Shell und Microsoft Imagine: Unterschied zwischen den Seiten

Aus Doc-Wiki
(Unterschied zwischen Seiten)
Zur Navigation springen Zur Suche springen
imported>Gtest2
 
imported>Krull
(Die Seite wurde neu angelegt: „Willkommen auf den Microsoft Imagine (ehemals DreamSpark, ehemals MSDNAA) Seiten des '''Instituts für Informatik'''[http://www.ifi.informatik.uni-goettingen.de].…“)
 
Zeile 1: Zeile 1:
  +
Willkommen auf den Microsoft Imagine (ehemals DreamSpark, ehemals MSDNAA) Seiten des '''Instituts für Informatik'''[http://www.ifi.informatik.uni-goettingen.de].<br>
{| style="border: 1pt black dashed"
 
  +
<br>
|-
 
  +
Das Softwareportal ist erreichbar via:
| [[Image:Diamond-caution.png]] || '''Beta Test!''' Please give feedback via '''<tt>feedback(ät)informatik.uni-goettingen.de</tt>'''<br /><small>For problem reports: please include ''always'' information about your system, the exact date+time, your IP address, your user id, what you wanted to accomplish, what you did and what happened instead.</small>|| [[Image:Diamond-caution.png]]
 
  +
* Startseite: https://dreamspark.informatik.uni-goettingen.de
|-
 
  +
* Zum Login: https://dreamspark.informatik.uni-goettingen.de/login.php?action=signin
|}
 
  +
Ansprechpartner für Zugangsberechtigungen im Studiengang "Angewandte Informatik" ist:
  +
* '''[mailto:dreamspark@informatik.uni-goettingen.de dreamspark@informatik.uni-goettingen.de]'''<br /> (= [[Benutzer:Burghardt|Udo Burghardt]] & [[Benutzer:Krull|Gunnar Krull]])
   
  +
* Wirtschaftsinformatiker lesen bitte http://www.uni-goettingen.de/de/63495.html, sie bekommen ''hier'' keinen Zugang.
  +
<br>
   
  +
__TOC__
  +
== Was ist Microsoft Imagine? ==
  +
Die Microsoft Imagine Premium Lizenz ist ein Angebot für Fachbereiche Hochschulen und Berufsschulen, die zu den Bereichen MINT (Mathematik, Informatik, Wirtschaftsinformatik, Naturwissenschaften & Technik - insb. Ingenieurwissenschaften) gehören. Sie bietet Lehrkräften, Lernenden und Administratoren zu Zwecken von Forschung und Lehre Zugriff auf Microsofts neueste Entwickler- und Designerwerkzeugen, Server und Betriebssystem.
  +
Die jeweilige Abteilung muss aber Konzepte der IT-Technologie und nicht nur deren bloße Anwendung lehren.
   
  +
Weiterhin finden Sie alle relevanten Informationen auf http://www.dreamspark.de<br>
== Usage ==
 
  +
Die aktuellen EULAs finden Sie hier: http://www.microsoft.com/germany/msdn/academic/dreamspark/eula.aspx
''Please read [[#2FA]] for initial setup.'' Then simply use SSH to login to this machine:
 
   
  +
== Folgende Software ist enthalten: ==
<big>
 
~# ssh username@shell.stud.informatik.uni-goettingen.de
 
####### shell.stud.informatik.uni-goettingen.de - login vm: shell5.cip.loc
 
...
 
'''Verification code: '''
 
'''Password: '''
 
Welcome to Ubuntu 14.04.4 LTS (GNU/Linux 3.13.0-87-generic x86_64)
 
username@shell5:~$
 
</big>
 
   
  +
* Microsoft Desktop-Betriebssysteme
  +
* Programmiersprachen und Entwicklertools
   
  +
Bitte beachten Sie, dass Microsoft Office ''nicht'' im Abonnement enthalten ist!
   
  +
== Wie bekomme ich als Student die Software? ==
For '''Windows''': use [[PuTTY]] (simple) or [[Cygwin]] (more complex and powerful) or any other SSH-implementation.
 
  +
Wer als Studierender den Zugang zu Microsoft Imagine haben möchte, muss diese Voraussetzungen erfüllen (diese sind von Firma Microsoft vorgegeben!):
   
  +
# Die rechtlichen Bedingungen gelesen haben und akzeptieren. Die aktuellen EULAs finden Sie [http://www.microsoft.com/germany/msdn/academic/dreamspark/eula.aspx hier].
  +
# Aktuell eingeschriebener Student des Studiengangs "Angewandte Informatik (Bachelor)", "Angewandte Informatik (Master)", "ITIS (Master)" oder "Lehramt- und 2-Fächer-Bachelor mit Hauptfach Informatik"
   
  +
* Erstsemester haben erst Zugriff, nachdem Immatrikulations-Listen abgeglichen wurden. Das dauert einige Wochen und kann mindestens bis Mitte November dauern.
=== Target audience ===
 
These machines are meant to be used by students. But ''of course'' they can be used by any staff members!
 
   
  +
* Für Studenten der '''Wirtschaftsinformatik''' wird ein eigenes MSDNAA-Programm der WiInf Abt. II angeboten [http://www.uni-goettingen.de/de/63495.html]. Studenten der Wirtschaftsinformatik bekommen daher am Institut für Informatik keinen Zugang zum MSDNAA.
For first time users: the only requirement is to logon one single time using one of the (physical) pool computers in our building - this will make you a "known user" to our systems. Additionally you need to walk through [[#2FA]].
 
   
  +
'''Auslieferung:'''<br />
=== Load Balancing ===
 
  +
Die Microsoft Imagine Software wird grundsätzlich '''nur online''' verteilt und freigegeben.
In fact this term is misleading on this specific installation as it simple does "round-robin", at least for now. The important point is that you'll get connected to ''any'' currently available login machine. This will be the "next" machine one after another and probably ''not'' the same one as one session before. If you landed on an overcrowded system simply disconnect/reconnect to use another machine.
 
<!--
 
=== Legacy <tt>login.stud</tt> ===
 
Both <tt>login.stud.informatik.uni-goettingen.de</tt> and <tt>login.informatik.uni-goettingen.de</tt> (for staff only) are not affected by this new approach. These "old" machines will continue to work unmodified.
 
-->
 
   
=== Timeout ===
+
== Einloggen ==
  +
Der Zugang zur Microsoft Imagine Webseite geht über den Benutzernamen und das Passwort des Studierendenaccount.<br>
* The session Timeout is set to '''36 hours''' -- this is the HAproxy related Timeout regarding the TCP connection
 
  +
Der Benutzername ist ohne Domäne anzugeben.
* [[Kerberos]]/[[OpenAFS]] have separate/shorter timeouts, usually 10 hours. Please check with <tt>klist</tt>. You need to run <tt>kinit && aklog</tt> when you're approaching timeout
 
   
  +
== Konto gesperrt? ==
<!--
 
  +
Nur eingeschriebene Studierende haben Zugang zum Microsoft Imagine Programm. Spätestens nach Ende eines Semesters wird der Zugang für nicht (mehr) immatrikulierte Studierenden gesperrt.
=== Availability ===
 
The goal - ''of course'' - is 24/7. Take a look at: http://shell.stud.informatik.uni-goettingen.de/ -- use <tt>ifi</tt>/<tt>ifi</tt> to login <small>("bots not welcome")</small>
 
-->
 
   
   
 
== Self defense of these servers = Rate Limiting ==
 
{| style="border: 1pt black dashed"
 
|-
 
| [[Image:Diamond-caution.png]] || We do limit the rate of ''new'' <tt>ssh</tt>- (<tt>tcp</tt>-) connections from each source IP address to '''10 per minute'''. If you hit this limit your source IP address is blocked for 5 minutes.<br /><small>The parameters are in flux and may change without further notice.</small>|| [[Image:Diamond-caution.png]]
 
|-
 
|}
 
 
 
 
<!--
 
=== Port knocking ===
 
For security reasons a "port knocking daemon" got installed. It works like a secret knocking sequence at the door of a conspiracy meeting: only after you have successfully performed that secret sequence the door is opened ''for a moment''. In our technical context this means that the listening <tt>sshd</tt> is ''reachable'' '''for 300 seconds''' after knocking...
 
 
{| style="border: 1pt black dashed"
 
|-
 
| [[Image:Diamond-caution.png]] || Secret: 33778 &bull; 22999 &bull; 44333 || [[Image:Diamond-caution.png]]
 
|-
 
|}
 
 
{| style="border: 1pt black dashed"
 
|-
 
| [[Image:Diamond-caution.png]] || This approach will get removed during the next days... || [[Image:Diamond-caution.png]]
 
|-
 
|}
 
 
 
Successfully triggering is possible using a variety of software tools:
 
 
* [[#Linux]]
 
* [[#Windows]]
 
* [[#Android]]
 
* [[#OS agnostic Web Browser]]
 
 
==== Linux ====
 
If you are using Linux and the package <tt>knockd</tt> is actually installed (which is not a requirement!) you can use this one-liner to log in:
 
~$ knock shell.stud.informatik.uni-goettingen.de 33778 22999 44333 && sleep 1; ssh username@shell.stud.informatik.uni-goettingen.de
 
 
If this fails try a slower version:
 
~$ knock shell.stud.informatik.uni-goettingen.de 33778; knock shell.stud.informatik.uni-goettingen.de 22999; knock shell.stud.informatik.uni-goettingen.de 44333 && sleep 1; ssh username@shell.stud.informatik.uni-goettingen.de
 
 
 
''Without'' having the package <tt>knockd</tt> installed: <tt>telnet</tt> to the rescue!
 
~$ telnet shell.stud.informatik.uni-goettingen.de 33778
 
~$ telnet shell.stud.informatik.uni-goettingen.de 22999
 
~$ telnet shell.stud.informatik.uni-goettingen.de 44333
 
~$ ssh username@shell.stud.informatik.uni-goettingen.de
 
 
 
 
[[Image:knockknock.png|343px|right]]
 
 
==== Windows ====
 
* <tt>telnet</tt> is included in Windows also. But it is not ''installed'' by default. You need to activate it through "Windows-Features aktivieren oder deaktivieren"/"Add windows features" "Telnet-Client". You need Administrator privileges to do so, so this is not an option on foreign computers
 
* There are dedicated tools available for this purpose. This one is tested and found to work as expected: https://sourceforge.net/projects/knockknock/ <br />The zip-file contains a (surprisingly small) executable. It is usable without installation, so you do ''not'' need Admin privileges
 
* Use a web browser to tickle those ports
 
* <small><tt>telnet</tt> is included in Windows also, but unfortunately it seems not to work reliably. During reproducible tests the ''third'' knock did not reach the server while the first two were handled correctly</small>
 
&nbsp;<br />&nbsp;
 
 
==== Android ====
 
"Port Knocker" via [[F-Droid]]: It is recommended to integrate that repository by installing https://f-droid.org/FDroid.apk. A direct link to the relevant package is: https://f-droid.org/repo/com.xargsgrep.portknocker_8.apk
 
 
This tool allows an arbitrary application to launch automatically after knocking. Tested successfully with [[ConnectBot]].
 
 
 
==== OS agnostic Web Browser ====
 
 
Create a new folder for these bookmarks. Prepare three Bookmarks:
 
** http://shell.stud.informatik.uni-goettingen.de:33778
 
** http://shell.stud.informatik.uni-goettingen.de:22999
 
** http://shell.stud.informatik.uni-goettingen.de:44333
 
 
Of course you will end up running into a timeout as ''there is no webserver listening''. You do not have to wait for timeout; simply cancel loading...
 
 
You can "click" them one after another. Browsers like [[Firefox]] offer a context menu entry "Alle in Tabs öffnen"/"Open all bookmarks" which tries to do what it says. You need to close all three of them one by one though.
 
-->
 
 
== 2FA ==
 
''Two Factor Authentication'' -- '''required, not optional'''
 
 
=== Concept ===
 
We use the well known <tt>google-authenticator</tt> to add a second factor as a requirement for (ssh-) logins. ''First'' you will get prompted for a "Verification code:". Then you'll get a second prompt asking for your normal "Password:".
 
 
The "Verification Code" changes every minute, this approach is called TOTP = Time-based One Time Password.
 
 
<small>(Do not try to use "Counter based OTP". It might work first, but it will do so only for a short while! We are using ''copies'' of the secret file. State updates required by the incremental counter strategy are ''not'' written back. Authentication will fail after reaching the windows size.) </small>
 
 
The order of both inputs is relevant: if an attacker manages to crack the first element (being the TOTP) he has a benefit for some minutes only. If we would ask for the ''Password'' first then the benefit of cracking the first element gives advantages probably for a very long time.
 
 
 
You need to have a compatible [[#Generators|generator]] - usually implemented as a small application.
 
 
Please note that often this approach is associated with a specific implementation: ''the'' [[Google Authenticator]]. This is misleading as there are other 100% compatible implementations. See also RFC 6238.
 
 
=== Initialization ===
 
Before you can use this technology the first time you need to prepare your personal secret credentials. You do this by using a simple command line tool and answering some questions.
 
 
Of course you can not do this on these shellX-machines as you can not login successfully (chicken-and-egg problem). '''Use one of the physical pool computers for this!''' <!-- or login.stud.informatik.uni-goettingen.de instead. -->
 
 
''The following instructions are copy-n-pastable as the commands are relative to anyones <tt>$HOME</tt>-folder. ''
 
 
~$ '''google-authenticator'''
 
Do you want authentication tokens to be time-based (y/n) '''y'''
 
... <small># For full output see [[Shell/2fa-example]]</small>
 
 
Due to some unusual behavior of [[OpenAFS]] regarding access rights (<small>they work ''only'' on directories, not on files</small>) we need to move that file into another, dedicated subdirectory. This man page explains the access rights mechanism and how to manipulate ''access-control-lists'':
 
~$ man fs_setacl
 
 
First you need to create that directory. A special user with the name <tt>ifi-login</tt> needs to have read access to the files in the directory <tt>.ifi-login</tt> inside of your <tt>$HOME</tt>. To be able to reach into that directory he needs to "walk through" your home folder. The third line is required to make this possible by granting "l"="list" access rights to your <tt>$HOME</tt>:
 
~$ mkdir .ifi-login
 
~$ fs sa -dir .ifi-login -acl ifi-login read
 
~$ fs sa -dir . -acl ifi-login l
 
 
As usual access rights are inherited. For this reason there are more rights granted than required. You ''might'' remove them now by commands like
 
~$ fs sa -dir .ifi-login -acl mta none
 
~$ fs sa -dir .ifi-login -acl spamassassin none
 
~$ fs sa -dir .ifi-login -acl web-home none
 
 
You can always check the current settings. At the end it may look like this:
 
~$ fs la .ifi-login
 
Access list for .ifi-login is
 
Normal rights:
 
system:administrators rlidwka
 
username rlidwka
 
username.system rl
 
'''ifi-login rl''' '' # this is the important one (in this context) ''
 
 
'''WARNING:''' do not remove rights if you are not absolutely sure they are not needed. ''It is very easy to remove too many rights'', leaving you with a directory that is not usable anymore!
 
 
Now move the created credential file into that new destination:
 
~$ mv .google_authenticator .ifi-login/
 
 
Please remember to repeat this step if you modify/recreate your configuration!
 
 
=== Generators ===
 
{| style="border: 1pt black dashed"
 
|-
 
| [[Image:Diamond-caution.png]] || The system time is used equivalent to a shared secret! Make sure your clock is set correctly or all generated codes will fail.
 
|-
 
|}
 
 
For all generators you need the secret created above. You can use any tool you want to look into the file <tt>.ifi-login/.google_authenticator</tt>. A one-liner which outputs ''only'' the "secret" is this:
 
~$ head -n1 .ifi-login/.google_authenticator
 
P2ZOMKQLEIC6SKCL
 
 
[[Image:winauth+putty.png|399px|right]]
 
 
* Android
 
** Play Store: "<tt>Google Authenticator</tt>".
 
** [[F-Droid]]: https://f-droid.org/app/com.google.android.apps.authenticator2
 
 
* Linux
 
** install <tt>oathtool</tt> to get some compatible command line utilities. Then this works:
 
~$ oathtool --totp -b $(head -n1 .ifi-login/.google_authenticator)
 
123456
 
 
* Ubuntu Touch
 
** Authenticator
 
 
* Windows:
 
** WinAuth: https://github.com/winauth/winauth -- <small>direct download as of 06.2016: https://winauth.com/downloads/3.x/WinAuth-3.5.1.zip</small><br />This is an installation-free application, no setup and no administrative access needed.
 
 
* OS agnostic
 
** [[Chromium]] Browser: GAuth application
 
** https://5apps.com/gbraad/gauth -- direct use web-application (think twice!) & application for Chrome and Firefox
 
 
== Tips 'n' Tricks ==
 
 
=== Connect to a specific machine ===
 
If your are using a ''semi-local source address'' from inside Gönet or inside the Institute = <tt>134.76.0.0/16</tt> + <tt>10.0.0.0/8</tt> + <tt>172.16.0.0/12</tt> circumventing the Round-Robin mechanism is possible: connect to a specific port <tt>42000+''n''</tt> with <tt>''n''={1..6}</tt>
 
 
For machine number 4:
 
 
~$ ssh -p 42004 username@shell.stud.informatik.uni-goettingen.de
 
#######
 
####### shell.stud.informatik.uni-goettingen.de - login vm: shell4.cip.loc
 
 
<!--
 
=== "knocking" not required from ''inside'' the Institute ===
 
If your are ''inside'' the Institute's LAN then there is no need to take the main entrance. You can circumvent the need to knock at the front door by connecting to the <tt>shellX</tt>-machines directly:
 
~$ ssh shell4.cip.loc
 
-->
 
 
=== Duplicate your Generators ===
 
It is absolutely fine to have a well configured generator on every single device you own. Remember: without the second factor you can not login. That's the goal of the whole shebang after all.
 
 
=== Write down your Emergency codes ===
 
Remember the console output during creation of the secret? "<tt>Your emergency scratch codes are:...</tt>". Write them down (or print them) and put that piece of paper into your pocket...
 
 
=== Credential problems ===
 
* the actual password is '''not stored anywhere''' in Institute's systems
 
** students: [[StudIT]] - https://wiki.student.uni-goettingen.de/support/account/passwort
 
** staff: [[Gwdg]] - https://info.gwdg.de/faq/index.php?action=artikel&cat=52&id=215&artlang=de - Institute's Admins will help as we have some administrative access. While we can not tell you your password we can ''reset'' it
 
 
* problems with the Verification Code: simply start again with [[#Initialization]] and overwrite <tt>~/.ifi-login/.google_authenticator</tt>. You need to re-configure ''all'' of your [[#Generators]] of course
 
 
== Todo ==
 
* Testing! -- the current state is considered "BETA"
 
<!-- * make Status Information publicly available? -- ''probably not'' -->
 
<!-- * possibly require 2FA only from outside the Institute? -- ''Not decided yet'' -->
 
 
== See also ==
 
* [[Remote Access]]
 
* [[Long Running Processes]] -- leave processes running
 
* [[2FA/Multiple]] -- use multiple identities
 
   
 
== Links ==
 
== Links ==
  +
* http://wiki.student.uni-goettingen.de/support/software/start - "Sonderkonditionen Software für Studierende"
* https://tools.ietf.org/html/rfc6238
 
* https://github.com/google/google-authenticator
 
   
<!--
 
* https://en.wikipedia.org/wiki/Port_knocking
 
* https://help.ubuntu.com/ -- common help regarding Ubuntu
 
* http://shell.stud.informatik.uni-goettingen.de/ -- current state of the load balancer. Use <tt>ifi</tt>/<tt>ifi</tt> to login <small>''("bots not welcome")''</small>
 
-->
 
   
  +
[[Kategorie:Software]]
[[Category:Pool]][[Category:Remote]]
 

Version vom 12. Oktober 2017, 09:35 Uhr

Willkommen auf den Microsoft Imagine (ehemals DreamSpark, ehemals MSDNAA) Seiten des Instituts für Informatik[1].

Das Softwareportal ist erreichbar via:

Ansprechpartner für Zugangsberechtigungen im Studiengang "Angewandte Informatik" ist:


Was ist Microsoft Imagine?

Die Microsoft Imagine Premium Lizenz ist ein Angebot für Fachbereiche Hochschulen und Berufsschulen, die zu den Bereichen MINT (Mathematik, Informatik, Wirtschaftsinformatik, Naturwissenschaften & Technik - insb. Ingenieurwissenschaften) gehören. Sie bietet Lehrkräften, Lernenden und Administratoren zu Zwecken von Forschung und Lehre Zugriff auf Microsofts neueste Entwickler- und Designerwerkzeugen, Server und Betriebssystem. Die jeweilige Abteilung muss aber Konzepte der IT-Technologie und nicht nur deren bloße Anwendung lehren.

Weiterhin finden Sie alle relevanten Informationen auf http://www.dreamspark.de
Die aktuellen EULAs finden Sie hier: http://www.microsoft.com/germany/msdn/academic/dreamspark/eula.aspx

Folgende Software ist enthalten:

  • Microsoft Desktop-Betriebssysteme
  • Programmiersprachen und Entwicklertools

Bitte beachten Sie, dass Microsoft Office nicht im Abonnement enthalten ist!

Wie bekomme ich als Student die Software?

Wer als Studierender den Zugang zu Microsoft Imagine haben möchte, muss diese Voraussetzungen erfüllen (diese sind von Firma Microsoft vorgegeben!):

  1. Die rechtlichen Bedingungen gelesen haben und akzeptieren. Die aktuellen EULAs finden Sie hier.
  2. Aktuell eingeschriebener Student des Studiengangs "Angewandte Informatik (Bachelor)", "Angewandte Informatik (Master)", "ITIS (Master)" oder "Lehramt- und 2-Fächer-Bachelor mit Hauptfach Informatik"
  • Erstsemester haben erst Zugriff, nachdem Immatrikulations-Listen abgeglichen wurden. Das dauert einige Wochen und kann mindestens bis Mitte November dauern.
  • Für Studenten der Wirtschaftsinformatik wird ein eigenes MSDNAA-Programm der WiInf Abt. II angeboten [2]. Studenten der Wirtschaftsinformatik bekommen daher am Institut für Informatik keinen Zugang zum MSDNAA.

Auslieferung:
Die Microsoft Imagine Software wird grundsätzlich nur online verteilt und freigegeben.

Einloggen

Der Zugang zur Microsoft Imagine Webseite geht über den Benutzernamen und das Passwort des Studierendenaccount.
Der Benutzername ist ohne Domäne anzugeben.

Konto gesperrt?

Nur eingeschriebene Studierende haben Zugang zum Microsoft Imagine Programm. Spätestens nach Ende eines Semesters wird der Zugang für nicht (mehr) immatrikulierte Studierenden gesperrt.


Links