Secure remote access of a private network

Transcription

1 Secure remote access of a private network using copssh, PuTTY and Remote Desktop Secure Shell(SSH) What is Secure Shell(SSH) from Wikipedia Remote Desktop (from the online version- Windows XP Professional Resource Kit) Remote Desktop provides access and control functionality from a remote location to a computer running the Microsoft Windows XP Professional operating system, giving you the flexibility to work on your Windows XP Professional based computer from anywhere, anytime. The Example Network Clickontheimageforalargerview How-To and other information Secure Shell(SSH) Install copssh server software

2 SSH Port forwarding through a firewall or router Remote Desktop ConfigureRemoteDesktopontheWindowsXPProhostPC PuTTY and Remote Desktop Addressing the SSH server Install and configure PuTTY ConnecttotheremotePCusingRemoteDesktopandSSH Remote Desktop Tip: Disable the host desktop wallpaper to speed up the connection Securing the copssh Server Securing the copssh server Install the copssh server The example installation is from an installation on a Windows XP Professional desktop PC Login as an Administrator or as a user with Administrator privileges then download the free copssh server software to atemporaryfolderonthehostpc. Navigate to the temporary folder and double-click on the copssh server install package. Install as directed including activatingusers.notethatinordertologontothecopsshserverpcasasshusertheaccountmustbelocalto the copssh server PC and be activated. Port forwarding for SSH Port forwarding of TCP Port 22 through any firewall/nat/router is required if the user needs to access the SSH server from a remote location. The following example is from a Buffalo WBR-G54 4-Port Broadband Router/Wireless Access Point. The screen shot is current with the Buffalo v2.20 firmware release.

3 Clickontheimageforalargerview Port forwarding instructions for other routers may be found on the router manufacturers support web pages, in the router Users Guides or on the PortForward.com web site. NOTE-ForWindowsXPSP2WindowsFirewallusers:IftheWindowsXPSP2WindowsFirewallisusedonaPC connecteddirectlytothepublicinternet,thefirewallcanbeconfiguredtoallowsshbyaddinganewportdescriptioninthe Exceptions tab.

4 TheOpenPortChecktool The CanYouSeeMe.org site Open Port Check tool can quickly tell you if port forwarding through local firewall/nat/router devices is proper configured and working correctly. You can use this site to help troubleshoot SSH firewall/connectivity issues.notethatyoushouldrunthistestfromthesshserverpc. Configure the Windows XP Professional Remote Desktop host PC See this Windows XP Professional Resource Kit Enabling Remote Desktop section.

5 Configure Remote Desktop Users See the Enabling Users to Connect to the Computer running Windows XP Professional section from the Windows XP Professional Resource Kit. Remote Desktop users should use a strong password as an added security practice. Remote SSH server addressing CallingtheSSHserverPCfromaremotelocationisaccomplishedusingthepublicIPaddress,asassignedbytheISP,or fullyqualifieddomainnameofthepcorrouter/nat/firewall.tofindthepublicipopeninternetexploreronthepcatthe remote location and go to sites like or and note the reported IP address. If the firewall/nat/router is configured correctly, the call will be successfully passed to the appropriate PC. IftheISPassignsadynamicIPthenanothersolutionistosetupanaccountwithoneofthedynamicnamingservicesthat mapafullyqualifieddomainnametotheip.inmycaseiuseafreeservicefromno-ip.com.theno-ip.comsoftwareruns onaxpproboxandonatimeschedulebasiscontactstheno-ip.comservers.theno-ip.comserversthenknowwhatthe publicipisandmapsthattoafullyqualifieddomainname.thatinformationisthenpropagatedoverthepublicinternet.you thencallthesshserverpcusingthefullyqualifieddomainname. Install and configure PuTTY on the remote Client PC The example installation is from an installation on a Windows XP Professional desktop PC client Download the PuTTY software file and save to a folder on the client PC. I recommend creating a C:\Program Files\PuTTY folder and saving the downloaded file there. Navigate to the folder and double-click on the PuTTY.exe file. Click on the Window and Appearance tabs and configure as needed.

6

7 To configure port forwarding for the example network click on Tunnels and for Remote Desktop enter a Source port of 3390.EnteraDestinationIPornameandportnumberof3389usingacolonseparatorcharacter.Anexampleisfora Remote Desktop session to the PC Ashtabula. Tap the Add button. Repeat for additional Remote Desktop host PCs. Use a different Source port for each additional Remote Desktop host PC. ClickonSSHandconfiguretoEnablecompressionanduseSSH2only.ClickonSessionandenterthepublicIPaddress orafullyqualifieddomainnameofthesshserverpc.enterauniquenameinthesavedsessionswindowandclickon Save. Click on Open and login to the SSH server with the appropriate user and password information.

8

9 SSH Tunneling the Remote Desktop session Establishing a Remote Desktop connection to more than one XP Pro PC through the SSH tunnel is easily accomplished once PuTTYisstartedandtheuserhassuccessfullyloggedontototheSSHserver.OntheremoteclientPCgotoStart All Programs Accessories Communications and tap on Remote Desktop Connection. For example use an address of localhost:3390 to connect to Ashtabula and an address of localhost:3391 to connect to Norman... Various options can be modified by clicking the Options>> button. To initiate the Remote Desktop connection click on the Connect button. Problems connecting using the localhost address (from the online version- Microsoft KB Article ) OnacomputerthatisrunningMicrosoftWindowsXPwithServicePack2(SP2),programsthatconnecttoIPaddressesthat areintheloopbackaddressrangemaynotworkasyouexpect.forexample,youmayreceiveanerrormessagethatsays that you cannot establish a connection. Windows XP SP2 users can download a patch from Microsoft that corrects this. Disable the remote host desktop wallpaper Users can speed up the rendering of the remote PC desktop display, particularly over slow data links, by disabling the displayoftheremotepcdesktopwallpaperontheclientpc's.thiscanbeconfiguredontheremotedesktophostpc using the Group Policy Editor. Run gpedit.msc and navigate to the Local Computer Policy Computer Configuration Administrative Templates Windows Components Terminal Services policies. Double click on the Enforce Removal of RemoteDesktopWallpaperpolicyandselectEnable.ClickOKtosavethenewconfiguration.ClickonFile Exittoexit the Group Policy Editor.

10 Secure Shell(SSH) resources copssh-afreesshserverforthewindowsoperatingsystem Securing the copssh server PuTTY-afreeSSHandTelnetclientfortheWindowsoperatingsystem WinSCP -afreesftpclientforthewindowsoperatingsystem Tunnelier a free SSH/SFTP client that launches a tunneled Remote Desktop session automatically Windows XP Remote Desktop Resources The Windows XP Professional Resource Kit Configuring Remote Desktop The Microsoft Remote Desktop How-To Remote Desktop troubleshooting help Miscellaneous Windows XP SP2 loopback patch Broadband Reports Windows Based Remote Connections FAQ Remote Desktop Expert Zone columns Remote Desktop connection client by Charlie Russell Tuning Remote Desktop by Charlie Russell The next best thing to transporter beams by Charlie Russell Last reviewed: 26 July awj Copyright 2006-AlanW.Jarvi -Allrightsreserved The Microsoft MVP Program