Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have some systems (Mostly CentOS 5 and some XP all running under ESXi) running behind my firewall. When I'm at friends, family or on vacation I sometimes want to connect to those systems over either SSH or RDP (which I can easily tunnel over SSH).

In the past (years ago) I had the SSH port fully open, but that caused me to be the target of a dictionary attack over the internet, so that's not an option.

The best option would be to install a VPN like OpenVPN but that means that I need to install a client on the computers of the family member I'm at. I don't want to do that and in case I'm on vacation it's not even possible. Also most internet cafes only allow http and https traffic, so any port other than that is not an option for that case.

I asked around and someone was suggested to use an HTTPS (SSL) based VPN which basically works by tunneling over SSL instead of SSH.

So I did some googleing and only found OpenVPN-ALS (aka Adito) which sounds good. I installed it, tried it and never got it to work very well under Linux (I probably did something wrong, gonna look into that anyway). I also noticed that this tool seems pretty 'dead' in terms of releases and commits to their sourceforge SVN.

My question is: Is OpenVPN-ALS (aka Adito) the way to go? Or is there a better solution for my requirements (that I can run for free for a single user (=me)) that I can run under CentOS 5 (32bit) or Windows XP (32bit)? Perhaps there is an "fully functional single user" version of a commercial product I can use?

Thanks,

Niels Basjes

share|improve this question

3 Answers 3

I would suggest going back to SSH and using port knocking as one option to consider.

share|improve this answer
    
I found that this solution (which works in most cases) has two issues: 1) Some ISPs route traffic differently based on the port number (i.e. when using https you see the IP of the proxy server and when using ssh you see a different IP address ). 2) When on vacation I would like to be able to use the same setup when I'm at an internetcafe (which usually only allow http and https). –  Niels Basjes Jun 20 '10 at 6:44

For occasional light use, I recommend GotoSSH. They have a lifetime subscription option which is a low one-time fee, and it uses a web interface between you and their system. They use SSH between their system and your server, of course. Bear in mind that this system can be slow sometimes (Especially over a satellite link!) but it is easily used from other computers with no setup. For security, you can choose to only accept incoming SSH from their server IP. (It's on their website.) Hope this helps!

share|improve this answer
    
+1 Great suggestion for part of my needs. What they provide is something I can do myself without the need to trust any outsider (like GotoSSH). I'll simply install something like AjaxTerm on one of my systems behind https with basic authentication (very easy to do). This will give me console access to my systems (i.e. so I can punch a small hole in my firewall). This solves the "at a friends house" case. This does not yet solve the "internet cafe" case (they usually have port 22 blocked). –  Niels Basjes Jun 20 '10 at 20:47

If you install an SSH client at an internet cafe computer and log in, you're in trouble! The system owner can simply log your keystrokes when you type in your password. This is possible regardless of your access mechanisms: SSH, HTTPS, passwords, keyfiles... if you are not at a computer that you own, do not log into your sensitive systems.

share|improve this answer
1  
+1 Very good point. I'll always keep this in mind. –  Niels Basjes Jun 28 '10 at 21:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.