vincentkong.com » SSH

Tabs for PuTTY

Vincent Kong — Tue, 24 Aug 2010 03:02:08 +0000

A lot of people including me uses the free PuTTY application as a SSH client for Windows. However, the most annoying thing about it, is the lack of tabs; making me having to manage multiple PuTTY windows for multiple SSH sessions.

PuTTY Connection Manager is a free PuTTY Client Add-on for Windows platforms uses tabs for managing multiple PuTTY instances!

When PuTTY Connection Manager is first started, it’ll ask you to enter the location of where your PuTTY is installed.

And finally, you can start using a tabbed version of PuTTY!

SSH with Ajaxterm

Vincent Kong — Wed, 11 Nov 2009 02:50:03 +0000

Almost a year ago I wrote about SSHing with a web browser using MindTerm. This was good, if the network allows traffic via the SSH port, and nowadays this is usually not the case.

Ajaxterm is a web based terminal that provides SSH connectivity with a AJAX supported web browser.

Installing Ajaxterm in Ubuntu

$ sudo apt-get install ajaxterm

Modify the configure file /etc/default/ajaxterm if a different port for ajaxterm is desired. The default port is 8022.

Setting up Ajaxterm with Apache

By default Ajaxterm only listen at 127.0.0.1:8022. For remote access, configure it with Apache using mod_proxy.

$ a2enmod proxy_http

Add the following to the Apache config /etc/apache2/httpd.conf

ProxyRequests off
ProxyPass / http://localhost:8022/
ProxyPassReverse / http://localhost:8022/

When completed point the browser to the domain associated with Ajaxterm.

Ajaxterm

Running GUI Software from Remote Servers with Xming

Vincent Kong — Thu, 29 Oct 2009 03:50:31 +0000

Xming provides an implementation of the X Windows System (X11 server) for Microsoft Windows. Its useful when needing to use a GUI application on a remote server that doesn’t provide remote desktop access.

Installing Xming

Installing Xming on Windows is easy; download the binary file and follow the installation wizard.

To configure Xming run XLaunch from the Start Menu, otherwise run Xming to start up the application.

When started an icon would appear on the taskbar.

Configure X11 Forwarding in PuTTY

Before establishing and SSH connection go to Connection -> SSH -> X11 in the configuration window and check the “Enable X11 forwarding” box.

PuTTY X11 Forwarding

After SSH connection has been established any GUI application can be run by executing it from the command prompt e.g. the Thunar file manager for Xubuntu

Running Thunar in Windows with Xming

More detail information can be found here.

SSH with a Web Browser

Vincent Kong — Wed, 24 Dec 2008 07:32:03 +0000

A while back, I was using someone’s computer and I wanted to SSH into my server. The machine didn’t have any SSH client and I didn’t have my U3 Smart Drive with me.

MindTerm is a client that implements the SSH protocols written in Java which can run as an Applet. The basic syntax for embedding the MindTerm Applet in a web page is as follows:

Due to the Java security model, the Applet requires to be sign, otherwise it won’t run properly and throw an AccessControlException, as shown in the Java console.

For information on how to sign an Applet refer to Signing Java Applets Using RSA Certificate. After the Applet has been successfully signed a pop up will appear asking to accept the digital signature, and when accepted the Applet will have permission to run properly; this can be verify with the Java console again.

Now you can SSH from any computer that has a web browser and internet access.

For more information refer to Running MindTerm as an Applet

Restricting Shell for only SCP/SFTP

Vincent Kong — Fri, 21 Nov 2008 06:28:30 +0000

If you have a server, but only want to allow users to copy files via sFTP without providing shell access. This can be done with rssh, a restricted shell for use with OpenSSH that allows only scp and/or sftp.

To install rssh

$ apt-get install rssh

By default rssh doesn’t allow anything, to allow only sftp modify the rssh.conf file.

$ nano /etc/rssh.conf

Uncomment the line for allowsftp and other transfer protocols you want to enable.

#allowscp allowsftp #allowcvs #allowrdist #allowrsync

To restrict a user to only allow sftp access, modify the /etc/passwd file

$ nano /etc/passwd

For example

ftp:x:100:100::/home/ftp:/usr/bin/rssh

Surfing the Web using SSH Tunnel

Vincent Kong — Sat, 23 Aug 2008 04:25:35 +0000

Sometimes, you are connected to an internet which is unknown/insecure such as public WiFi hotspots or you are just surfing the internet at work. In these type of scenarios you might want to secure your connection so no one can sniff at what or where you’re surfing. One way to create a secure connection is to create an SSH tunnel, and have your web browser use it as a SOCKS proxy.

The first requirement is to have a remote host running an SSH server. e.g. a box at home running OpenSSH. Then, you need to have an SSH client installed on your local machine, for Windows you can use PuTTY.

Establish an SSH tunnel using PuTTY:

Create a new PuTTY session

Run PuTTY and create a new session to connect to the remote host. Fill in the hostname, the port (usually 22), make sure SSH is checked.

Configure the Secure Tunnel

Click on “Tunnels” on the left panel to set up dynamic fowarding for a local port. Under “Add new forwarded port” type in the port number (e.g. 4080) for the source port, leave the destination blank, and check Auto and Dynamic. Then click the “Add” button. You should see D4080 listed in the “Forwarded Ports” box.

Establish an SSH tunnel on Linux:

Use the following command:

$ ssh -D 4080 username@remote_host_server

The tunnel is created when you login to the SSH server.

Configuring Your Web Browser:

To use the SSH tunnel as a SOCKS proxy you need to change the connection settings in the browser.

In the Firefox Connection Settings:

Check “Manual Proxy Configuration:”
Fill in 127.0.0.1 for the “SOCKS Host:” and 4080 for “Port:”
Check “SOCKS v5″

Once everything is done you are now surfing the web securely.

SSH through HTTP Proxies

Vincent Kong — Sat, 29 Mar 2008 02:28:45 +0000

A couple of days ago my office implemented a new firewall which block almost all incoming and outgoing traffic, including SSH which prevented me from accessing my Linux server. The only thing that was accessible was the internet through a HTTP proxy which implemented filtering capabilties and required credentials. Fortunately, with this I’m able to create a tunnel and encapulate a SSH connection into HTTP.

To create a HTTP tunnel I chose to use the GNU HTTP Tunnel software which does the work to encapsulate TCP into HTTP requests. For the Windows platform a binary version is also available

Setting up the tunnel

On the home computer (server):

Install the GNU HTTP Tunnel with the following command:

$ apt-get install httptunnel

Start the HTTP Tunnel server:

$ hts --forward-port localhost:22 8080

Here the HTTP Tunnel server receives HTTP requests through port 8080, decapsulates and re-assembles the ssh stream and forwards it to port 22, the SSH server.

On the office computer (client):

Start the HTTP Tunnel client:

$ htc --forward-port 900 --proxy OfficeProxy:8080 HomeComputer:8080

Here the HTTP Tunnel client listens on port 900 for a ssh stream, as well it establishes a TCP connection which can pass data back and forth to the home computer through the HTTP proxy.

If the proxy requires authentication, add --proxy-authorization username:password to the htc command line.

Finally to establish a SSH connection run the following:

$ ssh username@localhost:900

For information: Punching holes into firewalls

Remote Desktop with SSH Tunneling

Vincent Kong — Fri, 20 Jul 2007 03:44:56 +0000

Remote Desktop enables you to connect to your computer across the Internet from a computer. Once connected, you can control your computer using the mouse and keyboard while showing you everything that’s happening on the screen. With this, you can access your files, applications, and e-mail while leaving your computer at home or in the office.

Remote Desktop is very convenient, it suffers from to flaws: Although the connection uses 128-bit encryption, it still has the man-in-the-middle vulnerability where the traffic can be decrypted along the way. The default port of Remote Desktop is also 3389 which in most circumstances is blocked by firewalls in the network.

A solution to these flaws is to use Remote Desktop through a SSH tunnel.

SSH Server

The first requirement is to have an SSH server existing on your network. If you already have a Linux server like Ubuntu then you can install OpenSSH. However, if you only have computers with Windows then you can install copSSH.

Port Forwarding for SSH

To access the SSH server from a remote location you need to do port forwarding on port 22 through any firewall and router.

Enabling Remote Desktop

To enable Remote Desktop on Windows XP, right click on “My Computer”, and select “Properties”. Under the “Remote” tab check the box “Allow users to connect remotely to this computer”. The Remote Desktop user will require a password associated with the account.

Connecting to the SSH Server

To connect to your SSH Server remotely requires knowledge of your public IP address. This can be checked easily using the website http://checkip.dyndns.org. If you are using an ISP that provides you with a dynamic IP address, then you can setup a free account with No-IP http://www.no-ip.com or DynDNS http://www.dyndns.com where they can provide you with a fully qualified domain name.

Install/Configuring PuTTY

To open a SSH tunnel from the remote computer to your SSH server, you need to install PuTTY http://www.chiark.greenend.org.uk/~sgtatham/putty on the remote client computer. Open the application after installation is completed.

Expand “SSH” under “Connection”, and then go to “Tunnels”.
Under “Add new forwarded port:” enter a port number beside “Source port” e.g. 3390
Beside “Destination” enter your computer name or computer local IP address along with the port for Remote Desktop 3389 e.g. 192.168.1.10:3389, and click on the “Add” button.

Use a different Source port for each additional Remote Desktop host PC.

To improve traffic click on “SSH” under “Connection”. Check the box “Enable Compression”

Click on “Session” and under the “Host Name (or IP address)” enter the public IP address or a fully qualified domain name of the SSH server PC. Enter a unique name in the “Saved Sessions” window and click on “Save”. Click on “Open” and login to the SSH server with the appropriate user and password information.

SSH Tunneling the Remote Desktop session

Establishing a Remote Desktop connection through SSH tunnel is accomplished when PuTTY is started and the user has logged on to the SSH server. To Remote Desktop from the client computer, on the client computer go to “Start” > “All Programs” > “Accessories” > “Communications” and select “Remote Desktop Connection”. In the “Computer:” textbox enter “localhost:3390″, and click on the “Connect” button.

SSH Authentication with public-key

Vincent Kong — Thu, 10 May 2007 16:04:07 +0000

To create the private and public keys type on the unix prompt:

$ ssh-keygen

You can use the default location, and not use a passphrase. The keys will be created in the directory:

/home//.ssh/

Inside this directory you’ll find two files id_rsa (the private key), and id_rsa.pub (the public key).

Login into the remote server and created the ‘.ssh’ under the home directory. Ensure the directory only has permissions to the owner.

$ ssh @ $ mkdir .ssh $ chmod 700 .ssh

Go back to your host server and copy the public key to the remote server.

$ sftp @ $ put /home//.ssh/id_rsa.pub ./ssh

Login into the remote server again and rename the public key to authorized_keys. Also ensure the file only has permissions to the owner.

$ ssh @ $ cd .ssh $ mv id_rsa.pub authorized_keys $ chmod 600 authorized_keys

Next time you ssh to the remote server, you should be logged in automatically without needing to enter a password.

OpenSSH for Ubuntu Quickstart Guide

Vincent Kong — Thu, 10 May 2007 16:02:35 +0000

OpenSSH (Open Secure Shell) is a set of computer programs providing encrypted communication sessions over a computer network using the SSH protocol.

Installing OpenSSH for Ubuntu

From the Ubuntu desktop:

Go to System > Administration > Synapatic Package Manager
Search for “openssh-server” and “Mark for installation”
Click on the “Apply” to install

From the command line:

$ sudo apt-get install openssh-server

Configuration Files

The configuration files for OpenSSH is located in:

/etc/ssh

Disabling SSH Root Logins

Edit the /etc/ssh/sshd_config file and set the PermitRootLogin parameter to no.