SSH

You may use SSH protocol as a proxy server, an equivalent to ssh -D.

Profile syntax:

• Password authentication

[Proxy]
proxy = ssh, 1.2.3.4, 22, root, password=pw

• Public key authentication

[Proxy]
proxy = ssh, 1.2.3.4, 22, root, private-key=base64(privateKeyFileContent)

• Please notice you must use base64 to encode the entire private key file again, even though the private key file uses the base64 encoding itself. The value has to be a single line, so tell OpenSSL not to wrap its output (-A):

// OpenSSL 1.x
openssl enc -base64 -A -in /path/to/privatefile

// OpenSSL 3+
openssl base64 -A -in /path/to/privatefile

• Three types of private keys, RSA/ECDSA/ED25519, are supported. DSA (ssh-dss) is not supported: neither a DSA host key nor a DSA private key works.

• The KEX methods and ciphers below are libssh2's compiled defaults, which Chute Mac, iOS and tvOS use; Chute Android uses the default set of its SSH library, sshj, instead. They are not an allow-list Chute enforces — Chute does not narrow them:

• You may specify the idle timeout parameter now. The default value is 180 seconds. The connections made through the policy share one SSH session, which is closed once it has carried no connection for that many seconds. While any connection is open the session stays up, however quiet the connection is, and a connection that ends does not affect the others on the same session.

[Proxy]
proxy = ssh, 1.2.3.4, 22, root, password=pw, idle-timeout=180

Server Fingerprint

To cope with MitM attacks, you can specify the server's public key fingerprint with server-fingerprint, which ensures that only legitimate servers are connected. An entry is either the server's public key as ~/.ssh/known_hosts writes it — the key type and the base64 key, ssh-ed25519 AAAA… — or its SHA-256 fingerprint as ssh-keygen -l prints it, SHA256:…. The double quotes around the value are optional. When server-fingerprint is written but none of its entries can be read, every connection is refused, rather than any server being trusted. A refused connection is logged with the type and the SHA256: fingerprint of the key the server offered.

[Proxy]
proxy = ssh, 1.2.3.4, 22, root, password=pw, idle-timeout=180, server-fingerprint = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5ABCAIO9KYmO+KZQH3VXU5C1aO2xl4G8+7NLkOYDNBxfZUqep"

As there may be multiple public keys for a server, the server-fingerprint parameter supports configuring multiple fingerprints.

server-fingerprint = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5ABCAIO9KYmO+KZQH3VXU5C1aO2xl4G8+7NLkOYDNBxfZUqep,ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrklKEp4vuMqqNiS2lvDL7g3rQ2dAwvik+KIC4iVJNoaHhkLRAEv1y/dQYixf71ORZUI+w3AFKp1RzfiuwciTsMnp7Hq9uvcHqDRDaCrYe1EDx3Dr0XlH1wsdUcr+6DOAUzRSXK9LSEPVK1xHb6WJBaTkNOHruPCmrINA/DEIiflMN2q77AWlsMt+unhmY2YWgJprY+vpDOcXk8+CnL4K+QWNlHB8mTfB58p1oadz1xWG9so//rUMp7JHtUt6QpVJvwf/Qh7IcFNDhSHwSTJu2Px2P9biuUOPkmPtZmTIdnDx25EUWtmE/+VE3lZAYuur7KuGsG0o+X8dYnEMAN3ar"

You may obtain the server fingerprint from ~/.ssh/known_hosts file. Or you may use the command ssh-keyscan example.com in a trusted network environment to fetch. Please remove the hostname in the front of the line before copying it to Chute: an entry that still starts with the hostname cannot be read.