Reverse ssh - Revision history

amigadave: /* Scripts & Files */ copy scripts inline

amigadave — Thu, 09 Dec 2010 15:01:48 GMT

Scripts & Files: copy scripts inline

← Older revision		Revision as of 15:01, 9 December 2010
Line 35:		Line 35:

	== Scripts & Files ==		== Scripts & Files ==
-	* [[Image:Reverse_ssh.sh~~]] -~~ This file should be located in <code>/usr/share</code>, you also need to edit it with the correct ports and hostname.	+
-	* [[Image:Reverse ssh ~~stop~~.~~sh]]~~ - This file should also be in <code>/usr/share</code>.	+	'''All files need to have executable permissions''' (<code>chmod +x filename</code>, or <code>chmod 755 filename</code>)
-	* [[Image:Reverse ssh if down.sh]] - This file should be in <code>/etc/network/if-down.d/</code> ~~- After copying this file, remove the .~~sh ~~extension.~~	+
-	* [[Image:Reverse ssh if up.sh~~]] -~~ This file should be in <code>/etc/network/if-up.d/</code> ~~- After copying this file, remove the~~ .sh ~~extension~~.	+	=== reverse_ssh.sh ===
-	* '''All files need to have executable permissions''' (chmod -x filename, or chmod 755 filename)	+
		+	This file should be located in <code>/usr/share</code>, you also need to edit it with the correct ports and hostname.
		+	<source lang="bash">
		+	#!/bin/sh
		+
		+	echo "Script starting"
		+	while true; do ssh -N -C -p 22 -R 2222:127.0.0.1:22 myHostname.no-ip.info > /var/log/reverse_ssh.log; sleep 5; done
		+	</source>
		+
		+	=== reverse_ssh_stop.sh ===
		+
		+	This file should also be in <code>/usr/share</code>.
		+	<source lang="bash">
		+	#!/bin/sh
		+
		+	killall reverse_ssh.sh
		+
		+	for i in `ps aux \| grep -i "ssh -n" \| grep -v grep \| awk '{print $1}' ` ; do
		+	kill -9 $i
		+	done
		+	</source>
		+
		+	=== reverse_ssh_if_down ===
		+
		+	This file should be in <code>/etc/network/if-down.d/</code>
		+	<source lang="bash">
		+	#!/bin/sh
		+
		+	nohup /usr/share/reverse_ssh_stop.sh > /var/log/reverse_ssh_if_down.log &
		+	</source>
		+
		+	=== reverse_ssh_if_up ===
		+
		+	This file should be in <code>/etc/network/if-up.d/</code>
		+	<source lang="bash">
		+	#!/bin/sh
		+
		+	echo "Interface went Up"
		+	nohup /usr/share/reverse_ssh.sh > /var/log/reverse_ssh_if_up.log &
		+	</source>

	== Warnings ==		== Warnings ==

88.130.218.32: /* Scripts & Files */ remove that 777 crap

88.130.218.32 — Sat, 04 Sep 2010 18:29:32 GMT

Scripts & Files: remove that 777 crap

← Older revision		Revision as of 18:29, 4 September 2010
Line 39:		Line 39:
	* [[Image:Reverse ssh if down.sh]] - This file should be in <code>/etc/network/if-down.d/</code> - After copying this file, remove the .sh extension.		* [[Image:Reverse ssh if down.sh]] - This file should be in <code>/etc/network/if-down.d/</code> - After copying this file, remove the .sh extension.
	* [[Image:Reverse ssh if up.sh]] - This file should be in <code>/etc/network/if-up.d/</code> - After copying this file, remove the .sh extension.		* [[Image:Reverse ssh if up.sh]] - This file should be in <code>/etc/network/if-up.d/</code> - After copying this file, remove the .sh extension.
-	* '''All files need to have executable permissions~~, I usually just do "chmod 777 <filename>" - But I reckon that it is not very secure, so someone please clarify the minimum level of permissions needed.~~'''	+	* '''All files need to have executable permissions''' (chmod -x filename, or chmod 755 filename)
-	* '''You would want "chmod ~~755 <filename>" (777 = rwxrwxrwx, writable to anyone; 755 = rwxr-xr~~-x, ~~writable only to you)''' (remember~~ 755 ~~for executable and directories, 644 for files~~)	+

	== Warnings ==		== Warnings ==

208.97.167.12: /* Scripts & Files */ chmod

208.97.167.12 — Tue, 24 Aug 2010 19:39:27 GMT

Scripts & Files: chmod

← Older revision		Revision as of 19:39, 24 August 2010
Line 40:		Line 40:
	* [[Image:Reverse ssh if up.sh]] - This file should be in <code>/etc/network/if-up.d/</code> - After copying this file, remove the .sh extension.		* [[Image:Reverse ssh if up.sh]] - This file should be in <code>/etc/network/if-up.d/</code> - After copying this file, remove the .sh extension.
	* '''All files need to have executable permissions, I usually just do "chmod 777 <filename>" - But I reckon that it is not very secure, so someone please clarify the minimum level of permissions needed.'''		* '''All files need to have executable permissions, I usually just do "chmod 777 <filename>" - But I reckon that it is not very secure, so someone please clarify the minimum level of permissions needed.'''
		+	* '''You would want "chmod 755 <filename>" (777 = rwxrwxrwx, writable to anyone; 755 = rwxr-xr-x, writable only to you)''' (remember 755 for executable and directories, 644 for files)

	== Warnings ==		== Warnings ==

amigadave: add SSH link

amigadave — Wed, 16 Jun 2010 09:33:25 GMT

add SSH link

← Older revision		Revision as of 09:33, 16 June 2010
Line 1:		Line 1:
-	Reverse SSH is a term describing a method to connect to a destination host, when it is actually the host that is initiating the connection to a middle server.	+	Reverse SSH is a term describing a method to connect via [[SSH]] to a destination host, when it is actually the host that is initiating the connection to a middle server.

	== Rationale ==		== Rationale ==

eitama at 17:46, 5 June 2010

eitama — Sat, 05 Jun 2010 17:46:23 GMT

← Older revision		Revision as of 17:46, 5 June 2010
Line 45:		Line 45:
	* This may cause connectivity problems if you don't do something right.		* This may cause connectivity problems if you don't do something right.
	* This may compromise your phones security.		* This may compromise your phones security.
		+
		+	== Reliability ==
		+	* After using this for about 5 days, I can safely say this is very reliable. My setup: Nokia N900 > [http://en.wikipedia.org/wiki/Linksys_WRT54G_series Linksys WRT54GL] with [http://en.wikipedia.org/wiki/Tomato_(firmware) Tomato] firmware.
		+	* I have been able to connect to my N900 any time I wanted, and it just worked.
		+	* Tested both when phone was on WIFI, and 3G.
		+	* Also tested rebooting the router, causing the *.no-ip.info value to change, which also showed the N900 promptly queried for the new value.

	== Credits ==		== Credits ==

amigadave: /* Scripts & Files */ fix script links

amigadave — Thu, 03 Jun 2010 08:51:54 GMT

Scripts & Files: fix script links

← Older revision		Revision as of 08:51, 3 June 2010
Line 36:		Line 36:
	== Scripts & Files ==		== Scripts & Files ==
	* [[Image:Reverse_ssh.sh]] - This file should be located in <code>/usr/share</code>, you also need to edit it with the correct ports and hostname.		* [[Image:Reverse_ssh.sh]] - This file should be located in <code>/usr/share</code>, you also need to edit it with the correct ports and hostname.
-	* [[Image:Reverse ~~Ssh Stop~~.Sh]] - This file should also be in <code>/usr/share</code>.	+	* [[Image:Reverse ssh stop.sh]] - This file should also be in <code>/usr/share</code>.
-	* [[Image:Reverse ~~Ssh If Down~~.Sh]] - This file should be in <code>/etc/network/if-down.d/</code> - After copying this file, remove the .sh extension.	+	* [[Image:Reverse ssh if down.sh]] - This file should be in <code>/etc/network/if-down.d/</code> - After copying this file, remove the .sh extension.
-	* [[Image:Reverse ~~Ssh If Up~~.Sh]] - This file should be in <code>/etc/network/if-up.d/</code> - After copying this file, remove the .sh extension.	+	* [[Image:Reverse ssh if up.sh]] - This file should be in <code>/etc/network/if-up.d/</code> - After copying this file, remove the .sh extension.
	* '''All files need to have executable permissions, I usually just do "chmod 777 <filename>" - But I reckon that it is not very secure, so someone please clarify the minimum level of permissions needed.'''		* '''All files need to have executable permissions, I usually just do "chmod 777 <filename>" - But I reckon that it is not very secure, so someone please clarify the minimum level of permissions needed.'''

amigadave: wikify and categorize

amigadave — Thu, 03 Jun 2010 08:39:36 GMT

wikify and categorize

eitama at 07:59, 3 June 2010

eitama — Thu, 03 Jun 2010 07:59:32 GMT

← Older revision		Revision as of 07:59, 3 June 2010
Line 2:		Line 2:

	== Rational ==		== Rational ==
-	If your N900 (or any other linux machine) is hiding behind private ip addresses / firewalls / NATs that you cannot configure - basically unreachable, you can overcome these obstacles with reverse ssh.	+	If your N900 (or any other linux machine) is hiding behind private ip addresses / firewalls / NATs that you cannot configure - basically unreachable, you can overcome these obstacles with reverse ssh. Further discussion is located in this [http://talk.maemo.org/showthread.php?p=696130#post696130 thread].

	== How To ==		== How To ==

eitama at 07:58, 3 June 2010

eitama — Thu, 03 Jun 2010 07:58:03 GMT

← Older revision		Revision as of 07:58, 3 June 2010
Line 36:		Line 36:
	** I am not sure about BW usage for the "ServerAliveInterval" command, but it works for me, if you use it, make sure you monitor your network usage over a few days.		** I am not sure about BW usage for the "ServerAliveInterval" command, but it works for me, if you use it, make sure you monitor your network usage over a few days.

-	~~Please don't rewrite this wiki page just yet~~, ~~i'll add some content~~ to it ~~soon~~ with ~~examples~~ and ~~some more clarification~~.	+	== Scripts & Files ==
		+	* [[Image:Reverse_ssh.sh]] - This file should be located in /usr/share, you also need to edit it with the correct ports and hostname.
		+	* [[Image:Reverse Ssh Stop.Sh]] - This file should also be in /usr/share.
		+	* [[Image:Reverse Ssh If Down.Sh]] - This file should be in /etc/network/if-down.d/ - After copying this file, remove the .sh extension.
		+	* [[Image:Reverse Ssh If Up.Sh]] - This file should be in /etc/network/if-up.d/ - After copying this file, remove the .sh extension.
		+	* '''All files need to have executable permissions, I usually just do "chmod 777 <filename>" - But I reckon it's not very secure, so someone please clarify the minimum level of permissions needed.'''

-	~~Eitam~~.	+	== Warnings ==
		+	* This may drain your battery.
		+	* This may cause connectivity problems if you don't do something right.
		+	* This may compromise your phones security.

	== Credits ==		== Credits ==
	Special thanks to [http://talk.maemo.org/member.php?u=26108 Spanner] for helping me out in this [http://talk.maemo.org/showthread.php?p=696130#post696130 thread], none of this would have been possible for me without him.		Special thanks to [http://talk.maemo.org/member.php?u=26108 Spanner] for helping me out in this [http://talk.maemo.org/showthread.php?p=696130#post696130 thread], none of this would have been possible for me without him.
		+
		+	Please feel free to edit this page if you have anything to add, I am not a linux expert, and the directories I chose to put the files are totally random, they may not be the best places, but they are all very small so the impact is little.

eitama: /* Pitfalls */

eitama — Thu, 03 Jun 2010 07:36:55 GMT

Pitfalls

← Older revision		Revision as of 07:36, 3 June 2010
Line 22:		Line 22:
	'''There are a few short comings in this setup, most can be worked around.'''		'''There are a few short comings in this setup, most can be worked around.'''
	* In order to skip the password query on the HOST, one must copy the public SSH key from the host to the authorized_keys folder on the common server.		* In order to skip the password query on the HOST, one must copy the public SSH key from the host to the authorized_keys folder on the common server.
-	~~[Steps will be added later]~~	+	In case your host is the Nokia N900, the file is located here : ./root/.ssh/id_dsa.pub
		+	** Some routers allow you to paste the contents of that file via the web gui of the router. (For example Tomato firmware for wrt routers)
	* If the ssh connection between the host and the common server breaks, for any reason, we want it to be reconnected automatically, we can encapsulate the ssh command inside an infinite loop, using a while command : while true; do ssh -N -C -p 22 -R 2222:127.0.0.1:22 myHostname.no-ip.info; sleep 5; done		* If the ssh connection between the host and the common server breaks, for any reason, we want it to be reconnected automatically, we can encapsulate the ssh command inside an infinite loop, using a while command : while true; do ssh -N -C -p 22 -R 2222:127.0.0.1:22 myHostname.no-ip.info; sleep 5; done
	* The command should be inserted into a script, for easy dispatch.		* The command should be inserted into a script, for easy dispatch.
	* It is possible to add the command to /etc/network/if-up.d/ - this will cause it to get dispatched everytime 3g / wifi are connected, making your phone available immediately.		* It is possible to add the command to /etc/network/if-up.d/ - this will cause it to get dispatched everytime 3g / wifi are connected, making your phone available immediately.
	* If the above method is used, a matching script must also be added to /etc/network/if-down.d/ to kill the looping ssh command to save some battery.		* If the above method is used, a matching script must also be added to /etc/network/if-down.d/ to kill the looping ssh command to save some battery.
-	~~[Add~~ ssh_config ~~parameters~~ for ~~stability here]~~	+	* When not used, and idle ssh connection might fail, In order to make the phone close the SSH session and start a new one, and also try to maintain it, we can add 2 values to the ssh configuration of your phone.
		+	** Open the file /etc/ssh/ssh_config for editing using your favorite editor, mine is vi.
		+	** Insert the following lines into the file :
		+	*** ExitOnForwardFailure yes
		+	*** ServerAliveInterval 60
		+	** The lines should be inserted right after the "Host *" line.
		+	** I am not sure about BW usage for the "ServerAliveInterval" command, but it works for me, if you use it, make sure you monitor your network usage over a few days.

	Please don't rewrite this wiki page just yet, i'll add some content to it soon with examples and some more clarification.		Please don't rewrite this wiki page just yet, i'll add some content to it soon with examples and some more clarification.

← Older revision		Revision as of 08:39, 3 June 2010
Line 1:		Line 1:
-	Reverse ~~ssh~~ is a term describing a method to connect to a destination host, when it's actually the host that is initiating the connection to a middle server.	+	Reverse SSH is a term describing a method to connect to a destination host, when it is actually the host that is initiating the connection to a middle server.

-	== ~~Rational~~ ==	+	== Rationale ==
-	If your N900 (or any other ~~linux~~ machine) is hiding behind private ip addresses / firewalls / NATs that you cannot configure - basically unreachable, you can overcome these obstacles with reverse ~~ssh~~. Further discussion is located in this [http://talk.maemo.org/showthread.php?p=696130#post696130 thread].	+	If your [[Nokia N900\|N900]] (or any other Linux machine) is hiding behind private IP addresses / firewalls / NATs that you cannot configure - basically unreachable, you can overcome these obstacles with reverse SSH. Further discussion is located in this [http://talk.maemo.org/showthread.php?p=696130#post696130 thread].

	== How To ==		== How To ==
-	Reverse ~~ssh~~ depends on a common server, a machine that both the client (source) and the host (destination) can reach.	+	Reverse SSH depends on a common server, a machine that both the client (source) and the host (destination) can reach. The host connects to the common server, waiting for the client to connect, then, the client connects to the common server, which in turn forwards that connection to the host.
-	The host connects to the common server, waiting for the client to connect, then, the client connects to the common server, which in ~~term~~ forwards that connection to the host.	+

	== Incentive ==		== Incentive ==
-	My N900 has unlimited 3g data connection, and I wanted to be able to ssh to it, even though it is using a private ip address which is unreachable. Reverse ssh made it possible.	+	My N900 has unlimited 3G data connection, and I wanted to be able to ssh to it, even though it is using a private ip address which is unreachable. Reverse ssh made it possible.

	== Installation Steps ==		== Installation Steps ==
	The core of this "workaround" is very simple, it consists of :		The core of this "workaround" is very simple, it consists of :
-	* Common server which has an ~~ssh~~ server accessible for both client and host	+	* Common server which has an SSH server accessible for both client and host
-	* host runs the command : "ssh -N -C -p <commonServerPort> -R <forwardedPort>:127.0.0.1:<hostPort> commonServerHostname"	+	* host runs the command:<pre>ssh -N -C -p <commonServerPort> -R <forwardedPort>:127.0.0.1:<hostPort> commonServerHostname</pre>
-	* Example : ssh -N -C -p 22 -R 2222:127.0.0.1:22 myHostname.no-ip.info	+	* Example:<pre>ssh -N -C -p 22 -R 2222:127.0.0.1:22 myHostname.no-ip.info</pre>
-	* After connection has been set up (password is required when running the command above on the host(N900)) you connect to the common server using ssh and run the command : ssh root@127.0.0.1 -p 2222 ~~(as configured in the example).~~	+	* After connection has been set up (password is required when running the command above on the host(N900)) you connect to the common server using ssh and run the command (if configured as in the example):<pre>ssh root@127.0.0.1 -p 2222</pre>
	* You are now connected to the HOST.		* You are now connected to the HOST.

	== Pitfalls ==		== Pitfalls ==
-	'''There are a few ~~short comings~~ in this setup, most can be worked around.'''	+	'''There are a few shortcomings in this setup, most can be worked around.'''
-	* In order to skip the password query on the HOST, one must copy the public SSH key from the host to the authorized_keys folder on the common server.	+	* In order to skip the password query on the HOST, one must copy the public SSH key from the host to the authorized_keys folder on the common server. In case your host is the Nokia N900, the file is located at: <code>/root/.ssh/id_dsa.pub</code>
-	In case your host is the Nokia N900, the file is located ~~here~~ : ./root/.ssh/id_dsa.pub	+
	** Some routers allow you to paste the contents of that file via the web gui of the router. (For example Tomato firmware for wrt routers)		** Some routers allow you to paste the contents of that file via the web gui of the router. (For example Tomato firmware for wrt routers)
-	* If the ~~ssh~~ connection between the host and the common server breaks, for any reason, we want it to be reconnected automatically, we can encapsulate the ssh command inside an infinite loop, using a while command : while true; do ssh -N -C -p 22 -R 2222:127.0.0.1:22 myHostname.no-ip.info; sleep 5; done	+	* If the SSH connection between the host and the common server breaks, for any reason, we want it to be reconnected automatically, we can encapsulate the ssh command inside an infinite loop, using a while command:<source lang="bash">while true; do ssh -N -C -p 22 -R 2222:127.0.0.1:22 myHostname.no-ip.info; sleep 5; done</source>
	* The command should be inserted into a script, for easy dispatch.		* The command should be inserted into a script, for easy dispatch.
-	* It is possible to add the command to /etc/network/if-up.d/ - this will cause it to get dispatched ~~everytime 3g~~ / wifi are connected, making your phone available immediately.	+	* It is possible to add the command to <code>/etc/network/if-up.d/</code> - this will cause it to get dispatched every time 3G / wifi are connected, making your phone available immediately.
-	* If the above method is used, a matching script must also be added to /etc/network/if-down.d/ to kill the looping ssh command to save some battery.	+	** If the above method is used, a matching script must also be added to <code>/etc/network/if-down.d/</code> to kill the looping ssh command to save some battery.
-	* When not used, and idle ~~ssh~~ connection might fail, In order to make the phone close the SSH session and start a new one, and also try to maintain it, we can add 2 values to the ssh configuration of your phone.	+	* When not used, and idle SSH connection might fail, In order to make the phone close the SSH session and start a new one, and also try to maintain it, we can add 2 values to the ssh configuration of your phone.
-	** Open the file /etc/ssh/ssh_config for editing using your favorite editor, mine is vi.	+	** Open the file <code>/etc/ssh/ssh_config</code> for editing using your favorite editor, mine is vi.
	** Insert the following lines into the file :		** Insert the following lines into the file :
-	*** ExitOnForwardFailure yes	+	*** <code>ExitOnForwardFailure yes</code>
-	*** ServerAliveInterval 60	+	*** <code>ServerAliveInterval 60</code>
	** The lines should be inserted right after the "Host *" line.		** The lines should be inserted right after the "Host *" line.
	** I am not sure about BW usage for the "ServerAliveInterval" command, but it works for me, if you use it, make sure you monitor your network usage over a few days.		** I am not sure about BW usage for the "ServerAliveInterval" command, but it works for me, if you use it, make sure you monitor your network usage over a few days.

	== Scripts & Files ==		== Scripts & Files ==
-	* [[Image:Reverse_ssh.sh]] - This file should be located in /usr/share, you also need to edit it with the correct ports and hostname.	+	* [[Image:Reverse_ssh.sh]] - This file should be located in <code>/usr/share</code>, you also need to edit it with the correct ports and hostname.
-	* [[Image:Reverse Ssh Stop.Sh]] - This file should also be in /usr/share.	+	* [[Image:Reverse Ssh Stop.Sh]] - This file should also be in <code>/usr/share</code>.
-	* [[Image:Reverse Ssh If Down.Sh]] - This file should be in /etc/network/if-down.d/ - After copying this file, remove the .sh extension.	+	* [[Image:Reverse Ssh If Down.Sh]] - This file should be in <code>/etc/network/if-down.d/</code> - After copying this file, remove the .sh extension.
-	* [[Image:Reverse Ssh If Up.Sh]] - This file should be in /etc/network/if-up.d/ - After copying this file, remove the .sh extension.	+	* [[Image:Reverse Ssh If Up.Sh]] - This file should be in <code>/etc/network/if-up.d/</code> - After copying this file, remove the .sh extension.
-	* '''All files need to have executable permissions, I usually just do "chmod 777 <filename>" - But I reckon it's not very secure, so someone please clarify the minimum level of permissions needed.'''	+	* '''All files need to have executable permissions, I usually just do "chmod 777 <filename>" - But I reckon that it is not very secure, so someone please clarify the minimum level of permissions needed.'''

	== Warnings ==		== Warnings ==
Line 51:		Line 49:
	Special thanks to [http://talk.maemo.org/member.php?u=26108 Spanner] for helping me out in this [http://talk.maemo.org/showthread.php?p=696130#post696130 thread], none of this would have been possible for me without him.		Special thanks to [http://talk.maemo.org/member.php?u=26108 Spanner] for helping me out in this [http://talk.maemo.org/showthread.php?p=696130#post696130 thread], none of this would have been possible for me without him.

-	Please feel free to edit this page if you have anything to add, I am not a ~~linux~~ expert, and the directories I chose to put the files are totally random, they may not be the best places, but they are all very small so the impact is little.	+	Please feel free to edit this page if you have anything to add, I am not a Linux expert, and the directories I chose to put the files are totally random, they may not be the best places, but they are all very small so the impact is little.
		+
		+	[[Category:HowTo]]
		+	[[Category:Power users]]