One of the most important tasks when managing a web server is to ensure that content is being delivered to your visitors at a reasonable speed. This is also important when one of your applications uses an internet-based data source. One of our projects relies on frequent calls to a particular web API to gather data. We were experiencing significant delays during testing, and went to work to find the bottleneck. More →
One of our clients has a Linux server. What we want to do is SSH in and set up port forwarding for RDP to a PC that’s inside the network. However, the user should be restricted to only access a certain IP address. For this example, I’m adding an account for Suresh, to access “remotehost.example.com”. He will use this to create a tunnel, forwarding port 3306 to a PC on the remote network.
$ sudo useradd --shell /bin/false --create-home suresh $ sudo passwd suresh
Disconnect, then copy your ssh identity file to the destination server:
$ ssh-copy-id suresh@remotehost.example.com
$ ssh suresh@remotehost.example.com $ suresh@remotehost.example.com's password:
Welcome to Ubuntu 14.04.1 LTS (GNU/Linux 3.13.0-32-generic x86_64)
* Documentation: https://help.ubuntu.com/
System information as of Tue Jul 29 19:08:30 NZST 2014
System load: 0.94 Processes: 165
Usage of /: 66.2% of 1.70TB Users logged in: 1
Memory usage: 38% IP address for virbr0: 192.168.1.2
Swap usage: 0%
Graph this data and manage this system at:
https://landscape.canonical.com/
0 packages can be updated.
0 updates are security updates.
-address-via-
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
Connection to remotehost.example.com closed.
you@yourpc ~ $
Note that it connects, but immediately severs the connection.
$ sudo nano /etc/ssh/sshd_config
Add the following (Note the indent in the second line. That’s important):
Match User suresh
PasswordAuthentication no
Restart the ssh service for the change to take effect.
$ sudo service ssh restart
If you try to connect without your SSH key, you should now see:
Permission denied (publickey).
Now, to make it so the user can only access a single remote host:
$ sudo nano /home/suresh/.ssh/authorized_keys
You should see one line in there. Pre-pend the line with:
permitopen="{target IP address}:{target port}"
Save and exit the file and give your newly configured SSH access a try
ssh -N suresh@remotehost.example.com
The ‘-N’ option tells the SSH session that you only want to open an SSH tunnel, as opposed to both a tunnel and a terminal session as per normal. Annoyingly you won’t even be returned with a nice ‘Successfully connected’ message (just a hanging process), but if you’re not hit with an error message you can be confident that the connection works.
Now the user can connect for port forwarding to a specific remote PC, but for nothing else.
Gravity Computing has taken a strong stand against the controversial GCSB bill. Eric (our managing director) has taken to social media in earnest over the last few weeks; Roger has turned up in person at protests and rallies; and Ross took an evening a couple weeks ago to travel to Auckland with the team to represent our company and our clients against this bill.
Last night Eric and Roger attended an urgent “Stop the GCSB Bill” public meeting at the Auckland Town Hall to show support for the movement. The turnout was nothing short of amazing with over 1600 people attending in person, and a whopping 140,000 viewing the coverage online.
Eric and Seeby Woodhouse posing for a photo outside of the Auckland Town Hall after the recent “Stop the GCSB Bill” meeting (Apologies for photo quality).
A star panel of speakers were assembled, varied in their backgrounds and fields of expertise: two of New Zealand’s most illustrious investigative journalists; internet entrepreneur powerhouses Kim Dotcom and Seeby Woodhouse; legal experts; human rights advocates, and leaders of almost all opposition parties. Each took a different approach to commenting on the bill and the damage it could cause (from silencing ISPs for fear of prosecution, the chilling effects of a surveillance state, to covering up unethical actions of the military, to exposing the information of beneficiaries), and all emphasising the same point:
This bill is bad news for New Zealand and will strike a huge blow for human rights if it is to come into force.
On a more positive note, there were some familiar faces lingering outside the hall afterwards. Eric (@RhyvenNZ) met fellow Twitter user @endarken in person for the first time, with both of them being active anti-GCSB campaigners on Twitter. Eric got a few photos with some of the speakers, and we even chatted with Seeby Woodhouse for quite a while on some technical aspects of the GCSB and TICS bills.
If you would like to watch the meeting in it’s entirety, take a look at the video embedded below.
Given that Gravity Computing is such a widely-located company, working with sensitive data, it’s important that we have a platform in place that allows us to share resources between each other while keeping them secure. We’ve been using SpiderOak – a cloud-based service similar to Dropbox – which is strongly focused on privacy and security. 
One of those resources we share is the remote connection details for some of our clients. In Ubuntu we use a popular remote connection client named Remmina, which is well regarded for its ease of use and stability. We could each enter the remote connection details into Remmina ourselves, but that would take up unnecessary time and create a time lag if one person is waiting on details from someone else.
A better way of doing it? Create a symbolic link. Remmina stores its remote connection data in a hidden folder in the user’s home directory (i.e. /home/user/.remmina). If we were to store a master copy of the .remmina folder in SpiderOak and then have each desktop link to it, the remote connection details could instantly be accessed and updated from any location.
Even if you’re not all that familiar with the terminal, the process is really very simple. The series of steps below will create a symbolic link between the master .remmina folder and the SpiderOak hive folder. It will delete any Remmina connections that you’ve already saved, so we take a backup of them first.
$ mkdir ~/remminaBackup # Create a folder to contain your old Remmina files $ mv ~/.remmina/* ~/remminaBackup # Move your old Remmina files into your backup folder $ sudo rm -rf ~/.remmina # Remove the existing Remmina directory $ sudo ln -s '~/SpiderOak Hive/Remmina/' ~/.remmina # Create the Symlink $ cp ~/remminaBackup/* ~/.remmina # Copy your old Remmina files into your new Remmina folder
You can delete your remminaBackup folder once you’ve tested your old connections to make sure they still work.
Note that the command is entered in the format “sudo ln -s MASTERLOCATION LINKLOCATION”. Note also that the master location is encased in apostrophes, due to the fact that ‘SpiderOak Hive’ contains a space and would otherwise throw off the command.
Finally, you need to test the Symlink to make sure that it works correctly. The easiest way to do this is to navigate to the .remmina folder in a terminal and check that it contains the required files:
$ cd ~/.remmina # Enter the .remmina directory $ ls # Check the contents of the .remmina folder
You should be greeted with a folder that contains .remmina files, and is identical to your master Remmina folder. If this is not the case, make sure that you have entered in both locations correctly, and that any file path longer than the current folder begins with a backslash.
And voila! You now have a secure repository allowing all your PCs and Servers to be shared within your team.
I really like clean URLs. For example, I far prefer a URL like http://en.wikipedia.org/wiki/Tidy over something like http://www.gravitycomputing.co.nz/cgi-bin/gen.pl?id=4&category=M753n&style=gw3b (don’t even try it, that’s a fake link). For me, it’s a matter of ‘the tidier the better’, because the less in the URL, the less people have to remember when they try to find things again.
I’ve been trying half-heartedly to get our SilverStripe installation to play nicely with our blog.gravitycomputing.co.nz subdomain for some time now. It wasn’t particularly urgent, so I left it as www.gravitycomputing.co.nz/blog, but I do prefer the ‘subdomain style’ over the ‘subfolder style’. More →
Sometimes we have a project that requires an internet connection. Of course, before charging ahead and USING the connection, it’s safest to first test to see if there IS a connection! This module uses Windows’ built-in “wininet” to query a website and let us know if it’s available. We use a high-availability one like Google or Yahoo.