Tag Info

Hot answers tagged

25

SSLv2 and SSLv3 are completely different (and both are now considered insecure). SSLv3 and TLSv1.0 are very similar, but have a few differences. You could consider TLSv1.0 as SSLv3.1 (in fact that's what happens within the records exchanged). It's just easier to compare the TLSv1.0 with TLSv1.1 and TLSv1.2 because they've all been edited within IETF and ...


18

Have you tried syslog-ng and stunnel? Install Stunnel Create certificate files for syslog-ng over Stunnel Configure Stunnel for Use With syslog-ng Install syslog-ng Configure syslog-ng DONE! NOTE: Stunnel (http://www.stunnel.org) is a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) available on both Unix ...


13

Give openvpn a shot. You can create tunnels over UDP or TCP.


12

Short answer: VPN It may seem overkill, but it is the right answer and not that complicated to set up.


11

I believe I've found myself an answer to this problem. After tinkering for a while, I decided to reproduce the problem in a clean installation. The ip_gre module is not inserted by default in the kernel after installing Debian. ip tunnel show does not display any tunnel. After inserting the ip_gre module, but without creating any tunnel, gre0 appears and ...


10

Putty does support ssh tunnels, if you expand the Connection, SSH tree, you'll see an entry for tunnels. Local tunnels produce a localhost port opening on your windows machine that remotes to the ip address and port you specify. For instance, when I'm trying to RDP to a desktop at my house, I'll generally choose a random local port, something like 7789, ...


10

This will happen by default if the VPN is configured correctly. When you make a VPN connection from Windows CLIENT, there is an advanced option called Use Default Gateway on Remote Network which is checked by default. For example, in Windows XP: Go to Network Connections Right click on your VPN connectoid Choose Properties Go to the Networking Tab ...


9

If you are interested, I have a patch for keepalived which allows it to use unicast between a local and a remote VIP. I've successfully been using it at vps.net between virtual machines. It's a lot simpler than trying to set up a tunnel ! I've uploaded it there : http://1wt.eu/keepalived/ You then just have to specify "vrrp_unicast_bind " and ...


8

Hurricane Electric has POPs all over Europe, and distributes free IPv6 tunnels. I have one in France (www.bortzmeyer.org) and I'm quite happy with their reliability.


7

I'm not sure what's causing your particular problem, but you should note that in general it's better for tunnels to use an unreliable transport stream (i.e. UDP) than a reliable one. The reason for this is that if you do happen to get packet loss the tunnelled TCP layer should be the one managing the retransmission, and not the real transport layer. If ...


7

This being a tunnel opened at a remote server, that server needs to have GatewayPorts set to yes in its /etc/ssh/sshd_config. Depending on what kind of users that server have you might want to use the Match option to limit that capability to your user. Match User middleuser GatewayPorts yes Do note that you probably want to add this Match block in the ...


7

Expanding on Zoredache's comment, the only way you're going to get any sort of space in a broker is to DIY it with a VPN/tunnel. A /25 is 128 IPv4 addresses which are a highly valued commodity these days that you are going to pay out the roof for.( Expect 1-2 dollars IP per month atleast) For a block that big you will need to fill out a justification for ...


7

There is no need to use nginx. In your ssh daemon configuration (it should be /etc/ssh/sshd_config) set GatewayPorts to clientspecified and reload it. This is necessary for other systems to be able to connect to your tunnel. Without it, only programs running on your server will be able to use it. Now all you need to do is modify your ssh command to listen ...


6

For over a year i have been using m0n0wall for its IPv6 connectivity. It isn't perfect, as m0n0wall still has a lot of IPv6 functionality missing (e.g. traffic shaping). But it does have extraordinarily simple IPv6 Tunnel Broker setup. Now pfSense 2.1 has been released, with (hopefully) more IPv6 support than m0n0wall. On the other hand, the setup of an ...


6

In your authorized_keys file you can specify which command will be run when they login. You could simply set that command to run something that will just wait around for a long time. The sshd man page as a list of all the options you can use in your authorized_keys file. ...


6

Rsyslog can do this. Encrypting Syslog Traffic with TLS


6

SSH VPN tunnels still use the ssh connection, no? Last I checked it did. And since ssh runs over TCP that means that the VPN runs over TCP. This is not a good way to do it. A single dropped packet will cause i hickup of ALL communication that's going through the tunnel. Tunneling IP over TCP is a bad idea. OpenVPN can use TCP or UDP. UDP is preferred for ...


5

I understood that you want just to log in to the computer C, not really tunnel anything from A to C. So, this should do the trick: ssh -t computer-b "ssh computer-c" You might have to enter passwords twice, first for computer B and then for computer C, but this can be avoided by using ssh's key-pair authentication.


5

You can do it with netcat, but it's a huge security hole: http://www.stearns.org/nc/ http://forums.remote-exploit.org/newbie-area/5857-netcat-port-redirection.html mknod backpipe p nc -l -p 80 0<backpipe | tee -a inflow | nc localhost 81 | tee -a outflow 1>backpipe FWIW, this is probably a profoundly bad idea.... make sure your firewall is tight ...


5

I think a bit of a diagram may be in order here. You say that you've already setup an SSH over HTTP tunnel through the proxy server. Assuming you're running something on the remote server computer to handle terminating that SSH over HTTP tunnel you should be in business. It sounds like you don't really have an SSH over HTTP proxy, if you're still trying to ...


5

To open a port 12345 on your local machine that, when connected to, will connect to a port 54321 on remotemachine (the machine you're SSH'd into): ssh -L 12345:localhost:54321 remotemachine


5

You should be able to tunnel the telnet session through SSH similar to the following. plink -pw mypswd -L 23:192.168.0.1:22 root@192.168.0.1 Then you can connect on localhost:23 and have this traffic tunneled through SSH to your server.


5

You can assign a name by using the fact your loopback adapter will basically respond to any address in the 127.0.0.0/8 network. So instead of binding to port 4321 you could bind to 127.1.2.3:4321. Then simply setup a host entry that map a name to the loopback address that you used so foo.bar maps to 127.1.2.3. In my SSH configuration on my admin ...


5

There are a number of ways to do this; it depends on what you're comfortable using and maintaining and how much you want to pay. Amazon's "Virtual Private Cloud" lets you set up a server and connect to it using a tunnel to extend your datacenter. If you're just going to use one computer for the hosted server, you can just set up a tunnel between that ...


5

I have experienced similar issues. If you are tunneling with Firefox through ssh, some http connections can simply timeout due to server load or improper configuration. When the connection actually does timeout, you'll get an error message like the one you indicated. You can suppress these messages with the following command ssh user@xx.yy.zz.41 -p 1234 -D ...


5

You can simplify the solution... If you're looking for a way to link all of these servers (not routers or gateways devices) as though they were on one flat network, I'd suggest looking at the n2n peer-to-peer offering from ntop. This tool allows you to traverse intermediate devices; helpful if you don't have access to firewalls or have complex routing ...


4

If you add tunneling to your SSH session, there is an additional data stream created for the tunnel over the same encrypted connection. You also can create more than one tunnel or don't start an interactive session (with the -N parameter). So, basically, there is no real difference, just different methods to use the encrypted connection.


4

Yes, Microsoft does provide at least one solution. It's Remote Desktop Services. Specifically, the RD Gateway component. Technically, RD Gateway is an RPC over HTTP proxy which utilizes SSL to provide users with RDP connections to remote computers or RD session hosts over port 443. You ---[Port 443] ---> RD Gateway ---[Port 3389]---> Remote Host But ...


4

See http://www.linuxfoundation.org/collaborate/workgroups/networking/tunneling#IPIP_tunnels and the paragraph below. Basically it's that IPIP can handle only IPv4 unicast, no multicast traffic and only one tunnel for unique tunnel endpoints pair. GRE is more generic, with up to 64k tunnels between two unique endpoints plus multicast traffic which is ...


4

The thing to keep in mind with IPv6 and IPv4 is that they are two completely separate name-spaces, as well as protocols. The IPv6 client will have to somehow resolve that IPv4 resource as an IPv6 address. That's tricky. However, you may be able to leverage a certain IPv6 transition technology known as NAT64. This does the v6 <-> v4 translation, though ...



Only top voted, non community-wiki answers of a minimum length are eligible