Jephe Wu - http://linuxtechres.blogspot.com
Objective: Value-add advanced Linux OpenSSH video tutorial made free to everyone.
Video course 1: OpenSSH chroot sftp part I with PDF tutorial
Video course 2: OpenSSH chroot sftp part II with PDf tutorial
Video course 3: OpenSSH chroot sftp Part III with PDF tutorial
Video course 4: SSH passwordless login with PDF tutorial
Video course 5: SSH transparent proxy with PDF tutorial
Video course 6: SSH local port forwarding with PDF tutorial
Video course 7: SSH remote port forwarding with PDF tutorial
Video course 8: SSH gateway ports local with PDF tutorial
Video course 9: SSH gateway ports remote with PDF tutorial
Video course 10: SSH socks proxy with PDF tutorial
Video course 11: SSH http proxy with PDF tutorial
Video course 12: SSH agent with PDF tutorial
Video course 13: OpenSSH screen with PDF tutorial
Video course 14: OpenSSH keepalive with PDF tutorial
Video course 15: OpenSSH troubleshooting I with PDF tutorial
Video course 16: OpenSSH troubleshooting II with PDF tutorial
Linux OpenSSH Advanced Video Tutorial
How to access office server and admin desktop from home
Jephe Wu - http://linuxtechres.blogspot.com
Objective: assume you have a admin Windows xp pro desktop in office which is running 24 hours. You need to access company Linux servers and the admin Windows pc from home.
Environment: assume your office has lease line connecting to Internet, also 2 level of squid proxy server (parent proxy concept) running on the LAN for users to access Internet, Windows XP pro admin desktop pc and CentOS servers.
Connection diagram:
office lan - squid proxy - squid parent proxy
--internet firewall -[cloud] - Singapore ISP(starthub)--
home cable modem - wireless router - home Linux server + home Windows pc
Other ways: VNC listening viewer mode, openvpn, hosted vpn such as LogMeIn Hamachi.
Assume your 2 squid proxy has enabled port 22 for SSL
acl SSL_ports port 443 22
acl Safe_ports port 443 22
squid -k reconfigure
Configure home wireless router to port forwarding port 22 to your home Linux/Windows cygwin ssh server at port 22.
At home, configure ssh server /etc/ssh/sshd_config or /etc/sshd_config in cygwin (GatewayPorts yes)
In office, use the following ssh_config configuration (/etc/ssh/ssh_config): download proxytunnel v1.9 rpm and installed on admin linux server first.
Host jephe
ServerAliveInterval 60
ServerAliveCountMax 600
Proxycommand /usr/bin/proxytunnel -p 10.0.0.2:8080 -d jephe.domain.com:22
Run the following command to ssh into home Linux/Windows pc:
ssh -v -R 3389:adminpc.jephe.com:3389 -R 2222:localhost:22
[-L 8080:192.168.10.1:80] [-g] note:(-g means allows remote hosts to connect to local forwarded ports)(-L part means you can connect to linux admin server at port 8080 which will be tunnelled to home wireless router admin access page) How to connect to office from home:
use rdp to connect to localhost for office admin pc remote desktop.
use putty to connect to localhost:2222 for ssh into office linux admin pc
b. You need to allow remote desktop connection (right click computer, properties, advanced system settings,remote, choose users if necessary)
c. You cannot use port 3389 and 3390 for port forwarding at localhost, use 3391 instead.
so, after ssh, you should use localhost:3391 for connecting to office desktop pc.
note:
I have tried cygwin 1.7.7 on Windows xp for remote port portforwaring which is also working, without proxytunnel and http proxy.
b. openssh+nc
you can use the following in the /etc/ssh/ssh_config
Host test
hostname dest_server_ip
ProxyCommand ssh jephe@firewall_ip nc -w 1 %h %p
c. putty + proxytunnel
According to my test, putty can use http proxy option or external program proxytunnel. I tried both options, the remote port forwarding part doesn't work(putty 0.60 and latest snapshot,also Xshell, CentOS 5.5 openssh server), the normal port forwarding through putty is working, which means you can access home pc and wireless router when you are in office, but not office pc and linux admin server when you are at home.
Putty's http proxy:
Just specify the squid proxy ip and port number, it will be able to tunnel your ssh connection through squid proxy:
Proxytunnel:
go into the Connection > Proxy menu. Select the Local proxy type. And then provide as Telnet command, or local proxy command the following line:
proxytunnel -q -p squidproxy.jephe.com:8080 [-r jephe.apacheserver.com:443] -d %host:%port
-r part is used for Apache mod_proxy, refer to Reference 1 link.
Note: another options for http proxy is http://www.agroman.net/corkscrew/
note:
zmodem file transfer within Leputty(http://leputty.sourceforge.net/) and xshell
References:
2. proxytunnel homepage: http://proxytunnel.sourceforge.net/intro.php
3. tunnel ssh over http(s): http://dag.wieers.com/howto/ssh-http-tunneling/
4. use corkscrew tool
http://www.agroman.net/corkscrew/
http://daniel.haxx.se/docs/sshproxy.html
5. HowTo SSH outside using Authenticated Proxy
http://www.sohailriaz.com/howto-ssh-outside-using-authenticated-proxy/
Use Openssh chroot and ACL to make user to delete files under certain folder
Jephe Wu - http://linuxtechres.blogspot.com
Objective: let normal user accounts to be able to delete all files under /usr/local/tomcat/files/ directory and chroot to /usr/local/ after sftp.
Environment: CentOS 5.4, openssh 5.X, /usr/local/tomcat and all subdirectories are owned by tomcat:tomcat
Challenges:
1. default CentOS 5.4 doesn't come with the version of Openssh which is able to do chroot.
2. openssh internfal-sftp chroot requires all components of the pathname must be root-owned directories that are not writable by any other user or group, so we cannot chroot to /usr/local/tomcat/files directory, as tomcat is owned by tomcat , not root.
3. /usr/local/tomcat/files is owned by tomcat, not user accounts. So, although we can chroot to /usr/local/, we still need to let user acounts to be able to delete files.
Approach:
1. install the latest openssh 5.X
2. use chroot feature with internal-sftp, user can only use sftp, not shell, and chroot to /usr/local after that since /usr/local is owned by root.
3. use acl feature to set acl to be able to write for folder /usr/local/tomcat/files, but not able to list files under /usr/local/tomcat
Steps:
1. download and install openssh 5.x (./configure;make;make install to /usr/local/)
or you can check this page to install compiled RPM:
http://linuxadminzone.com/quickly-upgrade-ssh-openssh-in-centos-linux-to-latest-5-5-version/
2. configure /usr/local/etc/sshd_config as follows:
Subsystem sftp internal-sftp [-u 0002]
Match group chrooted
ChrootDirectory /usr/local/
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp [-u 0002]
Note: -u 0002 to specify umask for user after login, you can give
/usr/local as root:sftp -R and 755 -R
/usr/local/XXXX as apache:sftp -R and chmod 775 -R and chgrp g+ws XXXX -R
so that 2 users can share the work on the project.
Note: if you want to setup a chrooted sftp only environment for all users belongs to sftponly group. You can do this:
Match Group sftponly
ChrootDirectory %h
ForceCommand internal-sftp
or
Match Group sftponly
ChrootDirectory /sftponly
ForceCommand internal-sftp
note: You can give root:sftponly permission to /sftponly directory, if you'd like
to restrict users from writing to that folder, don't give write permission for group.
or create a subfolder under /sftponly then give write permission to that subfolder only, instead of parent folder.
3.create user account jephe:
useradd jephe
groupadd chrooted
usermod jephe -G chrooted
4. mount the partition which the folder /usr/local/ belongs to with acl options
5. set acl for user jephe
setfacl -m u:jephe:x /usr/local/tomcat/
setfacl -m u:jephe:rwx /usr/local/tomcat/files
Note: so, now user jephe is able to delete any files under /usr/local/tomcat/files, but cannot list any other files under /usr/local/tomcat directory. User can configure winscp to direct switch to /tomcat/files(/usr/local becomes / after chroot for user)
Posts
