author | Oleksandr Gavenko <gavenkoa@gmail.com> |
Wed, 17 Mar 2010 15:24:36 +0200 | |
changeset 347 | 8ae88e9dd05d |
parent 262 | 973d409e0752 |
child 371 | 0664ebefacb1 |
permissions | -rw-r--r-- |
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
1 |
-*- mode: outline; coding: utf-8 -*- |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
2 |
|
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
3 |
* ssh. |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
4 |
|
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
5 |
** ssh server on cygwin. |
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
6 |
|
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
7 |
* Инсталлируем стандартный набор утилит Cygwin + пакет openssh. |
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
8 |
* Устанавливаем переменную окружения CYGWIN=binmode tty ntsec. |
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
9 |
Это можно сделать глобально или через cygwin.bat (только для клиента). |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
10 |
set CYGWIN=binmode tty ntsec |
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
11 |
* Создать пользователя (XXX как сделать чтобы этот пользователь не мог логиниться?), |
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
12 |
например с именем user. |
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
13 |
* Обновить /etc/passwd |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
14 |
$ mkpasswd -l -u user >>/etc/passwd |
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
15 |
или |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
16 |
$ mkpasswd -l >/etc/passwd |
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
17 |
для обносления всех записей. |
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
18 |
* В приглашении bash: |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
19 |
$ mkdir -p /home/user |
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
20 |
$ ssh-host-config -y |
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
21 |
Стартуем сервер: |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
22 |
$ net start sshd |
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
23 |
или |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
24 |
$ cygrunsrv -S sshd |
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
25 |
* На удаленной машине логинимся: |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
26 |
$ ssh 192.168.1.26 -l user |
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
27 |
* Остановить сервер |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
28 |
$ cygrunsrv -E sshd |
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
29 |
|
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
30 |
*** Запускаем SSH server на правах произвольного пользователя. |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
31 |
|
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
32 |
* Создаем пользователя, например с именем user, задаем ему пароль, |
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
33 |
права (т.е. в какие группы будет входить) и т.д., пользователя не блокируем. |
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
34 |
* В консоле MMC добавляем оснастку "Параметры безопасности.". Модифицируем параметры: |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
35 |
|
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
36 |
"Параметры безопасности."->"Локальные политики."->"Назначение прав пользователя." |
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
37 |
->"Вход в качестве службы."->добавить 'user'. |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
38 |
|
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
39 |
"Параметры безопасности."->"Локальные политики."->"Назначение прав пользователя." |
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
40 |
->"Отклонить локальный вход."->удалить 'user' (если был установлен). |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
41 |
|
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
42 |
XXX "Принудительное удаленнон завершение." |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
43 |
|
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
44 |
** ssh client. |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
45 |
|
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
46 |
*** SSH client on Windows. |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
47 |
|
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
48 |
**** ssh from Cygwin. |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
49 |
|
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
50 |
* Инсталируем openssh из Cygwin. |
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
51 |
* В приглашении bash набираем |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
52 |
$ ssh user@192.168.1.38 |
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
53 |
или |
1
743f7a15697a
Move admin doc from utils proj.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
54 |
$ ssh -l user 192.168.1.38 |
4
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
55 |
|
261
0332d38237db
Rename ssh article to remote-shell.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
4
diff
changeset
|
56 |
** Reverse SSH Tunneling |
4
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
57 |
|
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
58 |
Have you ever wanted to ssh to your Linux box that sits behind NAT? Now you can with |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
59 |
reverse SSH tunneling. This document will show you step by step how to set up reverse SSH |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
60 |
tunneling. The reverse SSH tunneling should work fine with Unix like systems. |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
61 |
|
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
62 |
Let's assume that Destination's IP is 192.168.20.55 (Linux box that you want to access). |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
63 |
|
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
64 |
You want to access from Linux client with IP 138.47.99.99. |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
65 |
Destination (192.168.20.55) <- |NAT| <- Source (138.47.99.99) |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
66 |
|
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
67 |
SH from the destination to the source (with public ip) using command below: |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
68 |
|
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
69 |
$ ssh -R 19999:localhost:22 sourceuser@138.47.99.99 |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
70 |
|
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
71 |
port 19999 can be any unused port. |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
72 |
Now you can SSH from source to destination through SSH tuneling: |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
73 |
|
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
74 |
$ ssh localhost -p 19999 |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
75 |
|
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
76 |
3rd party servers can also access 192.168.20.55 through Destination (138.47.99.99). |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
77 |
Destination (192.168.20.55) <- |NAT| <- Source (138.47.99.99) <- Bob's server |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
78 |
|
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
79 |
From Bob's server: |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
80 |
|
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
81 |
$ ssh sourceuser@138.47.99.99 |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
82 |
|
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
83 |
After the sucessful login to Source: |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
84 |
|
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
85 |
$ ssh localhost -p 19999 |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
86 |
|
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
87 |
The connection between destination and source must be alive at all time. Tip: you may run |
c676a664a5ef
Reverse SSH Tunneling.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1
diff
changeset
|
88 |
a command (e.g. watch, top) on Destination to keep the connection active. |
262 | 89 |
|
90 |
* Ajaxterm. |
|
91 |
||
92 |
Allow remote shell access to host from web browser (require html+css+javascript). |
|
93 |
||
94 |
http://antony.lesuisse.org/software/ajaxterm |
|
95 |
home page |