Shell: Unterschied zwischen den Versionen

Version vom 9. Juni 2016, 08:45 Uhr

Beta Test. Please give feedback via feedback(ät)informatik.uni-goettingen.de.
Currently most important topic: #Port_knocking

Usage

Please read #Port_knocking if you can not connect.

Simply use SSH to login to this machine:

ssh  user@shell.stud.informatik.uni-goettingen.de

Note that the intially presented banner contains something like

#######  shell.stud.informatik.uni-goettingen.de - login vm: shell5.cip.loc

...telling you the actual local name of the automatically chosen destination machine.

For Windows: use PuTTY (simple) or Cygwin (more complex and powerful) or any other SSH-implementation.

Target audience

These machines are meant to be used by students. But of course they can be used by any staff members! (For first time users: the only requirement is to logon one single time using one of the (physical) pool computers in our building - this will make you a "known user" to our systems.)

Load Balancing

While this term is misleading on this specific installation (as it does simple "round-robin") the important point is that you'll get connected to any login machine. This will be the "next" machine one after another and probably not the same one as one session before. If you landed on an overcrowded system simply disconnect/reconnect to use another machine.

Timeout

The session Timeout is set to 36 hours -- this is the HAproxy related Timeout regarding the TCP connection
Kerberos/OpenAFS have separate/shorter timeouts, usually 10 hours. Please check with klist. You need to run kinit && aklog when you're approaching timeout

Self defense of these servers

Port knocking

For security reasons a "port knocking daemon" got installed. It works like a secret knocking sequence at the door of a conspiracy meeting: only after you have successfully performed that secret sequence the door is opened for a moment. In our technical context this means that the listening sshd is reachable for 300 seconds after knocking...

Secret: 33778 • 22999 • 44333

Successfully triggering is possible using a variety of software tools:

#Linux
#Windows
#OS agnostic Web Browser

Linux

If you are using Linux and the package knockd is actually installed (which is not a requirement!) you can use this one-liner to log in:

~$ knock shell.stud.informatik.uni-goettingen.de 33778 22999 44333 && sleep 1;  ssh username@shell.stud.informatik.uni-goettingen.de

If this fails try a slower version:

~$ knock shell.stud.informatik.uni-goettingen.de 33778; knock shell.stud.informatik.uni-goettingen.de 22999; knock shell.stud.informatik.uni-goettingen.de 44333 &&  sleep 1;  ssh username@shell.stud.informatik.uni-goettingen.de

Without having the package knockd installed: telnet to the rescue!

~$ telnet shell.stud.informatik.uni-goettingen.de 33778
~$ telnet shell.stud.informatik.uni-goettingen.de 22999
~$ telnet shell.stud.informatik.uni-goettingen.de 44333
~$ ssh  username@shell.stud.informatik.uni-goettingen.de

Windows

telnet is included in Windows also. But it is not installed by default. You need to activate it through "Windows-Features aktivieren oder deaktivieren"/"Add windows features" --> "Telnet-Client". You need Administrator privileges to do so, so this is not an option on foreign computers

There are dedicated tools available for this purpose. This one is tested and found to work as expected: https://sourceforge.net/projects/knockknock/
The zip-file contains a (surprisingly small) executable. It is usable without installation, so you do not need Admin privileges

Use a web browser to tickle those ports

OS agnostic Web Browser

Create a new folder for these bookmarks. Prepare three Bookmarks:

Of course you will end up running into a timeout as there is no webserver listening. You do not have to wait for timeout; simply cancel loading...

You can "click" them one after another. Browsers like Firefox offer a context menu entry "Alle in Tabs öffnen"/"Open all bookmarks" which tries to do what it says. You need to close all three of them one by one though.

Additionally...

If you have problems to login take a look at this page. These security aspect a definitely a work in progress and the final state is not being reached yet...

Tips 'n' Tricks

Connect to a specific machine

Circumventing the Round-Robin mechanism is possible: connect to a specific port 42000+n with n={1..6} :-)

For machine number 4:

~$ ssh -p 42004 username@shell.stud.informatik.uni-goettingen.de
#######
#######  shell.stud.informatik.uni-goettingen.de - login vm: shell4.cip.loc

"knocking" not required from inside the Institute

If your are inside the Institute's LAN then there is no need to take the main entrance. You can circumvent the need to knock at the front door by connecting to the shellX-machines directly:

~$ ssh shell4.cip.loc

Todo

Testing! -- current state considered "BETA"
make Status Information publicly available

Links

https://en.wikipedia.org/wiki/Port_knocking

@@ Zeile 64: / Zeile 64: @@
 === Port knocking ===
-Because "Rate Limiting" still allowed too many brute force attempts we need to enhance security. For this a "port knocking daemon" got installed. It works like a secret knocking sequence at the door of a conspiracy meeting: only after you have successfully performed that secret sequence the door is opened ''for a moment''. In our technical context this means that the listening <tt>sshd</tt> is ''reachable'' '''for 300 seconds''' after knocking...
+For security reasons a "port knocking daemon" got installed. It works like a secret knocking sequence at the door of a conspiracy meeting: only after you have successfully performed that secret sequence the door is opened ''for a moment''. In our technical context this means that the listening <tt>sshd</tt> is ''reachable'' '''for 300 seconds''' after knocking...
 {| style="border: 1pt black dashed"