[00:32] What about a Ubuntu Classroom lecture on how to package software for Ubuntu? [00:38] there's been a lot of them already IIRC [00:49] 10 min or so .. [00:49] I will be demo on a shared session :) [00:49] to log on : http://paste.ubuntu.com/156798/ [00:49] if we can get people connected to the server in advance - woot [00:50] If people need help connecting , ask [00:50] If you know how to connect, please help in a /msg ;) [00:54] don't all connect all at once now :) [00:54] welcmoe ibuclaw , thanks for coming ;) [00:55] ibuclaw: do you know how to use my shared ssh session ? [00:56] Hallo. [00:56] 'lo WastePotato , thank you for coming as well [00:57] do you recall how to connect to my ssh session ? [00:57] Hey bodhi_zazen. [00:57] I still have your key, but I don't remember the command. [00:58] http://paste.ubuntu.com/156798/ [00:58] 2 min or so ;) [00:58] who is here for the session ? [00:58] I am hoping to have a more interactive session, as they are more fun ;) [00:58] Present. [00:58] bodhi_zazen... is that.. screen? [00:59] yes WastePotato ;) [00:59] screen FTW [00:59] Dang. o: [00:59] ? [01:00] Looks nice. :D [01:00] >:) [01:00] bodhi_zazen: can we run commands in your SSH session? [01:00] Lawl no. [01:00] :( [01:00] no, but if you ask I will run them for you ;) [01:00] It's read only. |: [01:01] If too many people enter stuff at the same time it gets confusing [01:01] Shall we start ? [01:01] ssh is one of my favorite topics :) [01:02] Brief into to ssh ? [01:02] SSH \o/ [01:02] ssh == Secure SHell [01:02] it allows one to log into a server and execute commands [01:03] one can forward X applications, an entire desktop, ports, sockets, etc [01:03] I would like to cover some of the basics today ;) [01:03] Cool. :) [01:03] the computer you log into will be called "the server" today [01:04] You first need to install ssh onto the server [01:04] bodhi_zazen, I know vaguely how to use it... [01:04] apt-get install ssh-server [01:04] openssh-server* [01:04] (or does ssh-server work too?) [01:04] ? [01:04] thanks HymnToLife , lol [01:04] Oh. [01:04] you then ssh user@server [01:05] if you are on *unix , and have the same account name on clinet and server, you can ssh server [01:05] to execute a command on the server [01:05] ssh server command [01:05] not only on *nix :o [01:06] it works on Windows too [01:06] does it work on Windows ? [01:06] nice [01:06] PuTTy? [01:06] yes, use putty on windows [01:06] WastePotato: you can also install OpenSSH on Windows [01:06] although if you like putty you can install it on Linux as well [01:06] putty is a bit more convenient though [01:06] I see... [01:06] putty is nice in that it stores servers and idents :) [01:07] Putty on Linux as well? Nice. [01:07] OK, want to see a demo of ssh on my session ? [01:07] Yes! [01:07] or shall we move on [01:07] kk .. [01:07] \o/ [01:08] see how the first time we connect to the server, we are asked to accept the server key ? [01:08] the key is stored in ~/.ssh/known_hosts [01:08] now we will not be asked to accept the key , watch [01:09] see ? [01:09] OK, lets run a command on the server :) [01:09] ::) [01:09] you forward application with -X [01:10] Ah. Didn't know you could specify a command on connection. o: [01:10] ssh -X user@server xeyes [01:10] any idea why i can't forward firefox this way? [01:10] will run xeyes on your local client, assuming you have X installed ;) [01:10] yes kklimonda [01:10] WastePotato: actually, if you ssh server command [01:10] firefox is an exception to this [01:10] firefox will run LOCAL [01:11] only that command will be run on the server [01:11] unless you tell it NOT to [01:11] you won't get a prompt [01:11] bodhi_zazen: why is that? [01:11] it is the way they built firefox [01:11] kklimonda: actually, the "firefox" command runs a shell script that in turn runs Firefox itself [01:11] bodhi_zazen: is it ssh problem or generally X forwarding? [01:12] HymnToLife: and that's the reason? [01:12] so if you do that, you'll run the shell script that is on the server [01:12] i see [01:12] this is a firefox problem kklimonda [01:12] but it will then run the firefox that is on the client [01:13] kklimonda: see for example gedit `which firefox` [01:13] Try ssh server /usr/bin/firefox -p -no-remote [01:13] :) [01:13] that's what is run when you type "firefox" at your prompt [01:13] HymnToLife: i thought that wrapper script will pass everything that is needed to firefox binary [01:13] you need to tell firefox -no-remote to run it on server and forward it back over ssh [01:14] OK, if you run a ssh server, BE SURE YOU SECURE IT :) [01:14] https://help.ubuntu.com/community/AdvancedOpenSSH [01:14] it is already fairly secure by default though [01:14] shall I show you how to use keys ? [01:14] bodhi_zazen: is it possible to disable login by password for some users? [01:14] you use a key pair to log onto the server, then disable password logins [01:15] kklimonda: I do not think you can disable password logins per user [01:15] SSH is only as secure as the password you use (I learnt that the hard way) [01:15] you can do it for root [01:15] +1 MattJ [01:16] bodhi_zazen: i can set up that root and only root doesn't use password login? [01:16] shall we demo a key ? [01:16] kklimonda: yes, but it's really better to disable it altogether [01:16] HymnToLife: i know [01:16] yes kklimonda [01:16] HymnToLife: but it is the case that I don't want to do it [01:16] may I ask why? [01:16] I think it is AllowRootLogin nopassword [01:16] something like that [01:16] do not let "nopassword" fool you [01:17] see man sshd_config [01:17] OK, everyone on my shared ssh session ? [01:17] want to see how to make a key ? [01:18] HymnToLife: other users doesn't use linux, configuring keys in putty isn't as easy, they don't want to do it. [01:18] Command : ssh-keygen -t rsa -b 4096 -f root [01:18] enter your desired password [01:19] now we have 2 files , root and root.pub [01:19] we transfer root.pub to the server [01:19] bodhi_zazen: can I force password login by passing an argument to ssh ? [01:19] i'd like to test PermitRootLogin without-password [01:19] into /root/.ssh/authorized_keys [01:19] kklimonda: I can show you this ;) [01:20] sure [01:20] watch in the session and we can config [01:21] Command : ssh-copy-id -i ./root.pub root@192.168.1.14 [01:21] the command ssh-copy-id does all this for us automatically [01:21] now let us ssh into server again ;) [01:22] that went by fast :) [01:22] see we get 1 attempt w/ key, then if the wrong PW is entered, fall back to password ? [01:22] let us change that on the server :) [01:23] now kklimonda :) [01:24] see kklimonda , no log in w/o key :) [01:24] but with key :) [01:24] lol [01:24] bodhi_zazen: but what when I have key already on server, password already in seahorse cache and I want to simulate password login? :) [01:24] can I use -i /dev/null or something? [01:25] (i should check but if you are already here to poke... ;) ) [01:25] that change will disable passwords :) [01:25] test it out kklimonda :) [01:25] OK , now a bit of security [01:26] the key from the server insures against a "man in the middle" attack [01:26] let us change the stored server key :) [01:26] I changed the key [01:26] now let us log in [01:27] OH NO !!! [01:27] now what everyone says , just delete ~/.ssh/known_hoses [01:27] *hosts [01:27] DO NOT DO THIS [01:27] first contact the sys admin on the server [01:27] and make sure the keys changed [01:27] we know we changed the key [01:28] so how to remove the key ? [01:28] easily ? [01:28] without removing all your keys ? [01:28] ssh-keygen -R 192.168.1.14 [01:28] now watch :) [01:28] >:) [01:29] easy as pie [01:29] indeed [01:29] now ... [01:29] want to log in w/o entering a password ? [01:29] use ssh-agent / ssh-add [01:29] Normally you use ssh-add in an X session [01:29] ie seahorse [01:29] but in a terminal ? [01:30] Could not open a connection to your authentication agent. [01:30] anyone know what to do in a terminal w/o X ? [01:30] ??? [01:30] yup [01:30] you should tell about keys without password - it's still common to see it as a solution in some guides [01:30] ssh-agent bash [01:30] or ssh-agent zsh [01:31] that's not how I do it [01:31] I have this in my crontab: [01:31] @reboot ssh-agent -s | grep -v echo > $HOME/.ssh-agent [01:31] now :) [01:31] and a source ~/.ssh-agent [01:31] in my .zshrc [01:31] lol HymnToLife :) [01:31] see, I ssh into server w/o entering a PW [01:32] and look ma, no empty key :) [01:32] now when I close the shell [01:32] hehe [01:32] password is forgotten :) [01:33] * ibuclaw is running a remote upgrade [01:33] I also have keyon/keyoff as aliases for ssh-add [01:33] if you use ssh, you should look at screen [01:33] to just make it "forget" the pasphrase in one command [01:33] instead of exitting the shell [01:34] screen allows you to run a command in the server, exit the ssh session, and the command keeps on running ;) [01:34] we shall save screen for another day ? [01:34] bodhi_zazen: is you screen profile the same bundled with ubuntu screen package? [01:35] here is how to use putty : [01:35] http://wiki.amahi.org/index.php/Key-based_SSH_Logins_With_Putty [01:35] works on windows and linux :) [01:35] kklimonda: for this session it is [01:35] OK, that is ssh 101 :) [01:35] questions ? [01:36] i think you have answered all mine. [01:36] thanks :) [01:36] np :) [01:36] I think there were some additional questions ? [01:37] hmm.. weird.. i can't remove ssh key pass phase from seahorse cache [01:37] at least not from any gui [01:38] I have not been a huge fan of seahorse :) [01:38] yes it makes it easy, but if you want to change something it is a pain :( [01:39] Any other questions on ssh ? [01:39] nope [01:39] and HymnToLife I made a rsa key "just for your" , lol [01:39] *you [01:40] I will hold another session in 2 weeks [01:40] suggestions for topic ? [01:40] about? [01:40] oh :) [01:40] hmm.. screen magic would be nice [01:40] But I won't be here probably [01:40] screen would be fun :) [01:40] or maybe.. [01:40] yeah [01:40] other suggestions ? [01:40] I know some basics etc. but I know that screen has a lot of potential.. [01:41] kklimonda: http://www.pixelbeat.org/lkdb/screen.html [01:41] http://blog.bodhizazen.net/linux/shared-ssh-sessions-update-for-jaunty-ubuntu-904/ [01:42] thanks for this post - i'll read it later. [01:42] i was going to ask how you did it :) [01:42] ;) [01:43] It is a very nice, secure teaching tool ;) [01:43] exactly [01:43] I had to open a few small holes to allow this session in fact ;) [01:44] ibuclaw: questions ? [01:44] WastePotato: you ? [01:44] bodhi_zazen, not any from me... [01:44] aww ... [01:45] bodhi_zazen: why is apparmor policy modification needed? [01:46] what ? [01:46] you mean why did I write an apparmor policy for the shared session ? [01:46] oh, i see - jailbash is used instead of rbash? [01:46] bodhi_zazen, I've actually not paid a great amount of attention. Just picked up the `ssh iain@192.168.1.8`, `ssh -X iain@192.168.1.4 gui-app`, `ssh-keygen -t rsa -b 4096 -f root` and `ssh-copy-id -i ./iain.pub iain@192.168.1.8` commands and have been playing about ever since ;) [01:47] nice ibuclaw [01:47] jailzsh actually [01:47] I can give out the guru key to members of the BT for teaching [01:47] and this allows them to do a whole ton [01:47] but I restrict what they can do [01:47] since I'm behind a router, and I don't plan on port forwarding, I don't think I need to look too deep into the security side... yet. But I've learnt something today, that's for sure ;) [01:48] for example, you still in the shared session ? [01:48] want to see a demo of apparmor ? [01:48] no, i can login again [01:48] kklimonda, you can break out of rbash in less than 3 seconds [01:48] kk [01:48] ibuclaw: nice :) [01:48] you in ? [01:48] yes [01:49] see how I allow root access ? [01:49] but apparmor will restrict even root [01:50] :) [01:50] bodhi_zazen: btw.. there is a lot of discussion about apparmor vs. selinux - do you know what do ubuntu developers think about it? [01:50] see how I restrict the access to the net w/ iptables [01:51] yeh [01:51] apparmor does not allow root to turn it off [01:51] he he he [01:51] nor read sshd-config, let alone change [01:52] so I am resticting what this machine can do no my LAN [01:52] I specifically allowed access to 192.168.1.14 for this session ;) [01:53] oh :) [01:53] see, apparmor blocks access to .bashrc as well >:) [01:53] lol [01:54] and everyone likes that command :) [01:54] this one should be default :) [01:54] this shell ? [01:54] nah, preventing rm -rf / ;) [01:54] preventing rm -rf / [01:54] is default as of 8.10 [01:54] oh? damn :) [01:54] nice [01:55] but do not [01:55] rm -rf /* [01:55] lol [01:55] it still works? :) [01:55] see ? [01:55] yes [01:55] >:) [01:55] shh, don't tell anyone [01:55] :D [01:56] I like to see everyone's response when root is restricted by apparmor [01:56] as you can see, it is not a "fake" root account [01:56] uid = 0 [01:57] 3 min left [01:57] questions ? [01:57] other things to see and do ? [01:57] kklimonda: you still loged in ? [01:57] yes [01:57] watch this :) [01:57] see that command ? [01:58] *nods* [01:58] :) [01:58] see what happened ? [01:58] yup - nice feature [01:58] if I am not running a shared session -> no guest log in [01:58] try it [01:59] my iptables rules will block you for 10 min or so, nothing serious :) [01:59] go ahead, hit it 3 times or so :p [01:59] ;) [02:00] bodhi_zazen: great job with this screen setup. [02:00] It works great and looks nice :) [02:00] ok, time for my [02:00] good night everyone [02:01] thanks kklimonda :) [02:05] thank you all for coming :) [02:10] o/ [02:11] Damn. Missed half of it. I'll read the scrollback. :S === serverchen is now known as javapi === notLight is now known as Light- === kenny is now known as Guest91775 === iTroll is now known as WastePotato === kenny is now known as Guest20760 === Guest20760 is now known as KennyM === kenny is now known as KennyM