How to SSH home without access to router

Do you need to access a Linux box that sits behind a router or modem, however you don't have admin access to configure port forwarding? Well, here's something that might help you.

Before we start, make sure that the remote client machine is able to connect to an IPv6 network (test here).

1- Register for a gogo6/freenet6 account - http://www.gogo6.com/freenet6/registration

2- Install gogoc on the remote server

$ sudo apt-get install gogoc

3- Edit the configuration file with your credentials and your closest broker (mine was montreal.freenet6.net)

$ sudo vim /etc/gogoc/gogoc.conf userid= passwd= server=[your_broker].freenet6.net auth_method=any

4- Start the gogoc service

$ sudo service gogoc stop $ sudo service gogoc start

5- If you get the error "* Not starting gogoc - no server key", then follow steps 5a, b and c, otherwise go to step 6:

5a- Add your broker to the tsp-broker-list.txt 

$ cd /var/lib/gogoc/ $ sudo vim tsp-broker-list.txt  # Add your broker as [broker].freenet6.net

5b- Start the server in the foreground so you get prompted to accept the key

$ sudo /usr/sbin/gogoc -n -f /etc/gogoc/gogoc.conf montreal.freenet6.net is an unknown host, do you want to add its key?? (Y/N) y

5c- Wait for about 30 seconds (to be sure), then stop the foregroud process (Ctrl+c) and start it in the background (step 4)

6- Check that an IPv6 address was assigned is running:

$ ifconfig | grep -q inet6 && echo ok ok

7- Try to connect from the remote client

- If connecting from Linux:

$ ssh -6 [linux_user]@[net6_user].broker.freenet6.net

- If connecting from Windows:

http://www.gogo6.com/profile/gogoCLIENT

Port scanning with Bash's TCP socket

Let's say you logged on to a Linux machine and you need to run nmap to find out what ports are open on a specific node, however you do not have sudo access and/or 'nmap' (or nc) is not installed...

Well, here's the solution. Depending on the Bash version that you have, and if it has TCP socket enabled, you can use it's built-in TCP (and UDP) socket to create connections (it's somewhat similar to the client side of 'netcat').

Here's a quick function that can be used for that:

nmap2 () { [[ $# -ne 1 ]] && echo "Please provide server name" && return 1 for i in {1..9000} ; do   SERVER="$1"   PORT=$i   (echo  > /dev/tcp/$SERVER/$PORT) >& /dev/null &&    echo "Port $PORT seems to be open" done }

And here's an example of running the scan against my gateway:

$ GW=$(route -n | grep '^0.0.0.0' | awk '{print $2}') $ nmap $GW The program 'nmap' is currently not installed. You can install it by typing: sudo apt-get install nmap $ nmap2 $GW Port 1720 seems to be open

If you need to increase/decrease the ports that are scanned, simple change the option '{1..9000}' in the script.

How to highlight pdf files on Linux and Windows machines

Two annoyances that I have always had with ebooks and pdf material is that when I'm reading I like to highlight important info for future reference. Most readers (like Adobe) only allows you to highlight files that you have document rights to it, which I don't think makes any sense.

The other problem is that I read the same book between multiple computers and multiple platforms. I always have to write down the page I read last, and this is a bit annoying.

After doing a lot of searches I was finally able to find a pdf reader (PDF-XChange Viewer) that allows me to highlight text and save that information. Even better, they have a portable version so you can have the book, program and saved data (highlight and page) on a USB device and access it between machines.

For my utmost surprise the program works under wine and also reads the saved data.

Hot to get it working

1- Download the portable version of the program and unzip it to your flash device (either on Linux or Windows)

http://www.docu-track.com/download/PDFX_Vwr_Port.zip

2- Install wine on your Linux machine if you have not already done so

# Ubuntu (8.10) $ sudo aptitude install wine $ winecfg

3- Create a script in the flash drive within the program folder to open the program on Linux

$ echo -e '#!/bin/bash\n\nwine PDXCview.exe &' > PDFXCview_for_Linux

You should now be able to open the program on either Windows or Linux and see your highlighted text.

Quick and simple Quake Terminal

For the gamers out there, you know exactly what I'm talking about. I've never been big with gaming, but the idea of having a shortcut to shade a terminal window and bring it back whenever I want is pretty neat.

I already run a small terminal window as part of my desktop, but sometimes its not as flexible as a normal window. I'll write a post on how to use a terminal as a desktop background in the future. For now you can see a pic here.

To achieve what we want we will use a utility called wmctrl, which is on the Ubuntu repos (if I'm not mistaken the Universe repo). There are other ways you can achieve the same (like Tilda).

$ sudo apt-get install wmctrl

wmctrl bases it's commands on window name, so to make sure you have the proper name for the terminal window, open it with the desired profile and type:

$ wmctrl -l 0x03800021 -1 hostname Left 0x03c000cc 0 hostname Jinzora Media Jukebox - Genres - Mozilla Firefox 0x01407084 1 hostname blog - File Browser 0x04400057 1 hostname quake-terminal - OpenOffice.org Writer 0x0380859b 1 hostname victor@hostname: ~

These are the list of windows I have open. My terminal window is called “victor@hostname”, so this is the name I'm going to use. Next, I'll open my favorite text editor and add the following lines to a script:

#!/bin/bash if [ -f ~/bin/temp/quake ] ; then wmctrl -r 'victor@hostname: ~' -b remove,below wmctrl -r 'victor@hostname: ~' -b remove,shaded rm -r ~/bin/temp/quake else wmctrl -r 'victor@hostname: ~' -b add,below wmctrl -r 'victor@hostname: ~' -b add,shaded touch ~/bin/temp/quake fi

Here's a breakdown to make it easy. I have a folder on /home/victor/bin with many scripts I created, so I'll add this one as well, and I called it ter-quake.sh. Next, I created a temp folder inside my bin folder to generate a file that will check if my script was run previously or not. And here's the explanation for the script

#!/bin/bash ## This first line checks if the file /bin/temp/quake was created, which meas the script was run before if [ -f ~/bin/temp/quake ] ; then ## if the script was run before, it will unshade the terminal window and place it on top wmctrl -r 'victor@victor-laptop: ~' -b remove,below wmctrl -r 'victor@victor-laptop: ~' -b remove,shaded ## here we remove the file rm -r ~/bin/temp/quake ## otherwise, if the file does not exist else ## the sript will shade the window, place it bellow all others and... wmctrl -r 'victor@victor-laptop: ~' -b add,below wmctrl -r 'victor@victor-laptop: ~' -b add,shaded ## create the file touch ~/bin/temp/quake fi

Save the script and make it executable:

$ sudo chmod a+x ~/bin/ter-quake.sh

Last step, we will add a keyboard shortcut for the script. I've achieved that by using gnome's gconf-editor:

- Type “Alt+F2” and enter “gconf-editor”
- Browse to “/apps/metacity/keybinding_commands”
- Choose any of the empty commands and add the path to your script
- Go to “/apps/metacity/global_keybindings” and under “run_command_#” add the shortcut you would like to use. I've used q.


Vic.


Note: This is another useful topic from Linux Journal that I wanted to share. Issue 167. Link

Google Search Regex

Well, they are not really the same regex as we can use on Linux or programming. But some of the “tags” are pretty good and can help you on a lot of searches.

I've organized them in a manner that I thought made the best sense. But the sites where I got the information from do have them in different others, as well as some other tags that I did not find as important. The links are at the end of the post.


Basic
- "+" - Result must contain word
- "-" - Result must not contain word
- "OR" and "|" - Applied between two words, it will find "this or that", or both. The "OR" operator must be uppercase and have a space between the 2 words on each side. The "|" operator does not need a space between the words
- " "" " - Finds an exact match of the word or phrase
- "~" - Looks for synonyms or similar items. Eg: "~run" will match runner's and marathon
- ".." - Indicates that there's a range between number. Eg: 100..200 or $100..$200
- "*" - Matches a word or more. Eg: "Advanced * Form" finds "Advanced Search Form"
- "word-word" - All forms (spelled, singe word, phrase and hyphenated

Important
- "site:" - Search only one website or domain. Eg: "PC site:wazem.org" will find PC within wazem.org
- "filetype:" or "ext:" - Search for docs in the file type. Eg: "Linux tutorial filetype:pdf" will find Linux tutorial in the pdf format
- "link:" - Find linked pages (pages that point to the URL)
- "define:" - Provides definition for a word or a phrase
- "cache:" - Display Google's cached version of a web page.
- "info:" - Info about a page
- "related:" - Websites related to the URL
- "allinurl:" - All words must be in the URL
- "allintitle:" - All words must be in the title of the page
- "intittle:" - Match words in the title of the page
- "source:" - News articles from a specific source

Calculations
- "+ - * /" - Normal math signs. Eg: 12 * 4 + 2 - 1 /2
- "% of" - Percentage. Eg:10% of 100
- "^" or "**" - Raise to a power
- units "in" units - Convert Units (currency, measurements, weight). Eg: 300 lbs in Kg, 40 in hex

Others
- "book" or "books" - Search books. Eg: book "LPI Linux Certification in a Nutshell"

Links used:
GoogleGuide.com
GoogleGuide.com Advanced Operators
Wikipedia Regex

How to Masquerade Your PC When Connecting to an Unknown Network

Let's say you want to connect to an untrusted network, like school, library or other. All your packets could be traced by a proxy and your computer information as well.

There are many ways to avoid this from happening. The one I'll be describing here will involves connecting to a server on your home running a proxy daemon (like squid) via a secure tunnel (like SSH).

First we need to get squid and SSH server installed on your home server and make sure that your router is open for SSH (or another WAN port that can be forwarded to the SSH server port on your LAN).

You can get more info on this process here, and more info on SSH auto login here. These posts should get you connected to your home server and browsing the web without the proxy on the untrusted network knowing you packets (or what you are browsing).

Next step will be to mask your computer info. I'm not sure how well this would work as far as digital signatures, but it may help with some privacy.

I've created 3 files on my PC to use for a quick connection:
. MAC1 - Changes my MAC address, my hostname and my proxy configuration to 127.0.0.1:80
. MAC2 - Changes my MAC and my hostname to original and disables the usage of proxy
. File3 - A ssh script that binds local port 80 to the ssh tunnel

MAC1 #!/bin/bash sudo ifconfig eth0 down sudo ifconfig eth0 hw ether bogus-MAC sudo ifconfig eth0 up sudo bogus-hostname xauth add bogus-hostname/unix:0 MIT-MAGIC-COOKIE-1 `xauth list | grep original-hostname | cut -f5 -d" "` gconftool -s /system/proxy/mode -t string manual

MAC2 #!/bin/bash sudo ifconfig eth0 down sudo ifconfig eth0 hw ether original-MAC sudo ifconfig eth0 up sudo original-hostname xauth remove bogus-hostname/unix:0 MIT-MAGIC-COOKIE-1 gconftool -s /system/proxy/mode -t string none

File3 #!/bin/bash sudo ssh -v -L 80:squid-server-IP:3128 user@homeIP

Other Links:
- http://sourceforge.net/projects/anonym-os/


Vic

How to change Gnome Proxy Settings on a Terminal window

This document will show how to change proxy settings for Gnome from a terminal window (not from gnome-network-preferences).

The configuration information is saved under .gconf (front end GconfEdior), which is a system for storing application preference in Gnome (think Registry for Windows PC).

Keys can be accessed in terminal under “/home/user/.gconf/*”. The command below will display current proxy configuration loaded by gconf:

$ cat .gconf/system/http_proxy/%gconf.xml

This will be the same as:


The proxy configuration can be divided into two parts:
. /system/proxy/ - Configures SOCKS Proxy
. /system/http_proxy/ - Configures HTTP proxy

We can use gconftool -R to view the options within the subkeys. For the screenshot above we would get something similar to this:

$ gconftool -R /system/proxy old_ftp_port = 0 socks_host = 127.0.0.1 mode = manual old_socks_port = 0 secure_host = 127.0.0.1 ftp_host = 127.0.0.1 socks_port = 80 old_secure_host = secure_port = 80 ftp_port = 80 old_ftp_host = autoconfig_url = old_secure_port = 0 old_socks_host = $ gconftool -R /system/http_proxy use_http_proxy = true use_authentication = false host = 127.0.0.1 authentication_user = ignore_hosts = [localhost,127.0.0.0/8,*.local] use_same_proxy = true authentication_password = port = 80

So, to edit the proxy to the same settings as the one shown on the screenshot, we would do the following:

$ gconftool -s /system/http_proxy/use_http_proxy -t bool true $ gconftool -s /system/http_proxy/host -t int 127.0.0.1 $ gconftool -s /system/http_proxy/port -t int 80 $ gconftool -s /system/http_proxy/use_same_proxy -t bool true $ gconf -s /system/proxy/mode -t string manual

Vic.

Portable apps

I just found this site for portable apps. They can be used to run applications directly from your portable device (USB, Ipod, external HD, etc...) without installing on the host computer. They can come very handy if you are on an environment where you cannot install a software, or even if you want to keep your "profile" info.

Portable Apps.com

They have firefox, gimp, pidgin, open office, winSCP, VLC, etc... Check it out when you have a chance.


Vic.

How to bypass a proxy server with SSH

These steps will guide you on how to bypass a proxy server that may be blocking you from accessing that interesting web-site at work, school or wherever.

Please note that I do not make myself responsible for the usage of this. Use it at your own risk of getting fired or expelled from school. Main thing, use it with responsibility.

The steps of bypassing a web proxy are actually simple. This how to will enable you to even bypass socks proxies that need username and password, as long as they allow encrypted traffic over port 443 and/or 80.

You are going to need:
- A SSH server at the remote side (Windows or *nix)
- A proxy server at the remote side (I’m using squid, which can be installed either on a *nix or Windows box) which can be the same as the SSH server
- Port forwarding on you remote router (if applicable)
- Address for the local (blocking) proxy server (can be easily discovered by opening a web browser, running “netstat -a” and looking for a established connection on port 8080)
- Putty

I’ll lay it out in steps to make it easier:

1- Install Squid on the remote PC
Download and install squid (either the Windows version or *nix). Make sure you know what port is open and change if necessary (default is 3128).

Test it from another computer in the LAN or using 127.0.0.1:3128.

2- Install SSH server on the remote PC. Configure the listening port and configure a user if required. Test it to confirm that it’s working.

3- Configure port forwarding on your remote router to forward port we will use at your work (443 or 80) to the port the SSH server is listening to.

4- Download Putty.exe.
Now we need to configure it with all the required information for the connection.

4.1 Open putty and fill out the “Host name” with your remote IP (home) and the port you will be connecting to your router or directly to the PC with SSH installed (port 80, 443…)

4.2 On “Connection => Proxy” we need to enter the Proxy type, Proxy, Port, Username and Password. Remember that this information is for the proxy that we are trying to bypass
- Proxy type - Could be HTTP, SOCKS 4, SOCKS 5
- Proxy hostname - IP or hostname of the proxy
- Port - Port used to connect to the proxy (remember the netstat command)
- Username - Username that you usually input into IE when accessing the web
- Password - Password you usually input into IE when accessing the web



4.3 Open “Connection => SSH => Tunnels” and enter the following rules.



- Source port - Port you are going to use on your browser (I use 80)
- Destination:port - LAN IP address of the Squid server and port that is listening to. If you are using one server as SSH and another as Squid, this must be the IP of the Squid server. Now if you are using the Squid server and the SSH in one PC, you need to do a loopback into the port that squid is listening to. Eg: 127.0.0.1:80



5 Configure your web-browser to send requests to the source port we configured on the previous step. I have downloaded a different browser (Opera) that I use to bypass the proxy.



That’s it. You should now be able to access the blocked pages when putty is open and connected.

Process Explanation:
1- Browser sends a request to 127.0.0.1:80 (your PC)
2- Putty listens to the request and binds local port 80 to remote address 127.0.0.1 on port 80
3- Putty connects to the proxy and authenticates using username and password
4- Proxy connects to address and port we configured on step 4.1 (your remote address)
5- Your router accepts the request and forwards it to the port the SSH server is listening to
6- A putty terminal window opens and asks for username and password for SSH server
7- SSH server authenticates username and password and binds configuration from step 2
8- Squid sends requests to the Internet and replies back to tunnel


All this process is encrypted starting from step 2, so local proxy is not aware of any of the information sent over the tunnel.

There are also another 2 things that you might want to add for security and flexibility.

=> Security
- Use a USB pen to store an RSA key, which can be used for authentication with your SSH server. You can them configure your SSH server to only accept connections if the key is provided.

There are many how to’s on the Internet that show you how to do this. This one is a good tutorial for RSA and putty.

- You can also CHROOT you SSH user. This is a good tutorial for Ubuntu.

- If you decide to use CHROOT you can also limit WAN connections only for that limited CHROOT user. Take a look here.

=> Flexibility
- As you are using a USB pen, your configurations will be saved to the registry, and not your pen. You will have to reconfigure putty every time you connect to a different computer.

A good idea would be to use a batch file that loads your configuration when you open putty, and deletes it when you close the connection, so no one has access to it. Check this link.

Have fun setting this up…


Vic.