address = event['ConnectBackAddress']
-    proxy_type = event['ProxyType']
+    ssh_port = event['SSHPort']
+    ssh_key = event['SSHKey']
+    ssh_user = event['SSHUser']
+    proxy_username = event['ProxyUsername']
+    proxy_password = event['ProxyPassword']
 
-    command = "./awslambdaproxy-lambda -address {} -proxy-type {}".format(address, proxy_type)
+    key_filename = "/tmp/privatekey"
+    with open(key_filename, 'w') as key_file:
+        key_file.write(ssh_key)
+
+    command = "./awslambdaproxy-lambda -address {} -ssh-port {} -ssh-private-key {} -ssh-user {}  -proxy-username {} -proxy-password {}".format(address, ssh_port, key_filename, ssh_user, proxy_username, proxy_password)
     logger.info("Running: {}".format(command))
     try:
         proc = Popen(command, shell=True, stdout=PIPE, stderr=PIPE)

glide.lock

@@ -8,8 +8,6 @@ import:
   - aws/session
   - service/iam
   - service/lambda
-- package: github.com/elazarl/goproxy
-  version: ^1.0.0
 - package: github.com/hashicorp/yamux
 - package: github.com/pkg/errors
   version: ^0.8.0

glide.yaml

@@ -4,6 +4,7 @@ package awslambdaproxy
 
 import (
 	"time"
+	"log"
 
 	"github.com/pkg/errors"
 	"github.com/aws/aws-sdk-go/aws"
@@ -20,13 +21,13 @@ const (
 	lambdaFunctionIamRole = "awslambdaproxy-role"
 	lambdaFunctionIamRolePolicyName = "awslambdaproxy-role-policy"
 	lambdaFunctionZipLocation = "data/lambda.zip"
-	lambdaFunctionMemory = 128
 )
 
 type LambdaInfrastructure struct {
-	config   *aws.Config
-	regions []string
-	timeout int64
+	config           *aws.Config
+	regions          []string
+	lambdaTimeout    int64
+	lambdaMemorySize int64
 }
 
 func (infra *LambdaInfrastructure) setup() error {
@@ -39,19 +40,21 @@ func (infra *LambdaInfrastructure) setup() error {
 		return errors.Wrap(err, "Could not read ZIP file: " + lambdaFunctionZipLocation)
 	}
 	for _, region := range infra.regions {
+		log.Println("Setting up Lambda function in region: " + region)
 		err = infra.createOrUpdateLambdaFunction(region, roleArn, zip)
 		if err != nil {
-			return errors.Wrap(err, "Could not create/update Lambda function")
+			return errors.Wrap(err, "Could not create Lambda function in region " + region)
 		}
 	}
 	return nil
 }
 
-func setupLambdaInfrastructure(regions []string, timeout int64) (error) {
+func setupLambdaInfrastructure(regions []string, memorySize int64, timeout int64) (error) {
 	infra := LambdaInfrastructure{
-		regions: regions,
-		config: &aws.Config{},
-		timeout: timeout,
+		regions:          regions,
+		config:           &aws.Config{},
+		lambdaTimeout:    timeout,
+		lambdaMemorySize: memorySize,
 	}
 	if err := infra.setup(); err != nil {
 		return errors.Wrap(err, "Could not setup Lambda Infrastructure")
@@ -64,22 +67,30 @@ func (infra *LambdaInfrastructure) createOrUpdateLambdaFunction(region, roleArn
 	svc := lambda.New(session.New(), config)
 
 	exists, err := lambdaExists(svc)
-
 	if err != nil {
 		return err
 	}
 
 	if exists {
-		aliasExists, err := lambdaAliasExists(svc)
-		if err != nil || aliasExists {
+		err := infra.deleteLambdaFunction(svc)
+		if err != nil {
 			return err
 		}
-		return infra.updateLambdaFunction(svc, roleArn, payload)
 	}
 
 	return infra.createLambdaFunction(svc, roleArn, payload)
 }
 
+func (infra *LambdaInfrastructure) deleteLambdaFunction(svc *lambda.Lambda) error {
+	_, err := svc.DeleteFunction(&lambda.DeleteFunctionInput{
+		FunctionName: aws.String(lambdaFunctionName),
+	})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
 func (infra *LambdaInfrastructure) createLambdaFunction(svc *lambda.Lambda, roleArn string, payload []byte) error {
 	function, err := svc.CreateFunction(&lambda.CreateFunctionInput{
 		Code: &lambda.FunctionCode{
@@ -89,9 +100,9 @@ func (infra *LambdaInfrastructure) createLambdaFunction(svc *lambda.Lambda, role
 		Handler:      aws.String(lambdaFunctionHandler),
 		Role:         aws.String(roleArn),
 		Runtime:      aws.String(lambdaFunctionRuntime),
-		MemorySize:   aws.Int64(lambdaFunctionMemory),
+		MemorySize:   aws.Int64(infra.lambdaMemorySize),
 		Publish:      aws.Bool(true),
-		Timeout:      aws.Int64(infra.timeout),
+		Timeout:      aws.Int64(infra.lambdaTimeout),
 	})
 	if err != nil {
 		if awsErr, ok := err.(awserr.Error); ok {
@@ -143,24 +154,6 @@ func createLambdaAlias(svc *lambda.Lambda, functionVersion *string) error {
 	return err
 }
 
-func lambdaAliasExists(svc *lambda.Lambda) (bool, error) {
-	_, err := svc.GetAlias(&lambda.GetAliasInput{
-		FunctionName: aws.String(lambdaFunctionName),
-		Name:         aws.String(LambdaVersion()),
-	})
-
-	if err != nil {
-		if awsErr, ok := err.(awserr.Error); ok {
-			if awsErr.Code() == "ResourceNotFoundException" {
-				return false, nil
-			}
-		}
-		return false, err
-	}
-
-	return true, nil
-}
-
 func (infra *LambdaInfrastructure) createIAMLambdaRole(roleName string) (arn string, err error) {
 	svc := iam.New(session.New(), infra.config)