Init

There is a great tool in unix and windows to perform file synchronization called Unison. Unison shares a number of features with other file management/tracking packages (CVS, SVN, BitKeeper). It also runs on windows and many variations of Unix, and provides the ability to sync across platforms without worry.

I really need to sync my schoolwork and settings for varios programs (Evolution, Pidgin, Firefox) between my main desktop and laptop. To do this in Unison you need to create profiles for each directory that will need synchronization. You can do this with the GUI, but ultimately I would check the profiles in your ~/.unison directory. Here is an example where I am syncing my documents:

(more…)

SSH is fantastic for everything, if I could ssh into my refrigerator and let it know that I wanted milk it would be a perfect world. I need to install openssh on the box next to me for a whole host of reasons, so this is a quick guide on how to set up openssh in a secure manner.

Install and general configuration

Firstly you will want to install the openssh server:

sudo apt-get install openssh-server

After the install we want to change some of the default settings to promote some security through obscurity. First file we will edit is the /etc/ssh/sshd_config. Find the line that says:

#What ports, ips and protocols we listen for
Port 22

Make a change to that port (choose a non-standard port), we dont want to be running on the default port. You might also want to check the following settings:

• RSAAuthentication == YES
• Protocol == 2 (make sure this is not a ’1′)
• PasswordAuthentication == YES (only if you have not done the Key Authentication part below)
• AllowUsers == make sure the users you want to access the machine are in here
• PermitRootLogin == NO

*The above checklist has been scalped from TuxTraining

Then restart the sshd server:

sudo /etc/init.d/ssh restart

Now for some security lets configure the /etc/hosts.allow file, add an allow for for all local activity and for ssh from the ip’s you are expecting. This is fine for me on my local network where ip’s are not changing, but for a server that your ssh’ing into from other areas this might not be plausable. Nevertheless this is how my /etc/hosts.allow looks:

ALL : 127.0.0.1
sshd : 10.0.0.2, 10.0.0.4

Now the /etc/hosts.deny file:

ALL : ALL

Key Authentication

When I set up my first server I scoffed at the idea of doing key based authentication because I would be the only user and I had a fairly long key, however go ahead and check your log files for failed authentications and you will see thousands a month. For this reason it is advisable to use key based authentication and ditch passwords alltogether… how long will it take them to guess your user password?

Client

• If the directory does not already exist then create ~/.ssh
• Generate the public/private key pair with the following command, make sure to enter a password. If you do not enter a password then anyone who gets a copy of your key can use it:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa

• Now you need to edit the /etc/ssh/ssh_config file by changing the following lines:

IdentityFile ~/.ssh/id_rsa (remove the # to uncomment)

Protocol 2 (Remove the 1 and remove the # to uncomment)

Server

• If the directory does not already exist then create ~/.ssh
• Make sure the permissions on the ~/.ssh directory are 700
• Maybe have to chown the ~/.ssh directory if you created it with the sudo command, this is so you can copy your keys into is.
• Copy the ‘id_rsa.pub’ file from your client machine to your server, you can use scp for this (run this on your client, you are copying the file Client=>Server):

scp ~/.ssh/id_rsa.pub <user_name>@<server_address>:~/.ssh

• Now back to the server to put your key into the ~/.ssh/authorized_keys list:

cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

• Now you will want to edit the /etc/ssh/sshd_config file by changing the following lines:

Protocol 2 (make sure to remove the 1)

PubKeyAuthentication yes

AuthorizedKeysFile .ssh/authorized_keys

PasswordAuthentication no

ChallengeResponseAuthentication no

UsePAM no

• Now restart the sshd service and you are set to go:

sudo /etc/init.d/ssh restart

Now you should be good to go. There is all kinds of extra tightening down you can do, but this setup so far has let me sleep at night. Enjoy fantastic cli power!

Resources

The Ultimate SSH Security Tutorial (TuxTraining)

SSH Howto (Ubuntu Documentation)

Next to my workstation I have a second machine built that houses a 2TiB RAID 5 array and a 500GiB drive for virtual machines. Ideally these resources need to be accessed as if they were extensions of my workstation.

The solution to this situation was to set up nfs on both machines then mount the array on my workstation.

On the server nfs has to be set up properly, I choose to use the client’s IP as my authentication method because the machines were connected through a crossover cable and have a separate IP scheme set up for the nfs sharing.

(more…)

Verlihub is a Direct Connect protocol server runs on Linux OS written in C++. It runs on almost all OS (except some problems with Windows) with relatively very low processor-memory-bandwidth usage, and many useful features.

Verlihub will require a MySQL database installed to store much of the operational information, and a directory in which it will write the configuration files.

I am not opposed to compiling from source, however I like to take advantage of the repositories whenever available.

(more…)