<p>You've deployed a server in a customer environment and you don't have remote
network access configured. The customer is OK with you being able to remote
into their network, but its not practical to set you up with a VPN. Enter the
"Dial-Home Device".</p>
<h1 id="what-is-the-dial-home-device">What is the Dial-Home Device</h1>
<p>It's just an Ubuntu server that repeatedly tries to dial an internet connected
jump box in order to open a reverse session. As soon as the networking is set
up, it will dial home and open itself up for remote administration.</p>
<p>Also, <a href="https://stargate.fandom.com/wiki/Dial_Home_Device">this.</a></p>
<hr>
<h1 id="deploy-the-pivot-server">Deploy the Pivot Server</h1>
<h2 id="whats-a-pivot-server">What's a Pivot Server?</h2>
<p>This is an internet-connected server such as a VPS that the DHD will SSH to.</p>
<p>You'll SSH to it, then from there you can SSH through the DHD's reverse tunnel.</p>
<h2 id="steps-to-deploy">Steps to Deploy</h2>
<h3 id="launch-a-vps">Launch a VPS</h3>
<p>Using AWS, GCP, Azure, Linode, Digital Ocean, so on, launch an
internet-connected Ubuntu server. It needs to have a static, internet routed IP
address. Its not a bad idea to make a DNS entry for it too, so you can change
the IP down the road.</p>
<p>SSH to the server to confirm that it works.</p>
<h3 id="configure-remote-user">Configure Remote User</h3>
<p>These steps will create a user named <code>remoteuser</code></p>
<pre><code class="language-bash"># Create the user
useradd remoteuser

# Set a password for the user
passwd remoteuser

# Create the home &#x26; ssh directories for the user
mkdir -p /home/remoteuser/.ssh
chown -R remoteuser:remoteuser /home/remoteuser

# Disable shell access to the user, so it can't run commands on the pivot
usermod -s /bin/false remoteuser
</code></pre>
<hr>
<h1 id="deploy-the-dial-home-device">Deploy the Dial-Home Device</h1>
<p>Install Ubuntu Server on a physical server or VM at the remote location. This
server should have network connectivity to whatever resource you want to
manage, and outbound internet access (it can ping google).</p>
<h2 id="create-an-ssh-key-on-the-dhd">Create an SSH key on the DHD</h2>
<p>On the DHD server, you may already have SSH keys. Look in <code>~/.ssh</code>. If not,
run the following to create one. Don't use a passphrase, just hit enter when
prompted.</p>
<pre><code class="language-bash">ssh-keygen
</code></pre>
<p>Collect the public key for the next step:</p>
<pre><code class="language-bash">cat ~/.ssh/id_rsa.pub
</code></pre>
<p>For convenience, I like to copy the key to the root user too. Optional.</p>
<h2 id="authorize-the-ssh-public-key-on-the-pivot-serer">Authorize the SSH Public Key on the Pivot Serer</h2>
<p>Back on the Pivot server, edit the remote user's <code>authorized_keys</code> file to
grant this SSH key-pair access. Paste the SSH key at the end of the file</p>
<pre><code class="language-bash">vi /home/remoteuser/.ssh/authorized_keys
</code></pre>
<h2 id="test-a-remote-connection">Test a remote connection</h2>
<h3 id="initiate-the-connection">Initiate the connection</h3>
<p>From the DHD server, open the reverse tunnel manually to make sure it works.</p>
<ul>
<li>Replace the username as needed</li>
<li>The <code>$pivot</code> variable should be the IP or FQDN of the pivot server</li>
<li>Pick a random port in the range 1024-49151 for the listen port.</li>
</ul>
<pre><code class="language-bash">user="remoteuser"
pivot="support.example.com"
port=22222
ssh -fN -R 0.0.0.0:$port:127.0.0.1:22 $user@$pivot
</code></pre>
<h3 id="connect-through-the-pivot">Connect through the pivot</h3>
<p>From the pivot server, SSH to the DHD. This example assumes your username
is <code>myuser</code>.</p>
<pre><code class="language-bash">ssh -p 22222 myuser@127.0.0.1
</code></pre>
<p>Consider adding your public key to the <code>~/.ssh/authorized_keys</code> file now so
passwords aren't needed.</p>
<p>Now you can jump through the pivot into the DHD.</p>
<hr>
<h1 id="persist-the-connection">Persist the Connection</h1>
<h2 id="build-the-dial-home-command">Build the dial-home command</h2>
<p>From any directory, create the script:</p>
<p><code>vi dial-home</code></p>
<pre><code class="language-bash">#!/usr/bin/env bash

# Check if the reverse tunnel  is already open
port=22222
if [[ $(ps aux | grep ssh | grep $port) ]]; then
  # reverse tunnel is open
  exit 0
fi

# tunnel is not open, open it
user="remoteuser"
pivot="support.example.com"
ssh -fN -R 0.0.0.0:$port:127.0.0.1:22 $user@$pivot
</code></pre>
<p>Make the script executable</p>
<pre><code class="language-bash">chmod +x dial-home
</code></pre>
<p>Move the script to somewhere in the <code>$PATH</code></p>
<pre><code class="language-bash">sudo mv dial-home /usr/local/bin/
</code></pre>
<p>Now the <code>dial-home</code> command will open the tunnel.</p>
<h2 id="make-cron-dial-home-every-minute">Make cron dial-home every minute</h2>
<p>The connection will die for lots of reasons. Make it bring itself back online
automatically using cron.</p>
<p>From the DHD, make sure cron is running (by default, it is)</p>
<pre><code class="language-bash">systemctl status cron
</code></pre>
<p>Edit the crontab</p>
<p><code>sudo vi /etc/crontab</code></p>
<p>and insert this line, where <code>myuser</code> is your username on the DHD.
If you use root, you have to also give root the ssh private key.</p>
<pre><code class="language-text">* * * * *   myuser dial-home
</code></pre>
<p>Reload cron</p>
<pre><code class="language-bash">service cron reload
</code></pre>
<p>Then kill the session (using <code>ps aux</code> and <code>kill</code>) then watch it come back.</p>
<p>Done. Now the server is a dial-home device. It will constantly dial your pivot
server and re-open the session whenever its closed. To lock the server out,
just remove its public key from <code>remoteuser</code>'s <code>authorized_keys</code> file.</p>


<p>One pain point I often have is SSH forwarding the ports for a bunch of web
services and IPMI/IDRAC/ILO/Whatever connections through my pivot server to my
workstation. Its really tedious, and having a web UI right on the jump server's
subnet can be really helpful.</p>
<p>In this guide, I show how I launch Chrome on a remote Ubuntu server without
ever installing any graphics tools like Ubuntu Desktop on that server, and
without needing VNC/RDP/PCOIP/etc. X11 forwarding lets the XQuarts process on
a MacBook render the browser, while it still uses the networking on the Ubuntu
server it launched from.</p>
<hr>
<h3 id="table-of-contents">Table of Contents</h3>
<ul>
<li><a href="#configure-workstation-macbook-ssh-settings-for-x11-forwarding">Configure Workstation (MacBook) SSH Settings for X11 Forwarding</a>
<ul>
<li><a href="#set-xauthlocation">Set XAuthLocation</a></li>
<li><a href="#enable-forwardagent-and-forwardx11">Enable ForwardAgent and ForwardX11</a></li>
</ul>
</li>
<li><a href="#remotely-launch-graphical-apps-with-xwindows">Remotely Launch Graphical Apps with XWindows</a>
<ul>
<li><a href="#install-chrome">Install Chrome</a></li>
<li><a href="#install-x11-apps-for-xeyes">Install X11-apps for xeyes</a></li>
</ul>
</li>
<li><a href="#launch-forwarded-xwindows-session">Launch Forwarded XWindows Session</a>
<ul>
<li><a href="#open-ssh-session-with-x11-forwarding-enabled">Open SSH session with X11 Forwarding Enabled.</a></li>
</ul>
</li>
<li><a href="#troubleshooting">Troubleshooting</a>
<ul>
<li><a href="#xauth--timeout-in-locking-authority-file-xauthority">xauth:  timeout in locking authority file ~/.Xauthority</a></li>
<li><a href="#display-is-empty-no-xauth-program">$DISPLAY is Empty, No xauth program</a></li>
<li><a href="#x11-connection-rejected-because-of-wrong-authentication">X11 connection rejected because of wrong authentication.</a></li>
</ul>
</li>
<li><a href="#reference-links">Reference Links</a></li>
</ul>
<h1 id="configure-workstation-macbook-ssh-settings-for-x11-forwarding">Configure Workstation (MacBook) SSH Settings for X11 Forwarding</h1>
<p>If you're not using a MacBook, this won't apply.</p>
<h2 id="set-xauthlocation">Set XAuthLocation</h2>
<p>The workstation needs to allow X11 forwarding. Some brilliant update broke it
in my version of Mac OS I had to set the XAuthLocation in <code>ssh_config</code>.</p>
<p><code>vi /etc/ssh/ssh_config</code></p>
<pre><code class="language-bash">Host *
  SendEnv LANG LC_*
  XAuthLocation /usr/X11/bin/xauth
  ServerAliveInterval 60
  ForwardX11Timeout 596h
</code></pre>
<h2 id="enable-forwardagent-and-forwardx11">Enable ForwardAgent and ForwardX11</h2>
<p>My hostname was <code>adc-bmc</code> and its IP was 192.168.2.2. Alter this as needed.
On your workstation:</p>
<p><code>vi ~/.ssh/config</code></p>
<pre><code class="language-bash">Host adc-bmc
  HostName 192.168.2.2
  ForwardAgent yes
  ForwardX11 yes
</code></pre>
<h1 id="remotely-launch-graphical-apps-with-xwindows">Remotely Launch Graphical Apps with XWindows</h1>
<h2 id="install-chrome">Install Chrome</h2>
<p>You can use Firefox or whatever instead. Chrome's install will fail due to
missing dependencies, but apt can sort it out.</p>
<pre><code class="language-bash">wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
dpkg -i google-chrome-stable_current_amd64.deb
apt-get install -f
dpkg -i google-chrome-stable_current_amd64.deb
</code></pre>
<h2 id="install-x11-apps-for-xeyes">Install X11-apps for xeyes</h2>
<p>This is just for fun and testing. Xeyes is kind of neat.</p>
<pre><code>apt-get install -y x11-apps
</code></pre>
<hr>
<h1 id="launch-forwarded-xwindows-session">Launch Forwarded XWindows Session</h1>
<h2 id="open-ssh-session-with-x11-forwarding-enabled">Open SSH session with X11 Forwarding Enabled.</h2>
<p>XWindows can be passed through SSH. Open a new terminal window and connect to
the server using the <code>-X</code> flag to enable X forwarding on the client.</p>
<p>The xeyes application is a fun test.</p>
<pre><code class="language-bash">ssh -X myuser@192.168.2.2 xeyes
</code></pre>
<p>If that works, try Chrome. The extra flags enable compression and use a faster
encryption algorithm. If they cause problems, just use <code>-X</code>.</p>
<pre><code class="language-bash">ssh -XC -c chacha20-poly1305@openssh.com myuser@192.168.2.2 google-chrome
</code></pre>
<h1 id="troubleshooting">Troubleshooting</h1>
<h2 id="xauth--timeout-in-locking-authority-file-xauthority">xauth:  timeout in locking authority file ~/.Xauthority</h2>
<p>As your not-root user, remove and <code>chmod</code> some files.</p>
<pre><code class="language-bash">sudo rm ~/.Xauthority-c
sudo rm ~/.Xauthority-l
sudo rm -r ~/.Xauthority
mkdir ~/.Xauthority
chmod 0600 ~/.Xauthority
</code></pre>
<h2 id="display-is-empty-no-xauth-program">$DISPLAY is Empty, No xauth program</h2>
<p>On your mac, if you connect with <code>ssh -v -X ...</code> and you get an error line
saying <code>No xauth program</code>, then you need to edit your SSH config to specify
the xauth path. Mine was <code>/usr/X11/bin/xauth</code>.</p>
<h2 id="x11-connection-rejected-because-of-wrong-authentication">X11 connection rejected because of wrong authentication.</h2>
<p>If you're on Mac, this can happen when you didn't set the <code>XAuthLocation</code> ssh
configuration.</p>
<h1 id="reference-links">Reference Links</h1>
<ul>
<li><a href="https://linuxize.com/post/how-to-install-google-chrome-web-browser-on-ubuntu-18-04/">linuxize.com - Install chrome</a></li>
<li><a href="https://github.com/dnschneid/crouton/issues/2676">github.com - x11 forwarding tshooting</a></li>
</ul>


Kyle Pericak

"It works in my environment"

Categories

Tags