I need to work remotely and need to connect to a company network from my work Mac over the internet. How do I set this up? I have looked at different software for example OpenVPN and Tunnelblick. But not sure how to go about it. Any suggestions? Advice?
If your work Mac has restricted firewall, and speed is your concern, you can try shadowsocks-libev to bypass the firewall, which is primarily designed to bypass GFW, and used by millions of sneaky users. It is so fast that no vpn can compete with it.
For your work device (server side)
brew install shadowsocks-libev
# ss-server and ss-local installed
# create a server with listening port 3333
# sudo may be required
ss-server -p 3333 -m chacha20 -k your_password -u
For you client (home device)
brew install shadowsocks-libev
# apt install shadowsocks-libev
# sudo may be required
ss-local -s WORK_IP -p 3333 -b 127.0.0.1 -l 1080 -k your_password -m chacha20 -u
This created socks5 proxy with 127.0.0.1:1080. Make sure "your_password", port "3333", encrypt method "chacha20" should be matched on both sides.
set your home deivce (client side) socks5 proxy as 127.0.0.1:1080. Done.
Test IP
# With proxy, this would show your work Mac's IP
curl -x socks5h://localhost:1080 ifconfig.co/json
# without proxy
curl ifconfig.co/json
As a client side, GUI version is also recommended for beginners. Open source Mobile Version is also available.
This is a demo only. For security reasons, do not contain any password in the command line. Use -c config.json instead.
You can try this: vpn client
You should ask your admins to set up a vpn account for you. After that you can connect with a vpn client( of your choosing your use barracuda) and the provided credentials. Hope to have helped.
Since you brought up OpenVPN and Tunnelblick I should probably point out that
Tunnelblick is a free, open source graphic user interface for OpenVPN on macOS
Therefore Tunnelblick is probably going to be your app of choice.
Again, since you clearly are looking at OpenVPN I should point out there are two editions in circulation at the moment: commercial and community. I don't see any reason why you should pick commercial edition as your setup seems to be pretty simple. You probably will end up with a checklist of following things to do:
set up an OpenVPN server in your company network (windows, linux, pc, mac, raspberry pi - range of supported platforms is very extensive)
on the server generate keys for your client(s) (or use pre-shared secret as described in quick start below)
write and securely transport .ovpn config files (you can embed keys in there for simplicity) over to your mac
import the .ovpnfile into your Tunnelblick and start
The official quick start guide is probably the best place to start quick.
There's a whole bunch of other things that you (or more likely, your workplace network admin) will have to sort out. Just to name a few: routing and NAT-ting, ip address/domain name for OpenVPN server, firewall rules on machines you connect to.
But covering it all here without knowing your specifics will be problematic.
You should use any-desk or VNC server for connect your machine remotely. it's easy to use.
Your problem is not what you need to do on your Mac. What you do on the Mac-side is only half of any viable solution.
What you need to find out is what ways of connecting to the "company network" are provided by the company? Is anyone able to connect to the company network from a non-Mac computer? Does the company have any IT staff? Or do you have auth/means of changing their network configuration?
First of all, what type of control do you need? If we're talking about files and stuff like that then you should run a SSH server on your mac. More about that here (stackoverflow.com\superuser.com) and here (apple.com).
Another way to do that is to run a Remote Control Software (for example, Team Viewer), but it's laggy and unstable.
I was in the same situation as you a few months earlier and used the Tunnelblick in the Mac OS, which worked perfectly fine.
Since you are going to connect to your company network, I suggest you configure a VPN server and client to do that. I have configured the OpenVPN community edition to do that. The steps are:-
Server side configuration
- Login to root - sudo su
- Install OpenVPN and Easy-RSA - apt-get install openvpn easy-rsa
- Copy the server.conf from samples to /etc/openvpn - gunzip -c
/usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz >
/etc/openvpn/server.conf
- Edit server.conf
- Check that Diffie-Hellman is set to 2048 - dh dh2048.pem
- Uncomment push "redirect-gateway def1 bypass-dhcp"
- Uncomment push "dhcp-option DNS 10.0.2.100" or put any other DNS
server you want - default settings is OpenDNS.
- Setup IP forwarding echo 1 > /proc/sys/net/ipv4/ip_forward
- Also, edit /etc/sysctl.conf, and set "net.ipv4.ip_forward=1" after
uncommenting the line. This is for persisting the ip forwarding when
you reboot.
- Setup ufw (Uncomplicated Firewall - this is a frontend to iptables)
- ufw allow ssh
- ufw allow 1194/udp
- Edit /etc/default/ufw and set DEFAULT_FORWARD_POLICY to ACCEPT.
- Edit /etc/ufw/before.rules and add the following lines near the top
*nat :POSTROUTING ACCEPT [0.0]
-A POSTROUTING -s 10.0.8.0/8 -o ens4 -j MASQUERADE COMMIT ufw enable
- Do a ufw status and check if the rules are setup properly
- Setup the RSA keys
- cp -r /usr/share/easy_rsa/ /etc/openvpn/
- mkdir /etc/openvpn/easy-rsa/keys
- Edit /etc/openvpn/easy-rsa/vars and change keys KEY_COUNTRY etc, and
KEY_NAME="server"
- Generate the Diffie-Hellman PEM file - openssl dhparam -out
/etc/openvpm/dh2048.pem 2048 cd /etc/openvpn/easy-rsa/
- . ./vars
- ./clean-all
- ./build-ca
- ./build-key-server server
- cd keys && cp server.crt server.key ca.crt /etc/openvpn
- At this point your /etc/openvpn should contain server.key,
server.crt, ca.crt and dh2048.pem
- Start OpenVPN - service openvpn start
- Generate client config
- Copy client config from samples - cp
/usr/share/doc/openvpn/examples/example-config-files/client.conf
~/client/client.ovpn
- Generate the client keys - cd /etc/openvpn/easy-rsa && ./build-key
client It will generate client.crt and client.key files.
- Copy client.crt, client.key, ca.crt to ~/client.
- Edit client.ovpn
- Edit the entry "remote my-server-1 1194" and put the
IP/Hostname of the VPN server in place of my-server-1.
- At the end, append "auth-user-pass"
- In a new line, add an opening tag <ca>.
- Append the contents of /etc/openvpn/ca.crt.
- Append a closing tag </ca>.
- Append opening tag <cert>.
- Append contents of client.crt.
- Append a closing tag </cert>.
- Append a opening tag <key>.
- Append contents of client.key.
- Append a closing tag </key>.
- Comment out keys "remote-cert-tls server" and "tls-auth ta.key 1"
- Uncomment "user nobody" and "group nogroup".
- Save the file and download to your Mac client securely.
Client side configuration
Download the OpenVPN MacOs client
(https://openvpn.net/vpn-server-resources/connecting-to-access-server-with-macos/).
Import the .ovpn file mentioned earlier.
Connect using this client.
Related
I am running apps on Compute Engine. I run on a Windows box and use Putty to connect to the CE. This pretty much seems to work fine (leaving aside the problems in the Google doc on this).
I have set up another user who I want to enable for SSH (on a Mac) and have her use FileZilla to push files to the CE.
I am trying it out on my own Mac. I set up 2 firewall rules with 2 different priorities for tcp:22 =
myssh Apply to all IP ranges: 0.0.0.0/0 tcp:22 Allow 1000 default
default-allow-ssh Apply to all IP ranges: 0.0.0.0/0 tcp:22 Allow 65534 default
The user has permissions on of the Project of: "Compute Instance Admin(v1)"
On the Mac terminal I do the following:
ssh-keygen -t rsa -f ~/.ssh/userfirstname-ssh-key -C [googleusername.gmail.com]
I go to the GCP CE Meta data (logged in as myself) and then copy the contents of the userfirstname-ssh-key.pub to the Metadata/SSH Keys and save.
After GCP gives the ok on the key being added I enter the following in the Mac terminal:
ssh -i [userfirstname]-ssh-key [googleusername.gmail.com]#gcp-external-ip
Depending on i-don't-know-what, sometimes it says "Permission denied (public key)", "Operation timed out"
I've repeated this a few times and just tried to telnet in to the gcp-external-ip and get "Operation timed out" telnet: Unable to connect to remote host.
At a complete loss. Please help.
You could (and should) use the gcloud command line tools. Then it is easiest to simple copy the correct gcloud command from the Web Console. There is a little drop-down menu next to 'SSH' for each of your instances.
I've just successfully built SparkleShare for windows according to guide:
https://github.com/wimh/SparkleShare/wiki
and exported my ssh public key to a server.
The problem is that I can't connect from a client behind a http_proxy to a public server with ssh running on a custom port. I had also problem with cloning any git server. I need to switch git:// protocol to http:// one. Any suggestion? Does anyone have similar experience?
This is a log file:
15:25:13 [SSH] ssh-agent started, PID=4380 Identity added:
C:\Users\MYUSER\AppData\Roaming\sparkleshare\sparkleshare.MYEMAIL.key
(C:\Users\sg0922706\AppData\Roaming\sparkleshare\sparkleshare.MYEMAIL.key)
15:25:34 [Fetcher][C:\Users\MYUSER\Documents\SparkleShare.tmp\share]
Fetchin g folder: ssh://MYGITUSER#MYHOST/MYPATH 15:25:34 [Fetcher]
Disabled host key checking MYHOST 15:25:34 [Cmd] git clone --progress
"ssh://MYGITUSER#MYHOST/MYPATH" "C:\Us
ers\MYUSER\Documents\SparkleShare.tmp\share" 15:25:37 [Git] Exit code
128 15:25:37 [Fetcher] Failed 15:25:37 [Fetcher] Enabled host key
checking for MYHOST
To get SparkleShare to use your proxy you will need to modify the config of the msysgit that is installed as part of SparkleShare. Navigate to C:\Program Files (x86)\SparkleShare\msysgit\etc and edit the gitconfig file in notepad and add the following line under the [http] tag
proxy = http://user:pass#proxyurl:port
modifying the url as required to match your settings. You can then use the "On my own server" option to add the http url of your repository.
I have a work around on this particular problem. I guess that you already successfully connected to your server via a simple SSH client (i.e. PuTTY)? With PuTTY you can easily configure an ssh connection via any kind of proxy (such as HTTP, SOCKS, Telnet, ..)
What you can do now is to specify a local "tunnel" (an SSH port forwarding rule) like this: L22 127.0.01:22 (see attachment). If you are using a ssh command line add the following option: -L 22:127.0.01:22.
So now as soon as your terminal is open and running you'll be able to reach your git server via the server url: ssh://git#127.0.0.1.
If your local port 22 is busy you can define the tunnet on a other port. i.e. if the 44 is not occupied: L44 127.0.0.1:22. The url to use in SparkleShare become ssh://git#127.0.0.1:44.
But it's a work around. I'm looking for a better solution.
I've been using Tortoise to checkout/commit to the svn repository. It is set up to use Tortoiseplink as SSH client (D:\TortoiseSVN\bin\TortoisePlink.exe -l foo -pw bar). I have now moved to a Mac (using Cornerstone) but I can't get the same sort of setup. Whatever I do, I can't get Cornerstone to connect to the repo.
Do I need to set up an ssh tunnel? And how do I do that on a Mac?
Update: screenshot of the settings needed
What you have looks correct - the only thing I can think of is that your SSH connection is not working for some reason. Have you tried just doing an SSH to the server hosting the repository? To do this, open Terminal and type:
$ ssh hostgator_username#gator123.hostgator.com
If you are prompted for a password and you can log into the machine then that is a good start - if not that suggests that something is fishy with your network setup.
psql mydb yields:
psql: could not connect to server: Permission denied
Is the server running locally and accepting
connections on Unix domain socket "/var/pgsql_socket/.s.PGSQL.5432"?
psql -h localhost mydb works just fine. pg_hba.conf looks like:
local all all trust
host all all 127.0.0.1/32 trust
host all all ::1/128 trust
What up?
I had the exact same thing happen to me, presumably due to the conflicting version of psql (one from Lion, one from homebrew). While I still haven't been able to figure out how to make psql use the /tmp socket directory, I do have a work around.
Put the following in your .bashrc (or .zshrc, etc):
export PGHOST=/tmp
This sets the correct "host" back to the correct socket directory, without having to supply the -h flag
Probably psql and the server use a different location for the unix-domain socket.
( /var/pgsql_socket/ is a strange location) This can happen if you are mixing binaries from different packages.
Try to locate the socket ( /tmp/ is a good place to start) You can force psql to use a different directory by misusing the -h option:
psql -h /tmp/
It appears to be a reported defect.
This happened to me on OS X, and the problem was that /usr/bin/psql is what I was using, but postmaster was running from /Library/PostgreSQL/9.0. Using /Library/PostgreSQL/9.0/bin/psql (getting that into my PATH before all else) fixed the problem.
As other answers addressed other alternatives, I guess I could provide something about Mac OS X Server on Lion. I run into very similar issue - in my case even -h localhost didn't work as networking was disabled in PostregSQL which is by the way in many cases very good idea. The thing with Mac OS X Server is that it launches PostgreSQL server via launchd.
Some hints as you go around:
serveradmin service: postgres
launchd configuration file: /System/Library/LaunchDaemons/org.postgresql.postgres.plist
database folder: /var/pgsql
socket folder: /var/pgsql_socket
That configuration file overrides several configuration directives that can be found in postgresql.conf under database folder. Especially these two:
unix_socket_group
unix_socket_permissions
You can find that _postgres account is used to run the server and everything is also accessible if active user is member of _postgres group.
By running dscl . -read /Groups/_postgres GroupMembership you can see that by default that group has these members: _devicemgr _calendar _teamsserver _www
I guess you have two options. Add yourself to _postgres group or change launchd configuration plist file. The later is just plain text editing... But beware of security, because this way you'll be opening Server to whatever meets criteria you change (see the last paragraph).
The former can be done either via Server.app or via dscl command-line utility. The first option probably doesn't need anything to be added. Just make sure that you can see System Accounts (View -> Hide/Show System Accounts). I'm kind of CLI junkie so this should add your user to _postgres group:
sudo dscl . -append /Groups/_postgres GroupMembership $USER
Of course you should be careful what you run under your account then because you're giving access to you Mac OS X Server database back-end. So either secure you _postgres account or create separate user to manipulate your database or don't save anything private there.
I have connected to a server via SFTP using FileZilla and accepted adding the server's SSH key to the key cache in FileZilla.
How can I extract this cached key to a keyfile so that may use it through other SFTP applications that require a keyfile be made available?
I have not been able to find anything in the FileZilla documentation related to this.
If you use the standard openssh console client (cygwin or from linux), host keys are stored, one-per-line, in ~/.ssh/known_hosts. From there, it's a simple matter of figuring out which bit of that host key is needed for your library.
Putty also stores host keys, but it appears to encode them in hex. Those can be found at HKCUR\Software\SimonTatham\PuTTY\SshHostKeys
Thomas was correct. FileZilla piggybacks on PuTTY's PSFTP program and stores the saved keys encoded in a hex format at the registry key he listed (HKCUR\Software\SimonTatham\PuTTY\SshHostKeys). I needed the key in known_hosts format, so I has able to install a windows version of openssh at his recommendation and used the ssh-keyscan tool to hit the server and save the key info out in the correct format:
ssh-keyscan -t rsa <my_ftp_ip_address> > c:\known_hosts
ssh-keyscan -t dsa <my_ftp_ip_address> > c:\known_hosts
Thank you Thomas and SO!
If you'd rather use a GUI, you can snag the host key from the log window or the first-time connection popup using WinSCP FTP client: https://winscp.net/eng/docs/ssh_verifying_the_host_key
Thanks Dougman for the tip!
To further help any newcomers reading your answer.
Prior to running the ssh-keyscan, assuming the openssh is install by default, there is a few commands that needs to be run (read the quickstart/readme install for details).
Here are my commands which allow me to obtain the host key.
C:\Program Files\OpenSSH\bin>mkgroup -l >> ..\etc\group
C:\Program Files\OpenSSH\bin>mkpasswd -l >> ..\etc\passwd
C:\Program Files\OpenSSH\bin>net start opensshd
The OpenSSH Server service is starting.
The OpenSSH Server service was started successfully.
C:\Program Files\OpenSSH\bin>ssh-keyscan -t rsa vivo.sg.m.com > c:\known_hosts
vivo.sg.m.com SSH-2.0-Sun_SSH_1.1
Unless I am misunderstanding you: you don't need to.
If you connect to the server with another application (ie: PuTTY) and it has not seen the server before then you will be prompted to accept the key.
I see why you might want to do this, but each application could have it's own way to store keys.