Shadowsocks 开启 OTA

One Time Auth

One-time authentication (shortened as OTA) is a new experimental feature designed to improve the security against CCA. You should understand the protocol before reading this document.

By default, the server that supports OTA should run in the compatible mode. OTA is only applied if the client’s request header has a flag set. However, if the server switch on OTA explicitly, all clients must switch on OTA, otherwise connections will be denied.

The authentication method is HMAC-SHA1 which has wide supports among all major platforms and fairly good speed.

服务端

更新服务端 shadowsocks 版本(debian_shadowsocks_tennfy.sh)

配置启动参数以开启 OTA：vi /etc/default/shadowsocks-libev

# Extra command line arguments
DAEMON_ARGS="-u -A"

/etc/init.d/shadowsocks-libev restart

客户端 Mac

使用 shadowsocks-libev。

为安装脚本添加 -A 参数（OTA）：brew edit shadowsocks-libev

plist_options:manual => "#{HOMEBREW_PREFIX}/opt/shadowsocks-libev/bin/ss-local -A -c #{HOMEBREW_PREFIX}/etc/shadowsocks-libev.json"
 
<string>#{opt_bin}/ss-local</string>
<string>-A</string>
<string>-c</string>
<string>#{etc}/shadowsocks-libev.json</string>