SSH bypassing Firewall and NAT

Posted September 13th, 2011 in Linux by James

Just spent a while helping Jon Tremelling with his most recent Linux faux pas (for the future Jon; Don’t ever run dd on the wrong device!).

Anyway, as per usual we have a problem with me trying to SSH around his routers closed and forwarded ports. This got me thinking about reverse SSH tunneling and if we could use my VPS as a middle man.

Through some Googling I found the SSH option -R which allows you to bind a port on the remote server to a new host.
So let us run this command on the machine we are trying to reach, our destination machine, using my VPS (ivings.org.uk) as the middle man:

ssh -R 10022:localhost:22 middleman@ivings.org.uk

This opens and binds port 10022 on the VPS for listening, and all connections on that port are forwarded to port 22 of our destination.

Now if I ssh to the VPS:

ssh james@ivings.org.uk

Then connect to the tunnel port:

ssh user@localhost -p 10022

Where `user` is our username for the destination, then we should be logged on through our tunnel, bypassing the destination machines firewall and NAT.

If you want to add extra security, then this situation should work fine with normal ssh keys instead of passwords.

Upgrading Ubuntu from Jaunty 9.04 to Lucid 10.04

Posted August 31st, 2011 in Linux by James

Recently the lack of support for the version of Ubuntu I was lumped with on my VPS (9.04) was starting to be a major hindrance to development. It appears that once an Ubuntu version gets too old all the packages get deprecated completely, rendering the package manager apt completely useless.

Obviously I had put off upgrading long enough, so went searching on the best way to migrate to the newest version. The first command I found seemed pretty simple;

sudo do-release-upgrade

This should automagically download the latest kernel source and upgrade all packages to the newest supported version, awesome. However, if it was that simple then I wouldn’t be blogging about it right? Right.
It appears that this command gets deprecated when you fall more than one version behind. So although it can be used effectively to upgrade from Karmic to Lucid, it doesn’t work when upgrading from Jaunty. For reference, the the command gives the following output:

sudo do-release-upgrade

Checking for a new ubuntu release
Done Upgrade tool signature
Done Upgrade tool
Done downloading
extracting 'lucid.tar.gz'
authenticate 'lucid.tar.gz' against 'lucid.tar.gz.gpg'
tar: Removing leading `/' from member names

Reading cache

Checking package manager

Can not upgrade

An upgrade from 'jaunty' to 'lucid' is not supported with this tool.

In order to pull this off we firstly need to upgrade to Karmic. Luckily there is a small hack that allows us to upgrade all our packages to Karmic versions, including the kernel.
Edit the apt sources list so that it looks like this:

sudo nano /etc/apt/sources.list

## EOL upgrade sources.list
# Required
deb http://archive.ubuntu.com/ubuntu/ karmic main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu/ karmic-updates main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu/ karmic-security main restricted universe multiverse

# Optional
#deb http://archive.ubuntu.com/ubuntu/ karmic-backports main restricted universe multiverse
#deb http://archive.ubuntu.com/ubuntu/ karmic-proposed main restricted univ

Now, if we run a system upgrade, all Karmic packages will be downloaded and installed, including the new kernel.

sudo apt-get update && apt-get upgrade

Now we are running Karmic we can upgrade to Lucid using:

sudo do-release-upgrade

Hopefully you should not have any issues with this, but I had a couple with the old kernel files.
Explained by this StackOverflow post by me, I was stuck with some old kernel modules that would not uninstall because the kernels no longer existed. This was giving me this error message every time I ran apt:

The following packages will be REMOVED
linux-restricted-modules-2.6.28-11-server
linux-restricted-modules-2.6.28-19-server

Thank god for StackOverflow or I would still be stuck on it now. Check the link above for the given solution. Apart from that, and a few issues with my Apache server, it was a relatively smooth upgrade.