September 2018 – vathorstweb.nl

How to Create SSH Tunneling or Port Forwarding in Linux

SSH tunneling (also referred to as SSH port forwarding) is simply routing local network traffic through SSH to remote hosts. This implies that all your connections are secured using encryption. It provides an easy way of setting up a basic VPN (Virtual Private Network), useful for connecting to private networks over unsecure public networks like the Internet.

You may also be used to expose local servers behind NATs and firewalls to the Internet over secure tunnels, as implemented in ngrok.

SSH sessions permit tunneling network connections by default and there are three types of SSH port forwarding: local, remote and dynamic port forwarding.

In this article, we will demonstrate how to quickly and easily setup a SSH tunneling or the different types of port forwarding in Linux.

Testing Environment:

For the purpose of this article, we are using the following setup:

Local Host: 192.168.43.31
Remote Host: Linode CentOS 7 VPS with hostname server1.example.com.

Usually, you can securely connect to a remote server using SSH as follows. In this example, I have configured passwordless SSH login between my local and remote hosts, so it has not asked for user admin’s password.

$ ssh admin@server1.example.com

Connect Remote SSH Without Password

Local SSH Port Forwarding

This type of port forwarding lets you connect from your local computer to a remote server. Assuming you are behind a restrictive firewall, or blocked by an outgoing firewall from accessing an application running on port 3000 on your remote server.

You can forward a local port (e.g 8080) which you can then use to access the application locally as follows. The -L flag defines the port forwarded to the remote host and remote port.

$ ssh admin@server1.example.com -L 8080: server1.example.com:3000

Adding the -N flag means do not execute a remote command, you will not get a shell in this case.

$ ssh -N admin@server1.example.com -L 8080: server1.example.com:3000

The -f switch instructs ssh to run in the background.

$ ssh -f -N admin@server1.example.com -L 8080: server1.example.com:3000

Now, on your local machine, open a browser, instead of accessing the remote application using the address server1.example.com:3000, you can simply use localhost:8080 or 192.168.43.31:8080, as shown in the screenshot below.

Access a Remote App via Local SSH Port Forwarding

Remote SSH Port Forwarding

Remote port forwarding allows you to connect from your remote machine to the local computer. By default, SSH does not permit remote port forwarding. You can enable this using the GatewayPorts directive in you SSHD main configuration file /etc/ssh/sshd_config on the remote host.

Open the file for editing using your favorite command line editor.

$ sudo vim /etc/ssh/sshd_config

Look for the required directive, uncomment it and set its value to yes, as shown in the screenshot.

GatewayPorts yes

Enable Remote SSH Port Forwarding

Save the changes and exit. Next, you need to restart sshd to apply the recent change you made.

$ sudo systemctl restart sshd
OR
$ sudo service sshd restart

Next run the following command to forward port 5000 on the remote machine to port 3000 on the local machine.

$ ssh -f -N admin@server1.example.com -R 5000:localhost:3000

Once you understand this method of tunneling, you can easily and securely expose a local development server, especially behind NATs and firewalls to the Internet over secure tunnels. Tunnels such as Ngrok, pagekite, localtunnel and many others work in a similar way.

Dynamic SSH Port Forwarding

This is the third type of port forwarding. Unlike local and remote port forwarding which allow communication with a single port, it makes possible, a full range of TCP communications across a range of ports. Dynamic port forwarding sets up your machine as a SOCKS proxy server which listens on port 1080, by default.

For starters, SOCKS is an Internet protocol that defines how a client can connect to a server via a proxy server (SSH in this case). You can enable dynamic port forwarding using the -D option.

The following command will start a SOCKS proxy on port 1080 allowing you to connect to the remote host.

$ ssh -f -N -D 1080 admin@server1.example.com

From now on, you can make applications on your machine use this SSH proxy server by editing their settings and configuring them to use it, to connect to your remote server. Note that the SOCKS proxy will stop working after you close your SSH session.

Summary

In this article, we explained the various types of port forwarding from one machine to another, for tunneling traffic through the secure SSH connection. This is one of the very many uses of SSH. You can add your voice to this guide via the feedback form below.

Attention: SSH port forwarding has some considerable disadvantages, it can be abused: it can be used to by-pass network monitoring and traffic filtering programs (or firewalls). Attackers can use it for malicious activities. In our next article, we will show how to disable SSH local port forwarding. Stay connected!

Infiniband Switch upgrades

	To
From	1.0.`x`	1.1.`x`	1.3.`x`	2.0.`x`	2.1.2 – 2.1.6	2.1.7 – 2.1.9
1.0.`x`	Upgrade or Downgrade	Upgrade or Downgrade
1.1.`x`	Upgrade or Downgrade	Upgrade or Downgrade	Upgrade or Downgrade
1.3.`x`		Upgrade or Downgrade	Upgrade or Downgrade	Upgrade or Downgrade	Upgrade or Downgrade	Upgrade Downgrade to 2.1.6 first
2.0.`x`			Upgrade or Downgrade	Upgrade or Downgrade	Upgrade or Downgrade	Upgrade Downgrade to 2.1.6 first
2.1.2 – 2.1.6			Upgrade or Downgrade	Upgrade or Downgrade	Upgrade or Downgrade	Upgrade Downgrade to 2.1.6 first
2.1.7 – 2.1.9			Upgrade Downgrade to 2.1.6 first	Upgrade Downgrade to 2.1.6 first	Upgrade Downgrade to 2.1.6 first	Upgrade or Downgrade

For example, upgrading from firmware version 1.1.2 to 1.3.5 is supported. However, upgrading from firmware version 1.1.2 to 2.1.5 is not. You must first upgrade from firmware version 1.1.2 to 1.3.x, and from firmware version 1.3.x to 2.1.5.

Similarly, downgrading from firmware version 2.1.6 to 2.0.7 is supported. However, downgrading from firmware version 2.1.9 to 2.0.7 is not. You must first downgrade from firmware version 2.1.9 to 2.1.6 using the downgrade version of firmware 2.1.6. Then you can downgrade from 2.1.6 to 2.0.7.

Note – See Firmware Update Guidelines about upgrading and downgrading firmware.

Upgrade the Switch Firmware (CLI)

Note – Before upgrading or downgrading the switch firmware, read Firmware Update Guidelines.

Note – If you are going to downgrade the firmware to a version earlier than 2.1, you must disable secret M_Keys. Refer to the Sun Datacenter InfiniBand Switch 36 Administration Guide for Firmware Version 2.1 for instructions on disabling secret M_Key functionality.

Note – If you are going to downgrade the firmware to a version earlier than 2.0, you must remove user partitions and depopulate the Subnet Manager nodes list. Refer to the Sun Datacenter InfiniBand Switch 36 Administration Guide for Firmware Version 2.1 for instructions on removing partitions for a firmware downgrade.

1. Consider your first step:
  - If you are upgrading or downgrading from firmware version 2.0 or newer, go to Step 2.
  - If you are upgrading or downgrading from a firmware version earlier than 2.0, go to Step 5.

1. Open an SSH session as user ilom-admin and connect to the management controller by specifying the controller’s host name.For example:
```
% ssh -l ilom-admin switch_name
ilom-admin@switch_name's password: password
->
```
  where switch_name is the host name of the management controller. Initially, the password is ilom-admin.

If the Subnet Manager is running on the management controller, disable the Subnet Manager.

-> show /SYS/Fabric_Mgmt
NOTE: show on Fabric_Mgmt will launch a restricted Linux shell.
     User can execute switch diagnosis, SM Configuration and IB
     monitoring commands in the shell. To view the list of commands,
     use "help" at rsh prompt.

     Use exit command at rsh prompt to revert back to
     ILOM shell.

FabMan@switch_name->disablesm
Stopping partitiond-daemon.                                [  OK  ]
Stopping IB Subnet Manager..                               [  OK  ]
FabMan@switch_name->exit
exit
->

1. Go to Step 11.

1. Open an SSH session as user root and connect to the management controller by specifying the controller’s host name.
```
% ssh -l root switch_name
root@switch_name's password: password
#
```
  where switch_name is the host name of the management controller. Initially, the password is changeme.

If the Subnet Manager is running on the management controller, disable the Subnet Manager.

# disablesm
Stopping partitiond daemon.                                [  OK  ]
Stopping IB Subnet Manager..                               [  OK  ]
#

1. Verify that there is at least 80 MB available in the / filesystem.
```
# df -h /
Filesystem            Size   Used   Avail  Use%  Mounted on
/dev/hda2             471M   276M   172M   62%   /
#
```
  In this example, there are 172 MB available. If not enough space is available, you must delete or move files from the / filesystem.

1. Verify that there is at least 120 MB available in the /tmp directory.
```
# df -h /tmp
Filesystem            Size   Used  Avail  Use%  Mounted on
tmpfs                 250M   240K  249M   1%    /tmp
#
```
  In this example, there are 249 MB available. If not enough space is available, you must delete files from the /tmp directory.

Verify that there is at least 120 MB free memory available.

# free -m
                         total      used       free     shared    buffers    cached
Mem:                     498        104        393      0         12         47
-/+ buffers/cache:       45         453
Swap:                    0          0          0
#

In the -/+ buffers/cache: row of the free column, there should be at least 120 MB free memory. In this example, there are 453 MB available. If not enough memory is available, you must exit nonessential applications that are running.

Start the Oracle ILOM shell.

# spsh
Oracle(R) Integrated Lights Out Manager
Version ILOM 3.0 r47111
Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
->

You are now in the Oracle ILOM shell.

You can use the exit command to return to the Linux shell.

1. Begin the upgrade process.
```
-> load -source URI/pkgname
```
  where:
  - URI is the uniform resource indicator for the host where the switch firmware package is located. The FTP and HTTP protocols are supported. If you are upgrading from firmware 2.1.2-2 or newer, the TFTP protocol is also supported.
  - pkgname is the name of the firmware package in the transfer directory.
  For example, using the HTTP protocol:
```
-> load -source http://123.45.67.89/tmp/sundcs_36p_repository_2.1.9_1.pkg
Downloading firmware image. This will take a few minutes.
```
  Note – If you are experiencing version number contention, you can use the –force option to disable version number checking, and force the upgrade.
  
  The firmware is downloaded. The upgrade begins. A caution is displayed and you are asked to commit to the upgrade.
```
NOTE: Firmware upgrade will upgrade the SUN DCS 36p firmware. ILOM will enter a special mode to load
new firmware. No other tasks should be performed in ILOM until the firmware upgrade is complete.

Subnet manager is running on the switch. Proceeding with installation will stop it.
Are you sure you want to load the specified file (y/n)?
```

Answer y to the prompt to commit to the upgrade.The upgrade begins.

Setting up environment for firmware upgrade. This will take few minutes.
Subnet manager has been temporarily disabled on this switch so that firmware upgrade can go on. After the
upgrade is done, please make sure that the SM is running again, using commands sminfo and enablesm.
Starting SUN DCS 36p FW update
========================== 
Performing operation: I4 A 
========================== 
I4 A: I4 is already at the given version. 
=========================== 
Summary of Firmware update 
=========================== 
I4 status                :  FW UPDATE - SUCCESS 
I4 update succeeded on   :  none 
I4 already up-to-date on :  A 
I4 update failed on      :  none 
========================================= 
Performing operation: SUN DCS 36p firmware update 
========================================= 
SUN DCS 36p fw upgrade from 2.1.6-2 to 2.1.9-1: 
Upgrade started... 
Upgrade completed. 
INFO: SUN DCS 36p fw upgrade from 2.1.6-2 to 2.1.9-1 succeeded 
 
Post-install checks started... 
Post-install checks completed. 
Firmware update is complete. 
ILOM will be restarted and will take 2 minutes to come up. 
You will need to reconnect to Integrated Lights Out Manager. 
 
Stopping any already executing ILOM daemons 
Starting event manager 
Starting log manager 
Starting ILOM IPMI stack 
Started ILOM IPMI stack 
Starting lumain 
Starting luproxy 
Starting ealertd 
Starting web server 
Starting SNMP 
Terminated 
#

1. Exit the Oracle ILOM CLI shell.
```
-> exit
exit
#
```

Restart the switch to enable the new firmware.

-> reset /SP
Are you sure you want to reset /SP (y/n)? y
Performing reset on /SP
Broadcast message from root (Thu Mar 16 14:00:34 2017):
The system is going down for reboot NOW! 
-> Connection to switch_name closed by remote host.
Connection to switch_name closed.

Note – The restart process takes between 4 to 5 minutes to complete. The Oracle ILOM stack requires at least 2 minutes to become operational after a reboot.

If the Subnet Manager was previously disabled, log in as the root user and enable the Subnet Manager.

% ssh -l root switch_name
root@switch_name's password: password
# enablesm
Starting IB Subnet Manager.                                [  OK  ]
Starting partitiond daemon.                                [  OK  ]
#

Verify the firmware version.

# version
SUN DCS 36p version: 2.1.9-1 
Build time: Jan 12 2017 09:16:51
SP board info:
Manufacturing Date: 2013.08.13 
Serial Number: "NCDA00732" 
Hardware Revision: 0x0007 
Firmware Revision: 0x0102
BIOS version: SUN0R100 
BIOS date: 06/22/2010#

In the first line of the output is SUN DCS 36p version x.y.z-w, where x.y.z–w is the version of the firmware upgraded (or downgraded). For example, 2.1.9-1.

Verify the firmware integrity.

# fwverify
Checking all present packages:
........................................................................... OK
Checking if any packages are missing:
........................................................................... OK
Verifying installed files:
........................................................................... OK
Checking FW Coreswitch:
 FW Version: 7.4.3002 OK 
 PSID: SUN_NM2-36p_004 OK 
 Verifying image integrity OK#

How to Install Latest Roundcube Webmail on CentOS 7

Roundcube is a free and open source, fully-featured web-based multilingual IMAP webmail software, with an application-like user interface that is fully functional and customizable, and uses latest web standards. It is built using PHP and offers full functionality you expect from a modern email client.

Roundcube Features:

It’s multilingual, supports over 70 languages.
Supports a Find-as-you-type address book.
Supports multiple sender identities.
Offers sophisticated privacy protection.
Has a full featured address book with groups and LDAP connectors.
Offers richtext/HTML message composing.
Supports searching messages and contacts.
Supports Int. domain names (IDNA).
Supports folder manipulation, shared folders and ACL.
Extensible using the Plug-in API.
Provides spell checking functionality.
Provides import/export functions.
Has a plug-in API for flexible exensions and so much more.

Recommended System Requirements:

A CentOS 7 Server or RHEL 7 Server with Minimal Install.
Apache or Nginx web server
PHP 5.4 and MySQL/MariaDB database
SMTP and IMAP server with IMAP4 rev1 support

For the scope of this article, we assume that you already have a running Postfix email server with virtual users, otherwise, follow our guides setup:

Testing Environment:

For the purpose of this article, I will be installing Roundcube Webmail on a Linode CentOS 7 VPS with a Nginx web server, static IP address 192.168.0.100 and hostname mail.tecmint.com.

Step 1: Install Nginx, PHP-FPM and MariaDB in CentOS 7

1. First start by enabling EPEL and REMI repositories and install Nginx, PHP, PHP-FPM and MariaDB server on your CentOS 7 system.

# yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
# yum install http://rpms.remirepo.net/enterprise/remi-release-7.rpm
# yum install yum-utils
# yum-config-manager --enable remi-php72
# yum install nginx php php-fpm php-mcrypt php-cli php-gd php-curl php-xml php-mysql php-mbstring php-pspell php-imagick mariadb-server

2. Once you have successfully installed all the packages, start the Nginx web server, enable it to auto-start at boot time and check if its up and running.

# systemctl start nginx 
# systemctl enable nginx
# systemctl status nginx

3. Next, if you have a system firewall enabled, you need to open port 80 for external requests.

# firewall-cmd --permanent --add-port=80/tcp
# firewall-cmd --reload

4. Next, you need to configure PHP-FPM to work properly. Open the file /etc/php.ini using a command line test editor.

# vim /etc/php.ini

Look for the directive ;cgi.fix_pathinfo=1, uncomment it and set its value to 0.

cgi.fix_pathinfo=0

Also uncomment the directive ;date.timezone and set its value to your timezone.

date.timezone = "Africa/Kampala"

Once you are done, save the file and exit.

5. Then start PHP-FPM service, enable it to auto-start at boot time and check if its up and running, as follows.

 
# systemctl start php-fpm 
# systemctl enable php-fpm 
# systemctl status php-fpm

Step 2: Secure MariaDB Server and Create Roundecube Database

6. Now start the MariaDB service using the following commands.

# systemctl start mariadb
# systemctl enable mariadb
# systemctl status mariadb

7. The default MariaDB installation is unsecure. You need to run the security script which comes with the binary package, to secure it. You will be asked to set a root password, remove anonymous users, disable root login remotely and remove test database.

# mysql_secure_installation

8. Now login to the MariaDB database, create a database for Roundecube and grant the user to appropriate permissions on the database (remember to set a strong/secure password in a production environment).

# mysql -u root -p
MariaDB [(none)]> CREATE DATABASE roundcubemail /*!40101 CHARACTER SET utf8 COLLATE utf8_general_ci */;
MariaDB [(none)]> CREATE USER 'roundcube'@'localhost' IDENTIFIED BY '=213@!#webL';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON roundcubemail.* TO 'roundcube'@'localhost';
MariaDB [(none)]> FLUSH PRIVILEGES;
MariaDB [(none)]> exit

9. Next, import the roundcube table layout to the newly created database.

# cd /var/www/html/roundcubemail/
# mysql -u root -p roundcubemail < SQL/mysql.initial.sql

Step 3: Download Roundcube Package

10. In this step, download the latest stable version (1.3.7 at the time of this writing) of Roundcube from the download page or use wget command-line downloader to get it, extarct the TAR file, and upload the files into your web server document root.

# wget -c https://github.com/roundcube/roundcubemail/releases/download/1.3.7/roundcubemail-1.3.7-complete.tar.gz
# tar xzf roundcubemail-1.3.7-complete.tar.gz 
# mv roundcubemail-1.3.7 /var/www/html/roundcubemail

11. Next, set the appropriate permissions on the roundcube web root files.

# chown -R nginx:nginx /var/www/html/roundcubemail

Step 4: Configure Nginx Server Block For Roundcube Web Installer

12. Now create an Nginx server block for the roundcube under /etc/nginx/conf.d/ (you can name the file the way you want but it should have a .conf extension).

# vim /etc/nginx/conf.d/mail.example.com.conf

Add the following configuration in the file.

server {
listen 80;
server_name mail.example.com;
root /var/www/html/roundcubemail;
index  index.php index.html;
#i# Logging
access_log /var/log/nginx/mail.example.com_access_log;
error_log   /var/log/nginx/mail.example.com_error_log;
location / {
try_files $uri $uri/ /index.php?q=$uri&$args;
}
location ~ ^/(README.md|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
deny all;
}
location ~ ^/(config|temp|logs)/ {
deny all;
}
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
location ~ \.php$ {
include /etc/nginx/fastcgi_params;
#fastcgi_pass 127.0.0.1:9000;
fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
}

Save the file and close it.

13. Next, open the file /etc/php-fpm.d/www.conf to make a few changes to PHP-FPM web directive.

# vim /etc/php-fpm.d/www.conf

Change the user apache to nginx in the following variables.

user = nginx
group = nginx

Then comment out the line listen = 127.0.0.1:9000 and set the listen variable to listen on a unix socket set in the nginx server block file:

listen = /var/run/php/php-fpm.sock

Also set the permissions for unix socket, uncomment and change the lines to:

listen.owner = nginx
listen.group = nginx
listen.mode = 0660

Configure PHP-FPM

Once you are done, save the file and close it.

14. Then restart the Nginx and PHP-FPM services to apply the recent changes, as follows.

# systemctl restart nginx php-fpm

Step 5: Access Roundcube Web UI

15. Before you start the install wizard, to avoid any sessions errors, set the appropriate permissions on the directory /var/lib/php/session/. The default group owner is apache, change it to nginx as shown.

# ls -ld /var/lib/php/session/
# chown :nginx /var/lib/php/session/
# ls -ld /var/lib/php/session/

16. Now open a browser and use the address http://mail.example.com/installer (replace domain with the server name you set while creating a Nginx server block for roundcube) to access the web installer. If all PHP versions, extensions and php.ini/.htaccess settings are correct, you will see following screenshot, click on Next to go to the configurations page.

http://mail.example.com/installer
OR
http://IP-address/installer

Access Roundcube Webmail Installer

17. The configurations page allows you to setup your roundcube instance. We will only explain the important options for the scope of this guide.

Under the General Configuration, set a product_name for example Example.com Webmail.

Roundcube Product Name

Go to Database setup, enter the database host, name, user and password to connect to the MySQL server.

Roundcube Database Settings

Then scroll down to IMAP and SMTP settings and enter the IP address of your IMAP and SMTP server, if its same server on which you are running roundcube, leave it as “localhost” and also specify other necessary parameters.

You can specify other settings according to your needs, once you are done, click on Create Config.

18. You should new see a message saying ”The config file was saved successfully into /var/www/html/roundcubemail/config directory of your Roundcube installation.” Click on Continue.

Roundcube Configuration File Created

19. You can review your configuration from the Test config page as shown in the following screenshot.

Test Roundcube Configuration

20. Next, remove the whole installer folder (which contains files that may expose sensitive configuration data like server passwords and encryption keys to the public) from the roundcube root directory (or make sure that enable_installer option in config.inc.php is disabled).

# rm -rf /var/www/html/roundcubemail/installer

21. Finally, use the URL http://mail.example.com to access the roundcube login page. Enter your user name and password to view your mails.

Roundcube Webmail Login

Roundcube Webmail Access

Summary

Roundcube is a widely used, fully-featured web-based multilingual mail client. In this article, we showed how to install the latest stable version of Roundcube Webmail on a CentOS 7 with Nginx web server. If you have any questions, use the feedback form below to reach us.

Monthly Archive 26 September 2018

How to Create SSH Tunneling or Port Forwarding in Linux

Infiniband Switch upgrades

Upgrade the Switch Firmware (CLI)

How to Install Latest Roundcube Webmail on CentOS 7

Categories