Sunday, March 13, 2011

The Perfectly Formed Tunnel


You might have heard of the term tunneling when talking security, but what does it actually mean, why do we need it, how do we do it... and just how many spoons does it take?

The concept is super simple, as is the implementation actually, but let's start with a scenario. Using a simple secure proxy works just fine for general port 80 Internet use, but say I wanted to connect to something that didn't offer me a secure connection, an old mail client perhaps? That retro FTP server I've had running since the early 90s? That IRC bot that was never designed for secure use? That badly designed game or voice server?

Remember that these services would have to be running on a server you owned; you could still use a tunnel to connect to other services outside of your "domain", but the traffic from your server TO that service would not be super secure.

A good example of when this is a great idea is International travel. International law about what is and isn't acceptable is grey and sometimes purposefully vague about what can and cannot be transmitted/received, and it some countries *cough*China*cough* traffic is heavily monitored.

By establishing a tunnel to your server in your home territory first, you are removing (or at least restricting) that access.

Another neat concept with tunneling is that you can apply it on either a port level (eg encrypt all port 25 traffic), which will be system wide against that port, or on a system level, which will direct ALL traffic through the tunnel. If you want to be super secure just plugging your proxy server into Firefox just won't be enough... and heck you should be using Chrome now to boot... get with the program!

Another nice feature of tunneling is that it is established through SSH, which allows us to use no-password-authentication, using a certificate, eliminating the need for a password. The certificate just has to be present and the connection will establish. You could therefore have the certificate installed on a USB key and keep it with you at all times, and there you have a seriously secure connection. Then you just need to instruct your server to only accept certificates and you are on your way to being just a little more secure. You also might want to consider implanting a copy in your arm in case you loose the original (surgery may be required).

How do I do this then? - you ask spoon at the ready. First of all remember that there are many different base systems out there, along different versions of SSH, so this will act as a guide only, with a simple Linux server that would be considered a pretty common dedicated server right now (Linux 2.6.18-164.11.1.el5 i686 i386 GNU/Linux). Remember that you can still use SSH with other server variants (Windows Server -shudder- for example), you just need the appropriate software.

Q: How would we establish a connection to the server via SSH to send commands?

A: ssh username@yourserver.address.com

Sounds simple enough? We would obviously have to have SSH enabled for our account on the server, and if we didn't have a certificate to authenticate us it would then ask for a password.

Q: How could I tunnel an port through SSH?

A: ssh -f username@yourserver.address.com -L 25:localhost:25 -N

See how we did that? The -f switch tells the command to run in the background, but you might like to leave it visible for peace of mind. The -L is the local port redirection and the -N tells the server that we don't want to execute any commands, so don't even give us a prompt. So far so good? Remember I don't need to keep these ports the same (great for avoiding port restrictions)... so if my corporate firewall disallowed say... SMTP on port 25, I could remap it to port 2500 getting secure mail AND bypassing the firewall.

All I would need to do with the above is instruct the mail client to connect to localhost on port 25 and I'd be good to go.

Q: How could I tunnel everything through SSH?

A: It's easily possible, but requires more of a workaround. See when your computer accesses Internet services they all sit at different levels and use different protocols to connect, so we can't just demand that all traffic go through a secure channel. FFT we could do this at a ROUTER level. Take a look at http://www.plenz.com/tunnel-everything which will give you an idea on how to accomplish this with Linux and there is always Google if you are choosing to convene with the Devil.

Resources

* http://www.revsys.com/writings/quicktips/ssh-tunnel.html
* http://www.plenz.com/tunnel-everything

FFT

* Reverse Tunnelling - so that you are re-tunneling back to yourself if an uplink needs to be made - http://www.techrepublic.com/article/setting-up-a-reverse-ssh-tunnel/5779944

Friday, December 17, 2010

Extracts

Chapter 12 - Gain, High.

The arena is almost empty, the bright red paint on the cheap wooden seating wearing away to reveal the dark wood underneath. Usually packed full, deafening and smelly; filled with tourists, beggars, workmen, officers, and of course Nehuma's elite, this doesn't seem like the same arena during the waking hours.

There is a small friendly game underway, and the novice bookkeepers are out in few, collecting bets for just a couple of Kai per match. They move quickly around the few spectators in the arena, their little dirty jackets weaving in and out of the empty seats. You've got to start somewhere.

I take a seat. It's surprisingly comfortable thanks to the thousands of backsides that have previously visited.

The game bell rings, and the match starts. The rotating long boats with their targets, apparently resembling ancient Hosai warriors, with their black eyes, thin long faces and shaggy short hair. On their torso is a black splodge of paint, defining their black, evil hearts.

I wonder how many people actually appreciate the history behind this game, the battle between "good and evil" that underpins the battles fought all around Nehuma hundreds of years ago. I sit there somehow doubting it.

The game is now in full swing, with the bank of contenders sitting in two rows, facing out into the arena focusing intently on the rapidly moving long boats. I muse that they look like a panel of jurors, about to deliver a deadly verdict.

The boats rotate around the arena at such a speed that they become a blur. I can't even focus on one of the evil-doers now, let alone get a shot-off. The trained contenders however have developed their cortical reflexes to slow when processing the boats. I phase out to Juan telling me how they train for these events...

"Traffic. It's quite simple really, they sit there for hours on the TakWay, staring out at the traffic, trying to follow vehicles as they buzz by at hundreds of miles an hour. Eventually their brains recalibrate to process the images. Takes time though, months of training... and that's just so they can see the damn things!"

...Juan, filled with useless knowledge. I find myself wondering how people like Juan even have enough space left for the simple factoids in like, like names, places and colours.

BAM... someone has hit one of the targets and the bell rings once to announce it. It's a small little man with eyes following the targets so quickly, he looks inhuman. He cracks a half smile, realising that he is the first to score, a serious leg up in such a fast moving game.

I suddenly become aware of the people next to me, I'm not sure how long they hav been sitting there and I realise that I am wasting time. The restbite from my long journey home has turned into something more. I stand to leave.

"Alright mate? Don't suppose you could take a picture of 'at for me could ya? Left my camera at home, and it's my team from last night, won a bunch a money."

English. Uhh. I warily look across to the group. They stand out with their long jeans, teeshirts and big bulky backpacks. The apparent leader of the group is staring at me intently, waiting for an answer. Waiting to confirm the absence of a language barrier.

I calculate, it only takes a second. Risk, low. Gain, low. I look down at my right hand, apparently holding my phone. I realise that I didn't even know the phone was visible, let alone out and in my hand. I make a mental note to check that. This is not a forgiving city.

Despite this, I am feeling good. The pain is more manageable today and I am enjoying every second of it. I look up and see the team boards hanging high above the stadium. They are so different, some scrawled hurriedly by fresh newly created teams entering for the first time while others, representing the longer, more established monied teams, are clearly designed by studios.

I answer in clipped English, asking for the team name. He tells me the name of one of the less known teams, the scrawled green loops of their logo looking like they were drawn in I Class rather than a team signet.

I start thinking that this might be an up-and-coming team, and the gambling spirit which is present in all humankind of rekindled for as second. I squash this thought. Money is earnt. Not won. I phase to my father standing over me at the arcade, taking away my various winnings telling me exactly that.


I zoom in and take a picture of the team name, asking him for his email as I do it. He seems surprised that I can do these two simple tasks at once. I quickly send the message and confirm with him.

He thanks me as he scribbles something down on a piece of paper, and then hands it to me. It is a 200-Kai note. It is big money. I thank him, and he tells me that he has written his name and company on the note, that I should look up his office in town, that I have impressed him. Big deal. Tourist and a foreign business man; what a horrible combination.

I thank the group and head for the exit. Check that, Gain, high.


Chapter 15 - Sandlewood and Snowflakes

It's seven o'clock when I finally enter my God parents home. The heavy door seems even heavier today as I push it shut against the busy, bustling and highly smelly city. It was extra smoggy today and I inhale the clean processed air deeply, as though I had been underwater for the longest time.

The house as always, reminds me of a great library, with it's wooden panels, deep set artwork and intricate plaster work. I move to the back of the house, where I can hear muffled voices.

As I approach I think they might be outside, which I immediately discount. The south side, or dome side as some call it, is in perpetual snow storm, barely habitable for even the smallest creatures.

True enough however, they are outside. The big sandlewood shutters are open slightly and I peer out. The snow is blinding and I can barely focus as I push through. There is no snow storm today, just big flakes of snow falling to the white landscape, dancing, joining as they fall, like a snow featured drama. I take a deep breath and inhale the crisp cold air, my body unused to the natural unprocessed unpolluted air.

My God mother is standing looking out into the landscape, with her daughter Yim standing wrapped up in her big fur coat. She sees me and extends an arm out, pulling me out of my trance. I walk over and snuggle against the warm fir. Yim looks at me and smiles, bowing ever so slightly before turning back to the outside world. I follow her gaze, it is beautiful. An ocean of white. A sea of calm in a hectic compromised world.

For a second I forget it all. I forget work, the pain and all of life's other troubles. I know only white. Only calm. Only order. It is order through chaos. ordo ab chao.

The cold reminds me that I am badly dressed. I hug my God mother tightly and she releases me, knowing that I am moving on. As she does, she tells me that my Aunt is here.

Surprised I move with purpose now, back through the heavy shutter and into the lounge areas. I haven't seen my Aunt in over 5 years due to her arctic Government sponsored travels.

I move into the central lounge and see her sitting there. Elegantly dressed in white, sitting in my Great-Godfathers favourite armchair, right next to the roaring fire. She looks up from the big, anciently bound book she is studying and smiles. A wide knowing smile, almost as exactly as I remember it, with the exception of light wrinkles around her eyes and mouth. We are all aging, I remind myself, even timeless people like her.

I stand there waiting, the lounge is musky and the smell of burning wood fills my lungs now. The plush carpet wrapping around my feet. The oak panels seem to generate a certain enveloping warmth, not overpowering at all, but just enough to offer complete comfort.

She finally beckons me over as is required. As always she talks simply and cryptically at the same time. An interesting feat of communication in our challenging language.

"My son, it has been to long"

"My mother, so it has"

The convention of mother, son, when talking with direct relatives always lifts my spirits. It takes me away from that dreadful night as if it hadn't even happened.

"I have been traveling far, and as always I have little to tell. The world is not as it seems my son, and big change is coming. You must be prepared."

The government censor is too far reaching, I know that, but it never fails to frustrate me as I long to hear of her other-worldly travels outside the confines of our dirty city. Her cryptic messages phase me little now, although as she says this I feel a slight chill. This one has a certain preparatory nature which makes me uneasy.

We talk for hours on my life, and as always I value her council above all others. I find myself thinking how strange it is that we only confide our complete council to so few in life, and those few are usually the most distant from us.

She listens with tearful eyes as I explain my pain, I have already tried to minimise it, however my Godmother has already betrayed me, and my Aunt wants to know all. She helps me refocus, reminds me of the transience of pain and tells me that she wishes above all else that she could take it away from me.

It is now 2am and the once blazing fire now finally crackles out of life, giving up the fight against the absece of fuel. I tell her that I have work in just a few hours and she finally releases my hand. I kiss her forehead and pad to the door. As I reach the door she calls my name. I turn.

"It is coming. Be sharp. Be ready."

I nod, the same chill creeping over me. I wish to anything that I knew what it was that I should be ready for, but I know the penalty for breaking the censor, and she has already said too much.

Wednesday, November 17, 2010

Net Neutrality Arrives in the UK

So our wonderful Minister for "Culture" Ed Vaizey has come up with the new fangled concept of charging for a higher grade of bandwidth... or a two-tier Internet as it has been tagged. Now where have I heard that before?

The real danger here is that our law makers are all literally dying in their seats. They have little or no clue what the Internet is, let alone what the concept of net neutrality is. In addition, our Internet community is just not vocal, not passionate or a combination of the two. They just won't stand up.

For what it's worth I've written to Ed, along with my local representative, however I fully expect the issue to fall of deaf ears. It's just not on our pads here as it is in America. The danger is that this just gets bundled through, and the UK becomes the first country on the planet to tear apart net neutrality.

To Rep. Ed Vaizey:

Dear Mr Vaizey,

I've been reading with interest the world you're doing against net neutrality. In the States, net neutrality has really taken centre stage, with the online community as a whole outraged over the proposals to do just as you are doing, restructuring the Internet in a commercial and self-serving way. The only real difference is that in the States, law makers are more up to date with technological advancements, coupled with the fact that the American Internet community is more vocal, meaning that it is not an issue which can be bundled through. I believe that in parliament though this could very well happen, members of the house often lack the technical knowledge to see just how damaging this would be to the Internet as a whole.

Free, unrestricted, non-capped access to the Internet is something which must be protected at all cost. Your suggestion would mean that a class based system would exist on the Internet, with the better system being available to those that could afford it. Your original proposal may not allow for this directly, but once bandwidth capping is in place, it would only be a matter of time. In essence, it would completely restructure the Internet as we know it, changing the very essence of what is has achieved since inception; the removal of class and creed. This can only be bad for the consumer, and in turn, your constituents.

I would urge you to reconsider your position, and the actions you are planning to take, unless you want to permanently damage something which is sure to be the cornerstone of our futures. You would indeed be historically remembered as such, the "culture" minister that was responsible for the sell out of the Internet.

Yours faithfully,

Wednesday, September 15, 2010

RIP IM?

Considering the recent decline in IM usage thanks mostly to the rise in social networking sites like Facebook and platforms like Twitter, I decided it was time to make some cuts. I usually stay connected to most of the major IM clients (AIM, Yahoo, MSN) concurrently through a multi protocol program called Empathy.


One of the hardest decisions was who should go. I was able to take client performance out of the equasion, so it had to be purely on usage and global coverage. This article at Silicon Alley really helped concrete that for me, Yahoo is still blowing competitors out of the window, even if it's own usage has dropped in recent years.

So it really did turn out to be a fairly easy decision! Empathy also supports Facebook chat login; which is where most of my IM activity happens now anyway.

Thursday, September 9, 2010

Dy-na-mite!

What. On. Earth. The Google devs seem to be on some kind of go-faster crack right now. Yesterday they decided to get creative and greet users with pointer sensitive multi-coloured blobs using dynamic CSS3... but only US and European users. People from the remaining 5 continents (yes remaining five) were greeted with the regular logo.


Google's official statement says merely that "today's doodle is fast, fun and interactive, just the way we think search should be".

Adding to the wonderfully hyped-up geek fuelled mystery, the company also tweeted on Twitter, "Boisterous doodle today. Maybe it's excited about the week ahead..."

The following day, it was replaced by a similarly dynamic greyscale Google that filled with colour at each key stroke, letter by shining letter. Aww. They reported, "doodle is dressing up in its brightest colours for something exciting coming very soon".

There was some wild speculation on what this could all possibly mean... Google's September birthday maybe? Or the arrival of HTML5 (even though it was coded in CSS3). Only on the second day did word leak out that it was all to do with Google's new dynamic search feature.

What? Dynamic search? Chrome=Pokeball? Yes. Google have created a mechanism whereby instead of searching once for a term, you are now searching on the input of every single letter. Apparently all this to reduce search times, however slower connections will struggle, and the behemoth's search traffic will most likely sky-rocket, nicely congesting an already busy super highway. I could have however, swallowed all of this, if it wasn't for the fact that Google made this a default option today, forcing users to trial this new technology. Google. Dynamic. Sigh.

Yawn!

2 AM and the UnifiedBlue relaunch is officially complete. The unified wiki originally at the main domain has now been split into subdomains between secure and public content and the wiki software has been changed to Dokuwiki. The wiki-blog entries have now been deprecated and have been manually been moved to Imboogled. The mailserver has been officially launched, and work will shortly begin to move content and subscriptions. Finally the main domain now hosts a gateway page linking to the two wikis, the mail server and the server subdomains.... Phew!

The decision was taken to move from Mediawiki not because it was not proficient enough, but simply that it was not fit for purpose. It was almost too powerful for the limited use the UB requires, and also lacked innate security features that the secure wiki required. As mentioned previously, an OpenID token authentication method was active for the secure wiki previously, however it's integration to Mediawiki was limited, and showed signs of possible security flaws. The new site features secure basic https authentication provided by Apache as a first line and then a subsequent wiki user/pass combination to access content.



The deprecation of wiki-blogs was simple; Mediawiki or Dokuwiki for that matter, have no business hosting blog entries and are not built as such. It was fitting that they should move to the Imboogled blog.

It was an epic move, but one that will help shape the future of UnifiedBlue.

Pokoogle?

Just a quick one Imbooglers. Take a look at this... but sit down first:



Google Chrome Logo + Pokeball = Pokoogle?