Dante - Secure SOCKS4/SOCKS5 Proxy Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Dante is a free, robust circuit-level SOCKS proxy server from Inferno Nettverk. This AMI runs the sockd daemon as a self-hosted SOCKS4 and SOCKS5 forward proxy you run and control entirely in your own AWS account, delivered fully installed and hardened so an authenticated proxy is serving within minutes of launch.

## Why This Image vs a Manual Install

A SOCKS proxy that is safe to expose takes real work: installing and configuring the daemon, authoring an authentication method, writing source access rules so it is not an open relay, and provisioning per-deployment credentials. This image completes every one of those steps at build time. It never ships a default or shared credential, and it is never an open proxy. Launch the instance, read your unique credential, point your client at the SOCKS port, and you are proxying.

## Application Stack

sockd is installed from the distribution repository and runs under systemd, answering SOCKS4 and SOCKS5 on TCP port 1080. The daemon starts privileged only long enough to authenticate against the system password database, then drops to an unprivileged account for the relay children. systemd starts it on boot and restarts it on failure.

## Security Hardening

This image follows a defence-in-depth approach:

• Authentication enforced: every SOCKS request must present a valid username and password; anonymous and wrong-credential requests are rejected at method negotiation
• No default or shared credentials: a cryptographically random proxy username and password are generated on each instance's first boot and written only to a root-only file
• Not an open relay: source access rules pass only loopback and RFC1918 private ranges by default; everything else is blocked before authentication, so the proxy cannot be abused as an open relay
• Least privilege: the relay children run as an unprivileged account; only a minimal privileged helper reads the password database
• Automatic restart: systemd monitors the daemon and restarts it on failure

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

## Concrete Use Cases

• Egress control for a private subnet: route outbound traffic from application instances through a single authenticated SOCKS gateway, so egress is centralised, logged and credential-gated
• Secure remote access to internal services: developers tunnel to private-network resources over an authenticated SOCKS5 connection instead of exposing those services directly
• A controlled forward proxy for automation: scrapers, CI runners and batch jobs proxy through a source-restricted, authenticated endpoint you own rather than a public open proxy

## AWS Integration

Deploy on any EC2 instance type. The proxy listens on port 1080; open that port in the security group only to the client ranges you trust, and widen the in-proxy source access rules to match. Back up your configuration with EBS snapshots. Place the instance in a private subnet with a NAT or internet gateway to act as a controlled egress point.

## Getting Started

Read your credential from the root-only file, point your SOCKS-aware client or application at the instance on port 1080 with the generated username and password, and your traffic is proxied. Widen the source access rules in the configuration file to admit your own client networks.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, source access rules and client ranges, authentication configuration, egress design, and backup planning.