Category Archives: Technology

SSH – helping you stay secure when away from home

Technology

This past weekend Kay and I took a trip to Osage Beach, MO for a long weekend with family. We left Friday evening and stopped in St. Louis to stay at a friends place, finishing up on Saturday morning. We were staying through Tuesday afternoon and even though Kay took both days off I only had Tuesday. So again that left me with working remote, but that’s what I do every day so no big deal as long as I had a internet connection.

For work being remote doesn’t have many security concerns as I VPN into the network. But when dealing with personal business away from the comforts of the home network is a different story. That is where SSH can come in very handy.

Anytime your using a public internet connection your at risk to someone sniffing traffic to get information. A good rule of thumb is if your at an internet cafe, Starbucks, local hot spot, etc never enter login credentials without the url starting with https. Most of us by now have come to look for the lock at the bottom of the browser when purchasing products but one place that’s forgotten is email. Most who access email do so via POP or IMAP, both of which have secure capabilities but some hosts don’t enable it or us users don’t bother to check. That means your username and password, that more than likely is automatically entered for you, is subject to capture as it’s not encrypted. This is where SSH can be your friend.

If you have shell access to a machine/server on the internet and ssh is runing you can forward the POP requests, including the SMTP (sending of emails), to add a layer of security to your sharing of the internet with the 10s or 100s of others using the same hotspot. The -L switch in the SSH client allows for forwarding of ports and this is what you’d use. Some details from the info page:

-L [bind_address:]port:host:hostport
 Specifies that the given port on the local (client) host is to be
 forwarded to the given host and port on the remote side.  This
 works by allocating a socket to listen to port on the local side,
 optionally bound to the specified bind_address.  Whenever a con-
 nection is made to this port, the connection is forwarded over
 the secure channel, and a connection is made to host port
 hostport from the remote machine.  Port forwardings can also be
 specified in the configuration file.  IPv6 addresses can be spec-
 ified with an alternative syntax:
 [bind_address/]port/host/hostport or by enclosing the address in
 square brackets.  Only the superuser can forward privileged
 ports.  By default, the local port is bound in accordance with
 the GatewayPorts setting.  However, an explicit bind_address may
 be used to bind the connection to a specific address.  The
 bind_address of ``localhost'' indicates that the listening port
 be bound for local use only, while an empty address or '*' indi-
 cates that the port should be available from all interfaces.

You’ll want to make sure your root, or have admin privs, on the machine your running the ssh client and execute the following from a command line:

ssh -L 110:<your mail server name>:110 <ip of your remote server> -l <account on the remote box>

This logs you into your remote server and forwards port 110 traffic, to your mail server, from the machine your on to your remote server encrypting the connection. If you wanted to do this for sending emails substitue the 110 for 25 and if you wanted to do them both at the same time use:

ssh -L 110:<your mail server name>:110 -L 25:<your smtp server>:25 <ip of your remote server> -l <account on the remote box>

This comes in very handy for me since, I’ve noted in the past, emails sent from my domain sometimes are seen as spam. So I can ensure when I’m on the road, connected to the internet via XYZ ISP, that I don’t have to change any email setup just execute the command before opening my email client.

Cheers !!!

Pay attention with the Olympics coming up

Technology

For most wandering over to the Internet Storm Center is not going to be regular reading on the web. But from time to time their is something for everybody there. A recent post offered some good advice with a major world event just around the corner.

I’ll admit I sometimes don’t connect getting spam emails with what’s going on in the world but that is something they (spammers) do. If an email references a current topic a person is more likely to pay attention. So give it a quick read to remind yourself what not to do.

My email is spam, again

Technology

While in Costa Rica I tried to send a couple emails via my domain. I couldn’t get the ssh tunnel up to my server here at home so their was no way to forward it through Comcast, my ISP. A while ago I ran into the same problem when sending an email to some hockey buddies. I had hoped when my host did an upgrade this problem might go away, but I never got around to checking. Unfortunately it hasn’t as this time I got the following message.

554 The message was rejected because it contains prohibited virus or spam content

What this means is some providers might view an email coming from my domain as spam but I don’t have any control over that. The problem is when you use a host that has thousands of customers your site’s IP is the same as others. While you might not be sending spam someone else is and thus the reason we send through Comcast.

Just a minor annoyance but might be a good time for a new side project, to work out a solution when we’re away from home. Good thing this doesn’t come up to often.

Linux continues to answer the call

Technology,

As I wrote a while ago I’ve been using Linux 100% now, no more Windows for work. Things have been going well since the switch and even though Wine won’t run a few apps I need Windows for work provides terminal services for access.

Every week their seems to be something new when it comes to supporting applications at work. That is not suppose to be my main job these days but when the phone rings it’s hard to say “sorry call Support”. So when the question came yesterday, “what does this cryptic error message mean other than the xml data is bad”, I turned again to open source software to provide an answer.

At first I thought it was odd being asked to trouble shoot an issue this way but I’m always up for a challenge. So to answer the question I needed to validate the data against the xml schema. The schema I did not have, those who were asking the question did … which is why I thought it was odd. So I asked for the schema and set off to find a tool to do the validation. Most browsers today will parse xml which is very helpful to identify illeal characters and tags that aren’t closed. However validating against schema is another story.

After some googling and checking both Screem and Geany, as I use both, I came across MLView. A simple little gui that can create, modify and validate xml documents. It installed in 30 seconds and a minute after that I had my answer. BTW -Their was nothing wrong with the data it was the transport.

It’s refreshing to know that solutions to problems are but a click away where in many instances others have already created something to meet the same challenge. The web is a wonderful tool, open source makes it that much better.

N810 Impressions

Technology,

The N810 arrived just in time for the long weekend to Breckenridge, CO and it was nice to have a new toy for the travel time. For me the big reason for getting it was to replace my old Zaurus SL5500 which kept track of appointments, contacts and music. Anyone that read reviews for the N810 will note it’s not marketed as a device for managing contacts and appointments but it is open source and their are a large number of apps available…. so I wasn’t concerned. That was actually part of the reason for getting it, to take advantage of the ongoing development.

My first try at playing music was a dud, which was disapointing on the plane ride out of town. But I will say it’s my own fault. I ripped some CD’s to WAV, assuming it was supported and didn’t verify before I left. Now the reason I chose WAV is OGG wasn’t supported and I didn’t have the codec for MP3. But I found some time at the airport on the trip back to load SoundConverter and the instructions for MP3. I was then able to convert my WAV files to MP3. The default music player is decent but it will be nice to see what else is out there.

Since then I’ve loaded some additional apps like GPE for contacts and calendar and SSH. I also loaded Pidgin all of which can be found from http://www.gronmayer.com/it/, third party repos for the 770, 800 and 810. Up next will be the GPS.