- main - earth.li

Re: [ALUG] my questions recently about securely transferring files from remote system
by Chris Green 16 Jun '14

16 Jun '14

This is just an update about my recent questions regarding how to transfer files reasonably securely (as in system security rather than confidentiality of file content) from a remote unattended system. I have what seems to me to be a satisfactory solution that also makes some other things a bit easier. While hunting around for ideas and solutions for this and other issues I came across an explanation and examples of the use of ProxyCommand in the ssh config file. This has provided me with my solution. Just to recap, the remote system is a Beaglebone Black running Ubuntu which is on our boat in France monitoring temperatures, battery voltages, etc. It's connected to the internet via a WiFi hotspot so is behind a NAT router (presumably) and a firewall which are out of my control. So, to make the BBB accessible it runs an ssh tunnel to an intermediate system (my web hosting provider) where I have an ssh login account. To maintain this connection through power failures and/or other glitches I run ssh on the BBB using autossh:- autossh -N -R ?????:localhost:22 -l isbdnet3 <host on the internet> (port number masked to ??????, there's a real number there of course) To connect from home to the BBB I used to ssh from home to <host on the internet> and then from there, via the tunnel, to the BBB. The reason for the intermediate system is that my home firewall only allows connections from <host on the internet> and a couple of other specific IP addresses. (This is to protect my home system from long term attacks using ssh) Adding a ProxyCommand to my ssh config at home allows me to connect 'directly' from my home system to the BBB, the line is:- Host bbb ProxyCommand ssh <host on the internet> nc -q0 localhost ????? Now I can just 'ssh bbb' and it goes straight to the BBB. Even better and more importantly it means that I can use sshfs to mount a directory from the BBB onto my home system, thus I can:- sshfs bbb:tmp odin ... and the files being stored in ~/tmp on the BBB appear on my home desktop in ~/odin. This means I can manipulate them as required (which means add the values to a database) *and* when this has been done I can delete them safely, ideal! :-) -- Chris Green

2 1

[ALUG Announce] ALUG Norwich Pub Meet Thursday 12th June
by Viperfang 09 Jun '14

09 Jun '14

ALUG Announce Please send announcements to Announce(a)lists.alug.org.uk Unsub, change settings via http://lists.alug.org.uk/mailman/listinfo/announce ----- Hello Norwich Aluggers, Our monthly ALUG Norwich social meeting will be held this Thursday, 12th June at The Coach and Horses (82 Thorpe Road, Norwich, NR1 1BA). The meeting officially starts at 8pm, although some people may arrive earlier. More information on those people can be found on the list and the IRC channel. If you are unsure if you will recognise us then make yourself and your intent to attend known by either posting on list or visiting us on IRC so we can look out for you rather than hiding in the corner. Optionally you could ask at the bar if they know where the geeky computer weirdos are and they'll point you in the right direction (seriously!). Another possibility is look for heaps of electronics on a table that may possibly look like movie props that would used for detonating explosives. Feel free to bring electronics/laptops/gadgets to the meet, you will by no means be alone. Ben Bewick aka Viperfang NB: This mail is automated, please refer to the usual sources for more information. ALUG Contact Details: Website : http://www.alug.org.uk/ IRC : #alug on irc.alug.org.uk List : http://lists.alug.org.uk/mailman/listinfo Twitter : http://twitter.com/anglianlug Identica: TBA Facebook: http://www.facebook.com/group.php?gid=2381613902 ----- Send discussion replies to main(a)lists.alug.org.uk (Reply-To set) Unsub, change settings via http://lists.alug.org.uk/mailman/listinfo/announce

1 0

Security when transferring files - passwordless ssh or rsync daemon?
by Chris Green 04 Jun '14

04 Jun '14

I want to copy files from a BeagleBone Black (running Ubuntu) to my home dmz system. This has got to work unattended as the BBB is sat on our boat moored on the Somme. It's also got to be a 'push' from the BBB as it's connected via WiFi and while I can connect to it through an ssh tunnel copying files via that connection would be decidedly tricky. So, as I see it, I have two obvious options:- 1 - Set up a public key login for the BBB on my dmz that requires no passphrase, so it's effectively passwordless. Then the BBB can run rsync to copy the files. The security hole in this approach is that if someone accessed the BBB then they could login to the dmz without further difficulty. 2 - Run an rsync daemon on the dmz and copy the files by connecting to this from the BBB. The advantage is that someone at the BBB end can't do anything but copy files (and I can limit what can be copied with the rsyncd configuration), the disadvantage is that the connection isn't encrypted at all. There's nothing valuable in the files, they're just temperature and electrical measurements from the boat so I don't care at all about the files being visible to the world. My security concern is to minimise the risk of someone getting into my dmz system. OK, it's a dmz and it's just a Raspberry Pi so is hardly full of valuable data but it would be a nuisance and *might* be a jumping off place for further nefarious deeds. I guess I'm being a bit paranoid really, the BBB on the boat is headless and anyone breaking into the boat is hardly likely to be an accomplished Linux hacker. Option 1 above is certainly the easiest as rsync daemon takes a bit of setting up. Are there any really obvious flaws - is it only really vulnerable to someone who accesses the BBB? There is an option 3 but it's more difficult to set up, I could implement a passphraseless rsync connection from the BBB to the dmz that only allows rsync file copying to a specific directory. I've done this on one other system and it works pretty well (you do it by adding a command= at the front of the authorized_keys file) but like the rsync daemon it takes a bit of setting up and I'm wondering if it's worth the effort. Any comments anyone? Are there more obvious and/or easier ways of copying files without making systems vulnerable to other attacks? -- Chris Green

6 13

27U rack looking for a new home
by Adam Bower 04 Jun '14

04 Jun '14

At work we have a 27U rack cluttering up our office, it has front and rear doors, some fans in the top and is on wheels to make it easy to move around. For this wonderful item I hear you say "but how much does he want for such a lovely thing?" well, the answer to that is, it's free if you come and collect it from Cambourne business park (8 miles west of Cambridge). Please mail me off list if you are interested, I have offered it around a few other places so it will be first who is able to collect gets it. Adam

1 0

2600 meeting at 18:00 on Friday the 6th June.
by Viperfang 03 Jun '14

03 Jun '14

Quick heads up about this months Norwich 2600 meeting, more info at http://www.norwich2600.co.uk

1 0

Probably OT: Using a wifi connection as a WAN
by Mark Rogers 28 May '14

28 May '14

I'm not sure if this is simple or not; if not then the solution is almost certainly going to use a Linux box so this might be on topic, but if not I can't think who else to ask. In my office I have a Draytek router, connected to ADSL (was O2, now Sky), with it's WAN port connected to another ADSL router, itself connected to PlusNet, and load balancing between the two. I have it set up this way due to the pretty useless speeds we get here (I just ran a speed test and got 3Mbps up, 0.5Mpbs down). No prospect of it changing much either in the short term. On the other hand, the same speed test on my phone shows 20Mbps down, 8Mpbs up (4G on Three). And I have free unlimited data including tethering. So I want to find a way to tether my office network onto my phone when I'm in the office. Is this just as simple as replacing the second ADSL router with an access point, or do I need to be more clever than that? (Also: the Draytek has a USB port for (eg) a USB 4G dongle, but could I use a USB wifi dongle to tether to my phone instead?) The "right" solution is to get a 4G dongle for the Draytek, but data plans on data SIMs don't seem all that great - and even phone contracts aren't as good as they were (I get unlimited tethering, but new contracts limit to 5GB while tethering). So I'd like to find a way to use my existing phone connection if I can, albeit that it's going to kill my battery when I use it. Although if anyone can point at decent 4G data plans instead I'd be happy to switch (I am already paying for two ADSL lines so I can ditch one of those if I get this working). (Apologies to anyone who would kill for the 3Mbps I currently get!) Mark -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0844 251 1450 Registered in England (0456 0902) @ 13 Clarke Rd, Milton Keynes, MK1 1LG

4 6

Does NFS across subnets need to be able to 'see both ways'?
by Chris Green 28 May '14

28 May '14

As part of my improving security exercise I have implemented a DMZ system on a subnet separate from my main home subnet. Thus I have (similar to Mark Rogers) the following:- Draytek Vigor 2820n on subnet 192.168.1.0 WAN1 ADSL connection WAN2 Ethernet 192.168.13.0 to second ADSL router I have a Raspberry Pi plugged into to the second ADSL router's LAN so it's on the 192.168.13.0 subnet, this is the DMZ machine which will have a number of ports open to the internet. The 192.168.1.0 firewall doesn't allow any connections from the 192.168.13.0 subnet, but the Draytek Vigor 2820n does route anything addressed to 192.168.13.0 to WAN2. Thus for example I can ssh from my desktop machine on 192.168.1.0 to the Raspberry Pi. Now (finally!) to the question, can the Raspberry Pi export its files to my desktop (or anything on the 192.168.1.0 subnet) without opening up any holes in the firewall? I tried the obvious:- / *(rw,async,no_subtree_check) on the Raspberry Pi but although I could mount the filesystem successfully on my desktop any attempt to access it just hangs. -- Chris Green

1 0

Decent player wanted for internet radio streams (specifically BBC)
by Chris Green 28 May '14

28 May '14

I'm looking for a way to (simply) play BBC Radio 4 and other BBC stations on my desktop machine. I used to use radiotray but updating to xubuntu 14.04 seems to have broken that completely (it was always a *bit* flakey). I don't want a full blown music player really, though one that's easy to configure to play BBC would be OK. I *definitely* don't want a list of thousands of stations to select from which rarely includes BBC anyway, I just want to be able to enter a BBC radio URL and hear the radio. I have clementine installed but I can't see how to get that to play URLs, it looks like it should but seems to be broken when you try it. Like so many other players I've found. -- Chris Green

8 12

Would someone burn a distro for me?
by James Freer 24 May '14

24 May '14

My PC I think has a faulty DVD drive/corrupted installation as it doesn't seem to burn. My spare machine with a CDROM doesn't seem to work now and for some odd reason neither boot on the USB (even with PLoP). Not been a good day! If someone is prepared to help me out maybe you can reply off list - I live North of Bury. The distro is Fedora xfce and Salix (CDs as opposed to DVD). thanks james

1 2

Fwd: Re: Overheard in the bar
by RustyHinge 24 May '14

24 May '14

Apropos Chalk Hill? -------- Original Message -------- Subject: Re: Overheard in the bar Date: Sun, 18 May 2014 12:53:41 +0100 From: Znep <E-0C001302-5256-E(a)cleopatra.co.uk> Organization: None, really.... Newsgroups: uk.rec.sheds etc. In uk.rec.sheds, (Murff) wrote in <ll917d$q4k$20(a)dont-email.me>:: >On Sun, 18 May 2014 01:58:53 +0100, Mike Fleming wrote: > >> I've had some that's been good and >> some that hasn't coped so well. > >Just finishing some Naylor's Old Ale, from Kildwick. About 1 mile from >here, bought by the case from the brewers. At that distance, whether beer >travels or not is rather less of an issue. Um. I once took a mate of mine to the Lass o'Gowrie, and had a pint of their finest- which I rather liked. He didn't. "Where's this from?" he asked. "They make it out the back, there." "Huh. Doesn't travel well, does it?" -- Marc

1 0