How to Deploy your own stealth Proxy Server with tinyproxy.

alain12 · Feb 26, 2019

I am not affiliated with tinyproxy in any way.

Step 1: Find a good VPS provider that also offers extra IPs (if you intend on using multiple IPs). These are often called 'floating IPs'. At least 512MB of memory is needed. 1GB should be enough but it depends on how many simultaneous connections you'll use.

Step 2: Deploy your VPS with Debian 9. I recommend Debian 9 because it's often lighter than Ubuntu, and it's very stable, and easy to work with. Everything shown here should also work with Ubuntu, but you may run into minor issues. This guide will NOT work for CentOS, Fedora, etc.

Step 3: Attach your floating IPs if you bought any. You can always add IPs later.

Step 4: Login to your VPS with SSH (If you're on windows, you can use puTTY). The VPS provider will give you the username (probably root) and password.

Step 5: Install and Configure tinyproxy as follows:

Make sure you're logged in as root. If not, run sudo su

Update your system: apt update && apt upgrade -y

If you have less than 1GB of RAM, you can create a swap file which will be used as RAM if your system runs out. It's the Linux equivalent of the Windows pagefile. This is optional but generally good for performance:

First make sure your VPS does not already have a swap file or partition.

swapon

If this command outputs nothing, you do not have swap space. If it does, you already have swap space and should not need to create more.

Create a 1GB swapfile:

dd if=/dev/zero of=/swapfile bs=1k count=1M

Set correct permissions:

chmod 600 /swapfile

Activate it:

mkswap /swapfile
swapon /swapfile

Then save a line in your fstab, so when you reboot, your system will automatically use that swap space.

echo "/swapfile swap swap defaults 0 0" >> /etc/fstab

Install some packages: apt install -y git make automake nano build-essential

(git is for grabbing tinyproxy from github, nano is an easy-to-use text editor, the rest are for compiling the proxy software)

Download tinyproxy (the following command will always grab the most recent version):

https://github.com/tinyproxy/tinyproxy.git

Then

cd tinyproxy/
./autogen.sh
./configure
nano Makefile

Find the section that starts with "SUBDIRS = \" (it should be line 343)
And remove the line "docs \"
So the section should now look like this:

SUBDIRS = \
src \
data \
etc \
m4macros \
tests \
scripts

Then press Ctrl x then y then Enter.

(The reason for this edit is that building the documentation for tinyproxy would require downloading and installing 1GB+ of packages, and IMO a lighter system is more important than having these docs.)

make
make install

Configuration:

nano /usr/local/etc/tinyproxy/tinyproxy.conf

And make the following changes:

Group nobody > Group nogroup

Port 8888 > Port xxxx (Use something other than 8080, 8888, etc. You'll get less brute-force attacks. )

#BindSame yes > BindSame yes (this is only needed if you have multiple public IPs)

#LogFile "/usr/local/var/log/tinyproxy/tinyproxy.log" > LogFile "/var/log/tinyproxy.log" (Only if you want to save logs)

Allow 127.0.0.1 > #Allow 127.0.0.1

#BasicAuth user password > BasicAuth ChooseAUsername ChooseAPassword (Use a very strong and complex password, bots from all over the world will be constantly trying to guess it)

ViaProxyName "tinyproxy" > #ViaProxyName "tinyproxy"

#DisableViaHeader Yes > DisableViaHeader Yes (this is technically a wrong thing to do, but we don't want IG/etc. to know that we're using a proxy.)

Press Ctrl x then y then Enter to save and exit.

Your proxy server is now ready! Start it with:

tinyproxy

And to make sure it is running:

ss -lntup | grep tinyproxy

If you get no output, then it is either not running, or running but not binding to a port.

Finally, to make it run automatically after a reboot:

crontab -e

This will open a file in a text editor of your choice, simply add the following line at the end:

@reboot /usr/local/bin/tinyproxy

And done.

alain12 · Feb 27, 2019

alain12 said:
Download tinyproxy (the following command will always grab the most recent version):

git clone github. com/tinyproxy/tinyproxy.git

CORRECTION:

git clone https://github.com/tinyproxy/tinyproxy.git

zazazG · Feb 28, 2019

This is a very nice tutorial, I did a similiar thing with squid, but wouldn't the IP from VPS be detected as suspicious? I tried this before and in fact it didn't go well and I had to come up with something else a little bit more complex.

Btw:

alain12 said:
Port 8888 > Port xxxx (Use something other than 8080, 8888, etc. You'll get less brute-force attacks. )
.

I don't think that's a good choice. Bruteforcers are scanning ports, it doesn't really matter if you use 80, 3129 or any random number, they will eventually scan everything and find whatever service you're hosting on that port. I suggest you (and eventually any reader) to actually do something to avoid that (like Fail2Ban)

alain12 · Feb 28, 2019

zazazG said:
This is a very nice tutorial, I did a similiar thing with squid, but wouldn't the IP from VPS be detected as suspicious? I tried this before and in fact it didn't go well and I had to come up with something else a little bit more complex.

Btw:

I don't think that's a good choice. Bruteforcers are scanning ports, it doesn't really matter if you use 80, 3129 or any random number, they will eventually scan everything and find whatever service you're hosting on that port. I suggest you (and eventually any reader) to actually do something to avoid that (like Fail2Ban)

Thanks

You mean detected as suspicious by the sites (FB/IG/etc.) that I'm connecting to? They surely can tell that it's a datacenter IP, but I honestly have no idea if they would mark it as suspicious. I'm still new to this, should be able to tell in a few months.

You're right, port scanning is often involved. But with the number of potential targets, scanning all 65535 ports for each IP would be an immense task. Only the common ports are scanned on a large scale.

Fail2ban is a great idea, but since it works by scanning log files, I'm not sure if it has a filter that works with tinyproxy logs. I should probably look into that, I may have to write my own filter.

dogstyle007 · Feb 28, 2019

Good tutorial i will surely give this a try.

apfeltheif · Apr 20, 2019

Thanks for the tutorial!

kretchi · Apr 21, 2019

Awesome bro

alain12 · Nov 15, 2019

Here's an automated user friendly script for quickly setting up a proxy server on Debian 10 Buster. You need to be logged in as root for it to work. May or may not work on other debian/ubuntu versions.

Code:

#!/bin/bash

echo -n "Installing Proxy Server..."
apt update >/dev/null 2>&1
apt install -y tinyproxy >/dev/null 2>&1 && echo "done"
systemctl stop tinyproxy.service >/dev/null 2>&1
systemctl enable tinyproxy.service >/dev/null 2>&1
if [ ! -e /etc/tinyproxy/tinyproxy.conf.orig ]
then
        mv /etc/tinyproxy/tinyproxy.conf /etc/tinyproxy/tinyproxy.conf.orig && echo Backed up original configuration file to /etc/tinyproxy/tinyproxy.conf.orig
        fi

read -p "Choose your proxy username: " puser
        while [ -z "$puser" ]
        do
                echo "Username cannot be empty"
                read -p "Choose your proxy username: " puser
done

read -s -p "Choose your proxy password: " ppass
while [ -z "$ppass" ]
        do
                echo "Password cannot be empty"
                read -p "Choose your proxy password: " ppass
done

echo
read -p "Choose the maximum number of simultaneous connections this proxy should accept or press enter for the default of 100: " pmaxconn
if [ -z "$pmaxconn" ]
then
        pmaxconn=100
        fi

read -p "Choose the port number for your proxy or press enter for the default of 8888. Should be above 1024. " pport
if [ -z "$pport" ]
then
        pport=8888
        fi


echo -n "Saving Configuration..."
cat <<CONF > /etc/tinyproxy/tinyproxy.conf && echo "done"
User tinyproxy
Group tinyproxy
Port $pport
BindSame yes
Timeout 600
DefaultErrorFile "/usr/share/tinyproxy/default.html"
StatHost "tinyproxy.stats"
StatFile "/usr/share/tinyproxy/stats.html"
LogFile "/var/log/tinyproxy/tinyproxy.log"
LogLevel Warning
PidFile "/run/tinyproxy/tinyproxy.pid"
MaxClients $pmaxconn
MinSpareServers 5
MaxSpareServers 20
StartServers 10
MaxRequestsPerChild 0
BasicAuth $puser $ppass
DisableViaHeader Yes
ConnectPort 443
ConnectPort 563
CONF

echo -n "Starting Proxy Server..."
systemctl start tinyproxy.service && echo "done"
echo "Proxy port is $pport on all available IP addresses"
echo "Your username is: $puser"
read -p "Show password? y/n:" showp
if [ "$showp"="y" ]
then
    echo "Your password is: $ppass"
    fi

Save it as "proxy.sh" on your VPS, then:

Code:

chmod u+x proxy.sh
./proxy.sh

tophi · Nov 15, 2019

Do you have this for centos, as I already have a lot of stuff and I dont want to move to debian again...

karupoiss · Nov 15, 2019

Could be useful but unfortunately the fact that it is still a datacenter IP makes it not that valuable for sites like FB, Google etc.

alain12 · Nov 15, 2019

tophi said:
Do you have this for centos, as I already have a lot of stuff and I dont want to move to debian again...

Which centos version are you using?

tophi · Nov 15, 2019

alain12 said:
Which centos version are you using?

Based on my "/etc/redhat-release" its a CentOS release 6.10 (Final)

alain12 · Nov 15, 2019

Script for CentOS 6:

Code:

#!/bin/bash

echo "Disabling SELinux"
yum install -y libselinux-utils
setenforce 0
sed -i "s/enforcing/permissive/g" /etc/sysconfig/selinux
echo -n "Installing Proxy Server..."
yum install -y git automake gcc asciidoc make
git clone https://github.com/tinyproxy/tinyproxy.git
cd tinyproxy
./autogen.sh
./configure
make
make install
mkdir -p /usr/local/var/log/tinyproxy
mkdir -p /usr/local/var/run/tinyproxy
useradd -M tinyproxy
chown -R tinyproxy /usr/local/var/{log,run}/tinyproxy
echo "done"

if [ ! -e /usr/local/etc/tinyproxy/tinyproxy.conf.orig ]
then
        mv /usr/local/etc/tinyproxy/tinyproxy.conf /usr/local/etc/tinyproxy/tinyproxy.conf.orig && echo Backed up original configuration file to /usr/local/etc/tinyproxy/tinyproxy.conf.orig
        fi

read -p "Choose your proxy username: " puser
        while [ -z "$puser" ]
        do
                echo "Username cannot be empty"
                read -p "Choose your proxy username: " puser
done

read -s -p "Choose your proxy password: " ppass
while [ -z "$ppass" ]
        do
                echo "Password cannot be empty"
                read -p "Choose your proxy password: " ppass
done

echo
read -p "Choose the maximum number of simultaneous connections this proxy should accept or press enter for the default of 100: " pmaxconn
if [ -z "$pmaxconn" ]
then
        pmaxconn=100
        fi

read -p "Choose the port number for your proxy or press enter for the default of 8888. Should be above 1024. " pport
if [ -z "$pport" ]
then
        pport=8888
        fi


echo -n "Saving Configuration..."
cat <<CONF > /usr/local/etc/tinyproxy/tinyproxy.conf && echo "done"
User tinyproxy
Group tinyproxy
Port $pport
BindSame yes
Timeout 600
DefaultErrorFile "/usr/local/share/tinyproxy/default.html"
StatHost "tinyproxy.stats"
StatFile "/usr/local/share/tinyproxy/stats.html"
LogFile "/usr/local/var/log/tinyproxy/tinyproxy.log"
LogLevel Warning
PidFile "/usr/local/var/run/tinyproxy/tinyproxy.pid"
MaxClients $pmaxconn
MinSpareServers 5
MaxSpareServers 20
StartServers 10
MaxRequestsPerChild 0
BasicAuth $puser $ppass
DisableViaHeader Yes
ConnectPort 443
ConnectPort 563
CONF

echo -n "Starting Proxy Server..."
/usr/local/bin/tinyproxy -c /usr/local/etc/tinyproxy/tinyproxy.conf && echo "done"
echo -n "Adding line to crontab to start Proxy at boot..."
(crontab -l 2>/dev/null; echo "@reboot /usr/local/bin/tinyproxy -c /usr/local/etc/tinyproxy/tinyproxy.conf >/dev/null 2>&1") | crontab -
echo "done"
echo "Proxy port is $pport on all available IP addresses"
echo "Your username is: $puser"
read -p "Show password? y/n:" showp
if [ "$showp"="y" ]
then
    echo "Your password is: $ppass"
    fi

Shockx · Jan 24, 2021

I followed everything perfectly but don't understand why my proxy isn't working, do I need to enable the port or do something with it? It's on a server so I don't think I have access to that sort of stuff

Arvinw · Nov 26, 2021

TX, I try to build my own proxy server recently, this is a nice guid

How to Deploy your own stealth Proxy Server with tinyproxy.

alain12

Registered Member

alain12

Registered Member

zazazG

Newbie

alain12

Registered Member

dogstyle007

Power Member

apfeltheif

Registered Member

kretchi

Junior Member

alain12

Registered Member

tophi

Senior Member

karupoiss

Elite Member

alain12

Registered Member

tophi

Senior Member

alain12

Registered Member

Shockx

Newbie

Arvinw

Newbie

Main Menu

Marketplace

Making Money

BlackHat World