Useful Commands/Security

Frequently Used Commands

TODO	Command
Indirect outgoing for PostgreSQL	# [Private] # localhost -> localhost:15432 # -> server:22 # -> somewhere.com:5432 ssh -NCfL 15432:somewhere.com:5432 server # [Shared] # any -> *:15432 # -> server:22 # -> somewhere.com:5432 ssh -NCfL *:15432:somewhere.com:5432 server
Indirect outgoing for Web	# [Private] # localhost -> localhost:3128 # -> server:22 # -> *:* ssh -NCfD localhost:3128 server # [Shared] # any -> *:3128 # -> server:22 # -> *:* ssh -NCfD *:3128 server
Share MariaDB in LAN	# Step 1: Listen (Run at LAN) # Listen server:13306 -> server:22 # -> localhost:3306 ssh -NCfR 13306:localhost:3306 server # Step 2: Share (Run at Home/WAN) # any -> server:3306 # -> server:13306 # -> server:22 # -> localhost:3306 ssh -NCfL *:3306:localhost:13306 localhost
List tunnels	# List full commands. ps ax | awk '/ssh \-NCf/ { print $0 }' # List settings. ps ax | awk '/ssh \-NCf/ { print $7 }' # List pids. ps ax | awk '/ssh \-NCf/ { print $1 }' # Kill all tunnels. kill $(ps ax | awk '/ssh \-NCf/ { print $1 }')
Generate key pair	# Save as default name id_rsa, id_rsa.pub ssh-keygen # Save as thefuck, thefuck.pub without password ssh-keygen -f abc -N '' # Save as thefuck, thefuck.pub with password ssh-keygen -f abc -N '12345'
Generate public key from private key	# Dump ssh-keygen -yf thefuck.pem # Save as file ssh-keygen -yf thefuck.pem > thefuck.pub # Save as authorized_keys (while ~/.ssh/authorized_keys didn't exist) ssh-keygen -yf thefuck.pem > authorized_keys # Append into authorized_keys ssh-keygen -yf thefuck.pem >> authorized_keys

Access resources without VPN

Lesson 1: UDP -> UDP

Command	Routing
sudo socat -d -d \ udp4-recvfrom:53,bind=127.0.0.1,fork \ udp4-sendto:8.8.8.8:53

Lesson 2: UDP -> TCP -> UDP

Command	Routing
sudo socat -d -d \ udp4-recvfrom:53,bind=127.0.0.1,fork \ tcp4:127.0.0.1:1053 socat -d -d \ tcp4-listen:1053,bind=127.0.0.1,fork \ udp4-sendto:8.8.8.8:53

Lesson 3: UDP -> SSH -> TCP -> UDP

Command	Routing
# Step 1. SSH -> TCP -> UDP (Run at Office) socat -d -d -lf socat.log \ tcp4-listen:1053,bind=127.0.0.1,fork \ udp4-sendto:192.168.1.1:53 & ssh -NCfR 1053:127.0.0.1:1053 home # Step 2. UDP -> TCP -> SSH -> TCP -> UDP (Run at Home) sudo socat -d -d -lf socat.log \ udp4-recvfrom:53,bind=127.0.0.1,fork \ tcp4:127.0.0.1:1053 &

Lesson 4: Forward HTTP

# Step 1. SSH -> TCP -> UDP (Run at Office)
socat -d -d -lf socat.log \
  tcp4-listen:1053,bind=127.0.0.1,fork \
  udp4-sendto:192.168.1.1:53 &

ssh -NCfR 1053:127.0.0.1:1053 home

# Step 2. SSH -> SOCKS -> HTTP (Run at office)
ssh -NCfD 127.0.0.1:3128 localhost
ssh -NCfR 3128:127.0.0.1:3128 home

# Step 3. UDP -> TCP -> SSH -> TCP -> UDP (Run at Home)
sudo socat -d -d -lf socat.log \
  udp4-recvfrom:53,bind=127.0.0.1,fork \
  tcp4:127.0.0.1:1053 &

Lesson 5: Improve connection quality

• Create two tunnels in single connection.
• Make the ssh connection controllable.
• Make the ssh connection more reliable.

~/bin/mksvc.sh

socat -d -d -lf socat.log \
  tcp4-listen:1053,bind=127.0.0.1,fork \
  udp4-sendto:192.168.1.1:53 &

ssh -NCf -D 127.0.0.1:3128 localhost

~/bin/mktun.sh

ssh -NCf \
  -MS revtun.ctrl \
  -R 1053:127.0.0.1:1053 \
  -R 3128:127.0.0.1:3128 \
  home

rmtun.sh

ssh -S revtun.ctrl -O exit home

~/.ssh/config

Host                home
Hostname            x.x.x.x
User                user
IdentityFile        ~/.ssh/mykey.pem
TCPKeepAlive        yes
ServerAliveInterval 60
ServerAliveCountMax 3

DNS

sudo socat -d -d -lf socat.log \
  udp4-recvfrom:53,bind=127.0.0.1,fork \
  tcp4:127.0.0.1:1053 &

crontab -e

Create tunnels during 7:30~09:30, 21:00~22:00.

30   7   *   *   *   ~/bin/mktun.sh
30   9   *   *   *   ~/bin/rmtun.sh
00  21   *   *   *   ~/bin/mktun.sh
00  22   *   *   *   ~/bin/rmtun.sh