Passwordless SSH login

It is good to have authentication using SSH keys with password. However, when using scripts like multicopy/multiquery in Codeploy for simultaneously sending files/commands to multiple planetlab servers, it becomes a issue to keep retyping password.

We can use ssh-copy-id command to add our public key to authorized_keys on the target machine. This allows us to login without entering the passphrase when logging to the target server.

To do this, copy your public and private keys as id_rsa.pub and id_rsa in the ~/.ssh directory. Then type

ssh-copy-id -i ~/.ssh/id_rsa.pub username@remote_host

The reason why we need to copy public and private keys as id_rsa to .ssh directory is because there is no way (or I am not aware of) to specify the private key to use with ssh-copy-id command when logging to the remote server. The "-i" argument specifies the public key to be copied to authorized_keys on the target machine, and is not an equivalent of "-i" argument you use for ssh.

References:
1. http://everydaylht.com/howtos/system-administration/loggin-in-via-ssh-without-a-password/

Codeploy multicopy large files timedout ssh

When using multicopy command in Codeploy to transfer large files from/to to planetlab nodes, we might face "timedout ssh" problem. This can be avoided by setting up the environment variable MQ_TIMEOUT to be a large value like 100000. So along with MQ_SLICE and MQ_NODES, we need to set this third environment variable.

References:
1. http://lists.planet-lab.org/pipermail/users/2007-November/002599.html

Linux Screen Command

What is Screen for Linux?
As the man page states, “Screen is a full-screen window manager that multiplexes a physical terminal between several processes (typically interactive shells).” This can be a life saver when working on your dedicated server. Screen has a several great features for helping you administer your server more productively and safely.

Installing Screen on Linux
Chances are that you already have screen on your system. To see if screen is in your path, you can use the which command:

which screen

Using Screen
Screen is started from the command line just like any other command:

screen

You may or may not get a text message about screen. If you do not, then you probably think nothing has happened, but it has. You are now inside of a window within screen. This functions just like a normal shell except for a few special characters. Screen uses the command "Ctrl-A" as a signal to send commands to screen instead of the shell. To get help, just use "Ctrl-A" then "?". You should now have the screen help page.


Key bindings are the commands the screen accepts after you hit "Ctrl-A". You can reconfigure these keys to your liking using a .screenrc file. The power of screen will become obvious, especially if you need to bounce around to different file system locations and leave processes running. For example, when I go in to clean out wasted disk space, I can remove files in one screen while hunting for other files in another.

Multiple Windows
Screen, like many windows managers, can support multiple windows. This is very useful for doing many tasks at the same time without opening new sessions.

To open a new window, you just use "Ctrl-A" "c". This will create a new window for you with your default prompt. For example, I can be running top and then open a new window to do other things.

You can create several windows and toggle through them with "Ctrl-A" "n" for the next window or "Ctrl-A" "p" for the previous window. Each process will keep running while your work elsewhere.


Leaving Screen

There are two ways to get out of screen. The first is just like logging out of a shell. You kill the window with "Ctrl-A" "K" or "exit" will work on some systems. This will kill the current windows. If you have other windows, you will drop into one of those. If this is the last window, then you will exit screen.

The second way to leave screen is to detach from a windows. This method leaves the process running and simple closes the window. If you have really long processes, you need to close your SSH program, you can detach from the window using "Ctrl-A" "d". This will drop you into your shell. All screen windows are still there and you can re-attach to them later. This is great when you are using rsync for server migration. Attaching to Sessions
Use the screen listing tool to see what sessions are running:

screen -ls

To re-attach to a session, use the re-attach command:

screen -r <session name>

Just use screen with the -r flag and the session name. You are now re-attached to the screen. A nice thing about this, is you can re-attach from anywhere. If you are at work or a clients office, you can use screen to start a job and then logout. When you get back to your office or home, you can login and get back to work.


Screen Logging
Using "Ctrl-A" "H", creates a running log of the session. Screen will keep appending data to the file through multiple sessions. Using the log function is very useful for capturing what you have done, especially if you are making a lot of changes. If something goes awry, you can look back through your logs.

Other Tips
Screen can monitor a window for activity or lack thereof. This is great if you are downloading large files, compiling, or watching for output. If you are downloading something or compiling, you can watch for silence. To start the monitor, go to the screen you want to monitor and use "Ctrl-A" "M" to look for activity or "Ctrl-A" "_" to monitor for silence. When the monitor detects activity or silence, you will get an alert at the bottom with the window number. To quickly go to that window, use "Ctrl-A" "(thats a quote mark, ctrl-a then a “). After you do this, just type in the number of the window and enter. To stop monitoring, go to that window and undo the monitor with the same command. For example, to stop monitoring for activity you would use "Ctrl-A" "M" again.


References:
http://www.rackaid.com/resources/linux-screen-tutorial-and-how-to/

Reverse SSH tunnel to connect to a machine inaccessible due to firewall or NAT

We cannot directly connect to a machine if it is behind a NAT (Network Address Translation) or a firewall. Almost all large networks (corporate and universities) have firewalls and may also employ NATs. Even home routers are now using some sort of NAT.

We need to create a reverse SSH tunnel to establish a connection. If you are familiar with Hamachi or gotomypc type software do the exact same thing  - they connect to computers behind NAT/Firewalls, only they use their severs as the middle man. We are going to have to find our middle man on our own.

In order for you to create a reverse tunnel you must have SSH access to a middle computer that you can connect to from origin computer.

Step-1:
On the destination computer type the following command. Replaceing middleuser with your name and replacing middle with the domain of the middle computer.

ssh -R 10002:localhost:22 middleuser@middle

This will open port 10002 for listening and forward all future connections to port 22 at destination. This connection must remain on the entire time to ensure that you can access your destination computer whenever you want.

Step-2:
Now if sshd is set to use GatewayPorts you should be able to connect with this:

ssh destinationuser@middle -p 10002

If you are not sure if GatewayPorts is on or you don’t have the access to change it use the following method to connect:

First connect to the middle computer how you would normally.

ssh user@middle

Then connect to the localhost of the middle computer on port 10002.

ssh user@localhost -p 10002

Note: The port 10002 is arbitrary you can use any port you want.

You should now be remotely logged into your computer behind the NAT/Firewall. Enjoy :)

Refer [2] to make the reverse ssh tunnel permanent, and restart automatically if the tunnel gets closed.

Reference:
1. http://www.marksanborn.net/howto/bypass-firewall-and-nat-with-reverse-ssh-tunnel/
2. http://www.clingmarks.com/setup-a-unbreakable-ssh-tunnel/21