Search Results

Search found 9446 results on 378 pages for 'ssh keys'.

Page 264/378 | < Previous Page | 260 261 262 263 264 265 266 267 268 269 270 271  | Next Page >

• How to open a server port outside of an OpenVPN tunnel with a pf firewall on OSX (BSD)

  - by Timbo

  I have a Mac mini that I use as a media server running XBMC and serves media from my NAS to my stereo and TV (which has been color calibrated with a Spyder3Express, happy). The Mac runs OSX 10.8.2 and the internet connection is tunneled for general privacy over OpenVPN through Tunnelblick. I believe my anonymous VPN provider pushes "redirect_gateway" to OpenVPN/Tunnelblick because when on it effectively tunnels all non-LAN traffic in- and outbound. As an unwanted side effect that also opens the boxes server ports unprotected to the outside world and bypasses my firewall-router (Netgear SRX5308). I have run nmap from outside the LAN on the VPN IP and the server ports on the mini are clearly visible and connectable. The mini has the following ports open: ssh/22, ARD/5900 and 8080+9090 for the XBMC iOS client Constellation. I also have Synology NAS which apart from LAN file serving over AFP and WebDAV only serves up an OpenVPN/1194 and a PPTP/1732 server. When outside of the LAN I connect to this from my laptop over OpenVPN and over PPTP from my iPhone. I only want to connect through AFP/548 from the mini to the NAS. The border firewall (SRX5308) just works excellently, stable and with a very high throughput when streaming from various VOD services. My connection is a 100/10 with a close to theoretical max throughput. The ruleset is as follows Inbound: PPTP/1723 Allow always to 10.0.0.40 (NAS/VPN server) from a restricted IP range >corresponding to possible cell provider range OpenVPN/1194 Allow always to 10.0.0.40 (NAS/VPN server) from any Outbound: Default outbound policy: Allow Always OpenVPN/1194 TCP Allow always from 10.0.0.40 (NAS) to a.b.8.1-a.b.8.254 (VPN provider) OpenVPN/1194 UDP Allow always to 10.0.0.40 (NAS) to a.b.8.1-a.b.8.254 (VPN provider) Block always from NAS to any On the Mini I have disabled the OSX Application Level Firewall because it throws popups which don't remember my choices from one time to another and that's annoying on a media server. Instead I run Little Snitch which controls outgoing connections nicely on an application level. I have configured the excellent OSX builtin firewall pf (from BSD) as follows pf.conf (Apple App firewall tie-ins removed) (# replaced with % to avoid formatting errors) ### macro name for external interface. eth_if = "en0" vpn_if = "tap0" ### wifi_if = "en1" ### %usb_if = "en3" ext_if = $eth_if LAN="{10.0.0.0/24}" ### General housekeeping rules ### ### Drop all blocked packets silently set block-policy drop ### all incoming traffic on external interface is normalized and fragmented ### packets are reassembled. scrub in on $ext_if all fragment reassemble scrub in on $vpn_if all fragment reassemble scrub out all ### exercise antispoofing on the external interface, but add the local ### loopback interface as an exception, to prevent services utilizing the ### local loop from being blocked accidentally. ### set skip on lo0 antispoof for $ext_if inet antispoof for $vpn_if inet ### spoofing protection for all interfaces block in quick from urpf-failed ############################# block all ### Access to the mini server over ssh/22 and remote desktop/5900 from LAN/en0 only pass in on $eth_if proto tcp from $LAN to any port {22, 5900, 8080, 9090} ### Allow all udp and icmp also, necessary for Constellation. Could be tightened. pass on $eth_if proto {udp, icmp} from $LAN to any ### Allow AFP to 10.0.0.40 (NAS) pass out on $eth_if proto tcp from any to 10.0.0.40 port 548 ### Allow OpenVPN tunnel setup over unprotected link (en0) only to VPN provider IPs ### and port ranges pass on $eth_if proto tcp from any to a.b.8.0/24 port 1194:1201 ### OpenVPN Tunnel rules. All traffic allowed out, only in to ports 4100-4110 ### Outgoing pings ok pass in on $vpn_if proto {tcp, udp} from any to any port 4100:4110 pass out on $vpn_if proto {tcp, udp, icmp} from any to any So what are my goals and what does the above setup achieve? (until you tell me otherwise :) 1) Full LAN access to the above ports on the mini/media server (including through my own VPN server) 2) All internet traffic from the mini/media server is anonymized and tunneled over VPN 3) If OpenVPN/Tunnelblick on the mini drops the connection, nothing is leaked both because of pf and the router outgoing ruleset. It can't even do a DNS lookup through the router. So what do I have to hide with all this? Nothing much really, I just got carried away trying to stop port scans through the VPN tunnel :) In any case this setup works perfectly and it is very stable. The Problem at last! I want to run a minecraft server and I installed that on a separate user account on the mini server (user=mc) to keep things partitioned. I don't want this server accessible through the anonymized VPN tunnel because there are lots more port scans and hacking attempts through that than over my regular IP and I don't trust java in general. So I added the following pf rule on the mini: ### Allow Minecraft public through user mc pass in on $eth_if proto {tcp,udp} from any to any port 24983 user mc pass out on $eth_if proto {tcp, udp} from any to any user mc And these additions on the border firewall: Inbound: Allow always TCP/UDP from any to 10.0.0.40 (NAS) Outbound: Allow always TCP port 80 from 10.0.0.40 to any (needed for online account checkups) This works fine but only when the OpenVPN/Tunnelblick tunnel is down. When up no connection is possbile to the minecraft server from outside of LAN. inside LAN is always OK. Everything else functions as intended. I believe the redirect_gateway push is close to the root of the problem, but I want to keep that specific VPN provider because of the fantastic throughput, price and service. The Solution? How can I open up the minecraft server port outside of the tunnel so it's only available over en0 not the VPN tunnel? Should I a static route? But I don't know which IPs will be connecting...stumbles How secure would to estimate this setup to be and do you have other improvements to share? I've searched extensively in the last few days to no avail...If you've read this far I bet you know the answer :)

  Read the article

• Disable Network settings (TCP/IP & DNS) on Windows 7 Ultimate

  - by TiD91

  i also read this discussion here How to disable Tcp/Ip settings in windows 7 via GPO? about what i want to do but i still have problems. So here i am: i have a desktop pc with two accounts, both with Administrative rights. One is used by the entire my family, in particular by my brother. The problem is that i set some DNS and IP configurations to let be possible the VNC connection from remote. Now i would like to disable the network settings (TCP/IP and DNS) to prohibit my brother to change it preventing me to connect to it. So how can i do this? I set the policies from GPO but i still can change these settings from his account. Here's a pic of Registry Keys: http://imageshack.us/a/img339/3310/famigliapc2012092017274.png what didn't i do? Thanks in advance for your help. Rub|TiD

  Read the article

• How can one make the title bar text/buttons have better contrast on dark colors in Windows 8?

  - by zeel

  When Windows 8 color setting are set to a very dark color, such as black or navy blue, the title bar text and the minimize/maximize buttons are nearly invisible. This makes dark colors difficult to work with. In Windows 7 there was an advanced color options, this is gone in 8. The registry keys associated with this seem to still be present, but they have no effect. Is there a way to change this? Or a third party application that can do it? I don't want to use the ugly high contrast theme, I want to use the nice Win 8 theme with a dark color.

  Read the article

• Getting started with VNC

  - by Stephen

  I have subscribed to a VPS service for the purpose of running some remote applications. To do this I'm going to need a remote desktop of one sort or another. With this in mind it was suggested that I try Ubuntu. The installation that was prepared for me was Ubuntu 11.10 64 bit (Ubuntu 11.10 (GNU/Linux 2.6.18-348.4.1.el5.028stab107.1 x86_64)) From here I used apt-get install ubuntu-desktop which completed successfully. I rebooted the machine and reconnected via ssh. When I attempt to connect from TightVNC on my Windows machine I get a message about the session being actively refused. What should I do to confirm the service is running? Do I need to setup a firewall rule to allow the ports to pass through? (I am a linux newb so explicitness is appreciated)

  Read the article

• Issues connecting to a pix 501 via console cable

  - by Bourne

  Have a pix 501 that was set up to do filtering and I was working on setting the vpn up when I lost ssh connectivity. Looking at the front, all 4 lan lights blink intensely green but in a very repetitive pattern. The funny thing is there are only 3 devices connected to the 4 ports so that's the first element that doesn't look right to me. Console cable light doesn't turn on when cable is plugged in and have tried rebooting it many many times to see the bootup sequence with no result. Also, I cannot connect to it via pdm or console but the traffic is permitted through. Are there any additional troubleshooting steps I could do or should I count it as dead? Thank you.

  Read the article

• How to merge several detached signatures from different people into one?

  - by Petr Pudlák

  A group of people wants to publish a file and they all want to digitally sign the file as different recipients of the file will have different chains of trust. For simplicity, it's desired that there is only one detached signature file with all the signatures, so that the recipients don't need to check them one by one: foo.tar.gz foo.tar.gz.sig However, for security reasons, every person needs to perform the signing on their computer, it's not possible to create the combined signature by having multiple private keys on one computer and performing the operation with one command. Is it possible with GPG to somehow merge detached signatures of a file from multiple participants?

  Read the article

• Windows port forwarding

  - by carlesso

  This is the scenario: A Windows XP client A Linux Server The client is natted/firewalled/unreacheable from outside, the linux server is public. I need to allow the client, once upon some conditions, to expose the remote desktop port (3389) on the Linux Server, somethig like ssh -R 3389:localhost:3389. I dream it as a service, or something like that so I can start and stop the "forwarding-session" on my needs. I've to pilot this session from some program-language (python or ruby mostly). Any hint? Thanks in advance.

  Read the article

• Virtualbox VM (spawned by Vagrant) running but inaccessible. What now?

  - by Matt V.

  I have a Virtualbox VM running Ubuntu that was started by Vagrant. At some point my ssh session connected to the guest stopped responding. I tried "vagrant halt" from a terminal window on the host (OS X). The shutdown process seemed to also hang. Shutting down the Oracle VM VirtualBox Manager doesn't shut down the VMs themselves. Is there a way in either Vagrant or VirtualBox to force the running VM to shutdown? When running desktop guest OSes, closing the GUI window presents several options for shutting down the guest, but I don't know how to do the equivalent when the guest is running headless.

  Read the article

• How to map command in vim that maintains mode when invoked?

  - by Phoenix

  I'm configuring vim in Mac OS X's Terminal app to do useful things with my arrow keys (among others). For example, I want option-left to move the cursor back one word, similarly to how it works in other Mac applications. In normal mode, this is easy enough; I can simply map the sequence to b. But when I'm in insert mode, I want to stay in insert mode (i.e., map the sequence to <c-o>b. In my .vimrc` file, I have these lines: nmap ^[[xol~ b imap ^[[xol~ <c-o>b Where ^[[xol~ is the character sequence that I've configured Terminal to send when I press option-left. This works, but it gets pretty tedious, especially when I've got nearly two dozen commands that I want to map. Is there a better way to do this?

  Read the article

• Can't unlock locked screen, in Ubuntu 12

  - by Camille Goudeseune

  After locking the screen (with a keystroke bound to xlock -nice 8 -mode blank), I can unlock the screen as expected, but only within a few minutes. After being locked overnight, when I hit a key (even Ctrl+Alt combos), the screen stays black with just a brief white flash across the middle of both monitors. The workaround is to ssh in from another host and restart X. Some months ago, this happened every few weeks. By now it happens almost every morning. How do I even start to diagnose this? What might I look for in log files? (The intermittency is particularly troubling.) Failing that, is there an alternative to xlock aka xlockmore? Hardware: 3-year-old HP minitower, GEForce 9800 GT, two Asus LCD monitors. Software: Ubuntu 12.04.2 LTS. Window manager awesome-wm. NVidia driver 304.88. XLock version xlockmore-5.31.

  Read the article

• Subscript/Superscript Hotkey for Excel 2010 Macro?

  - by advs89

  Background In Excel 2010, for some ridiculous reason, there is no built-in hotkey (or even a button on the toolbar) for subscripting/superscripting text within a text cell. You can, however, highlight the text, right-click the selection, click format, and then check the [x] subscript or [x] superscript checkbox. Question Are there any kinds of excel macros or workarounds to map two keyboard hotkeys to the subscript and superscript keys, respectively? (It should only be, like, two lines of code - one for the event handler and one for the actual procedure call... I would write one myself but my VBA is rusty, at best, and I am pretty confident there is probably already some kind of solution, despite my inability to find one via search engine) Thanks for any help you can provide!

  Read the article

• Server installation logging / logbook / diary?

  - by The MYYN

  Are there some ways field-tested ways to keep a kind of logbook for a server? Including: software installations (and de-installations) custom configurations (e.g. of a webserver, ssh daemon, etc.) personal notes The big picture. I am preparing a server and would like to extensively document the state and how it was established over time, so that a new person can easily see, what's going on and why. The setup is not too complicated, but I would like to do it anyway. I once used something like Maintain /etc with mercurial on Debian and it was nice, but I am looking for a little more flexible solution. Addendum: So I am interested in logging and documentation first. In an ideal world however, I would like to have a command, which in a few steps would take me from a bare newly installed unix system to a functional environment with all the components setup and in place by the means of, say an 'executable' log. But that would be very ideal, I imagine.

  Read the article

• Computer hanged in the middle of bios flashing process

  - by Stalker

  I have a laptop: Toshiba Satellite c660-17j, today I decided to update BIOS. I've downloaded bios updater from manufacturer's web site, and in the middle of flashing process computer hanged. I was waiting more than 30 minutes, but nothing was changed on the screen, i've tryed to PRESS MORE BUTTONS, but there were no reactions, so i've turned it off by removing battery (all other methods failed, even pressing power button for ~10 secs). After that computer can't start. I understand, that there's MESS in BIOS chip, and it's possible to re-flash it with hardware programmer, but I don't have it. I remember, that on some PCs (even on my eeepc) there was possibility to re-flash bios by inserting usb flash-disk (with .dat file on it, which contained BIOS), and power on PC, while holding some keys combination, then PC was switching to BIOS programming mode and re-flashed BIOS, after that it was possible to boot up normaly. Is there a way to recover computer without hardware programming BIOS chip? p.s. sorry for my english.

  Read the article

• Is it possible to pick out what applications that should run through a VPN in Ubuntu 9.10

  - by user31257

  Hi, I'm using Ubuntu 9.10 and I'm wondering if it is possible to pick out what applications that should use a VPN. Say for example that I want to route Transmissions connection through a VPN, but I also want to be able to access my computer over SSH via my usual static IP-adress ( running the SSH- deamon over my normal internet connection) . Is there anyway to do this? As I've been searching the web I found that at least it is possible to set whether you want both your internet connection and your "local network" to go through the VPN or if you want just the "local network" to go through it. I'm using the network-manager-pptp with the pptp- protocol.

  Read the article

• Registering VPS server: some newbie questions [closed]

  - by Angstrem

  I'm new to VPS in particularly and to servers in general. But it turns out that I need to raise and maintain a VPS server. I've decided to register it at https://nodedeploy.com/ but I have lot's of questions, conducted with it. Does that site provide VPS hosting or it is just a web-site hosting? Will the payments for the VPS be done automatically, or I'll have to do them manually? How do I select a VPS OS that will be installed? How do I get the root password? Will it be available after payment? Is ssh access supported there? How can I cancel my account if something goes wrong with my project? What VPS-hosting service would you recommend for using? Maybe, the questions are really full and newbie, but It's really important for me to know that points. I'll be very grateful for any answers.

  Read the article

• How to make a secure MongoDB server?

  - by Earlz

  Hello, I'm wanting my website to use MongoDB as it's datastore. I've used MongoDB in my development environment with no worries, but I'm worried about security with a public server. My server is a VPS running Arch Linux. The web application will also be running on it, so it only needs to accept connections from localhost. And no other users(by ssh or otherwise) will have direct access to my server. What should I do to secure my instance of MongoDB?

  Read the article

• Load on Ubuntu 8.04 LTS high

  - by Paddington

  My Ubuntu 8.04 LTS server periodically has a high load avg spike(once every 2 days) resulting in Apache timing out and virtualy everything even SSH to the server is not possible. When I am on the console and run TOP is see that The load avg increases from less than 1 to above 60 in 15 mins. How can I isolate the cause? top - 09:21:51 up 37 days, 20:18, 6 users, load average: 5.41, 5.53, 5.36 Tasks: 160 total, 2 running, 156 sleeping, 0 stopped, 2 zombie Cpu(s): 65.0%us, 8.8%sy, 0.0%ni, 1.0%id,24.6%wa, 0.3%hi, 0.3%si, 0.0%st Mem: 3989468k total, 3444984k used, 544484k free, 360460k buffers Swap: 11687248k total, 178168k used, 11509080k free, 881772k cached

  Read the article

• Amazon EC2 Socket connection not being accepted

  - by Joseph

  I am trying to run a java application on my EC2 instance. The application accepts socket connections on port 54321. If I try and connect to it, it times out. My Security Group is set as: TCP Port (Service) Source Action 21 0.0.0.0/0 Delete 22 (SSH) 0.0.0.0/0 Delete 80 (HTTP) 0.0.0.0/0 Delete 20393 0.0.0.0/0 Delete 54321 0.0.0.0/0 Delete Is there anything else I need to do? # iptables -nvL Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination # iptables -nvL -t nat Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination #

  Read the article

• How to move mail accounts when migrating webhosting

  - by pkswatch

  I am migrating my website abc.com from one webhosting company to another in a shared hosting environment. Both have cpanel. And the second hosting account i am preparing to move is my multi-domain hosting account with 3 domains already in it. The problem is, i have many email accounts associated with my website abc.com, which are accessed using webmail. So if i move it to the other host, will i lose all those accounts and their emails? If yes, then how should i synchronise the email accounts so that all the accounts and the contained emails remain intact? I saw some several sync tools like IMAP Sync, etc. But these require two hosts while synchronizing, and as you see, i have just one domain name to be synchronized over 2 servers. PS, i do not have any ssh access on either of them, and i have made complete backup of all files using backup wizard in cpanel.

  Read the article

• Running php and java in parallel on the same server

  - by manni

  I have got a java server from Rackspace. and I am already running a java application on the server. Now I want to run a php application on the same server. What should I do? When I asked Rackspace people, they said, apache is already installed on the server so I can run the php on it. I have also tried installing php on the server and then copied my php files in var/www/xxx but when I hit the url it is saying giving the page not found error. They have given me the ssh server root username and password. Thanks in advance.

  Read the article

• Do TCP connections work differently within the same subnet?

  - by Dean

  I've encountered some network behaviour that confuses me while trying to get Java RMI working. I use netcat to connect to a local machine: [my_machine]$ nc -w 1 192.168.0.100 60000 && echo success success I try to do the same to my server: [my_machine]$ nc -w 1 my-servers-ip 60000 && echo success This doesn't work, unless I explicitly listen on the server socket: [amazon_ec2]$ nc -l 60000 [my_machine]$ nc -w 1 my-servers-ip 60000 && echo success success For the version that fails, the SYN packet receives a RST, ACK in response. I'm not too knowledgable about this stuff, at this point I only have wild theories such as the one in the question. Any ideas? Potentially useful details: Local Machine (192.168.0.100) - Macbook Remote Machine (Amazon EC2) - Amazon Linux AMI 2012.03 Security Group Settings: 22 (SSH) 0.0.0.0/0 1099 0.0.0.0/0 49152-65535 0.0.0.0/0 "iptables -L" shows no rules set

  Read the article

• User and Key Press Issues with Putty

  - by DizzyDoo

  Ubuntu Server newbie here, got some annoying issues with remote accessing my box with Putty. When I create a user and then login as that user, the terminal always starts with just '#' and not 'user@hostname:~#' which isn't useful where I want to see where I've changed directory too, like I can normally. Also, when logged in as a user, I can't press the cursor keys to move the caret (blinking thing) around, or press up to see previously executed commands. Instead it gives me this representation of the button pressed: ^[[D ^[[A ^[[B ^[[C. Pressing Delete, too, gives me ^[[3~. This is all strange to me, because when logged in as root, it all works fine. I'm hoping this is just something I've accidentally changed in Putty, or added the user wrongly, or perhaps just got caps lock on. Thanks.

  Read the article

• SSL issues with puppet agent at openSUSE

  - by Roman Grazhdan

  I have a master running at my vps, and it has a simple helloworld manifest which works fine with any ubuntu machine I have. It connects, exchanges keys and creates test file allright, so I'm sure it's not server issue. The agent which is running at a virtual machine with openSUSE says: err: Could not request certificate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed. This is often because the time is out of sync on the server or client I believe it's probably a broken or missing lib, since the package is not built very accurately - it wouldn't start out of the box because of wrong path to lockfile, for example. So how do I figure out what exactly is wrong here? The time is allright, I've checked it. I probably could do without SSL if it's possible, since that SUSE machines are just for training, but it's the last opportunity.

  Read the article

• Setting up linux server with multiple access rights

  - by Mark

  I am a graduate student and want to set up a linux server (preferably Ubuntu) in my office. I also want to give my friends SSH access to that box. My question is can I set up my server such that I can give one of my friends rights to install software on my machine but he cannot brows around outside the directory he is allowed to? Can I set up multiple apache instances (on different ports) for different people? so each has access to their own apache instance?

  Read the article

• centos 5.6, virtual on Vsphere

  - by Glasnhost

  suddenly my virtual centos server (5.6 on VMWare-VSphere) is not working... It started with the url not responding, nor the ip. (NO HTTP response, no ping). When I entered on the server via ssh to start troubleshooting I noticed that most of commands don't work anymore: top- machine hangs (it's not slow anyway) ps - machine hangs (funny enough apache server and web app are running and sending me emails) on some directory ls -l - machine hangs after first file, if ls l.txt the file show only the first file "more" command, also hangs on some file. So there are very little things I can try. I recovered my virtual machine from yesterday and before yesterday, and they show the same behaviour, it hangs on commands (but yesterday they were working). There is no firewall on the machine, there is on the host though. I can connect with ftp but I can't download files nor list directory apart the user top directory... Working hard right now, any idea appreciated

  Read the article

< Previous Page | 260 261 262 263 264 265 266 267 268 269 270 271  | Next Page >