![]() |
ubuntu.com - launchpad.net - ubuntu help
|
|
|||||||
|
Tutorials & Tips The place to find Ubuntu related Tips & Tricks. |
|
|
Thread Tools | Display Modes |
|
|
#1 |
|
Spilled the Beans
![]() Join Date: Dec 2005
Beans: 13
Dapper Drake Testing/
|
Secure Remote Access with Hamachi and VNC
--------------------------------------------- ---- Update: 4/19/06 - Added 'Single User' configuration instructions for Hamachi and installation of gHamachi (Hamachi gtk GUI). ---- By KingOfNowhere This is a How-To for setting up a secure VNC server by tunnelling it through a Hamachi virtual private network. By setting up VNC this way, it allows you to access your machine securely (using Hamachi's encryption) and makes your machine accessable from anywhere on the net. Before I jump right in, here is some background: Hamachi is a zero-config VPN client for Windows and Linux (currently Beta for Mac). It allows you to, very easily, create a virtual private network that can be logged into and accessed for all over the net. It does this by creating IP tunnels to each VPN client, making them directly accessable to all the other clients on the VPN. Hamachi also encrypts the connections it creates to allow for secure access. VNC is a widely used, cross-platform application that allows for remote desktop access. Together, these apps can allow for secure, remote access to you machine from anywhere. Lastly, before I begin the guide, I would like to give credit to those I referenced for this guide: HOWTO: Hamachi Linux Guide (2.4.x and 2.6.x) By Kamel and HOWTO: Set up VNC server with resumable sessions By Tichondrius thx guys. Anyway on to the guide. --------------------------------------------- Part 1: Hamachi 1.A) The 'tun' Module The very first part of the Hamachi installation is to enable IP Tunnelling support in your kernel. This can be done like this: Code:
sudo modprobe tun Code:
sudo gedit /etc/modules 1.B) Installing Hamachi Okay, now on to the actual Hamachi software. But first, we need to make sure that a valid tunnelling node has been created in /dev. This is done like this: Code:
ls /dev/net/tun Code:
sudo mkdir /dev/net sudo mknod /dev/net/tun c 10 200 Download the latest version of Hamachi from http://www.hamachi.cc/download. Enter the directory where you downloaded it and here is how to install it: Code:
#Extract the archive tar -zxvf hamachi-0.9.9.9-x.tar.gz cd hamachi-0.9.9.9-x/ #install Hamachi sudo make install sudo tuncfg #Hamachi is installed For security sake, we are going to set the permissions of Hamachi so that it can only be started by members of the 'hamachi' group. This is done like so: Code:
#Create the 'hamachi' group sudo groupadd hamachi #Add your user to the group sudo gpasswd -a user hamachi #Add root to the group sudo gpasswd -a root hamachi #Set socket permissions sudo chmod 760 /var/run/tuncfg.sock #Finally, changing the group of the file sudo chgrp hamachi /var/run/tuncfg.sock 1.D) Hamachi Configuration - System Service Follow this section if you want Hamachi to run as a system service (in the background). I chose to list this method of configuration first because it seemed most relivant to the guide. If you want to have Hamachi run as a user application and install the gtk frontend, skip to section '1.E'. 1.D.1) Base Configuration Creating an initial configuration can be done like so: Code:
sudo hamachi-init -c /etc/hamachi Code:
Initializing Hamachi configuration (/etc/hamachi). Please wait .. generating 2048-bit RSA keypair .. ok making /etc/hamachi directory .. ok saving /etc/hamachi/client.pub .. ok saving /etc/hamachi/client.pri .. ok saving /etc/hamachi/state .. ok Authentication information has been created. Hamachi can now be started with 'hamachi start' command and then brought online with 'hamachi login'. Code:
sudo hamachi -c /etc/hamachi start Code:
sudo hamachi -c /etc/hamachi set-nick "YourNickHere" Code:
#Login to Hamachi sudo hamachi -c /etc/hamachi login #To join an existing network sudo hamachi -c /etc/hamachi join network password #Or to create a new network sudo hamachi -c /etc/hamachi create network password #Lastly, to go online to the network you joined sudo hamachi -c /etc/hamachi go-online network I would recommend visiting http://grc.com/passwords for a random string password. They are very strong passwords and adds to the security of your setup. Now your machine is up and running on it's own Hamachi VPN. The last part of the installation is a script written by Kamel that will allow Hamachi to run on startup. 1.D.2) Hamachi Startup Script Open gedit and save the following as /etc/init.d/hamachi Code:
#!/bin/sh
hamachi_start() {
echo "Starting hamachi..."
/sbin/tuncfg
/usr/bin/hamachi -c /etc/hamachi start
/bin/chmod 760 /var/run/tuncfg.sock
/bin/chgrp hamachi /var/run/tuncfg.sock
}
hamachi_stop() {
echo "Stopping hamachi..."
killall tuncfg
/usr/bin/hamachi -c /etc/hamachi stop
}
hamachi_restart() {
hamachi_stop
sleep 1
hamachi_start
}
case "$1" in
'start')
hamachi_start
;;
'stop')
hamachi_stop
;;
'restart')
hamachi_restart
;;
*)
hamachi_start
esac
Code:
sudo chmod +x /etc/init.d/hamachi sudo update-rc.d hamachi defaults Follow this section if you want Hamachi to run as a user application and to use the pretty gtk frontend. If you want to have Hamachi run as a system service in the background, go back to section '1.D'. 1.E.1) Base Configuration Creating an initial configuration can be done like so: Code:
hamachi-init Code:
Initializing Hamachi configuration (/home/user/.hamachi). Please wait .. generating 2048-bit RSA keypair .. ok making (/home/user/.hamachi directory .. ok saving (/home/user/.hamachi/client.pub .. ok saving (/home/user/.hamachi/client.pri .. ok saving (/home/user/.hamachi/state .. ok Authentication information has been created. Hamachi can now be started with 'hamachi start' command and then brought online with 'hamachi login'. Code:
hamachi start Code:
hamachi set-nick "YourNickHere" Code:
#Login to Hamachi hamachi login #To join an existing network hamachi join network password #Or to create a new network hamachi create network password #Lastly, to go online to the network you joined hamachi go-online network I would recommend visiting http://grc.com/passwords for a random string password. They are very strong passwords and adds to the security of your setup. Now your machine is up and running on it's own Hamachi VPN. The last part of the installation is to install the GUI for Hamachi. Here is how that is done. 1.E.2) Hamachi GUI (gHamachi) Installation First, visit the Hamachi forums and download the most recent version of the gHamachi frontend for either gtk 2.0 or gtk 1.2 (whichever you prefer). gHamachi can be found here. Second, simply unpack the gHamachi tarball, copy the binary to /usr/bin, and give it permission to run (chmod +x). Code:
tar xfz gHamachi_gtk2.tar.gz sudo mv ghamachi /usr/bin/ sudo chmod +x /usr/bin/ghamachi Start the GUI like this: Code:
ghamachi Part 2: VNC This section of my guide is largely based on Tichondrius' Guide, nice guide man. This part of the guide is currently intended only for those using the Gnome desktop. For those of you using KDE or something else, please refer to other threads on this forum or the VNC Homepage. 2.A) Enabling XDMCP in Gnome There are a few settings that need to be set inside Gnome before we begin: System -> Administration -> Login Screen Setup Security Tab -> Enable XDMCP XDMCP Tab -> Disable "Honor Indirect Requests" Next we need to install the required packages. 2.B) Installing VNC and xinetd First, make sure you have the Universe repository added to your apt.sources. If you dont know how to do that, look here. Next, install VNC and xinetd: Code:
sudo apt-get install vnc4server xinetd Code:
sudo vncpasswd /root/.vncpasswd Code:
service Xvnc
{
type = UNLISTED
disable = no
socket_type = stream
protocol = tcp
wait = yes
user = root
server = /usr/bin/Xvnc
server_args = -inetd :1 -query localhost -geometry 1024x768 -depth 16 -once -fp /usr/share/X11/fonts/misc -DisconnectClients=0 -NeverShared passwordFile=/root/.vncpasswd
port = 5901
}
Code:
sudo /etc/init.d/xinetd stop sudo killall Xvnc sudo /etc/init.d/xinetd start Code:
vncviewer localhost:1 Part 3: Settings and Usage 3.A) Firewalls To keep your machine secure with these newly installed services, I recommend these additional settings in your firewall: For XDMCP -> only allow incoming connections from 5.x.x.x (Hamachi subnet) to Ports 6000-6009 For VNC -> only allow incoming connections from 5.x.x.x (Hamachi subnet) to Port 5901 Filtering these ports this way, will only allow Hamachi connections to connect to these services. *NOTE FOR FIRESTARTER USERS* If you use the Firestarter firewall, then you must add these two lines to your '/etc/firestarter/user-pre' file to accept connections on the Hamachi interface: Code:
$IPT -A INPUT -i ham+ -j ACCEPT $IPT -A OUTPUT -o ham+ -j ACCEPT Code:
sudo /etc/init.d/firestarter restart 3.B) Usage Now that your machine is all setup and configured, accessing your machine remotely becomes as easy as a few simple steps. - On the Connecting Machine - You need to install Hamachi on the connecting machine and join the network your destination machine is on. Then, you need to install a VNC Viewer on the connecting machine. Once Hamachi is setup and VNC Viewer is installed on the connecting machine, all you need to do now is open a VNC connection to your destination machine's Hamachi IP address (ex. 5.x.x.x) on display 1 (ex. 5.x.x.x:1). For Example: Server = 5.18.36.109:1 *Do not forget to specify the ':1' after the IP address, otherwise you won't connect. Then, all you have to do is enter your VNC password, then login as your user. Now that you are logged into your machine remotely, my guide is done here. ---------------------------------------------- I hope everyone finds this informative. Any corrections are welcome. And thanks again to Kamel and Tichondrius for their guides, they really helped me out. - KingOfNowhere
__________________
Unleash the Code... Open Source your Software. Last edited by KingOfNowhere; April 19th, 2006 at 06:20 PM.. |
|
|
|
|
|
#2 |
|
Spilled the Beans
![]() Join Date: Dec 2005
Beans: 13
Dapper Drake Testing/
|
Re: HOW-TO Secure Remote Access - Hamachi+VNC
Hamachi Update:
The developers of hamachi are currently working on Hamachi for Mac OS X, with the completion of this, hamachi will work across all platforms (Win, Lin, Mac). -KingOfNowhere
__________________
Unleash the Code... Open Source your Software. |
|
|
|
|
|
#3 |
|
Just Give Me the Beans!
![]() Join Date: Mar 2005
Location: Hungary, Győr
Beans: 68
Ubuntu 6.06
|
Re: HOW-TO Secure Remote Access - Hamachi+VNC
Hi!
Nice work! You should add the following command at the end: Code:
sudo update-rc.d hamachi defaults |
|
|
|
|
|
#4 |
|
Way Too Much Ubuntu
![]() |
Re: HOW-TO Secure Remote Access - Hamachi+VNC
cool howto
what is the passwd for network #To join an existing network sudo hamachi -c /etc/hamachi join network password it said Code:
Creating network .. failed, network name is already taken
__________________
Juventus the champion |
|
|
|
|
|
#5 |
|
Way Too Much Ubuntu
![]() |
Re: HOW-TO Secure Remote Access - Hamachi+VNC
The hamachi start script will not work unless you run it as root. And if you run hamachi as root there's no need to change tuncfg.sock to writable for hamachi group.
|
|
|
|
|
|
#6 | |
|
Way Too Much Ubuntu
![]() |
Re: HOW-TO Secure Remote Access - Hamachi+VNC
Quote:
So you have to create your own network or join an existing one. To create do "sudo hamachi -c /etc/hamachi create network password" and replace network with the name you want and password with the password you want. Last edited by Rizado; March 29th, 2006 at 11:17 AM.. |
|
|
|
|
|
|
#7 |
|
Way Too Much Ubuntu
![]() |
Re: HOW-TO Secure Remote Access - Hamachi+VNC
so i can skip this ans continuoe with howto
__________________
Juventus the champion |
|
|
|
|
|
#8 | |
|
Way Too Much Ubuntu
![]() |
Re: HOW-TO Secure Remote Access - Hamachi+VNC
To use hamachi you have to either create a network or join an existing one. You don't need hamachi at all to use vnc. Quote from http://www.hamachi.cc/
Quote:
|
|
|
|
|
|
|
#9 |
|
5 Cups of Ubuntu
![]() Join Date: Aug 2005
Beans: 23
|
Re: HOW-TO Secure Remote Access - Hamachi+VNC
Namesa and KingOfNowhere...
Is it necessary to issue the command: sudo update-rc.d hamachi defaults And at what point should I enter it? Thanks Sidd.... |
|
|
|
|
|
#10 |
|
First Cup of Ubuntu
![]() |
Re: HOW-TO Secure Remote Access - Hamachi+VNC
Thanks for the great tutorial!
|
|
|
|
| Bookmarks |
| Thread Tools | |
| Display Modes | |
|
|