Phone HomeUse Dynamic DNS to phone home!
Paul ElliottTell the dynamic DNS server toattend to your domain.

●The dynamic DNS server will modify Arecords.

Create an A record for dynamic DNS
to point to your Home computer.
●

127.0.0.1 (local host)is a good initial value.

You do not have to have your own
domain to phone home.
●●If you get a free account with dyndns.org they
will create an host within one of their domainsthat you can cause to always point to yourhome computer.
You can ssh to this host– ssh you@yourcomputer.dyndns.org

Tell your router to phone home toyour dynamic DNS server.
●●●●●

How you do thisdepends on yourrouter.
This is the best way, ifit works.
However somerouters don't knowhow.
So you need plan Ba dynamic DNSclient.

If you have openwrt you can have your router
handle dynamic dns!

If you have openwrt have your router do dynamicdns!
●Install luci-app-ddns from “System/Software”●

Configure DDNS from LuCIServices

This is your hostname

Any “A” record can be modified.

NameCheap
Hostname and Username

NameCheap
owlnest.blackpatchpanel.com

Subdomain with “A” record•My domain•NameCheap
owlnest.blackpatchpanel.com

Goes in openwrt “Username” field.
•Goes in openwrt “Domain” field.
•If your router will not cooperate●●

Then you must get your linux computer toupdate dynamic dns.
Read on.

Install ddclient on your linux
machineAre you running dhclient or dhcpcd?

$ ps -A|grep -i dh3222 ?
00:00:00 dhcdbd
3426 ?
00:00:00 dhclientEdit /etc/ddclient.conf●Start with–●/usr/share/doc/ddclient/examples/sample-etc_ddclient.conf

Includes most common ddclient options
daemon=300
syslog=yes
mail=root
mail-failure=root
pid=/var/run/ddclient.pid
ssl=yes# check every 300 seconds# log update msgs to syslog# mail all msgs to root
# mail failed update msgs to root# record PID in file.
# use ssl-support. Works with

Edit /etc/ddclient.conf●Start with–●/usr/share/doc/ddclient/examples/sample-etc_ddclient.conf

Includes “use” line for getting external IP address from mostcommon routers. Simply uncomment router you have!

#use=watchguard-soho,
fw=192.168.111.1:80# via Watchguard's SOHO FW#use=netopia-r910,
fw=192.168.111.1:80# via Netopia R910 FW#use=smc-barricade,
fw=192.168.123.254:80# via SMC's Barricade FW#use=netgear-rt3xx,
fw=192.168.0.1:80# via Netgear's internet FW#use=linksys,
fw=192.168.1.1:80# via Linksys's internet FW#use=maxgate-ugate3x00,
fw=192.168.0.1:80# via MaxGate's UGATE-3x00 FW#use=elsa-lancom-dsl10,
fw=10.0.0.254:80# via ELSA LanCom DSL/10 DSL Router#use=elsa-lancom-dsl10-ch01, fw=10.0.0.254:80# via ELSA LanCom DSL/10 DSL Router#use=elsa-lancom-dsl10-ch02, fw=10.0.0.254:80# via ELSA LanCom DSL/10 DSL Router#use=alcatel-stp,
fw=10.0.0.138:80# via Alcatel Speed Touch Pro#use=xsense-aero,
fw=192.168.1.1:80# via Xsense Aero Router#use=allnet-1298,
fw=192.168.1.1:80# via AllNet 1298 DSL Router#use=3com-oc-remote812,
fw=192.168.0.254:80# via 3com OfficeConnect Remote 812#use=e-tech,
fw=192.168.1.1:80# via E-tech Router#use=cayman-3220h,
fw=192.168.0.1:1080# via Cayman 3220-H DSL Router

Edit /etc/ddclient.conf●Start with–●/usr/share/doc/ddclient/examples/sample-etc_ddclient.confIncludes server options for most dynamic dns hosts.
Simply uncomment lines add your host name andpassword!
● Your complete#### dyndns.org dynamic addresses#### (supports variables: wildcard,mx,backupmx)### server=members.dyndns.org,\# protocol=dyndns2\●# your-dynamic-host.dyndns.org#login=your-login# default login#password=test# default password ●#mx=mx.for.your.host# default MX#backupmx=yes|no# host is primary MX?
#wildcard=yes|no# add wildcard CNAME?

dns hostname
goes here.
Login
password

Edit /etc/ddclient.conf
daemon=300
syslog=yes
mail-failure=root
pid=/var/run/ddclient.pid
ssl=yes# check every 300 seconds# log update msgs to syslog# mail failed update msgs to root# record PID in file.
# use ssl-support. Works with

use=fw, fw=192.168.86.198/mymodem_summary.htm, fw-skip='internet_options.htm><U>'## NameCheap (namecheap.com)#
protocol=namecheap,\
server=dynamicdns.park-your-domain.com, \login=blackpatchpanel.com,\
password=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
owlnest\Edit /etc/ddclient.conf
daemon=300
syslog=yes
mail-failure=root
pid=/var/run/ddclient.pid
ssl=yes# check every 300 seconds# log update msgs to syslog# mail failed update msgs to root# record PID in file.
# use ssl-support. Works with

use=fw, fw=192.168.86.198/mymodem_summary.htm, fw-skip='internet_options.htm><U>'## NameCheap (namecheap.com)#
protocol=namecheap,\
server=dynamicdns.park-your-domain.com, \login=blackpatchpanel.com,\
password=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
owlnest\●Needed only if you need to run as a daemon●i.e. not running dhclient or dhcpcd

Edit /etc/ddclient.conf
daemon=300
syslog=yes
mail-failure=root
pid=/var/run/ddclient.pid
ssl=yes# check every 300 seconds# log update msgs to syslog# mail failed update msgs to root# record PID in file.
# use ssl-support. Works with

use=fw, fw=192.168.86.198/mymodem_summary.htm, fw-skip='internet_options.htm><U>'## NameCheap (namecheap.com)#
protocol=namecheap,\
server=dynamicdns.park-your-domain.com, \login=blackpatchpanel.com,\
password=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
owlnest\Edit /etc/ddclient.conf
daemon=300syslog=yes
mail-failure=root
pid=/var/run/ddclient.pid
ssl=yes# check every 300 seconds# log update msgs to syslog# mail failed update msgs to root# record PID in file.
# use ssl-support. Works with

use=fw, fw=192.168.86.198/mymodem_summary.htm, fw-skip='internet_options.htm><U>'## NameCheap (namecheap.com)#
protocol=namecheap,\
server=dynamicdns.park-your-domain.com, \login=blackpatchpanel.com,\
password=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
owlnest\Running dhcpcd?
cp /usr/share/doc/ddclient/examples/sample-etc_dhcpc_dhcpcd-eth0.exe \/etc/dhcpc/dhcpcd-{your ethernet interface}.exe●

See ddclient documentation.

#!/bin/sh######################################################################## $Id: sample-etc_dhcpc_dhcpcd-eth0.exe 8 2006-06-14 19:51:39Z wimpunk $######################################################################
PATH=/usr/sbin:${PATH}## update the DNS server unless the IP address is a private address## that may be used as an internal LAN address. This may be true if## other interfaces are assigned private addresses from internal## DHCP server.
case "$1" in10.*);;172.1[6-9].* | 172.2[0-9].* | 172.3[0-1].*) ;;192.168.*);;*)
logger -t dhcpcd IP address changed to $1
ddclient -daemon=0 -syslog -use=ip -ip=$1 >/dev/null 2>&1;;esac

If you are running dhclient?

$ ps -C dhclient
PID TTY
TIME CMD
2833 ?
00:00:00 dhclient●cp /usr/share/doc/ddclient/examples/sample-etc_dhclient-exit-hooks /etc/dhclient-exit-hooks

Otherwise... Run ddclient as adaemon

Daemon talks to router to getexternal IP address.
#use=watchguard-soho,
fw=192.168.111.1:80# via Watchguard's SOHO FW#use=netopia-r910,
fw=192.168.111.1:80# via Netopia R910 FW#use=smc-barricade,
fw=192.168.123.254:80# via SMC's Barricade FW#use=netgear-rt3xx,
fw=192.168.0.1:80# via Netgear's internet FW#use=linksys,
fw=192.168.1.1:80# via Linksys's internet FW#use=maxgate-ugate3x00,
fw=192.168.0.1:80# via MaxGate's UGATE-3x00 FW#use=elsa-lancom-dsl10,
fw=10.0.0.254:80# via ELSA LanCom DSL/10 DSL Router#use=elsa-lancom-dsl10-ch01, fw=10.0.0.254:80# via ELSA LanCom DSL/10 DSL Router#use=elsa-lancom-dsl10-ch02, fw=10.0.0.254:80# via ELSA LanCom DSL/10 DSL Router#use=alcatel-stp,
fw=10.0.0.138:80# via Alcatel Speed Touch Pro#use=xsense-aero,
fw=192.168.1.1:80# via Xsense Aero Router#use=allnet-1298,
fw=192.168.1.1:80# via AllNet 1298 DSL Router#use=3com-oc-remote812,
fw=192.168.0.254:80# via 3com OfficeConnect Remote 812#use=e-tech,
fw=192.168.1.1:80# via E-tech Router#use=cayman-3220h,
fw=192.168.0.1:1080# via Cayman 3220-H DSL Router●●

Common routers have built in support.
Just uncomment correct “use” line in the sample
ddclient.conf file.

If your router is unsupportedWeb Scrape●

Find the page in your router's web pages that
displays the external IP address.

Isolate the frame containing theexternal IP address.

●

Right click on the frame; Show only this Frame

Note the URL.

●

We will use the url to create a “use” line.

View the source for the page

Search of external IP address in thesource!

Locate unique prefix●●Locate a prefix thatuniquely precedes theexternal IP address inthe source html.
If necessary, use
regular expressions.

Construct a “use” line.
use=fw, fw=192.168.86.198/mymodem_summary.htm, fw-skip='internet_options.htm><U>'●

Construct a use line from the two pieces ofdata we have gathered.
– The URL.
– The Prefix string●

Put use line in /etc/ddclient.conf

Edit /etc/ddclient.conf
daemon=300
syslog=yes
mail-failure=root
pid=/var/run/ddclient.pid
ssl=yes# check every 300 seconds# log update msgs to syslog# mail failed update msgs to root# record PID in file.
# use ssl-support. Works with

use=fw, fw=192.168.86.198/mymodem_summary.htm, fw-skip='internet_options.htm><U>'## NameCheap (namecheap.com)#
protocol=namecheap,\
server=dynamicdns.park-your-domain.com, \login=blackpatchpanel.com,\
password=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
owlnest\Run ddclient as a daemon●

Done configuring ddclientRemember how I told you if you had
dhclient or dhcpcd you did not haveto run ddclient?
●●You could read the ddclient doc and find out afile you could copy to run ddclient when you
received a new dhcp lease?
On my debian lenny distro it, (the method
specified in the ddclient docs,) which I told you
about earlier in this presentation, did not work!

What worked.
#!/bin/sh/usr/sbin/ddclient -daemon=0 -syslog -use=fw -fw "192.168.86.198/mymodem_summary.htm" -fw-skip 'internet_options.htm><U>' >/dev/null 2>&1●

Added the following file to– /etc/dhcp3/dhclient-exit-hooks.d/ddclient-hook●

Highlighted portions are from my use line. You
will need to find them by web scraping yourrouter as previously described.

Test that host record points tocorrect place.
$ dig owlnest.blackpatchpanel.com; <<>> DiG 9.5.1-P3 <<>> owlnest.blackpatchpanel.com;; global options: printcmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49840;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0;; QUESTION SECTION:;owlnest.blackpatchpanel.com. INA;; ANSWER SECTION:
owlnest.blackpatchpanel.com. 1800 INA

99.93.100.238;; Query time: 106 msec;; SERVER: 192.168.86.198#53(192.168.86.198);; WHEN: Sun Jan 24 13:15:47 2010;; MSG SIZE rcvd: 61$●

Repeat that test still works after you get a new
DHCP lease!

Tell your router how to route
incoming connection requests.

●

How to do this depend on your router.

●Port 22 is used by ssh●

what should your router do with an incoming
connection request on port 22?

Configure the ssh daemon'ssecurity.
●

Under root, edit
– /etc/ssh/sshd_config●

Limit sshd access to users withknown strong security.
AllowUsers pelliott

●

●

●
●

Your “distro” will often add accounts that you
don't even know about.
Just because you let someone have an accounton your computer, does not mean you want to
let them have remote access.
Most people's security practices are horrible.
It is nice to limit remote access to a known finitelist.

Consider disabling password accessaltogether!
PasswordAuthentication no●

Berlios developer web site was attacked
recently using man-in-the-middle attack using
passwords.

Disable protocol 1
Protocol 2●Protocol 1 is old.

If you want to run remote X11
programs, you will have to enableX11Forwarding
X11Forwarding yes●

Most security concerns concerning X11
Forwarding are for the X server i.e. where themouse and the display is.

TCP wrappers may prevent sshd
from accepting incoming
connections!
/etc/hosts.deny
ALL : ALL EXCEPT LOCAL,localhost●●●

Most distro's versions of ssh link to tcp
wrappers.
This means they will not allow incoming
connections if tcp wrappers is not configured
properly.
It is a good idea to tell tcp wrappers to disallow
everything not explicitly permitted.

Explicitly allow sshd to connect.
/etc/hosts.allow
portmap: 192.168.86.0/255.255.255.0
statd: 192.168.86.0/255.255.255.0
sshd: ALL : ALLOW●

Modify /etc/hosts.allow to allow sshd to talk tothe outside world.

Pierce your firewall to allow
incoming connections●●

How you do thisdepends on yourfirewall management
software.
I use “firestarter”

Restart the ssh daemon# /etc/init.d/ssh restart●

After changing security parameters, you willneed to restart the daemon.

Go to ShieldsUP to verify we haveand open port!

Go to ShieldsUP to verify we haveand open port!

●No Open port, no possibility of remote
access!

Make sure your passwords arestrong because they will try to get in!
hrnowl:/var/log# grep ssh auth.log |grep rootFeb 2 15:31:40 hrnowl sshd[5205]: User root from 211.92.149.147 not allowed because not listed in AllowUsers
Feb 2 15:31:42 hrnowl sshd[5207]: User root from 211.92.149.147 not allowed because not listed in AllowUsers
Feb 2 15:31:44 hrnowl sshd[5209]: User root from 211.92.149.147 not allowed because not listed in AllowUsers
Feb 2 15:31:46 hrnowl sshd[5211]: User root from 211.92.149.147 not allowed because not listed in AllowUsers
Feb 2 15:31:48 hrnowl sshd[5213]: User root from 211.92.149.147 not allowed because not listed in AllowUsers
Feb 2 15:31:50 hrnowl sshd[5215]: User root from 211.92.149.147 not allowed because not listed in AllowUsers
Feb 2 15:31:52 hrnowl sshd[5217]: User root from 211.92.149.147 not allowed because not listed in AllowUsers
Feb 2 15:31:54 hrnowl sshd[5219]: User root from 211.92.149.147 not allowed because not listed in AllowUsers
Feb 2 15:31:56 hrnowl sshd[5221]: User root from 211.92.149.147 not allowed because not listed in AllowUsers
Feb 2 15:31:59 hrnowl sshd[5223]: User root from 211.92.149.147 not allowed because not listed in AllowUsers
Feb 2 15:32:01 hrnowl sshd[5225]: User root from 211.92.149.147 not allowed because not listed in AllowUsers
Feb 2 16:29:29 hrnowl sshd[5658]: User root from 219.93.76.50 not allowed because not listed in AllowUsers
hrnowl:/var/log#●Excerpt from my system log show hackerstrying to get in!

Generate a ssh public private key
pair (if you have not already)●●Use ssh-keygen to generate the keys. On your mobilecomputer
Distribute the public key to the remote computer. Thatis your home computer.
– To the ~/.ssh directories of the accounts that willphone home.

●

●

●

If you have disabled password access, you won't beable to use ssh itself to do this.
Append the public key to ~/.ssh/authorized_keys of
the account that will be used at home.
ssh-copy-id -i ~/.ssh/yourkey.pub user@remote.hostIf you have disabled passwords you
will have to use sneakernet fordistribution●

ssh-copy-id -i ~/.ssh/yourkey.pub user@remote.host– If you have disabled password access this will notwork!

– Copy the file via sneaker net and a usb stick– On your mobile computer

Cp mykey.pub /media/usbstick/mykey.pub– On your home computer●●

cat /media/usbstick/mykey.pub \>>~/.ssh/authorized_keys

You are now ready to phone home.
ssh -X pelliott@owlnest.blackpatchpanel.com /usr/bin/konsole●●●

Run a X11 terminal program on your homecomputer from your remote laptop.
From this window you can run any X11programs.
You can even su to root, (if you know thepassword), for remote system administration,using X11 point and clicky programs.

Run program on remote “client”●●

From this console
window, you can run
any X11 program.
Output display will beseen on local X
server. Program will
run on remotecomputer.

X11 terminology●●

In X11 terminology,
the “X server” iswhere the screen, thekeyboard and themouse is, and the“client” is where the“program” is.
This is backward frommost other usage ofclient/server.