SSH addenda

[tech]

posted by tom / August 31, 2005 /

I can't install programs at work!

You shouldn't have to. PuTTY doesn't require installation; it's just an executable you run. I can't account for every security configuration that your work might have, but you don't have to be an administrator to run PuTTY. However, at my job I've got admin rights, and I haven't bothered to create a non-admin user and try this out for myself. I would suggest dumping PuTTY on a thumbdrive. While you're at it, stick Portable Firefox on there, too. You can set up all the proxy settings at home and not worry about having rights to change them at the office. Just run the apps off your thumb drive.

If that doesn't work, well, there's probably not much more I can do to help. Well, okay, that's not true. I'll try to put up something about recovering your local Administrator password by and by. But in the short term: go buy a thumbdrive and give it a try.

I have a Mac!

First: this might be totally unhelpful. I don't own a Mac, and I havent yet installed the leaked OSX86 image. It would be great if a knowledgeable Mac user could add a comment explaining where I'm totally off-base.

But... from what I can tell, here's how you'd do it. Thing is, OS X is based on BSD, a *nix-style system, which makes SSH a very natural fit. In fact, you probably already have an SSH server installed and running, according to this page. To make sure it's on, go to the "Sharing" System Preferences Panel and make sure "Remote Login" is enabled.

You'll want to restrict the users who can log in. Like with OpenSSH on Windows, this is based on the system's users, not some SSH-specific pool of logins and passwords. I'm no expert on adding users on the Mac, but this page might provide you with some help if you need it. Now: to restrict the SSH server to only let in the designated user.

The SSH server config file is either /etc/sshd_config or /etc/ssh/sshd_config (probably the former, but I can't confirm). Edit it (you'll probably have to be logged in as a superuser) and find the line that begins with "AllowUsers". If there isn't one, add it. After it, specify the user name you want to allow to log in. If you'd like to change the port on which SSH will run, this file is also the place to do that — find the line that says "Port", remove the hash (#) in front of it (if there is one), and change the number accordingly. Then stop and restart the "Remote Login" service as outlined above.

As for Privoxy... well, there's a Mac installation package available, and we didn't have to specify any custom settings during the PC install. Looking here, it doesn't seem like you should have to do anything other than run the installer.

That should take care of the server half of the equation. You should be able to forward a port on your router and log into your Mac from the outside world. You can mix and match platforms — the server and client don't have to be the same operating system.

But what if you've got a Mac at work? Well, I'm sure there are plenty of SSH clients out there for Macs, but OS X should already have the command-line version available; let's just use that (you will have to figure out how to get to the command-line, though). Once you've got a cursor in front of you, and assuming a) your SSH server's public IP is, say, 12.34.56.78 and b) the account you specified in sshd_config is "sshuser" (like in the other howto), you'd use the following line:

ssh -lsshuser -L8118:127.0.0.1:8118 12.34.56.78

Note that both of those parameters are "L"s, but one is uppercase and the other is lower. Hit enter; get the prompt about the unknown key; enter the password — and then configure your browser's proxy settings as described in the PC howto.

I hope this is helpful. Sorry I can't be more specific, particularly with respect to the Mac. If you have problems with these instructions, post a message to comments and hopefully we can all muddle through together.