Tag Info

Hot answers tagged

20

SSLv2 and SSLv3 are completely different (and both are now considered insecure). SSLv3 and TLSv1.0 are very similar, but have a few differences. You could consider TLSv1.0 as SSLv3.1 (in fact that's what happens within the records exchanged). It's just easier to compare the TLSv1.0 with TLSv1.1 and TLSv1.2 because they've all been edited within IETF and ...


18

Have you tried syslog-ng and stunnel? Install Stunnel Create certificate files for syslog-ng over Stunnel Configure Stunnel for Use With syslog-ng Install syslog-ng Configure syslog-ng DONE! NOTE: Stunnel (http://www.stunnel.org) is a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) available on both Unix ...


13

Give openvpn a shot. You can create tunnels over UDP or TCP.


11

Short answer: VPN It may seem overkill, but it is the right answer and not that complicated to set up.


11

I believe I've found myself an answer to this problem. After tinkering for a while, I decided to reproduce the problem in a clean installation. The ip_gre module is not inserted by default in the kernel after installing Debian. ip tunnel show does not display any tunnel. After inserting the ip_gre module, but without creating any tunnel, gre0 appears and ...


10

This will happen by default if the VPN is configured correctly. When you make a VPN connection from Windows CLIENT, there is an advanced option called Use Default Gateway on Remote Network which is checked by default. For example, in Windows XP: Go to Network Connections Right click on your VPN connectoid Choose Properties Go to the Networking Tab ...


10

Putty does support ssh tunnels, if you expand the Connection, SSH tree, you'll see an entry for tunnels. Local tunnels produce a localhost port opening on your windows machine that remotes to the ip address and port you specify. For instance, when I'm trying to RDP to a desktop at my house, I'll generally choose a random local port, something like 7789, ...


9

If you are interested, I have a patch for keepalived which allows it to use unicast between a local and a remote VIP. I've successfully been using it at vps.net between virtual machines. It's a lot simpler than trying to set up a tunnel ! I've uploaded it there : http://1wt.eu/keepalived/ You then just have to specify "vrrp_unicast_bind " and ...


8

Hurricane Electric has POPs all over Europe, and distributes free IPv6 tunnels. I have one in France (www.bortzmeyer.org) and I'm quite happy with their reliability.


7

I'm not sure what's causing your particular problem, but you should note that in general it's better for tunnels to use an unreliable transport stream (i.e. UDP) than a reliable one. The reason for this is that if you do happen to get packet loss the tunnelled TCP layer should be the one managing the retransmission, and not the real transport layer. If ...


7

This being a tunnel opened at a remote server, that server needs to have GatewayPorts set to yes in its /etc/ssh/sshd_config. Depending on what kind of users that server have you might want to use the Match option to limit that capability to your user. Match User middleuser GatewayPorts yes Do note that you probably want to add this Match block in the ...


7

There is no need to use nginx. In your ssh daemon configuration (it should be /etc/ssh/sshd_config) set GatewayPorts to clientspecified and reload it. This is necessary for other systems to be able to connect to your tunnel. Without it, only programs running on your server will be able to use it. Now all you need to do is modify your ssh command to listen ...


7

Expanding on Zoredache's comment, the only way you're going to get any sort of space in a broker is to DIY it with a VPN/tunnel. A /25 is 128 IPv4 addresses which are a highly valued commodity these days that you are going to pay out the roof for.( Expect 1-2 dollars IP per month atleast) For a block that big you will need to fill out a justification for ...


6

In your authorized_keys file you can specify which command will be run when they login. You could simply set that command to run something that will just wait around for a long time. The sshd man page as a list of all the options you can use in your authorized_keys file. ...


6

Rsyslog can do this. Encrypting Syslog Traffic with TLS


5

SSH VPN tunnels still use the ssh connection, no? Last I checked it did. And since ssh runs over TCP that means that the VPN runs over TCP. This is not a good way to do it. A single dropped packet will cause i hickup of ALL communication that's going through the tunnel. Tunneling IP over TCP is a bad idea. OpenVPN can use TCP or UDP. UDP is preferred for ...


5

You can do it with netcat, but it's a huge security hole: http://www.stearns.org/nc/ http://forums.remote-exploit.org/newbie-area/5857-netcat-port-redirection.html mknod backpipe p nc -l -p 80 0<backpipe | tee -a inflow | nc localhost 81 | tee -a outflow 1>backpipe FWIW, this is probably a profoundly bad idea.... make sure your firewall is tight ...


5

I think a bit of a diagram may be in order here. You say that you've already setup an SSH over HTTP tunnel through the proxy server. Assuming you're running something on the remote server computer to handle terminating that SSH over HTTP tunnel you should be in business. It sounds like you don't really have an SSH over HTTP proxy, if you're still trying to ...


5

To open a port 12345 on your local machine that, when connected to, will connect to a port 54321 on remotemachine (the machine you're SSH'd into): ssh -L 12345:localhost:54321 remotemachine


5

For over a year i have been using m0n0wall for its IPv6 connectivity. It isn't perfect, as m0n0wall still has a lot of IPv6 functionality missing (e.g. traffic shaping). But it does have extraordinarily simple IPv6 Tunnel Broker setup. Now pfSense 2.1 has been released, with (hopefully) more IPv6 support than m0n0wall. On the other hand, the setup of an ...


5

You should be able to tunnel the telnet session through SSH similar to the following. plink -pw mypswd -L 23:192.168.0.1:22 root@192.168.0.1 Then you can connect on localhost:23 and have this traffic tunneled through SSH to your server.


5

You can assign a name by using the fact your loopback adapter will basically respond to any address in the 127.0.0.0/8 network. So instead of binding to port 4321 you could bind to 127.1.2.3:4321. Then simply setup a host entry that map a name to the loopback address that you used so foo.bar maps to 127.1.2.3. In my SSH configuration on my admin ...


5

There are a number of ways to do this; it depends on what you're comfortable using and maintaining and how much you want to pay. Amazon's "Virtual Private Cloud" lets you set up a server and connect to it using a tunnel to extend your datacenter. If you're just going to use one computer for the hosted server, you can just set up a tunnel between that ...


5

You can simplify the solution... If you're looking for a way to link all of these servers (not routers or gateways devices) as though they were on one flat network, I'd suggest looking at the n2n peer-to-peer offering from ntop. This tool allows you to traverse intermediate devices; helpful if you don't have access to firewalls or have complex routing ...


4

Inside the sshd_config file just change the #PermitTunnel setting from no to yes. from #PermitTunnel no to PermitTunnel yes


4

You were able to create a dial-up VPN connection between Vista and Windows Web Server 2008 without the Network Policy Server role? If so, I'm curious as to what the subnet/IP looked like to the client in that scenario once the tunnel was up. If you have a VPN up, then you've transferred your problem domain from one of VPN to one of routing. I'm pretty ...


4

Unfortunately you cannot install RRAS on Server 2008 Web Edition, its not an allowed role. So you would need to use a third party application, Open VPN is one of the most common and one I have used successfully on server 2003 before. Once you have that setup, Joel's advice for the client setup will make sure your web traffic goes through the VPN.


4

Solution is quite simple after all: make ssh connect to proxy ONLY when it needs to establish a tunnel for the first time: ssh_config: Host external-host.com ProxyCommand corkscrew corp.proxy.ip 8080 %h %p That works cool. Thanks for watching, everybody :)


4

tinc seems to do the trick : http://www.tinc-vpn.org/ m2c


4

I understood that you want just to log in to the computer C, not really tunnel anything from A to C. So, this should do the trick: ssh -t computer-b "ssh computer-c" You might have to enter passwords twice, first for computer B and then for computer C, but this can be avoided by using ssh's key-pair authentication.



Only top voted, non community-wiki answers of a minimum length are eligible