I am busy changing the world

I wrote a blog post about SSH tunneling 4 years ago at this . Today I will show you another trick that gets you into the server behind firewalls. Normally, corporate's firewalls will block all the incoming ports except port 80 and 443 which are using for accessing the web servers. So, here are how to can get access to the servers from outside (assuming you have access to the server you want to connect to from inside the corporate network): 1. If the server you want to connect to doesn't have anything web or anything running on port 80/443, you just need to change its's ssh config to let sshd runs on port 80/443. sudo nano /etc/ssh/sshd_config ... Port 80 ... sudo systemctl restart ssh 2. If your server already has a web or a server that runs on port 80/443, use another server that you can access from inside the network and free of port 80/443.  Then establish the tunnel, assuming: server.A.com: the server that I have access from inside the network server....

As you may already know, OpenStack is a big software project that running on stacks of servers so you cannot just folk it to your computer and run. Fortunately, the OpenStack community had built a minimal version of the OpenStack called devstack that help you have a developing environment without using a lot of resources. But, devstack still eats lots of CPU and memory of your computer so in my opinion, it's better to have a dedicated machine for running devstack (mine is a computer with 16GB). So the last things you need to do to start working on your patches are: 1. SSH to the devstack server 2. Make sure that the service outputs logs to some files (such as /opt/stack/logs/tacker.log) For Tacker or services that have settings file under /etc/<service name>/<service name>.conf, you can change the parameter to output logs to file 3. Using tmux or byobu to have multiple ssh console screens that you can easily switch to and for 4. Use VI or NANO to ma...

I was trying to set up unattend ssh login for vyatta user by concatenate my computer's public key to /home/vyatta/.ssh/authorized_keys but every time the server gets restarted, the key's gone. I shouldn't do it that way because Vyatta has its own way of managing ssh keys. Do this instead: 1. From my computer, copy the public key to vyatta server: $ rsync -arv ~/.ssh/id_rsa.pub vyatta@vyatta:/home/vyatta (at this point, I have to enter the password for vyatta user) 2. On Vyatta, using Vyatta's commands to import the key: $ configure $ loadkey vyatta /home/vyatta/id_rsa.pub From now I don't have to enter password to ssh to Vyatta.

In Microsoft Windows Server 2008 (Active Directory Domain Controller), you can reset a user password using command prompt with dsmod: dsmod user <user dn> -pwd new_password What if you want to do it from remote? Python and Paramiko module will help: 1. In the Active Directory domain controller, install  cygwin with ssh module. Create a ssh user. 2. Still in the Active Directory domain controller, export the user's dn list to a csv file using command prompt: dsquery user "ou=MyUser,dc=my,dc=domain,dc=com" | dsget user -samid -fn -ln -dn > myusers.csv 3. Open names.csv, add a column name "password" and fill in new password for all the user. Save and copy it to your computer. 4. In your computer (I'm running Ubuntu 14.04), install all the paramiko python module: $ sudo pip install paramiko then run this python script: $ python mass_reset_ad_passwd.py /path/to/myusers.csv

In some cases, when writing a bash shell script like running the rsync command multiple times, and you want to avoid entering username and password over and over again, you may find sshpass useful. $ sudo apt-get install sshpass Example script: #! /bin/bash for oldblogid in `cat $1` do         media=/var/www/wp-content/blogs.dir/$oldblogid           echo "=== Checking the existance of $media directory..."                                                                                                if [ -d "$media" ]          then                 echo "    Existed! Copying $media..."           ...

So I heard that you want to enable FTP access (read + write) to a specific folder inside your WordPress (or any folder) directory to a specific user without installing the FTP service . SFTP is one way to achieve that. Follow these steps: Assuming: myuser: the user you want to grant access. /var/www/myvhost: is a WordPress installation directory. /var/www/myvhost/the_shared_folder (or the wp-content folder) : is a folder inside your WordPress root you want to grant access to myuser. 1. Create the user and specify the shared folder as her home directory: $ sudo useradd -d /var/www/myvhost/the_shared_folder myuser $ sudo passwd myuser 2. Disable shell login on myuser : $ sudo usermod -s /bin/false myuser 3. Configure ssh: $ sudo nano /etc/ssh/sshd_config ... #Subsystem sftp /usr/lib/openssh/sftp-server Subsystem sftp internal-sftp ... Match User myuser         X11Forwarding no         ChrootDirectory /var/www/my...

I'm using this utility class to make ssh connection in python using Paramiko module with connection fail-overs between ssh servers. Quite simple: References:  [0] http://jessenoller.com/blog/2009/02/05/ssh-programming-with-paramiko-completely-different [1] http://sebastiandahlgren.se/2012/10/11/using-paramiko-to-send-ssh-commands/ [2] http://www.lag.net/paramiko/

Currently, I wanted to ssh to a remote server from my computer. But, the network where my computer resides has blocked the ssh port. I could not do it the normal way. So, I used the SSH tunneling technique to bypass this strict policy. Here is how I did it: 1. Create an SSH tunnel from my machine (localhost) through a un-blocked server (e.g. the firewall), the only computer that can make ssh connections to the outside world, to the server I want. (Luckily, I have access to the firewall of the network ) $ ssh -L 2022:myremoteserver.com:22 firewall_user@firewalldomain.com This will ask me to provide the password of the firewall_user. It will open a tunnel from my local machine at port 2022 to the ssh port (22) of the firewall. Keep the terminal window open and move to the next step. To 2. Open another terminal window and SSH through the tunnel by the following command : $ ssh -l remote_user -p 2022 localhost This command will ask me the password of the remote_user user...

Today, I looked for a way to lock a Xubuntu machine remotely, and after a while of googling, I figured out this method: 1. I created 2 alias command to lock and unlock the monitor's screen (xscreensaver) in /home/myuser/.bash_aliases : alias lock='export DISPLAY=:0.0; xflock4;' alias unlock='export DISPLAY=:0.0; kill -9 "$(pidof xscreensaver)"; xscreensaver -no-splash &' 2. Install JuiceSSH (a ssh client) app in my Android phone: https://play.google.com/store/apps/details?id=com.sonelli.juicessh&hl=en 3. From my Android , connect to the Xubuntu machine via SSH with username ' myuser ', and then: To lock the screen, type this in my phone terminal: $ lock And unlock the screen with: $ unlock It's just fascinating! Feel like a hacker!!! \m/\m/\m/

To launch a GUI program in a xUbuntu machine from a remote xUbuntu box, following these steps: 1. Assuming someone had logged-in to the remote machine (let call it R) with user ' remoteuser ' in graphical mode (init 5) 2. From my computer, ssh to R machine with user ' remoteuser ' (!important, if you login to R with another user, this won't work): trinh@local-pc $ ssh remoteuser@R.IP.Address 3. Run the following command before launch any graphical program: remoteuser@remote-pc $ export DISPLAY=:0 4. Finally, launch whatever GUI program you want, for example: Firefox: remoteuser@remote-pc$ firefox &

To allow only some specific users/groups access the SSH server: $ sudo nano /etc/ssh/sshd_config Add the following line to allow access only for user 'trinh': AllowUsers trinh Or this line to allow only group 'mygroup': AllowGroups mygroup Restart ssh service: $ sudo service ssh restart More options (source: http://knowledgelayer.softlayer.com/learning/how-do-i-permit-specific-users-ssh-access) : AllowGroups This keyword can be followed by a list of group name patterns, separated by spaces.If specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns.`*' and `?' can be used as wildcards in the patterns.Only group names are valid; a numerical group ID is not recognized.By default, login is allowed for all groups. AllowUsers This keyword can be followed by a list of user name patterns, separated by spaces.If specified, login is allowed only for user names that match one of the ...

Your company network does not allow any SSH connection? Just make it through a Sock Proxy. You can easily ssh successfully to your server with Tor. 1. Install Tor: $ sudo apt-get install tor After installing Tor, some services will be started: tcp        0      0 127.0.0.1:9050          0.0.0.0:*               LISTEN      14753/tor       tcp        0      0 127.0.0.1:9150          0.0.0.0:*               LISTEN      7373/tor       tcp        0      0 127.0.0.1:9151          0.0.0.0:*               LISTEN      7373/tor     2. SSH through Tor network: $ torify ssh root@myoutsidedomain.com Cool!!! Referen...

Here is one more thing I have to take note when messing around with Heroku: SSH Key After installing a fresh copy of Xubuntu 13.10 (Saucy Salamander), I created a new virtualenv with all the requirement. I made some changes in the Django app. And, finally I intended to push the updates to Heroku: $ git push heroku master But, it said that I don't have permission. OK, I don't have the right ssh key on my new OS. So,  I fixed this by: 1. Generate new pair keys: $ ssh-keygen -t rsa 2. Add the new key to Heroku: $ heroku keys:add Done. Everything's back to normal. I can push code to Heroku again.

I had to enter password every time I push my commits to git server. I can avoid doing it again and again by using SSH key: 1. In my computer, generate SSH Key : $ cd ~/.ssh $ ssh-keygen -t rsa -C "dangtrinhnt@gmail.com" The above command will create 2 files, id_rsa and id_rsa.pub . id_rsa.pub is your public key. Send it to the git server. 2. Copy the public key to the remote server: $ ssh-copy-id -i ~/.ssh/id_rsa.pub myusername@remotehost The command will prompt me to enter password of my user account in the remotehost. Enter and done. + After that, if I can ssh to the remote server without error, I can assume that it works: trinh@mylocalpc$ ssh myusername@remotehost myusername@remotehost$ + If I get the error " Agent admitted failure to sign using the key ", run the following command and try to ssh again: $ ssh-add From now on, whenever I push code to remote git server, I don't have to input my password anymore. References: http:...

I will use the ssh_client module I wrote ( http://iambusychangingtheworld.blogspot.com/2013/05/manipulate-windows-machines-from-linux.html ) to execute M$ Windows Active Directory command line remotely from my Ubuntu. #! /usr/bin/python import ssh_client def dn_existed (dn, type_of_dn, ssh_client): # type_of_dn is group , ou or user command = 'dsget ' + type_of_dn + ' "' + dn + '"' ssh_client.execute_command(command) if 'succeeded' in ssh_client.return_str: return True return False if __name__ == "__main__":        client = ssh_client.MySSHClient()        client.do_connect()        dn = 'OU=MYOU,DC=MYGENIUS,DC=COM'        if dn_existed(dn, 'ou', client):               print "Existed"        else:               print "Not existed"

Sometime you want to copy something (files) from your remote server to your local machine. The thing is, the remote server is the only one that has ssh, so you can only push file to it (remote one) through scp command. I found the rsync command that solves the problem: (type this in your local machine's terminal) rsync -chavzP --stats user@remote.host:/path/to/copy /path/to/local/storage

1. On the Windows machine : - Install SSHD using Cywin: check  http://www.howtogeek.com/howto/41560/how-to-get-ssh-command-line-access-to-windows-7-using-cygwin/ - Assuming that you create a user name genius with administrator permission, including ssh access. 2. On the other machine which installed python and paramiko module : Before going further, I prefer you read the following article carefully about paramiko and its capability: jessenoller.com/blog/2009/02/05/ssh-programming-with-paramiko-completely-different Write the client class which will connect to ssh server (the Windows) and execute command from that server for you, ssh_client.py :

Just taking note a very interesting example in using paramiko of Jesse Noller (http://jessenoller.com/blog/2009/02/05/ssh-programming-with-paramiko-completely-different)