Update README.md
This commit is contained in:
parent
ed15229d09
commit
c2e0d0b71e
1 changed files with 191 additions and 1 deletions
192
README.md
192
README.md
|
|
@ -6,6 +6,196 @@
|
|||
<h1 align="left">Paw Dance</h1>
|
||||
|
||||
|
||||
<p align="left">Hello World!!</p>
|
||||
|
||||
###
|
||||
<p align="left">a stealth‑grade, post‑quantum SSH VPN</p>
|
||||
|
||||
###
|
||||
|
||||
<p align="left">Pawdance is a tool that uses OpenSSH you already trust into a fully working Layer‑3 VPN.</p>
|
||||
<p align="left">Pawdance can also fuction as transparent vpn if needed. Good for prodcution, when accsess to server is required and its network. why use third party vpns if you have ssh?</p>
|
||||
|
||||
###
|
||||
|
||||
<h4 align="left">No fixed packet signature, and censorship resistance</h4>
|
||||
|
||||
###
|
||||
|
||||
<p align="left">WireGuard and SSTP send a recognisable first‑flight; OpenVPN’s TLS ClientHello can be fingerprinted.<br>SSH randomises its initial IV and padding, so every session’s first packet length is different, defeating simple length‑based fingerprints.</p>
|
||||
|
||||
###
|
||||
|
||||
<h4 align="left">Stealthy</h4>
|
||||
|
||||
###
|
||||
|
||||
<p align="left">http://witch.valdikss.org.ru/ test detected as internet modem.</p>
|
||||
|
||||
###
|
||||
|
||||
<div align="left">
|
||||
<img height="400" src="https://cloud.protogen.engineering/public.php/dav/files/CFCC6qL2JR2jfNY" />
|
||||
</div>
|
||||
|
||||
###
|
||||
|
||||
|
||||
|
||||
|
||||
## Important one‑time step on the server
|
||||
|
||||
OpenSSH must be told to allow tunnel devices.
|
||||
Edit the daemon config **manually** and restart the service:
|
||||
|
||||
```bash
|
||||
sudo vim /etc/ssh/sshd_config
|
||||
# ──────────────────────────────────────────────
|
||||
PermitTunnel yes # add this line (or PermitTunnel point-to-point)
|
||||
# ──────────────────────────────────────────────
|
||||
|
||||
sudo systemctl restart sshd
|
||||
```
|
||||
|
||||
## Installation client and server
|
||||
|
||||
```bash
|
||||
# run installer on each side
|
||||
sudo bash install.sh
|
||||
```
|
||||
|
||||
The installer simply copies `pawdance` into `/usr/local/bin/`
|
||||
|
||||
|
||||
## 1 – Prepare the client
|
||||
|
||||
```bash
|
||||
# generate a template
|
||||
pawdance make-config --role client -o pawdance-client.conf
|
||||
|
||||
# edit it
|
||||
vim pawdance-client.conf
|
||||
```
|
||||
|
||||
Example **client** config:
|
||||
|
||||
```bash
|
||||
# pawdance client example config
|
||||
ROLE="client"
|
||||
|
||||
# How to reach the server
|
||||
CONNECT_MODE="dns" # dns | ip | auto
|
||||
REMOTE_HOST="vps.your.domain"
|
||||
# REMOTE_CONNECT_IP4="203.0.113.42"
|
||||
# REMOTE_CONNECT_IP6="2001:db8::42"
|
||||
CONNECT_PREFER="ipv4" # auto | ipv4 | ipv6
|
||||
|
||||
REMOTE_USER="stinky"
|
||||
|
||||
# Tunnel interface
|
||||
TUN_INDEX="1"
|
||||
TUN_DEV="tun${TUN_INDEX}"
|
||||
|
||||
LOCAL_IP4="10.0.1.2/24"
|
||||
REMOTE_IP4="10.0.1.1"
|
||||
|
||||
LOCAL_IP6="2001:db8:1::2/64"
|
||||
REMOTE_IP6="2001:db8:1::1"
|
||||
|
||||
MTU="1500"
|
||||
|
||||
# Optional: post‑quantum crypto overrides
|
||||
SSH_KEX="mlkem768x25519-sha256"
|
||||
SSH_CIPHERS="chacha20-poly1305@openssh.com"
|
||||
SSH_MACS="hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com"
|
||||
|
||||
# Push whole‑internet routes through the tunnel?
|
||||
DEFAULT_ROUTE_IPV4="true"
|
||||
DEFAULT_ROUTE_IPV6="true"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 2 – Prepare the server
|
||||
|
||||
```bash
|
||||
pawdance make-config --role server -o srv-config.conf
|
||||
vim srv-config.conf
|
||||
```
|
||||
|
||||
Example **server** config:
|
||||
|
||||
```bash
|
||||
ROLE="server"
|
||||
|
||||
TUN_INDEX="1"
|
||||
TUN_DEV="tun${TUN_INDEX}"
|
||||
|
||||
LOCAL_IP4="10.0.1.1/24"
|
||||
LOCAL_IP6="2001:db8:1::1/64"
|
||||
MTU="1500"
|
||||
|
||||
# allow VPN clients to access other networks?
|
||||
VPN_FORWARD="true" # adds iptables/ip6tables FORWARD rules
|
||||
|
||||
# keep this true (required for routing)
|
||||
IP_FORWARD="true" # sets net.ipv4.ip_forward + net.ipv6.conf.all.forwarding
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3 – Bring the tunnel up
|
||||
|
||||
### On the server
|
||||
|
||||
```bash
|
||||
sudo pawdance up --config srv-config.conf
|
||||
```
|
||||
|
||||
server is now ready. client can connect.
|
||||
|
||||
### On the client
|
||||
|
||||
```bash
|
||||
sudo pawdance up --config pawdance-client.conf
|
||||
```
|
||||
|
||||
First run may prompt for:
|
||||
|
||||
* *“Are you sure you want to continue connecting (yes/no)?”*
|
||||
* SSH password or pass‑phrase (unless key‑based auth already set up)
|
||||
|
||||
Once authenticated:
|
||||
|
||||
```bash
|
||||
ip addr show tun1 # should list 10.0.1.2/24
|
||||
ping 10.0.1.1 # ping the server’s tunnel IP
|
||||
curl ifconfig.me # should show the VPS public IP if default routed
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 4 – Tear down
|
||||
|
||||
```bash
|
||||
# either side:
|
||||
sudo pawdance down --config <your‑config>.conf
|
||||
```
|
||||
|
||||
This removes:
|
||||
|
||||
* per‑family default routes
|
||||
* passthrough routes to the SSH endpoint
|
||||
* the TUN interface
|
||||
* any iptables/ip6tables **FORWARD** rules added by Pawdance
|
||||
|
||||
(Kernel forwarding sysctls remain as you set them.)
|
||||
|
||||
---
|
||||
|
||||
### Why Pawdance is stealthier than “normal” VPNs
|
||||
|
||||
1. **Looks like vanilla SSH** — no OpenVPN/WireGuard/IPsec signatures.
|
||||
3. **Randomised first‑packet length** — SSH padding defeats length‑marker DPI.
|
||||
4. **Nothing new listening** — only your hardened sshd.
|
||||
5. **PQ‑safe handshake** — same post‑quantum KEX most modern OpenSSH clients now use.
|
||||
---
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue