Add privilege de escalation option about redsocks

[darkk]

See https://github.com/darkk/redsocks/blob/master/redsocks.conf.example#L20
user can be set in the configuration file, is there anything wrong with it?

Here is relevant code: https://github.com/darkk/redsocks/blob/master/base.c#L325

[tlvince]

Ah, thanks for the reminder. This works fine, although it might be worth adding an option for added flexibility with init/service scripts.

[darkk]

I doubt. I have two arguments:

1. UID is part of firewall configuration in case of redsocks (the easiest way to do firewall exception for redsocks is UID-based), so it should be somewhere near configuration file, it's not really part of "system" configuration.
2. nginx does not have it. See also http://yourlogicalfallacyis.com/appeal-to-authority :-)

Are these arguments valid from your point of view?

[tlvince]

Regarding 1), could you comment on my iptables rules? This doesn't
use a UID/GID approach, but I can see the benefits of using one.

Regarding 2), fair point ;) Although, it's not uncommon for daemons to
have a --user option (dnsmasq for one).

Regardless, I appreciate the discussion and the want to "keep it
simple".

[darkk]

Does this iptables rule set really work? It seems to me that redsocks itself will be redirected to back redsocks using this rule set.

[tlvince]

It works :)

I'm not an iptables expert but from my understanding, it first sets up
the redsocks chain and appends it to the OUTPUT chain. After sending any
packets on the whitelist back to OUTPUT, it redirects everything else to
port 31338, which redsocks is listening on.

[darkk]

Is your proxy located at local network? redsocks generates packets itself, so additional exception is needed if the proxy is outside of LAN.

[tlvince]

No, I'm connecting to a remote machine (via a socks tunnel). Connection
seems fine with these rules (public IP address changes before/after
redsocks is running).

[darkk]

${subj} is basically implemented long time ago.
Cleaning up open issues :)