The work computer is NATed behind a Firewall that I do not have controll over and it runs a Web and SSH servers which I would like them to be accessible from home. The home computer also runs SSH and Web servers which I want them to be accessible from the Internet. My Linksys WRT54g router has the following configuration:

I will show following steps in my configuration:

• How to make SSH and Web home servers Internet accessible.
• How to make the SSH server on the Linksys router Internet Accessible.
• How to setup on Linksys SSH key-based authentication.
• How to setup remote tunnels.

Making Home SSH, HTTP and HTTPS servers Internet accessible

First you have to assign a static IP to the home computer via a DHCP reservation. First you need to find the MAC address of the Home Computer network card. To do this on Windows open a command window and type ipconfig /all. On linux and MAC OS X open a terminal and type ifconfig. The value you are looking for is 12 digit value seperated by colons or dashes (i.e. xx:xx:xx:xx:xx:xx).
Now go to the router web configuration page (usually http://192.168.1.1) click on Network Tab and subsequently to the Hosts sub-tab. On the Static IP addresses (for DHCP) section and on the MAC Address text box (on the left) type the MAC Address and on the IP Address text box (right) type 192.168.1.x where x is the the IP Address you would like to address the home computer in your local LAN. Then click add, Save Changes and Apply changes. Disconnect and reconnect your LAN and make sure that your home computer has the assigned IP address.

Now navigate again to the router web configuration page and click on Network>Firewall.  You need now to create 3 rules for forwarding external traffic to the home computer. The forwarding rules look like this:

Ports 22 (SSH), 80 (HTTP), 443 (HTTPS).

Now click and apply changes and  the home servers will be accessible from the internet.

Making the SSH server on the Linksys router Internet Accessible

The SSH server on the Linksys router should be accessible from your LAN out of the box. If not that probably means that you have not installed dropbear SSH server. You can install it by navigating to System>Packages. First of all you need to move the SSH server from the default port 22 to another port (2222) to avoid conflicting with the home computer SSH server when accessing it from the internet. To change the port ssh to the Linksys router and edit the file /etc/init.d/S*dropbear. Then edit the last line from:

/usr/sbin/dropbear

to

/usr/sbin/dropbear -p 2222

Now reboot the router and test that the SSH server on Linksys has indeed moved to port 2222

reboot
ssh -p 2222 linksys

To make the server internet accessible go to the router’s web interface Network>Firewall and add an accept rule for protocol tcp and port 2222.

Now click and apply changes and the Linksys SSH server will be accessible from the internet on port 2222.

Setting up SSH key-based authentication on Linksys

The first step is to create a public and private SSH key pairs. On Linux and MAC OS X this can be done with the command

ssh-keygen -t rsa

This will create a directory ~/.ssh/ with the files id_rsa.pub and id_rsa. The former is the public key and the latter the private key.

If you are using PuTTY on windows you need to download PuTTYgen program to generate the keys.

Note: The public key format from the PuTTYgen application is not recognised by *nix SSH servers your need to convert it by removing new line characters and headers and footers. More about this later.

Now copy the id_rsa.pub from your home network to the router using the commands

scp -P 2222 ~/.ssh/id_rsa.pub root@linksys:
ssh -p 2222 root@linksys
cat ~/id_rsa.pub >> /etc/dropbear/authorized_keys
exit

Now try to ssh to the Linksys router and it will not ask you for password.

Now repeat the same procedure but this time from a terminal in the work computer.

Once you can SSH without a password from work and home computers you can disable password authentication on the Linksys router. This will tighten your security and avoid brute force password guessing threats that run on the internet. You are strongly advice to disable password authentication but this step is still optional.

To disable password authentication, ssh on the Linksys router and edit again the file /etc/init.d/S*dropbear and this time add another addition switch on the init script “-s”. The dropbear init script line now looks like this:
/usr/sbin/dropbear -p 2222 -s

Now reboot the router.

Setting up remote tunnels

From the work computer you can now set up remote tunnels to the Linksys router with the following commands.

ssh -p 2222 myhomenetwork.no-ip.org -R linksys:9000:workComputerIP:80 \
-R linksys:9001:workComputerIP:443 \
-R linksys:9002:workComputerIP:22


The above commands creates an SSH connection from the work computer to the Linksys router on port 2222 and sets up 3 tunnels. The first tunnel is from port 9000 of the router to the apache web server on the work computer, the second from port 9001 to the ssl apache webserver on the work computer and the last tunnel from port 9002 of the Linksys router to the SSH server on the work computer. This means that the Linksys router is now able to connect to the 3 services (HTTP, HTTPS and SSH) provided by the work computer via ports 9000-9002. If the web server is not running on workComputerIP but on another server inside the network you can still set up the tunnels by adjusting the workComputerIP to reflect the webserver’s address. i.e.

ssh -p 2222 myhomenetwork.no-ip.org -R linksys:9000:workWebServer:80 \
-R linksys:9001:workWebServer:443 \
-R linksys:9002:workSSHServer:22


The tunnels are now up and running but you would still like to access these services from the home computer rather than the Linksys router. To achieve this you need to reconfigure dropbear SSH server on the Linksys router to allow remote hosts to connect to the forwarded ports. To do this SSH to the router and append the -a option in the /etc/init.d/S*dropbear file. i.e. change the line from:

/usr/sbin/dropbear -p 2222 -s

to

/usr/sbin/dropbear -p 2222 -s -a

Now reboot and navigate from your home computer web browser to http://linksys:9000/ or https://linksys:90001/ and for the work’s SSH server do: ssh -p 9002 linksys
Done

Share This

I will explain how to setup Mercurial in bluehost WITHOUT ssh access and how to use https to avoid sending your password unencrypted over the network.

If you can find a binary package of mercurial this will save you some trouble but in bluehost the python version is 2.3.4 and the machine architecture is x86_64 so it will be quite unlikely to find a binary where you can simply upload and it will work.

So go here to download the latest stable snapshot of mercurial. Upload the file to your account in bluehost and save it under /home/yourusername/local/. Extract the tar.gz and rename the extracted folder from mercurial-revision to just mercurial.

Now we will use a perl cgi script to compile the mercurial with python 2.3.4 (I am not sure what the rational of bluehost is to uses this ancient version but anyway).

Create the perl script with the following code.

#!/usr/bin/perl

print "Content-type: text/plain";

system("cd /home/yourusername/local/mercurial/;

make local; ./hg debuginstall");

Remeber to replace “yourusersname” with your actual user name. Save the script compile.cgi and upload it using bluehost’s File Manager Interface (FMI) in the cgi-bin directory. (Remeber that the FMI truncates /home/yourusername and the folder /home/yourusername/local/mercurial will shown in FMI as /local/mercurial). Change the file’s permissions to 755 and point your browser to http://www.yourdomain.com/cgi-bin/compile.cgi.

This will hopefully compile mercurial for you. Check the output for any error messages. Once it is done delete the script from the server or change its permissions to 000.

Now using the FMI again; create the following two folders

/public_html/hg
/public_html/hg/repos

Copy the hgwebdir.cgi from /local/mercurial to /public_html/hg andopen hgwebdir.cgi to uncomment the 6th and edit the 7th line. It should look like this

import sys
sys.path.insert(0, "/home/youusername/local/mercurial")

Create a new file in /public_html/hg called hgweb.config with the following

[collections]
/home/yourusername/public_html/hg/repos = /home/yourusername/public_html/hg/repos
[web]
allowpull=true

Create an .htaccess file in the same directory with the following.

Options +ExecCGI
RewriteEngine On
RewriteBase /~yourusername/hg
RewriteRule ^$ hgwebdir.cgi  [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule (.*) hgwebdir.cgi/$1  [QSA,L]
AuthUserFile /home/yourusername/etc/hg-basic-auth
AuthName "HG Repositories"
AuthType Basic

Require valid-user

Switch to your home workstation to create a password file with the following command and then upload it with the FMI in /etc/.

htpasswd -s -c hg-basic-auth myuser1
htpasswd -s  hg-basic-auth myuser2

If you navigate to https://www.yourdomain.com/~yourusername/hg you should see the nice interface of mercurial.

It is time to finally create a ouR repositories using the same hack we used to compile mercurial. The cgi script this time contains the following.

#!/usr/bin/perl
print "Content-type: text/htmlnn";
system("cd /home/yourusername/public_html/hg/repos/;
/home/yourusername/local/mercurial/hg init projectA");

system("cd /home/yourusername/public_html/hg/repos/;
/home/yourusername/local/mercurial/hg init projectB");

Point your browser to the scripts URL and you are almost set. You can pull a repository with hg pull https://www.yourdomain.com/~yourusername/hg/projectA
However you can not push, because the allow_push user list is empty. To solve the problem you will have to create the hgrc file in the projects directory (.hg/hgrc) (i.e. /home/yoursuername/public_html/hg/repos/projectA/.hg/hgrc. A sample is shown below:

[web]
contact= Projects contact e-mail
description= Project description
allow_push= myuser1, myuser2
allow_archive = bz2 gz zip

Finally you can push and pull over https but I would recommend to provide the http URL to anonymous users since https increases the load on bluehost’s server. The problem I have at the moment and I will keep you updated if I find the solution (please let me know if you do too) is that when I try to push a large repository, the push fails with the following error

searching for changes
abort: error: Broken pipe

The problem seems to be that the repository is too big and the push operation uses a lot of swap before the transaction completes and bluehost kills the process. A solution might be to push a few revisions at a time. But I have not figure this out yet.

Enjoy!

Share This

While I am at it, I should add some more flexibility, allowing the user to specify the update interval of the “widget photo”. Now you can have photo of the hour, photo of the day, photo of the week,…
These two changes bring us to pflickr widget v1.1.

For installation instructions see the post of version 1.0.

The new caching mechanism will create a new table in your wordpress database to cache flickr API requests (which tend to be slow). I did not do any benchmarking to see the exact benefits but I am sure that my blog loads faster, while the additional storage overhead is a lightweight (tiny) table.

For the second feature the random number generator is fed with a timestamp seed which varies according the users selection. For example the photo of the day created with the seed DD:MM:YYYY (dmY).

Here is a screenshot of the widget admin panel.

Known issues:

When you upload photos in your stream the “widget photo” changes before the day has elapsed. This occurs because your photos in your stream are indexed from [0 - total number of photos] and after you upload new photos, the “total number of photos” changes, hence the random number generator selects and displays a different photo because the range changed.
Enjoy!

Christos

Share This

UPDATE: New release pflcikr v1.1

First of all, you must to install the widget plugin from Automatic available here.

If your theme does not support widgets, you will have to get another theme or you should widgetize your theme following the instruction here.

Once you setup widget plugin and make sure it works fine you can download the Photo of the Day Flickr Widget.

Unzip it and upload it to your webserver in the plugins/widgets directory.

Navigate to Plugins tab in the administration panel and activate the plugin.

Go to Presentation tab and then select the Sidebar Widget tab.

You will be able to see the pflickr widget under the Available Widget.

Drag the plickr Widget to your sidebar and click at the box appearing on the right on top of the widget. This opens the configuration interface for the widget.

All the options in the widget interface are obvious other than the flickr API key. You can obtain a key here: http://www.flickr.com/services/api/key.gne.

Once you obtain your flickr API key copy & paste the key in the widget configuration window. You can now click somewhere outside the configuration window to close it and click Save Changes button.

Done! Visit your blog and everything should work like a charm.

The widget works using the phpflickr class by Dan Coulter, which is bundled with this widget.
If you are using the widget successfully or not please let me know.

Christos

Share This

Here is a screenshot of my map!

Share This