Firewall on Michael’s Domain

x11vnc as a nxserver replacement

Thu, 29 Nov 2012 00:00:00 +0000

Now that nomachine ’s great nxclient is defunct on MacOS X and its new nxplayer is still in beta (and completely nonfunctional on my setup), I needed another solution to connect to my work desktop from home. I tried many things, but then settled for x11vnc . My work desktop is running Ubuntu Precise Pangolin (12.04) and I connect from a MacOS X 10.8 (Mountain Lion). I only had to install x11vnc and openssh-server on my work desktop and add an x11vnc.conf file to /etc/init with the following content:x11vnc -forever -rfbauth /etc/x11vnc.pass -bg -o /var/log/x11vnc.log -scale 1280x800 -display :0 -auth /var/run/lightdm/root/:0I have to create the password file:x11vnc -storepasswd password /etc/x11vnc.passThen I just have to get into my work desktop by some means or another. At the moment I jump there via the UNIX computers of the university, because direct ssh access is not possible because of a firewall. So I ssh into the UNIX mainframe and from there I ssh into my work computer. Once I am in, I establish a reverse ssh tunnel to my Macbook Pro at home:ssh -R 19999:localhost:5900 IP_address_of_homecomputerOn my Macbook at home I had to enable Sharing - Remote login first. Then I just use the inbuilt Screen sharing of the OS “Connect to server” and then I type “vnc://localhost:19999” and voila I can see my work desktop’s login screen.Alternatively I could use my openvpn server that I have installed on my Macbook and use an openvpn client on my work desktop to establish a connection to my Macbook. Then I could directly log in and avoid the hops via the university UNIX machines to set up the reverse ssh tunnel.Another, although very slow method to access the GUI of my work desktop is X11 forwarding via ssh. All I need is a working ssh connection to the server, X11 forwarding enabled in the ssh server configuration file and an X11 server on the local machine (e.g. XQuarz on MacOSX):ssh -X username@remote-server.comxclock &

One firewall to block them all

Tue, 06 Nov 2012 00:00:00 +0000

Helsinki University’s firewall prevents employees from workingWhile I was lying in hospital with a broken calf-bone I couldn’t get any work done because of the Helsinki University’s firewall. Even if the Android OpenVPN client would have allowed me in, I wouldn’t have been able to work. The purpose of a VPN is to allow remote clients the same access to the LAN resources as those machines, that are physically located in the LAN. Obviously Helsinki University doesn’t think so and doesn’t give VPN clients equal privileges. In my case it meant that I cannot ssh into my work computer. This makes remote work expensive, because it required my boss to buy a laptop for me just because the firewall between HY-VPN clients and local machines blocks ssh connections. Without this restriction I could do all the work from my 400€ tablet using e.g. nomachine Player).The work-arounds failed alsoIf I had managed to login into one of the University’s UNIX servers (myntti, kruuna, klaava or ruuvi), I could have logged into my work computer from there. However, my Android ssh client ConnectBot was not able to ssh into them. I presume this to be the fault of my mobile phone network provider Tele Finland , because I couldn’t log into my own ssh servers either (which I normally can, when my Android is connected via WLAN). Once I can connect via ssh to my work computer, I can establish a reverse ssh tunnel and use X Windows or the NoMachine Player to do all the work I usually can when sitting in the laboratory in front of my work computerPlex and no end of video playback troubleHowever, I couldn’t get the OpenVPN configuration right on Android and neither could the helpdesk support to this date. So I was totally bored in the hospital and since we use Plex at home as our media center, I decided to watch some movies. However, Plex is still after four years development in beta and we had our fair share of trouble with media playback. Also this time: I couldn’t play back a single movie or a single song using the Android client . It made the connection to our (Ubuntu 10.04) plexmediaserver without problems, but the only thing that worked was the “Photos” section. By trial and error, I found out that a part of the problem was, that the videos were in Apple’s QuickTime format (they had been encoded on a Mac). So I was looking for a way to batch-convert hundreds of files from .mov into .avi. Certainly this would be faster than filing a bug report and waiting that the Plex guys fix the problem. QuickTime is anyway dead, isn’t it? ffmpeg was certainly the way to go, but Google flooded me with hits concerning batch conversion and the problem was finding the one that works. There is unfortunately lots of crap and noise on the web. The following one-liner did work:find . -name '*.mov' -exec sh -c 'ffmpeg -i "$0" -sameq "${0%%.mov}.avi"' {} \;

Firewall configuration programs (fwbuilder, yast2, iptables, Brickwall/Brickhouse)

Wed, 04 Apr 2007 00:00:00 +0000

Configuring the firewall by hand using iptables is quite difficult. When we still used RedHat 8.1 we have been doing it but now not anymore. We have been using yast2 now for firewall configuration. An alternative to yast2 is fwbuilder . We tried it once and it seems to work although the code it produces is quite large compared to manual configuration. An obvious advantage is that fwbuilder can be used together with many different types of firewalls and operating systems (e.g. also Mac OS X). I still think Brickhouse (formerly Brickwall) is a very good - probably the best and easiest - configuration script for the inbuilt firewall/routing functions of Mac OS X. I think the Linux community needs such a project since Brickhouse is way easier to use than fwbuilder.