How To make SSH Tunnel

Hi,
In this post I'll discuss no how to make ssh tunnel
this how to will show you the basic, and I hope you will take the good from it to your needs.

the main configuration is:
edit /etc/ssh/ssh_config with your favorite editor
# vi /etc/ssh/ssh_config
and add flowing lines in the end

Host test
HostName localhost
User your_user_name
LocalForward 2022 SERVER1_IP:22
LocalForward 2080 SERVER2_IP:80
LocalForwars 2025 SERVER3_IP:25

save the file.
and run: # ssh test
now if you'll try to access to localhost on port 2080 you'll go to SERVER2 on port 80, you can test it from your browser - http://localhost:2080/ or try to ssh to locahost with port 2022
# ssh -p 2080 localhost

and you'll see you go to SERVER1.

You can run the ssh tunnel from one command line instead of edit the ssh_config.
# ssh -N -f User_Name@SERVER2_IP -L 2080/localhost/80
this script tell the server to forward all the traffic to port 2080 to SERVER2 on port 80

Or if you want to make REVERSE tunnel you can run the same command but with -R instead of -L
# ssh -N -f User_Name@SERVER2_IP -R 2022/localhost/22
(with this script you can access from the remote machine (SERVER2) via ssh to your machine with port 2022)
run # ssh -p 2022 localhost from SERVER2

I'm hoping this post will help you to understand the basic of ssh tunneling
Please comment

Read more >>

How to block Root access and use sudo permissions

In my servers Policy I usually block the Root user access via ssh,
and I create an admin user how I give a sudo permissions to manage the server.
for disable Root login edit sshd_config file:
# vi /etc/ssh/sshd_config

search the line #PermitRootLogin yes , remove the # from it and change it to 'no'.
do the same to this line: #StrictModes yes
the section in the sshd_config file should look like this:

#LoginGraceTime 2m
PermitRootLogin no
StrictModes no
#MaxAuthTries 6

now restart the ssh service:
# /etc/init.d/sshd restart

OK, now you block the root access, the next step is to create admin user and give him sudo permissions to the commends you like.
How it work?
#useradd admin
#passwd admin
(Enter any password you want to admin user)


#/usr/sbin/visudo
now you need to edit this file to your needs
first create User alias specification
User_Alias ADMIN = admin
then create Command alias specification
Cmnd_Alias CADMIN = /bin/rm, /sbin/service, /bin/chown, /bin/tar, /bin/cp
you can add here any command you want the user admin will have.
and at last you need to create User privilege specification
ADMIN   ALL=NOPASSWD: CADMIN
in the end the file should look something like this:

# sudoers file.
# This file MUST be edited with the 'visudo' command as root.
# See the sudoers man page for the details on how to write a sudoers file.

# User alias specification
User_Alias ADMIN = admin

# Cmnd alias specification
Cmnd_Alias CADMIN = /bin/rm, /sbin/service, /bin/chown, /bin/tar, /bin/cp

# User privilege specification
root    ALL=(ALL) ALL
ADMIN   ALL=NOPASSWD: CADMIN

That's it.

Read more >>

How to ssh without password

On client side, (the machine you want ssh to)
Run the next command.
Use the default settings and an empty passphrase:
# ssh-keygen -t rsa

On the remote machine, (the machine you want ssh from)
Run the next line:
# ssh user@remote test -d \~/.ssh \|\| mkdir \~/.ssh \; cat \>\> \~/.ssh/authorized_keys <~/.ssh/id_rsa.pub
don't forget to change the user@remote to your own one.

OR
you can copy the id_rsa.pub from the clinet machine with :
# ssh-copy-id -i ~/.ssh/id_dsa.pub username@remotebox

END.

Read more >>