KCLUG

kclug@kclug.org

5 participants
3240 discussions

still no ssh access
by Brian Kelsay 30 Sep '04

30 Sep '04

Now that I have sshd running on the new server and I can connect to it from another PC on my LAN, I know that it should work. I have setup port 80, 8000 and 21 to forward to 22 on the server, but none allow me to connect with Putty from work. Those that remember, I had narrowed it down to port 80 being unblocked on outbound and POSSIBLY port 21. I just want the ability to sftp a few small files to it, enable new functions and test the webserver in general. The rules are set up in IPCop correctly. I am about to resign myself to the fact that there is no way to do this unless there is some other package that I can put on the server to allow remote access via port 80 or 443 (https). Anybody know of something like webmin that comes by default to work on 443 and then allows you to ssh or ftp? I feel really stupid. The next step I will try is to put webmin on 443 instead of 10000 or whatever it is set by default, but I'm not confident. I probably need to leave my current port forwarding rules until LUG meeting night to see if I can get in remotely from another location. This has been a testing nightmare for me. Brian Kelsay

5 4

Re: still no ssh access
by Brian Kelsay 30 Sep '04

30 Sep '04

Now that is a good question and probably the answer. I believe in the scientific method for testing of any type. Make changes to only one item at a time until all are exhausted so you know what made the difference. I have never had to change this before. I assume it is sshd.conf. I'll give it a look tonight and set everything else back the way it was. Brian Kelsay >>> <JARiley 09/30/04 03:13PM >>> Why don't you just change your sshd config file to use port 443, then the encrypted traffic won't throw up any flags to the firewall admins. James Riley, CISSP

1 0

Re: still no ssh access
by Brian Kelsay 30 Sep '04

30 Sep '04

Interesting, but I have already been able to use Putty on a PC in my LAN. It worked with no change. Brian Kelsay >>> Rich Edelman <redelman(a)speedscript.com> 09/30/04 01:39PM >>> What I've found I needed to do to allow PuTTY and WinSCP clients to connect is to change the sshd config. These are the options I needed to change, keep in mind this has been on SuSE 9.x, your distribution may vary. /etc/ssh/sshd_config: #PasswordAuthentication no #PermitEmptyPasswords no UsePAM yes

2 1

RE: still no ssh access
by Brian Kelsay 30 Sep '04

30 Sep '04

The IPCop box, if ssh is enabled on it, will allow ssh on 222. You can then port forward 22 to one box internal and setup any others with different external ports forwarded to specific boxes port 22. e.g. ip:22 -->192.168.0.3:22, ip:1022-->192.168.0.4:22, ip:1023-->192.168.0.5:22. Unfortuantely I can't do that. My workplace blocks outbound connections to anything but 80, 443 and 21 (ftp). I have tried port 22, 80, and 21 forwarded at the firewall to server port 22. Brian Kelsay >>> "Dustin Decker" <dustin.decker(a)1on1security.com> 09/30/04 01:25PM >>> IPCop is designed to have ssh run on port 222, leaving you the luxury of forwarding the SSH port (which is 22 btw, not 21) to another host on your network. If you're on RoadRunner, you might want to modify IPCop to have the web admin interface listen on something other than port 445, as that is blocked because of the number of worms which attack Win2K on that port. If you are trying to connect to a host _behind_ IPCop, forward port 22 to that host. If you are trying to connect to IPCol itself, use the -p flag to connect on port 222. Dustin > -----Original Message----- > Of Brian Kelsay > Sent: Thursday, September 30, 2004 1:04 PM > To: kclug(a)kclug.org > Subject: still no ssh access > > Now that I have sshd running on the new server and I can connect to it > from another PC on my LAN, I know that it should work. I have setup port > 80, 8000 and 21 to forward to 22 on the server, but none allow me to > connect with Putty from work. Those that remember, I had narrowed it down > to port 80 being unblocked on outbound and POSSIBLY port 21. I just want > the ability to sftp a few small files to it, enable new functions and test > the webserver in general. The rules are set up in IPCop correctly. I am > about to resign myself to the fact that there is no way to do this unless > there is some other package that I can put on the server to allow remote > access via port 80 or 443 (https). > > Anybody know of something like webmin that comes by default to work on 443 > and then allows you to ssh or ftp? I feel really stupid. The next step > I will try is to put webmin on 443 instead of 10000 or whatever it is set > by default, but I'm not confident. > > I probably need to leave my current port forwarding rules until LUG > meeting night to see if I can get in remotely from another location. > This has been a testing nightmare for me. > > Brian Kelsay

1 0

Re: still no ssh access
by Brian Kelsay 30 Sep '04

30 Sep '04

Why should it matter? It is not 3 services, but one, with one ultimate destination and I am the only user. There are no connections on 22, 80, 21 or 8000 until I attempt them. I only attempt to connect to one at a time. What's the difference from this and having a firewall forward both 80 and 8080 to the same webserver, which I understand is standard practice? Brian Kelsay >>> crash 3m <crash3m(a)gmail.com> 09/30/04 01:22PM >>> Your forwarding 3 ports, to 1 port? I dont believe thats a workable solution, if you forward port 80 on the external machine, to 22 on the internal machine, and set putty to connect to port 80 for an ssh/scp connection you can transfer your files. But AFAIK (and IANA tcpi/ip expert) you cannot have the 3 services listening on the same port on the same protocol (e.g. you could have one on udp and one on tcp) Surely there will be some others that will chime in with a more accurate answer. On Thu, 30 Sep 2004 13:04:01 -0500, Brian Kelsay <brian.kelsay(a)kcc.usda.gov> wrote: > Now that I have sshd running on the new server and I can connect to it from another PC on my LAN, I know that it should work. I have setup port 80, 8000 and 21 to forward to 22 on the server, but none allow me to connect with Putty from work. Those that remember, I had narrowed it down to port 80 being unblocked on outbound and POSSIBLY port 21. I just want the ability to sftp a few small files to it, enable new functions and test the webserver in general. The rules are set up in IPCop correctly. I am about to resign myself to the fact that there is no way to do this unless there is some other package that I can put on the server to allow remote access via port 80 or 443 (https). > > Anybody know of something like webmin that comes by default to work on 443 and then allows you to ssh or ftp? I feel really stupid. The next step I will try is to put webmin on 443 instead of 10000 or whatever it is set by default, but I'm not confident. > > I probably need to leave my current port forwarding rules until LUG meeting night to see if I can get in remotely from another location. This has been a testing nightmare for me. > > Brian Kelsay > > _______________________________________________ > Kclug mailing list > Kclug(a)kclug.org > http://kclug.org/mailman/listinfo/kclug > -- Got gmail? I do hahaha _______________________________________________ Kclug mailing list Kclug(a)kclug.org http://kclug.org/mailman/listinfo/kclug

1 0

OT: W98SE needed
by Jonathan Hutchins 30 Sep '04

30 Sep '04

I need to restore the OS on an older laptop, and I would prefer to go with W98SE rather than the original W98. Unfortunately that's one of the things I don't have in my cumulative computer junk stash. I don't mind asking my client to buy a copy, but they're a bit hard to find these days. I can get a copy of the media, but I'll need a license/certificate/activation key too. If any of you _does_ have such a thing in their cumulative computer junk stash, I'd be glad to buy it from you; if you know of somewhere that might have it please let me know.

1 0

Localhost route missing
by Jon Moss 28 Sep '04

28 Sep '04

A couple of weeks ago, when I was having trouble with my web server, I noticed that I don't have a localhost route: ]$ cat hosts # Do not remove the following line, or various programs # that require network functionality will fail. 127.0.0.1 lumcweb localhost.localdomain localhost 192.168.0.33 lumcweb.localdomain lumcweb 192.168.0.25 MossLinux MossLinux 24.94.162.101 smtpserver ]$ netstat -r Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 192.168.0.0 * 255.255.255.0 U 0 0 0 eth1 169.254.0.0 * 255.255.0.0 U 0 0 0 eth1 default 192.168.0.1 0.0.0.0 UG 0 0 0 eth1 Yet my hosts files includes it. This server is running Fedora Core 2. I can also ping the localhost just fine: PING lumcweb (127.0.0.1) 56(84) bytes of data. 64 bytes from lumcweb (127.0.0.1): icmp_seq=0 ttl=64 time=0.071 ms 64 bytes from lumcweb (127.0.0.1): icmp_seq=1 ttl=64 time=0.063 ms 64 bytes from lumcweb (127.0.0.1): icmp_seq=2 ttl=64 time=0.060 ms 64 bytes from lumcweb (127.0.0.1): icmp_seq=3 ttl=64 time=0.063 ms Should I be concerned? -- Thanks very much, Jon Moss jon.moss(a)cnonline.net

2 1

RE: Which distro ... for low end hardware ?
by Brian Densmore 28 Sep '04

28 Sep '04

Very true, but when a person is asking for advice on a cheap solution for a single non-networked PC which is a new install LTSP is well ... overkill. LTSP is great for what it is designed for, revitalizing old hardware for use by many. > -----Original Message----- > From: Bill Cavalieri > > Jonathan Hutchins wrote: > > >DISCLAIMER: Jason works for a company that sells LTSP > solutions to schools. > > > >He also aparently missed the fact that this is a "Single > user single desktop > >maybe not even networked". LTSP involves building a fairly > sturdy server and > >saving your money on multiple served workstations, noth the > case here. > > > >I've often wondered, given the cost of the server required, > at what point you > >actually start saving money with LTSP by reconditioning > existing PC's instead > >of buying new, low-end (sub $300) workstations and using a > peer-to-peer > >network. > > > > > Linking to an opensource project is hardly worth a DISCLAIMER. > > Since your wondering, often, when the money savings start, > lets do some > brainstorming, > > Performance: > $300 desktop, is going to run like a $300 desktop. I'll start with 5 > workstations, but even 2 would work. > 5 * $300 = $1500, now you could have 5 computers that run like $300 > computers. > Or buy a $1500 ltsp server, and re-use your old computers, = > 5 computers > running near $1500 speeds. > > Maint: > 5 computers to keep running, updated, etc... > Or 1 ltsp server, workstations will netboot, without need for hd, > floppy, cdrom > > Karma: > UN reports it takes 1.8 tons of materials to make a modern pc. > > "that extending a machine's operational life through re-use > holds a much > greater potential for energy saving than recycling." > http://www.infoworld.com/article/04/03/07/hnunstudy_1.html > > -Bill > > _______________________________________________ > Kclug mailing list > Kclug(a)kclug.org > http://kclug.org/mailman/listinfo/kclug >

2 1

[OT] RE: Anyone still need a gmail invite?
by Brian Densmore 28 Sep '04

28 Sep '04

So let me get this straight. Everyone already has a gmail account including this guy who is complaining about people sending out gmail invites? So how did this guy get a gmail account if not from one of these nefarious "spammers" sending him one? So now I am to be equated with a spammer because I post a single email that goes to select list of users that might actually appreciate having a gmail account for capturing spam, or being able to store lots of email (like from a LUG mailing list) without buying a new harddrive. Gee thanks for the compliment D. Joe. BTW, I have one invite left in case you want it. Oh wait that's right you don't want one. But apparently, 5 people still didn't have a gmail account and were appreciative of getting an invite. I guess you could flame me for not marking my post as OT. I've fixed that, but you shouldn't flame someone for offering something of value to at least a good number of us. Have a nice day, Brian > -----Original Message----- > From: D. Joe Anderson > > > On Mon, Sep 27, 2004 at 11:47:08PM -0500, D. Joe Anderson wrote: > > On Mon, Sep 27, 2004 at 01:35:50PM -0500, Brian Densmore wrote: > > > I have some gmail invites for anyone that wants one. > > > > Ah, gmail. The world's most successful spam effort: > > Make that: > > http://zork.net/~nick/mail/we-do-not-want-your-gmail-invitations > > _______________________________________________ > Kclug mailing list > Kclug(a)kclug.org > http://kclug.org/mailman/listinfo/kclug >

1 0

Re: Anyone still need a gmail invite?
by Brian Kelsay 28 Sep '04

28 Sep '04

Joe, some people still don't have Gmail accounts. Some of us prefer the unobtrusive ads from Gmail over those from Hotmail and Yahoo. Others of us always need some spamcatcher webmail acct to use to register for various things. Gmail has the added benefit of being fast and with a large storage space so you don't have to clean it out every two days. Brian Kelsay >>> "D. Joe Anderson" <> 09/27/04 11:51PM >>> On Mon, Sep 27, 2004 at 11:47:08PM -0500, D. Joe Anderson wrote: > On Mon, Sep 27, 2004 at 01:35:50PM -0500, Brian Densmore wrote: > > I have some gmail invites for anyone that wants one. > > Ah, gmail. The world's most successful spam effort: Make that: /we-do-not-want-your-gmail-invitations

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG