Topic: remote access

[Frank]

Hi Folks,

unfortunately my company's Firewall won't let me tunnel to my SME, nor anywhere outside ,
does anybody have an idea whowto workaround that, so I can get a console on my WS on work?

If I use dialup to a ISP, I can login perfect with putty, unfortunately webconsole is not working also, I think it'll be the same as in Putty (port980 blocked).

Greetz

[Frank]

PS: Server-manager is running fine in the office

[chris meredith]

What exactly are you trying to do?

[Guck Puppy]

Aha! Finally, someone asked...

first visit :
http://www.nocrew.org/software/httptunnel.html
and read a bit about what the GNU HTTP Tunnel is.

Get the files:
for linux
http://www.macgyver.org/software/httptunnel/

and for windows
http://eduardo.cobian.free.fr/gnuht/Win32/Gnu_Http_Tunnel_3_3.zip

(I assume you're running windows in your office, behind your Corp LAN).

next, read Dan Brown's HTTP port changing howto :
http://www.familybrown.org/howtos/listen-port-howto.html

(the idea being that you're going to make it easy to change the port that your main webserver listens on - but don't actually change it yet, that's what the shell scripts below are for.)

after that, you can create files called :

tunnel-start - which contains:
#!/bin/sh
/sbin/e-smith/config setprop httpd-e-smith HttpPort 8080
/sbin/e-smith/expand-template /etc/httpd/conf/httpd.conf
/sbin/service httpd restart
hts --max-connection-age 20000 -F {your.esmith.domain}:22 80
ps aux | grep hts
grep 8080 /etc/httpd/conf/httpd.conf

(that's 6 lines of text, in case this text input box wraps it - and replace {your.esmith.domain} with your esmith server's domain name)

tunnel-stop - which contains:
/sbin/e-smith/config setprop httpd-e-smith HttpPort 80
/sbin/e-smith/expand-template /etc/httpd/conf/httpd.conf
killall hts
/sbin/service httpd restart
ps aux | grep hts
grep 8080 /etc/httpd/conf/httpd.conf

(6 lines again)

save these two files somewhere nice (personally, I have made a "bin" folder in my home directory where I dump all such scripty bits).

There's essentially three parts to digging the tunnel to your esmith box from the restrictive corporate LAN.

1. Initiate the tunnel server on your esmith box:
sudo tunnel-start

2. Initiate the tunnel client on your windows box:

IF you are running a Proxy on your lan :
htc -P {LAN.PROXY.IP}:{LAN_PROXY_PORT} -F 22 {your.esmith.domain}:80

(that's all on one line - substitute your LAN's proxy address and it's proxy port as appropriate)

IF NO PROXY :
htc -F 22 {your.esmith.domain}:80

3. You have essentially opened up a tunnel to the SSH server on your esmith box via your corporate proxy - neat! Now you have to connect to it. Install an SSH client on your windows box : choose -
http://www.ece.nwu.edu/~mack23/ssh-clients.html
(personally, I prefer to have cygwin's version, get it from:
http://sources.redhat.com/cygwin/ )

the address you will be connecting to with your SSH client is
localhost

This will take you via the tunnel to your esmith box.

Now, ssh on it's own may not be all your after, but that's the beauty of SSH! you can redirect all kinds of ports through the tunnel, by adding redirects to your SSH config file! e.g.
#~/.ssh/config
--
### forward to e-smith server-manager
LocalForward 980 localhost:980

### forward to e-smith  secure server-manager
LocalForward 981 localhost:981

### forward to e-smith  websites (port 8080)
LocalForward 8080 localhost:8080

### forward to e-smith  secure websites (port 443)
LocalForward 443 localhost:443

### forward to e-smith  IMAP
LocalForward 143 localhost:143

### forward to e-smith  LDAP
LocalForward 389 localhost:389

### forward to e-smith  FTP
LocalForward 21 localhost:21

all you have to do is (once you have your tunnel in place and you've logged in via SSH) point the various applications (browsers, mail clients, ftp clients etc) to localhost rather than directly at your e-smith box. The connections go through the tunnel, and you are in business. Ah, what fun...
and when you return to your e-smith box, you can stop the http tunnel and put your websites back on to their normal port 80 by running :

sudo tunnel-stop

I suppose you could set these scripts to run in cron to automatically create the tunnel on your esmith box during the time you are at your corporate office... I haven't figured that out as yet.

All the best,

G

[Frank]

@Chris: I got some spare time, sometimes at work, and want to do the work on my personla SME from my Office. Server-Manager is powerful, but sometimes u need a console login. My wife is bored when I sit on my console for hours, this is the main reason.

@Guck: Lets have a look how good the firewall is , thanx for your suggestions and help. Oh, yes, this is a MS$ PC in the corporateLAN with NT on it. I successfully got Server-manager running, but the tunneling , maybe I'm not allowed at all due to my profile, lets see.... I'll let u know

Thanx

[Peter Side]

Do you know if port 16510 I want to use ssh to tunnel my way to my pop mailer so everythings encrypt when I retreive or send mail.

Peter

[Peter Side]

Just want to know if port 16510 is blocked in SME.

Peter

[Guck]

The easiest way to find out what ports are accessible from where is :

- try telneting to that port (telnet your-ip the-port)
- install "nmap" (there's an rpm for e-smith, search here for it) and then do (nmap -sT -p the-port the-ip-to-scan)

and bear in mind that you may get different results when attempting to find out what's open if you do it from boxes on the edge of your network (i.e. your gateway), inside your network and outside your network.

if you find out it is blocked and want to open it, that's when you have to deal with the iptables (or ipchains in < 5.6) firewall rules, to open up the port you want. Apparently you can also use the "port-opening" rpm that adds a panel in the server manager too...

G

[Peter Side]

ISP blocked port 80.  Do you know a way arround ?

Peter

[Guck Puppy]

Peter Side wrote:
> ISP blocked port 80.  Do you know a way arround ?

That depends on what is open on your corporate firewall. Most of the really tight ones will have only 80 open... you could try 8000 or 8080 or some of the other common ports :

25 -smtp (likely blocked by your isp too)
53 -dns
110 - pop3

basically you have to find a port which is :
- open on your corp. firewall
- unblocked by your ISP

G