public:ssh-usage

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
public:ssh-usage [2015-03-09 09:49] – [SSH Port forwarding / tunneling] gritpublic:ssh-usage [2018-07-18 11:46] (current) – [Simple VPN using dynamic port forwarding] Reinoud Bokhorst
Line 12: Line 12:
 ==== Linux or OS X ==== ==== Linux or OS X ====
  
-The first thing you need to do is generate an authorisation key using the DSA algorithm, which means you need to do the following once. +The first thing you need to do is generate an authorisation key using the RSA algorithm (please don't use DSA as it is insecure), which means you need to do the following once. 
 You need to have a somewhat recent version of OpenSSL on your system for this to work: You need to have a somewhat recent version of OpenSSL on your system for this to work:
-  ssh-keygen -tdsa +  ssh-keygen -t rsa 
-  cp .ssh/id_dsa.pub .ssh/authorized_keys+  cp .ssh/id_rsa.pub .ssh/authorized_keys
 Use cat or some editor like vi, kate or emacs if authorized keys already exists and can't be simply copied. Copy your ''.ssh/authorized_keys'' to the ''$HOME/.ssh'' directory of each system you want access to. **Please make sure you use a passphrase to encrypt your private key**, to prevent easy access. When using the instructions below on the ssh-agent, you'll only have to provide it once each time you use the systems. You only need to generate one key-pair on your personal machine! You can also use cut and paste to simply copy your public key to all target systems. Don't let you editor use word-wrap, since the key must be one single line. Use cat or some editor like vi, kate or emacs if authorized keys already exists and can't be simply copied. Copy your ''.ssh/authorized_keys'' to the ''$HOME/.ssh'' directory of each system you want access to. **Please make sure you use a passphrase to encrypt your private key**, to prevent easy access. When using the instructions below on the ssh-agent, you'll only have to provide it once each time you use the systems. You only need to generate one key-pair on your personal machine! You can also use cut and paste to simply copy your public key to all target systems. Don't let you editor use word-wrap, since the key must be one single line.
  
Line 26: Line 26:
 Select from the ''Programs'' menu the ''Putty'' section and select ''PuttyGen''. Select from the ''Programs'' menu the ''Putty'' section and select ''PuttyGen''.
  
-  * Select in the ''Paramaters'' section the key type (e.g., SSH-2 DSA).+  * Select in the ''Parameters'' section the key type '''SSH-2 RSA''' and number of bits 2048.
   * Press the ''Generate'' button.   * Press the ''Generate'' button.
   * Now you'll have to move your mouse over the grey area below the progress bar.   * Now you'll have to move your mouse over the grey area below the progress bar.
Line 93: Line 93:
 {{public:osx_ssh_agent.png?330x200|SSh Agent 1.1}} {{public:osx_ssh_agent.png?330x200|SSh Agent 1.1}}
  
-If you have this set up, then you can easily make bookmarks in [[http://iterm.sourceforge.net/|iTerm]] to access machines and forward the ssh-agent. An example with some of the LOFAR machines is shown in the image below.+If you have this set up, then you can easily make bookmarks/profiles in [[http://iterm.sourceforge.net/|iTerm (older OSX)]] / [[https://www.iterm2.com/|iTerm2 (newer OSX)]] to access machines and forward the ssh-agent. An example with some of the LOFAR machines is shown in the image below.
 {{ :public:iterm_bookmarks.png?520 |iTerm bookmarks}} {{ :public:iterm_bookmarks.png?520 |iTerm bookmarks}}
  
Line 193: Line 193:
 <code>ServerAliveInterval 60</code> <code>ServerAliveInterval 60</code>
 That will send send a message to the server every 60 seconds, keeping the connection open. I prefer this way because I login to several machines every day, and I don’t have root access to all of them. That will send send a message to the server every 60 seconds, keeping the connection open. I prefer this way because I login to several machines every day, and I don’t have root access to all of them.
 +
 +
 +==== lofarsys@localhost ====
 +
 +When you need to become lofarsys on the current host, you can use the following trick to overcome host key conflics:
 +  alias lof='ssh -XA -o NoHostAuthenticationForLocalhost=yes lofarsys@localhost' 
 +
 +\\
 +
 +
 +
 +===== Simple VPN using dynamic port forwarding =====
 +
 +Instead of forwarding a single port you can also use dynamic port forwarding. This will turn your SSH client into a local [[https://en.wikipedia.org/wiki/SOCKS|SOCKS]] proxy server. This is quite powerful as all client programs that are then configured to use the SOCKS proxy, will have access to services in the remote network over the encrypted ssh connection. When SOCKS5 is used, also DNS lookups can be sent through your tunnel, basically turning your SSH connection into a poor man's VPN connection.
 +
 +The most useful application is to use a SOCKS proxy to access LOFAR web services that are behind the firewall (when you are not connected to the LAN). Two steps are needed:
 +  - Create a SOCKS proxy to the LOFAR portal
 +  - Configure your browser (or OS) to use the proxy
 +Below a description on how to do that.
 +
 +==== Create SOCKS proxy ====
 +
 +__With SSH__
 +
 +The SOCKS proxy is created by enabling the dynamic port forwarding feature when connecting to the LOFAR portal:
 +
 +<file>
 +ssh -D 1080 <user>@portal.lofar.eu
 +</file>
 +
 +Port 1080 is the default SOCKS port but you can also choose another non-privileged one (e.g. 9999). Some client programs however may expect that port 1080 is used.
 +
 +Additionally you may add the '-C' flag to enable compression. This will speed up your connection in most cases except when dealing with a lot of binary data.
 +
 +__With PuTTY__
 +
 +Create a new session in the Putty configuration dialog to portal.lofar.eu on port 22 as you would normally do (e.g. adding your ssh key for authentication).
 +
 +Then go to Connections->SSH->Tunnels and enable the 'Auto' and 'Dynamic' radio buttons. Fill in 1080 as the source port and click on 'Add'. It should now look like this:
 +
 +{{:public:putty-port-added.png?400|}}
 +\\
 +
 +Go back to the Session and save this configuration under an existing or new session.
 +
 +
 +
 +==== Configuring your web browser ====
 +
 +A web browser must be configured to use the SOCKS tunnel as a proxy server. Generally this is done by going to the web browser settings and looking for something like 'network' or 'proxy' settings:
 +
 +__Firefox__
 +
 +  - Go to Preferences
 +  - Look for an item called 'Network proxy'. You may also type 'proxy' in the search field to find it for you.
 +  - Click on Settings, choose "Manual proxy configuration" and fill in the details as below (socks host and port, SOCKSv5, proxy DNS):\\  {{:public:ff_proxy_2.png?400|}} \\ \\ Make sure that DNS is forwarded using SOCKS5 by checking the checkbox.
 +  - Now try to access an internal web service, you should be able to use the internal domain name of the service (xxx.control.lofar). 
 +
 +\\ 
 +
 +__Chrome__
 +
 +Newer versions of chrome use the system-wide network configuration for its proxy settings. This is an alternative to only configuring the web browser to use the proxy. However, if you want to limit the proxy only for web browsing you can start Chrome adding the flag --proxy-server, e.g. on Linux Mint: 
 +
 +<file>
 +google-chrome-stable --proxy-server="socks5://localhost:1080"
 +</file>
 +
  
  
  • Last modified: 2015-03-09 09:49
  • by grit