Waxing Cerebral

Using ssh we can create tunnels to route bi-directional traffic. Depending on our selection of destination and server computers to connect to, the complete tunnel is made of a fully secure ssh tunnel, and possibly an additional tunnel continuing on that is not secure. The examples below should help explain this.
Here's the command:

ssh -NL localport:targethost:hostport server [-p serverport]

Where

• -N means don't start a remote ssh session (useful if just port fowarding)
• -L indicates a tunnel is to be set up with the following params:
• localport: tunnel 'entry'. Port number to connect to locally (ie at localhost)
• targethost: tunnel 'destination'. Which computer (name or ip) to connect to
• hostport: tunnel 'exit'. Port number to appear as on the other side of the tunnel.
• server: computer to validate ssh connection on (needs to be running ssh server). This forms part of the tunnel and three variations of this are explained below. You can make this 'user@server' in order to specify a username for the authentication if required.
  
• serverport: this is optional, but if you want to create the ssh connection over a non-standard port (ie not 22) then use this. You'll need to get the sshd listening on the new port in this case.
  

Remember these funky things are 2-way so if whatever you're communicating with at the other end of the tunnel sends info back down the tunnel (via hostport) then you'll get it right back at your end (localport). It's cool.

Example 1, target computer is running ssh server:
ssh -NL 8081:192.168.1.4:8090 192.168.1.4
Create a tunnel from 8081 locally to 192.168.1.4, and appear there at port 8090. Validate at 192.168.1.4. This is a short tunnel, between just the client and host, but completely secure. All traffic in this case will be over port 22 (ssh default).

Example 2, host computer is running ssh server:
ssh -NL 8081:192.168.1.4:8090 localhost
Exactly as in example 1, only this time the local machine is both ssh server and client. There is effectively no secure tunnel here (ie it's only between ports on the local machine), so unsecure over port 8090 to 192.168.1.4.

Example 3, 3rd computer is running ssh server:
ssh -NL 8081:192.168.1.4:8090 192.168.1.5 -p 3389
In this case, locally we are the ssh client, connecting securely (over port 3389) to the ssh server, 192.168.1.5. From there traffic travels over port 8090 to the destination box, 192.168.1.4. This is very powerful as traffic can be securely routed into a limited-access network. For example in this case if Microsoft's Remote Desktop Protocol (RDP) was the only traffic allowed in and out (eg through VPN), then the client externally can run this command, connect through on the RDP port (3389), connecting to a box inside the network (192.168.1.5). From there the destination IP is resolved, so this needn't be visible from the client computer, and traffic flows freely inside the network over 8090.

Another option is remote tunnels (instead of local tunnels). These use essentially the same commands, but with -R in place of -L. With a remote tunnel it is possible to declare a port on a foreign machine as the tunnel entry.

A nice way to test your tunnel is to use netcat. For the above examples this test would be:

On 192.168.1.4:
nc -l -p 8090
listen (-l) on port (-p) 8090 - end of the tunnel

On localhost:
nc localhost 8081
connect to localhost on 8081 - start of the tunnel

The localhost connection should get tunneled to the remote box and you'll be able to type at either end and see it appear in the terminals.

Bash scripts are fantastic. I could end the post there, but they can be made even better for end users by using one of the simple GUI applications out there that can be run from bash. Here's a great little example (using gtkdialog)that pretties-up the interface for my infrared phone script from this post.

Beautiful

If you're in NZ, and you've got TelstraClear cable internet, congrats cos that's the best option we have.

But if you have the experience I've had, you'll be tearing your hair out. I have a couple of computers at home (only my wife's work laptop runs Windows :) and a Netgear router (WGR614 v7) connecting them to the cable modem. Since the first weeks of having the setup though, the internet connection drops off way too often (3-4 times in a work day). Telstraclear and the modem were fine; connecting just one computer direct to the modem would chug along for weeks without issues. I am on my second replacement router (that means 3rd in total) and have had conversations with Dick Smiths (router retailer) and Netgear, and still have the same problem.

Frustrations!

So today I managed to talk directly to the right people at TC to help me troubleshoot things. And lo! I have the wrong type of cable modem!!
That's right, they have two (at least) models they provide customers with, the Motorola SB5101 and 5100. I had been given the 5101, and not knowing there was an option, had blindly accepted it as the modem.

TelstraClear cable customers using a router should be provided a model 5100 cable modem.

If this is you, and you are having these problems then call them. They should replace it without a call-out fee if you had a router from the start. And how are we mere customers supposed to know this? Beat your head against various unyielding walls for a year seems to be the answer...

EDIT: Just had the modem replaced this morning. Turns out the 5101's were introduced to be more compatible with Windows XP! What a joke - you know not everyone uses Windows! And the 5100's won't fix the problem, but they should reduce the disconnects. The main cause is an issue with TC's hardware, for which they're getting in some new equipment which should resolve the issue by the end of February 2008.


Also, on the topic of things TC doesn't tell you about their cable internet service, they recently rolled out a 'customer security' measure whereby any change in MAC address connected directly to the modem will not work for a stand-down period of a number of hours. So if you change computers that are directly connected (or switch from router to computer while troubleshooting!) then you won't get a connection anyway. That took a bit of figuring out at the time. You have to ring them and ask for that 'feature' to be removed from your account. It does have security benefits, but it's a wired connection, so someone would have to be sneakily plugging into your modem or cable anyway.

Good service, but keep us informed Telstra.

Apt needs to be configured to use a proxy if you're using one (eg if using cntlm). This is done by creating /etc/apt/apt.conf.d/proxy, with content similar to:

Acquire {
Retries "0";
HTTP {
Proxy "http://127.0.0.1:3128";
};
};

How to restore grub, the linux boot manager. Maybe a Windows installation has written over the MBR?

Use a boot disk, such as Knoppix or Ubuntu LiveCD.

1. $ sudo grub
2. grub> find /boot/grub/stage1
(If it fails here, jump to 'preparing root' below)
3. grub> root (hd#,#) (where 'hd#,#' is the result of step 2)
4. grub> setup (hd#)
5. grub> quit
That's it. Done!

-------------------------------------------------------------------------
Preparing root
If step 2 failed above then do these steps first:
A. $ sudo mkdir /mnt/root
B. $ sudo mount /dev/sda1 /mnt/root (where sda1 is your linux partition)
C. $ sudo mount -t proc none /mnt/root/proc
D. $ sudo mount -o bind /dev /mnt/root/dev
E. $ sudo chroot /mnt/root /bin/bash
Now start again from step 2 above.

Full credit to the guys on this thread at ubuntuforums.

• FATAL
• ERROR
• WARN
• INFO
• DEBUG
• TRACE

From wikipedia site

I was stuck trying to get through a MS Proxy Server. Thankfully people have magicked a way around it. Get NTLMaps and read these instructions, particularly note the dpkg-reconfigure line, it's easily missed.

EDIT: Wohoa! While NTLMaps is a great tool, it was using 130% of my dual-core 2GHz processor! Thankfully there is a much slicker alternative: cntlm. This puppy is C-based and has a much lower overhead. Http responses seem to be faster as well. The compilation from source is quite straight forward as well, with no dependencies.

You'll need to configure proxy settings on the box now, e.g.:
apt

A place for my notes on the things I've done to get Xubuntu Feisty (Ubuntu is the same procedure) running from scratch on my Toshiba Tecra P5 laptop (PTS53A-02F01D).

Started by trying to boot into the LiveCD. This failed with:
/bin/sh: can't access tty; job control turned off
This message is a symptom of any boot problems - after some figuring out it turned out that there were problems with the cd module.
To fix, restart and on the boot screen, push F6. Edit the boot command ('e'), add:
break=top
(type 'b') to boot
This causes booting to stop early in the boot process (I think) and lets you type in stuff. When the prompt comes up, type:
modprobe piix
exit
This loads the module required to read the cd.

Booting then seems to continue happily but eventually it just freezes with text on the screen. This is because it doesn't recognise the video driver properly. We need to use the xorg default driver for now.
Pushing Ctrl+Alt+F1 takes you to the single user login.
sudo -s
vi /etc/X11/xorg.conf - (This uses the editor 'vi'. If you're not familiar with this, use 'i' to change to edit mode, 'esc' to come back out of edit mode, 'x' to delete a letter (when not in edit mode), ':w' to save (write) the file and ':q' to quit.)
change driver "nv" to "vesa" then exit
/etc/init.d/gdm restart
And Ubuntu should boot!

So play with it, enjoy the LiveCD, and when ready, double click 'install' on the desktop.

At first it couldn't manage to partition the hard drive, and unfortunately killed Windows :(.
-----------------------------------------------------------------------------------------------------------
ONLY DO THIS SECTION IF IT CAN NOT WRITE THE PARTITIONS - THIS WILL KILL WINDOWS.

I managed to get the disk manageable again by running:
mkfs /dev/sda
Now I could partition with:
cfdisk
--------------------------------------------------------------------------------------------------------------------------------

Congratulations, you should now be booting into Ubuntu :)

CD
So, in order to get continued cd support, we need to tell Ubuntu to load piix each time it boots. To do this, open a terminal and type:
sudo vi /etc/modules
To the end of this file, add:
piix

Graphics
I had difficulty setting up the nvidia graphics driver and really wanted the goods. So I found envy. Brilliant. Get it, run it. It downloads and installs the correct nvidia proprietary video drivers.

Sound
Initially I had a hardware problem so couldn't get sound at all which was very frustrating. Now that the hardware's fixed, it's fine. (Antony Williams also has a great script for automatically getting the latest alsa development drivers, should you need them.) Currently, plugging in headphones has no impact (i.e. sound still comes out of speakers and headphones are dead), so will update here when I resolve.
EDIT (Feb 08): I now have headphones sound as of alsa v1.0.16. You can find out your current alsa version by running:

Use the script above to get this version if you don't have it. Issues still outstanding with sound:

1. I need to mute the main speakers manually when I plug in the headphones
2. Microphone doesn't work, either built-in or plugged-in

--------------------------------------------------------------------------------------------------------------------------------
Upgrade
-Gutsy
Upgraded to gutsy gibbon October 07 without a hitch. Great advances, so highly recommend. Still sticking with the lighter-weight Xubuntu distro, using the xfce window manager. It's nice :)

Wireless
Prior to Gutsy, ndiswrapper was needed to run the Tecra's Intel Corporation PRO/Wireless 4965 AG network card. From gutsy onwards, however, it is supported with the iwl4965 driver (pre-installed). Hurrah!
I still have to use WEP with my router (I know!), so just remember with WEP to use Hex keys, not ASCII and it should work fine.
If you aren't using network manager like I'm not (trying to minimise services), then EDIT:if you boot with wireless switched off, you'll need to do 'sudo ifdown wlan0' then 'sudo ifup wlan0' after switching it on use wicd.

--------------------------------------------------------------------------------------------------------------------------------
Upgrade
-Hardy
Upgrade went without a hitch. Have upgraded successfully from Feisty to Gutsy to Hardy (and have now been using that for 6 months).

Hold down the following keys at boot time for:

Single user: command + s

Select boot drive: opt

Boot from dvd drive: c


At command line, mount the harddrive by: # /sbin/mount -wu /
Start OS X by: # /sbin/SystemStarter