Dante SOCKS Proxy Server on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of Dante on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Dante is a mature, lightweight SOCKS4 and SOCKS5 proxy server from Inferno Nettverk. It lets you route outbound TCP and UDP traffic through one controlled gateway, with source access rules, username and password authentication and detailed logging, all from a single headless daemon.

The image builds Dante 1.4.4 from the verified canonical upstream source (inet.no/dante, SHA256 checked at build time), so the exact version is reproducible and there is no third party package repository on the running VM. The sockd daemon runs under systemd; it starts privileged only long enough to check passwords, then drops the relay children to the unprivileged nobody user. Unattended security upgrades keep the base OS patched.

Secure by design — no default credentials. A proxy that anyone can use anonymously is an open relay, so this image never ships a fixed or shared credential. On the very first boot of every VM a fresh per instance proxy username and password are generated. The proxy account is an unprivileged, no login system user whose password lives only in the shadow database, and the plaintext is written to /root/dante-credentials.txt (mode 0600, root only). SOCKS authentication is mandatory (socksmethod: username), so anonymous and wrong credential requests are rejected at the SOCKS negotiation.

Locked down by default. Access is restricted to clients on loopback and RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), with a client block default that refuses every other source before authentication is even attempted. You widen access to your own client ranges with one config edit.

What is included:

• Dante 1.4.4 built from the verified upstream source, run under systemd (sockd.service)

• A SOCKS4 and SOCKS5 forward proxy on TCP 1080

• Mandatory SOCKS authentication (socksmethod: username) against a per instance account, so anonymous requests are rejected

• A per instance username and password generated on first boot, documented in /root/dante-credentials.txt (0600)

• A secure default source access control list: loopback and private ranges only, with a client block default, so the proxy is never an open relay

• Least privilege: the relay children run as the unprivileged nobody user; only a minimal helper reads the password database

Prerequisites

• Active Azure subscription, SSH public key, VNet + subnet in target region

• Subscription to the Dante listing on Azure Marketplace

• Network Security Group rules allowing TCP 22 (admin) and, for the clients that will use the proxy, TCP 1080 (SOCKS)

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) for a small proxy. Higher throughput deployments should use Standard_D2s_v5 or larger.

Step 1: Deploy from the Azure Portal

Search Dante in Marketplace, select the cloudimg publisher, and click Create. Configure the Network Security Group to allow TCP 1080 from your client networks, and TCP 22 for administration.

Step 2: Deploy from the Azure CLI

RG="proxy-prod"; LOCATION="eastus"; VM_NAME="dante1"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/dante-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 1080 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

Step 3: First boot

On first boot the image generates a fresh per instance proxy username and password, creates the no login system account, resolves the outbound interface, starts sockd, and writes /root/dante-credentials.txt. This completes within a few seconds. SSH in as azureuser and read the details:

sudo cat /root/dante-credentials.txt

Step 4: Confirm the service is running

sockd.service runs under systemd. The main process runs as the unprivileged nobody user; a minimal privileged helper reads the password database. ss confirms the SOCKS proxy is listening on :1080.

systemctl is-active sockd.service
ps -o user= -p $(systemctl show -p MainPID --value sockd.service)
/usr/sbin/sockd -v
ss -tlnp | grep ':1080 '

Step 5: The proxy requires authentication

The proxy rejects anonymous and wrong credential requests at the SOCKS negotiation, and accepts the correct per instance credentials. Read your credentials from the file into shell variables, then prove the round trip. These commands run on the VM against loopback; from a remote client, replace 127.0.0.1 with the VM address and connect from an allowed range.

PROXY_USER=$(sudo grep '^PROXY_USERNAME=' /root/dante-credentials.txt | cut -d= -f2-)
PROXY_PASS=$(sudo grep '^PROXY_PASSWORD=' /root/dante-credentials.txt | cut -d= -f2-)
echo -n 'anonymous      : '; curl -s -o /dev/null -m 15 -x socks5h://127.0.0.1:1080 http://example.com && echo ALLOWED || echo REJECTED
echo -n 'wrong password : '; curl -s -o /dev/null -m 15 -x "socks5h://$PROXY_USER:wrong@127.0.0.1:1080" http://example.com && echo ALLOWED || echo REJECTED
echo -n 'authenticated  : HTTP '; curl -s -o /dev/null -w '%{http_code}\n' -m 25 -x "socks5h://$PROXY_USER:$PROXY_PASS@127.0.0.1:1080" http://example.com

Step 6: Review the secure by default configuration

The configuration ships mandatory authentication (socksmethod: username), a source access control list that admits only loopback and RFC1918 private ranges, and a client block default that refuses every other source. The relay children drop to the unprivileged nobody user.

grep -vE '^\s*#|^\s*$' /etc/sockd.conf

Step 7: Confirm no default credentials ship

No default or shared credentials ship in the image. The credentials file is 0600 root:root, and the proxy account is an unprivileged no login system user whose password lives only in the shadow database and is regenerated on every VM's first boot.

sudo stat -c '%n %a %U:%G' /root/dante-credentials.txt
PROXY_USER=$(sudo grep '^PROXY_USERNAME=' /root/dante-credentials.txt | cut -d= -f2-)
getent passwd "$PROXY_USER"

Step 8: Allow your own remote clients

By default only loopback and RFC1918 private ranges are admitted, so remote clients on the public internet are refused before authentication. To admit a client range, add a client pass block for that CIDR above the client block default in /etc/sockd.conf and reload the service. Replace <your-mgmt-cidr> with your own client network:

sudo sed -i '/^client block/i client pass { from: <your-mgmt-cidr> to: 0.0.0.0/0 log: error }' /etc/sockd.conf
sudo systemctl reload sockd

Keep the client block rule last so anything not explicitly admitted is refused. Widening the source ACL does not weaken authentication: admitted clients still have to present a valid username and password.

Step 9: Add another proxy user

Dante authenticates against the system password database, so an additional proxy user is a normal no login system account with a password. Create one and set a strong password. Replace <new-password> with the password you want to issue:

sudo useradd --system --no-create-home --shell /usr/sbin/nologin teammate
echo 'teammate:<new-password>' | sudo chpasswd

The new user can authenticate immediately; no service reload is needed because Dante checks the live password database on each request.

Step 10: Configure a client to use the proxy

From a client machine on an allowed range, point your SOCKS aware tools at the proxy. Read the username and password from /root/dante-credentials.txt, and replace <public-ip> with your VM's public IP. For example, with curl:

curl -x socks5h://PROXY_USERNAME:PROXY_PASSWORD@<public-ip>:1080 https://ifconfig.me

Or configure an application's SOCKS proxy setting to <public-ip>:1080 with the same username and password. Replace PROXY_USERNAME and PROXY_PASSWORD with the values from /root/dante-credentials.txt.

Step 11: Security recommendations

• Restrict the NSG. Allow TCP 1080 only from the client networks that need the proxy, and TCP 22 for administration only.

• Keep authentication mandatory. The image ships socksmethod: username; never change it to none or the proxy becomes an open relay.

• Scope the source access control list. Add only the specific client ranges you need above the client block default; never admit 0.0.0.0/0 as a client source.

• Rotate credentials by setting a new password on the proxy account with chpasswd; the plaintext of the original per VM password lives only in /root/dante-credentials.txt.

• Keep the OS patched. Unattended security upgrades remain enabled on the running VM.

Step 12: Support and Licensing

Dante is developed by Inferno Nettverk A/S and distributed under a permissive BSD/CMU style licence, which allows redistribution in source and binary form. This cloudimg image builds the unmodified upstream Dante 1.4.4 source. cloudimg provides the packaging, the secure default configuration, the per instance credential automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.

cloudimg is not affiliated with or endorsed by Inferno Nettverk. Dante is a mark of its respective owner and is used here only to identify the software.

Deploy on Azure

Find Dante SOCKS Proxy Server on Ubuntu 24.04 LTS on the Azure Marketplace, published by cloudimg. Deploy from the Portal or the Azure CLI as shown above.

Need Help?

Email support@cloudimg.co.uk for deployment help, configuration questions, or licensing enquiries.