Remote Desktop Administration (Linux/X11)

Version 1.0.0 © Adam Trickett, January-2017 Distributed under a creative commons Attribution-NonCommercial-ShareAlike licence.
1
Remote AdministrationRemote Administration
of Desktop Systemsof Desktop Systems
Adam John TrickettAdam John Trickett
www.iredale.net
adam.trickett@iredale.net
PGP Key: 0xAF0DB8C8

2
General problemGeneral problem
• You need to connect to a remote system
• You need to administer the system (upgrade, repair,
extend etc.)
• You need to see the desktop as the user sees it
• The end user may not be technical

3
TopologyTopology
Internet
Firewall
Router
Other
PCYour
PC

4
Technical problemsTechnical problems
• Where is the other PC?
• Most ISP only offer dynamic IP
• How do I get through the firewall?
• Each make and model is different
• How do I reach the PC on the inside?
• Most networks use dynamic & private IPs on the inside
• What needs to be installed on the target system?
• Not all systems have everything installed by default

5
Where is the other PCWhere is the other PC
• The best solution is a static IP for the router/firewall
• Standard with some ISPs
• Optional cost extra with others
• If dynamic is the only option, then:
• Some routers/firewalls will auto-update Dynamic DNS
services
• You can install a dynamic DNS client on the target PC
• You can create a script to email you the external IP

6
Firewall - rulesFirewall - rules
• Most sane routers allow:
• All ports outbound
• All ports inbound that are part of an outbound pair
• All ports inbound that are not part of a pair are denied
• You will need to tell it to allow at least one port
inbound:
• Some have virtual “DMZ”
• Some have general rules

7
Router - ForwardingRouter - Forwarding
• The remote system's firewall/router needs to
forward incoming connections:
• of type X, e.g. tcp
• of port Y, e.g, 22
• to IP address Z, e.g. 192.168.0.10
• External port number and internal port number are
the same by default

8
Router – NAT/DHCPRouter – NAT/DHCP
• You need to ensure that the PC you want to reach
has the same private IP so that the NAT rule points
to the correct system every time:
• DHCP reservation using MAC address
• Static configuration in router and PC

9
Basic tools - SSHBasic tools - SSH
• Secure Shell (“SSH”)
• Replaces Telnet, rlogin, rsh, ftp etc
• Standard on almost all Linux/Unix systems
• Secure
• Supports port forwarding
• Creates a temporary on-demand instant “VPN-lite”

10
Extra toolsExtra tools
• Mobile Shell (“Mosh”)
• Deals with lost connections better than SSH
• Does not support port forwarding
• OpenVPN
• Builds a permanent secure bridge between systems
• Doesn't require user configuration to use
• Requires administrative configuration to set-up
• More complex than SSH

11
General installationGeneral installation
• OpenSSH server, though in all distros is not installed
by default on all of them
• Mosh is widely available but not installed by default
on most/all
• Sudo is widely available and installed by default on
many but all
• Screen is widely available but not installed by
default on most/all

12
Specific installationSpecific installation
• linuxvnc shares the physical console as VNC session,
useful in emergencies or headless servers
• x11vnc shares the desktop X session as a VNC
session and allows you to interact with the desktop
at the same time as the user
• There are others but I'm not going to talk about
them

13
Forwarding SSH portsForwarding SSH ports
• The remote system's firewall/router needs to:
• Forward TCP port on the external side to TCP port on the
target PC
• SSH normally uses tcp port 22
• Mosh normally uses udp port 60001 (and up) plus SSH to
start with only
• Many people change the external port to reduce the
noise from script kiddies

14
Basic AdministrationBasic Administration
• Use SSH/Mosh to connect to the remote system
• Default SSH configuration will work but you need to
harden it
• Run normal command line tools from login shell of your
choice
• Good for day to day administration and all standard tasks
• No good if you need to see what the user sees or
configure a desktop application

15
Harden SSHHarden SSH
• Open SSH is pretty good but it is not as secure as it
can be out of the box on most Linux distributions:
• Turn off password login – only allow SSH keys
• Turn off root login – only allow real users
• Specify the named users you want to allow
• Turn off SSH protocol 1 – it may still be turned on in some
distros

16
Configure SSH ClientConfigure SSH Client
• Edit your ~/.ssh/config file:
Host <machinename>* <ip address>
HostName <machinename.network.com>
user <your username on machinename>
Port <TCP port number>
ForwardX11 yes
Compression yes
LocalForward localhost:5900 localhost:5900

17
ProcedureProcedure
• Add your SSH-Key to your SSH-Agent
• Start your SSH session to the other system
• ssh machinename
• Your default shell starts at the other end
• Start screen
• Start any X programs
• Start x11vnc or linuxvnc
• Start your VNC client on your desktop

18
What does SSH forwarding do?What does SSH forwarding do?
• When you start x11vnc or linuxvnc they start to listen
on the local host of the remote system on tcp port
5900 by default
• The SSH client on your PC also listens on TCP port
5900 locally, but forwards the packets to the remote
system to its TCP port 5900
• That means an insecure protocol like VNC is now
running over a secure and compressed SSH
connection

19
SSH Client
TCP 5900
listen
SSH Server
TCP 22 listen
x11VNC
TCP 5900
listen
VNC Client
Secure SSH

20
x11vnc configurationx11vnc configuration
• To automate and get the best out of x11vnc without
end user interaction – there are a lot of options!
• Something like:
$ sudo x11vnc -nopw -localhost -ncache 10 -ncache_cr
-q -nodpms -auth <something>

21
linuxvnc configurationlinuxvnc configuration
• Exports a physical terminal
• Useful if X has failed to start
• Allows you to see kernel messages etc
• Of only limited use, but nice to know
$ sudo linuxvnc 1 -alwaysshared

22
DemoDemo

23

24

25

26

27

28

29

30

31

32
ThankThank YouYou
AnyAny
Questions?Questions?

Remote Desktop Administration (Linux/X11)

Recommended

More Related Content

What's hot (20)

Viewers also liked (9)

Similar to Remote Desktop Administration (Linux/X11) (20)

More from Adam Trickett (13)

Recently uploaded (19)

Remote Desktop Administration (Linux/X11)