Useful Commands/Security

Frequently Used Commands

TODO	Command
Automatically accept fingerprint.	ssh -o "StrictHostKeyChecking no" ...
Indirect outgoing for PostgreSQL	# [Private] # localhost -> localhost:15432 # -> server:22 # -> somewhere.com:5432 ssh -NCfL 15432:somewhere.com:5432 server # [Shared] # any -> *:15432 # -> server:22 # -> somewhere.com:5432 ssh -NCfL *:15432:somewhere.com:5432 server
Indirect outgoing for Web	# [Private] # localhost -> localhost:3128 # -> server:22 # -> *:* ssh -NCfD localhost:3128 server # [Shared] # any -> *:3128 # -> server:22 # -> *:* ssh -NCfD *:3128 server
Share MariaDB in LAN	# Step 1: Listen (Run at LAN) # Listen server:13306 -> server:22 # -> localhost:3306 ssh -NCfR 13306:localhost:3306 server # Step 2: Share (Run at Home/WAN) # any -> server:3306 # -> server:13306 # -> server:22 # -> localhost:3306 ssh -NCfL *:3306:localhost:13306 localhost
List tunnels	# List full commands. ps ax | awk '/ssh \-NCf/ { print $0 }' # List settings. ps ax | awk '/ssh \-NCf/ { print $7 }' # List pids. ps ax | awk '/ssh \-NCf/ { print $1 }' # Kill all tunnels. kill $(ps ax | awk '/ssh \-NCf/ { print $1 }')
Generate key pair	# Save as default name id_rsa, id_rsa.pub ssh-keygen # Save as thefuck, thefuck.pub without password ssh-keygen -f abc -N '' # Save as thefuck, thefuck.pub with password ssh-keygen -f abc -N '12345' # Generate ed25519 key ssh-keygen -t ed25519 -f sucks.pem ssh-keygen -t ed25519 -f sucks.pem -C nobody@sucks.com
Generate public key from private key	# Dump ssh-keygen -yf thefuck.pem # Save as file ssh-keygen -yf thefuck.pem > thefuck.pub # Save as authorized_keys (while ~/.ssh/authorized_keys didn't exist) ssh-keygen -yf thefuck.pem > authorized_keys # Append into authorized_keys ssh-keygen -yf thefuck.pem >> authorized_keys

Access resources without VPN

Lesson 1: UDP -> UDP

Command	Routing
sudo socat -d -d \ udp4-recvfrom:53,bind=127.0.0.1,fork \ udp4-sendto:8.8.8.8:53

Lesson 2: UDP -> TCP -> UDP

Command	Routing
sudo socat -d -d \ udp4-recvfrom:53,bind=127.0.0.1,fork \ tcp4:127.0.0.1:1053 socat -d -d \ tcp4-listen:1053,bind=127.0.0.1,fork \ udp4-sendto:8.8.8.8:53

Lesson 3: UDP -> SSH -> TCP -> UDP

Command	Routing
# Step 1. SSH -> TCP -> UDP (Run at Office) socat -d -d -lf socat.log \ tcp4-listen:1053,bind=127.0.0.1,fork \ udp4-sendto:192.168.1.1:53 & ssh -NCfR 1053:127.0.0.1:1053 home # Step 2. UDP -> TCP -> SSH -> TCP -> UDP (Run at Home) sudo socat -d -d -lf socat.log \ udp4-recvfrom:53,bind=127.0.0.1,fork \ tcp4:127.0.0.1:1053 &

Lesson 4: Forward HTTP

# Step 1. SSH -> TCP -> UDP (Run at Office)
socat -d -d -lf socat.log \
  tcp4-listen:1053,bind=127.0.0.1,fork \
  udp4-sendto:192.168.1.1:53 &

ssh -NCfR 1053:127.0.0.1:1053 home

# Step 2. SSH -> SOCKS -> HTTP (Run at office)
ssh -NCfD 127.0.0.1:3128 localhost
ssh -NCfR 3128:127.0.0.1:3128 home

# Step 3. UDP -> TCP -> SSH -> TCP -> UDP (Run at Home)
sudo socat -d -d -lf socat.log \
  udp4-recvfrom:53,bind=127.0.0.1,fork \
  tcp4:127.0.0.1:1053 &

Lesson 5: Improve connection quality

~/bin/mksvc.sh

Create SOCKS and TCP DNS services.

socat -d -d -lf socat.log \
  tcp4-listen:1053,bind=127.0.0.1,fork \
  udp4-sendto:192.168.1.1:53 &

ssh -NCf -D 127.0.0.1:3128 localhost

~/bin/mktun.sh

Make tunnels.

ssh -NCf \
  -MS revtun.ctrl \
  -R 1053:127.0.0.1:1053 \
  -R 13128:127.0.0.1:3128 \
  home

~/bin/rmtun.sh

Remove tunnels.

if [ -e /tmp/revtun.ctrl ]; then
  ssh -S /tmp/revtun.ctrl -O exit home
fi

~/.ssh/config

Make the ssh connection more reliable.

Host                home
Hostname            x.x.x.x
User                user
IdentityFile        ~/.ssh/mykey.pem
TCPKeepAlive        yes
ServerAliveInterval 60
ServerAliveCountMax 3

crontab -e

Create tunnels during 7:30~09:30, 21:00~22:00 only.

# 07:30 ~ 09:30
30   07   *   *   *   ~/bin/mktun.sh
30   09   *   *   *   ~/bin/rmtun.sh
# 21:00 ~ 22:00
00   21   *   *   *   ~/bin/mktun.sh
00   22   *   *   *   ~/bin/rmtun.sh

Homework

Do it at home. NAS is a good choice.

sudo socat -d -d -lf socat-dns.log \
  udp4-recvfrom:53,bind=*,fork \
  tcp4:127.0.0.1:1053 &

sudo socat -d -d -lf socat-socks.log \
  tcp4-listen:3128,bind=*,fork \
  tcp4:127.0.0.1:13128