Dante

Search the Marketplace for Dante, select the SecureAnyCloud publisher, and select Create.

Configure the Network Security Group to allow TCP 1080 from your client networks and TCP 22 for administration.

RG="proxy-prod"; LOCATION="eastus"; VM_NAME="dante1" IMAGE_URN="sac1647283583153:dante-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:dante-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 1080 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

On first boot, the image generates a fresh per-instance proxy username and password and creates the no-login system account. It also resolves the outbound interface, starts sockd, and writes /root/dante-credentials.txt. This takes a few seconds.

SSH in as azureuser and read the details:

sudo cat /root/dante-credentials.txt

sockd.service runs under systemd. The main process runs as the unprivileged nobody user, and a minimal privileged helper reads the password database. Run ss to confirm that the SOCKS proxy is listening on :1080.

systemctl is-active sockd.service ps -o user= -p $(systemctl show -p MainPID --value sockd.service) /usr/sbin/sockd -v ss -tlnp | grep ':1080 '

The proxy rejects anonymous and wrong-credential requests at the SOCKS negotiation, and it accepts the correct per-instance credentials. Read your credentials from the file into shell variables, then prove the round trip.

These commands run on the VM against loopback. From a remote client, replace 127.0.0.1 with the VM address and connect from an allowed range.

PROXY_USER=$(sudo grep '^PROXY_USERNAME=' /root/dante-credentials.txt | cut -d= -f2-)
PROXY_PASS=$(sudo grep '^PROXY_PASSWORD=' /root/dante-credentials.txt | cut -d= -f2-)
echo -n 'anonymous : '; curl -s -o /dev/null -m 15 -x socks5h://127.0.0.1:1080 http://example.com && echo ALLOWED || echo REJECTED
echo -n 'wrong password : '; curl -s -o /dev/null -m 15 -x "socks5h://$PROXY_USER:wrong@127.0.0.1:1080" http://example.com && echo ALLOWED || echo REJECTED
echo -n 'authenticated : HTTP '; curl -s -o /dev/null -w '%{http_code}\n' -m 25 -x "socks5h://$PROXY_USER:$PROXY_PASS@127.0.0.1:1080" http://example.com

The configuration ships mandatory authentication (socksmethod: username) and a source access control list that admits only loopback and RFC1918 private ranges. A client block default refuses every other source.

The relay children drop to the unprivileged nobody user.

grep -vE '^\s*#|^\s*$' /etc/sockd.conf

No default or shared credentials ship in the image. The credentials file is 0600 root:root.

The proxy account is an unprivileged, no-login system user. Its password lives only in the shadow database and is regenerated on every VM's first boot.

sudo stat -c '%n %a %U:%G' /root/dante-credentials.txt
PROXY_USER=$(sudo grep '^PROXY_USERNAME=' /root/dante-credentials.txt | cut -d= -f2-) getent passwd "$PROXY_USER"

By default, only loopback and RFC1918 private ranges are admitted, so remote clients on the public internet are refused before authentication.

To admit a client range, add a client pass block for that CIDR above the client block default in /etc/sockd.conf, then reload the service. Replace <your-mgmt-cidr> with your own client network:

sudo sed -i '/^client block/i client pass { from: <your-mgmt-cidr> to: 0.0.0.0/0 log: error }' /etc/sockd.conf
sudo systemctl reload sockd

Keep the client block rule last, so that anything not explicitly admitted is refused. Widening the source ACL does not weaken authentication, because admitted clients still have to present a valid username and password.

Dante authenticates against the system password database, so an additional proxy user is a normal no-login system account with a password. Create one and set a strong password.

Replace <new-password> with the password you want to issue:

sudo useradd --system --no-create-home --shell /usr/sbin/nologin teammate echo 'teammate:<new-password>' | sudo chpasswd

The new user can authenticate immediately. No service reload is needed, because Dante checks the live password database on each request.

From a client machine on an allowed range, point your SOCKS-aware tools at the proxy. Read the username and password from /root/dante-credentials.txt, and replace <public-ip> with your VM's public IP address.

For example, with curl:

curl -x socks5h://PROXY_USERNAME:PROXY_PASSWORD@<public-ip>:1080 https://ifconfig.me

Or set an application's SOCKS proxy to <public-ip>:1080 with the same username and password. Replace PROXY_USERNAME and PROXY_PASSWORD with the values from /root/dante-credentials.txt.

• Restrict the NSG. Allow TCP 1080 only from the client networks that need the proxy, and TCP 22 only for administration.
• Keep authentication mandatory. The image ships socksmethod: username. Never change it to none, or the proxy becomes an open relay.
• Scope the source access control list. Add only the specific client ranges you need above the client block default. Never admit 0.0.0.0/0 as a client source.
• Rotate credentials by setting a new password on the proxy account with chpasswd. The plaintext of the original per-VM password lives only in /root/dante-credentials.txt.
• Keep the OS patched. Unattended security upgrades remain enabled on the running VM.

Dante is developed by Inferno Nettverk A/S and distributed under a permissive BSD/CMU-style licence, which allows redistribution in source and binary form. This SecureAnyCloud image builds the unmodified upstream Dante 1.4.4 source.

SecureAnyCloud provides the packaging, the secure default configuration, the per-instance credential automation, security patching, and 24/7 support with a guaranteed 24-hour response SLA.

SecureAnyCloud is not affiliated with or endorsed by Inferno Nettverk. Dante is a mark of its respective owner and is used here only to identify the software.

Deploy on Azure

Find Dante SOCKS Proxy Server on Ubuntu 24.04 LTS on the Azure Marketplace, published by SecureAnyCloud. Deploy from the Portal or the Azure CLI as shown above.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions, or licensing enquiries.

Deploy on Azure

Launch Dante 1.4.4 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Find the Dante listing published by SecureAnyCloud on AWS Marketplace, subscribe, and choose Launch through EC2. Select your key pair.

Configure the security group to allow TCP 1080 from your client networks and TCP 22 for administration.

To launch the same AMI from the AWS CLI, replace the example values with your own:

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <security-group-id> \
  --subnet-id <subnet-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=dante-proxy}]'

Connect over SSH as your operating system variant's default login user:

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i <your-key>.pem ubuntu@<public-ip>

A unique proxy username and password are generated on first boot and written to a root-only file. Read them with:

sudo cat /root/dante-credentials.txt

The file contains PROXY_USERNAME= and PROXY_PASSWORD= <set-at-first-boot> plus the SOCKS endpoint. Keep these credentials safe. They are unique to this instance, and your clients authenticate with them.

Dante runs under systemd and listens for SOCKS clients on TCP 1080:

sudo systemctl status danted --no-pager | head -n 5

sudo ss -tlnp | grep 1080

Confirm the credentials file exists and is root-only (0600), without printing its contents:

sudo ls -l /root/dante-credentials.txt

Read the per-instance credentials into shell variables (they are never printed), then make a request through the proxy. The request leaves through the instance, so the returned address is the instance's own public IP address:

PROXY_USER=$(sudo grep '^PROXY_USERNAME=' /root/dante-credentials.txt | cut -d= -f2-)
PROXY_PASS=$(sudo grep '^PROXY_PASSWORD=' /root/dante-credentials.txt | cut -d= -f2-)
curl -s -x "socks5h://$PROXY_USER:$PROXY_PASS@127.0.0.1:1080" https://api.ipify.org echo

Now prove that the proxy is not an open relay. An anonymous request (no credentials) is rejected at SOCKS method negotiation:

if curl -s -o /dev/null -m 15 -x socks5h://127.0.0.1:1080 https://api.ipify.org; then echo "UNEXPECTED: anonymous request succeeded" else echo "anonymous request correctly rejected (not an open relay)" fi

From a client on an admitted network, point any SOCKS-aware application at the instance on port 1080 with the per-instance username and password.

For example, with curl from your workstation, replace the example values with your instance address and credentials:

curl -x socks5h://PROXY_USERNAME:PROXY_PASSWORD@<public-ip>:1080 https://ifconfig.me

Most browsers, SSH (ssh -o ProxyCommand), and language HTTP libraries accept a SOCKS5 proxy with authentication in the same way.

By default, only loopback and RFC1918 private sources are admitted. To allow your own remote client range, add a client pass block for that CIDR in /etc/danted.conf, above the final client block, then reload:

sudo nano /etc/danted.conf
# add, for example:
# client pass { from: 203.0.113.0/24 to: 0.0.0.0/0 }
sudo systemctl reload danted

Also open TCP 1080 in the instance's security group for those client networks.