[Android Software/Hacking General [Developers Only]] mikshepard:
What I wanted was a simple, secure way to access my home computer remotely from my android phone. I know there are vpn options but I’ve seen that cause battery drain issues if in constant use, and also is more than I wanted/needed to setup. I know I could just setup a ssh server but leaving port 22 open on the remote computer for anyone to scan and hack the password seemed too insecure for me. So I came up with this solution and have been using it for about 2 years now without any problems. I thought maybe I should share this method since it may be of use to someone else and I don’t know of anyone else putting all these together for use with android.

What this does:

By running a small script on your android phone in terminal (only 2 commands), your phone knocks 3 specific ports, in a specific order (like a combination lock), your remote computer recognizes this order and opens port 22 for 10 sec. Your script then ssh’s the remote computer on port 22 and you log in. The port 22 on the remote computer closes so no one else can see it, but the keep-alive feature keeps your ssh session open so you can do whatever you need, for as long as your like, without worrying about someone port sweeping the remote computer and seeing the port open, or brut forcing a ssh password on it. You with me so far?

Now the ssh session also uses port forwarding to forward port 5900 from the remote computer to port 5900 on the localhost of the android phone. Now you can open your vnc client and connect to the remote computer through your ssh tunnel and see your x11 desktop. So you know also have a secure VNC connection! All this is done securely and only runs ondemand.

While this may look like a lot to setup, it’s actually quite easy and should only take about 15min tops. This tutorial should be complete but if I’ve forgotten anything, let me know and I’ll be sure to update this page.

In other words, run two simple commands within a script and you have secure access to your remote computer from your phone! Enjoy!

Pros:

- Secure

- Works on 3G and wifi

- Runs on all android versions

- Works on all x11 GUI’s (gnome, kde, etc). Assuming a VNC session is also desired.

- Fun!

Problems:

- This only works on linux computers, although I’m sure there is a way to setup port knocking on windows. I have no use for this, but if people are interesting, I can add a way to my tutorial as well.

Howto:

Setup Remote Computer:

First we need to setup the remote computer. This is geared towards Debian/Ubuntu but small adjustments should have it working on all distros (I’m using Debian Squeeze personally). Let’s begin:

First we need to install a few packages if not already there:

apt-get install openssh-server x11vnc knockd

Now lets configure your ssh daemon. Using nano or another text editor, edit /etc/ssh/sshd_config:

Change the following line to read as follows:

PermitRootLogin no

This will disable root login, so you will login in as a user and then su to root (You can leave root login if desired, it’s just less secure and not recommended).

Next we need to edit our iptables, so open /etc/network/if-pre-up.d/iptables and add the following:

MAKE A BACKUP FIRST OF THIS FILE

# Accepts all established inbound connections
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allows all outbound traffic
iptables -A OUTPUT -j ACCEPT

# Allow ping
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

# log iptables denied calls (access via 'dmesg' command)
iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Reject all other inbound - default deny unless explicitly allowed policy:
iptables -A INPUT -j REJECT
iptables -A FORWARD -j REJECT

Now we setup our port knocking. Edit /etc/knockd.conf:

[options]
UseSyslog

[openSSH]
sequence = port1,port2,port3
seq_timeout = 5
command = /sbin/iptables -I INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
cmd_timeout = 10
stop_command = iptables -I INPUT -p tcp -m state --state NEW --dport 22 -j DROP
tcpflags = syn

[closeSSH]
sequence = port1,port2,port3
seq_timeout = 5
command = /etc/init.d/ssh stop
tcpflags = syn

The section [openSSH] is what opens the port for 10 sec by running the iptables command and then drops the packets after the time expires, running the stop_command. The section [closeSSH] is not needed. It was a failsafe I use in case I want to disable ssh if I thought I was getting hacked and could not login. This is also left to show how you can use the knocking to run different commands using another sequence of ports (for ftp, etc.)

Now lets restart the network interface and restart the knock daemon:

ifconfig eth0 down #adjust to whatever interface you use normally
ifconfig eth0 up
dhclient
/etc/init.d/knockd restart
/etc/init.d/sshd restart

Test your internet and make sure it works. To make sure you have it setup to run on boot, first determine your runlevel:

runlevel

Make sure knockd, ssh are in the /etc/rcX.d (where X equals your runlevel). If not, add it

ln -s /etc/init.d/knockd /etc/rcX.d/S02knockd

And so on for shh if needed, (again, adjust X to equal your runlevel)

Setup X11VNC password:

x11vnc --store password

create a script for ~/bin/x11vncserver

add this to the script

#!/bin/bash
x11vnc -safer -forever -usepw -noxdamage

The “-noxdamage” fixes a display problem of the desktop not updating in the android vnc client. Now if using gnome and you only care about vnc login for one user then, goto System → Preferences → Startup Applications → Add →

Name = VNC Server

Command = x11vncserver &

Or add to GDM for access to any user, add to /etc/gdm3/Init/Default:

x11vnc -safer -forever -usepw -noxdamage

DONE! (KDE will be similar but slightly different to load on login, post if help is needed)

Setup android phone:

create script called knockh in /system/xbin. Then add this:

nc -z [ipaddress] port1 port2 port3
ssh -L 5990:localhost:5900 user@[ipaddress]

Replaces the ipaddress with your own (google “what is my ip” if you don’t know your external ip). Replace the ports with the ones used in the config file above for knockd. Change the user to whatever user has ssh rights. Then

chmod 755 /system/xbin/knockh

Now run

knockh

in the terminal and you should see a login for ssh on your remote computer.

Next download “android-vnc-viewer” from the market (it’s free). Create a new connection by selecting “new” from the dropdown box.

Create a nickname, enter your x11vnc pasword, address is “localhost” and port is “5900”. For 3G connections, I recommend 8 colors, for wifi 256. I also check the “Local mouse pointer” in the checkbox. Now click connect and see your desktop!

(If you are on your local wifi network be sure to create another connection for your local ip address)

Fixes:

Keep in mind this is for remote networks, if you are on your local lan, this won’t work without changing the ip address.

If using a router or modem, setup port forwarding to your remote computer for TCP ports 5900, 22, port1, port2, port3 (your port knocking ports). Also make sure to setup a static dhcp for the remote computer so your router/modem doesn’t change it’s ip address and you can’t connect.

If you are using an ISP that doesn’t give you a static ip address for your router, you will not be able to login whenever they change it, you’ll have to update the script first with the new IP. A solution is to setup a dynamic dns, using dyndns.org or something similar. Free options are out there, just google it.

I hope this helps, please post if you have any questions, comments, etc. Enjoy!

-Mike