2

I have some systems (Mostly CentOS 5 and some XP all running under ESXi) running behind my firewall. When I'm at friends, family or on vacation I sometimes want to connect to those systems over either SSH or RDP (which I can easily tunnel over SSH).

In the past (years ago) I had the SSH port fully open, but that caused me to be the target of a dictionary attack over the internet, so that's not an option.

The best option would be to install a VPN like OpenVPN but that means that I need to install a client on the computers of the family member I'm at. I don't want to do that and in case I'm on vacation it's not even possible. Also most internet cafes only allow http and https traffic, so any port other than that is not an option for that case.

I asked around and someone was suggested to use an HTTPS (SSL) based VPN which basically works by tunneling over SSL instead of SSH.

So I did some googleing and only found OpenVPN-ALS (aka Adito) which sounds good. I installed it, tried it and never got it to work very well under Linux (I probably did something wrong, gonna look into that anyway). I also noticed that this tool seems pretty 'dead' in terms of releases and commits to their sourceforge SVN.

My question is: Is OpenVPN-ALS (aka Adito) the way to go? Or is there a better solution for my requirements (that I can run for free for a single user (=me)) that I can run under CentOS 5 (32bit) or Windows XP (32bit)? Perhaps there is an "fully functional single user" version of a commercial product I can use?

Thanks,

Niels Basjes

3 Answers 3

3

If you install an SSH client at an internet cafe computer and log in, you're in trouble! The system owner can simply log your keystrokes when you type in your password. This is possible regardless of your access mechanisms: SSH, HTTPS, passwords, keyfiles... if you are not at a computer that you own, do not log into your sensitive systems.

1
  • 1
    +1 Very good point. I'll always keep this in mind. Jun 28, 2010 at 21:05
2

For occasional light use, I recommend GotoSSH. They have a lifetime subscription option which is a low one-time fee, and it uses a web interface between you and their system. They use SSH between their system and your server, of course. Bear in mind that this system can be slow sometimes (Especially over a satellite link!) but it is easily used from other computers with no setup. For security, you can choose to only accept incoming SSH from their server IP. (It's on their website.) Hope this helps!

1
  • +1 Great suggestion for part of my needs. What they provide is something I can do myself without the need to trust any outsider (like GotoSSH). I'll simply install something like AjaxTerm on one of my systems behind https with basic authentication (very easy to do). This will give me console access to my systems (i.e. so I can punch a small hole in my firewall). This solves the "at a friends house" case. This does not yet solve the "internet cafe" case (they usually have port 22 blocked). Jun 20, 2010 at 20:47
0

I would suggest going back to SSH and using port knocking as one option to consider.

1
  • I found that this solution (which works in most cases) has two issues: 1) Some ISPs route traffic differently based on the port number (i.e. when using https you see the IP of the proxy server and when using ssh you see a different IP address ). 2) When on vacation I would like to be able to use the same setup when I'm at an internetcafe (which usually only allow http and https). Jun 20, 2010 at 6:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .