Dante SOCKS5 Proxy For Named Accounts, Never Into Private Networks
Dante SOCKS5 server from EPEL for the accounts the role makes, and only those: each expired for every other service, since its password otherwise opened SSH tunnels, and private, link-local and loopback ranges out of reach by address or by name. The live test is refused by each range, another account and SSH. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-10-08 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-dante?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [Dante SOCKS5 Proxy For Named Accounts, Never Into Private Networks](https://www.iac-bazaar.com/catalog/ansible-dante?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# Dante SOCKS5 Proxy For Named Accounts, Never Into Private Networks: https://www.iac-bazaar.com/catalog/ansible-dante (download from your IaC Bazaar account)
```Preview:
Documentation
dante
The Dante SOCKS5 server from EPEL for the accounts the role makes, and only
those: a password made for each, the accounts expired for every other service so
a proxy password is not an SSH password, the private, shared, loopback and
link-local ranges out of reach by address and by name, and the file checked by
sockd -V before it lands. Original role for EL 10, live-tested with podman on
Rocky Linux 10.
No download, and no version to pin. EL 10 packages sockd in EPEL, so the
role installs it by name and takes what the distribution ships: a security
update arrives through dnf, not through a new release of this role. What the
role owns is the configuration and the proof that the service works.
The distribution's unit, our configuration. The role installs
dante-server from EPEL, writes /etc/sockd.conf (root 0644: it holds no
passwords) and enables the package's sockd.service. Outgoing connections leave
from the interface of the default route unless dante_external names one. The
listener is 127.0.0.1:1080 by default; to serve other hosts set
dante_listen_address and add their network to dante_client_networks. The
live test reads the listening sockets and expects loopback only.
A proxy user is a system account, and its password opened SSH. Dante
checks the user name and password against the system's own password file, so
each proxy user is an account on the host. With sshd accepting passwords, such an
account's password opened an ssh -N -L tunnel - a nologin shell does not stop
a tunnel (measured). The role makes each proxy account with no shell, no home and
an expiry date in the past: PAM refuses an expired account to every service that
asks it ("Access denied ... by PAM account configuration" from sshd, "User
account has expired" from su), while sockd, which only compares the password
hash, still lets it in (measured both ways, and again by the live test).
Only the accounts the role made. Each pass rule names its account, so another account on the host with a valid password is refused (measured).
Nothing private through the proxy. Without destination rules, a proxy user reached private addresses and the host's own loopback (measured). The role blocks this host, the private, shared and link-local ranges (169.254/16 holds the cloud metadata address) and the special-purpose ones - by address and by any name that resolves into them - and the live test is refused by each range while a public-looking address answers. The pass rules name IPv4 destinations, so an IPv6 destination is refused too.
SOCKS5 is not encrypted. The user name and password cross the network in clear, and so does the traffic the client sends; keep the listener on loopback or a network you trust.
The package does not start as installed. Its /etc/sockd.conf enables no
authentication method and the unit fails; sockd -V checks each candidate
before it lands (a syntax error: rc 1).
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-squid
The stock squid.conf allows localhost before it denies loopback destinations, so a local client can proxy into loopback services. This role puts every deny first and binds loopback. The live test fetches a page through it, then sees squid itself refuse loopback, 169.254.169.254, an unsafe port, CONNECT to 25 and a non-loopback client. Original role, live-tested on Rocky Linux 10.
ansible-consul-server
HashiCorp Consul as a single-node server from the upstream release (sha256-verified), as a hardened system service with HTTP, DNS, RPC and both serf listeners on loopback and its configuration checked by consul validate before it lands. The live test waits for a leader, writes a KV key through the API, reads it back and reads the member alive. Original role, live-tested on Rocky Linux 10.
ansible-frr
FRR from AppStream: BGP that announces only your prefixes, accepts from each neighbour only what you list for it, signs sessions with TCP MD5, and applies a change without dropping them. The live test peers with a real BGP speaker in its own namespace; a filtered prefix stays out of the kernel and a wrong password keeps the session down. Original role, live-tested on Rocky Linux 10.
ansible-headscale
Headscale, the self-hosted Tailscale control server, from the upstream release binary (sha256-verified) as a hardened system service on loopback with sqlite; configtest runs as the service user (it opens the database). The live test creates a user over the unix socket, issues a reusable pre-auth key for it, reads the user back from the key, destroys it. Original role, live-tested on Rocky 10.
ansible-kea-dhcp4
Kea DHCPv4 from AppStream: your subnets, pools, options and reservations in Kea's own keys, checked with kea-dhcp4 -t and applied by reload, leases on disk. The live test runs a raw-socket DHCP client in a namespace: an address with router, DNS and lease time, the reserved address for its MAC, and nothing on a segment no subnet covers. Original role, live-tested on Rocky Linux 10.
ansible-libreswan
Libreswan from AppStream: IPsec connections authenticated by a pre-shared key made on the host, negotiated with IKEv2 under the system crypto policy, IKE kept to one address, each connection checked by its keywords and again by pluto. The live test brings a peer in a namespace up, sees the ping cross as ESP only, and is refused with a different key. Original role, live-tested on Rocky Linux 10.