Size: 11687
Comment:
|
Size: 12633
Comment:
|
Deletions are marked like this. | Additions are marked like this. |
Line 1: | Line 1: |
<<TableOfContents(3)>> | #rev 2020-09-10 bonaccos <<TableOfContents()>> |
Line 5: | Line 7: |
The chapter "Remote Access" will show you possible solutions to remotely access a managed client or your data inside the D-ITET networks from the selfmanaged client network or from devices outside the ETH network. It will cover the following topics: | The article ''Remote Access'' will show you possible solutions to remotely access a managed client or your data inside the D-ITET networks from the selfmanaged client network or from devices outside the ETH network. It will cover the following topics: |
Line 12: | Line 14: |
=== Remote access and network restrictions === |
|
Line 17: | Line 21: |
* '''VPN zone(s)''' (Public VPN zones; you will be assigned to this zone by default when you connect to the ETH network using the VPN client. An exception would be if a realm to enter a specific private VPZ zone is configured in the VPN client. The latter is only enabled in exceptional cases; contact ISG.EE for details.) * '''Internet''' (all networks outside ETH intranet) |
* '''VPN zones''' (Public VPN zones like "guest", "student-net", "staff-net"; you will be assigned to this zone by default when you connect to the ETH network using the VPN client. An exception would be if a realm to enter a specific private VPZ zone is configured in the VPN client. The latter is only enabled in exceptional cases; contact ISG.EE for details.) * '''Internet''' (this is not a real VPZ, but it describes all networks outside of the ETHZ intranet) |
Line 20: | Line 24: |
=== Enabled remote access protocols === | |
Line 21: | Line 26: |
Here is a table with the relevant protocols for remote access: |
The following table shows protocols which are relevant for remote access: |
Line 30: | Line 33: |
|| SMB/CIFS |||| Server Message Block / Common Internet Filesystem |||| Microsoft network file sharing protocol || || NFS |||| Network File System |||| Unix/Linux network file sharing protocol || |
|| SMB/ CIFS |||| Server Message Block/ Common Internet Filesystem |||| Microsoft network file sharing protocol || || NFS |||| Network File System |||| Linux network file sharing protocol || |
Line 34: | Line 37: |
<<BR>> | |
Line 36: | Line 38: |
The following table shows the available protocols depending on the source and target network: || |||| ICMP |||| SSH |||| HTTP/ HTTPS |||| RDP |||| VNC |||| SMB/ CIFS |||| NFS *1) |||| IMAP/ SMTP || || internet -> itet-isg |||| (./) |||| {X} |||| {X} |||| {X} |||| {X} |||| {X} |||| {X} |||| ( (./) ) *2) || |
=== Remote access map of allowed traffic === The following table shows the allowed traffic flows for remote access related services: || Client source network -> Remote destination network |||| ICMP |||| SSH |||| HTTP/ HTTPS |||| RDP |||| VNC |||| SMB/ CIFS |||| NFS¹ |||| IMAP/ SMTP || || internet -> itet-isg |||| (./) |||| {X} |||| {X} |||| {X} |||| {X} |||| {X} |||| {X} |||| ( (./) )² || |
Line 45: | Line 50: |
*1) NFS access from unmanaged clients is not allowed for security reasons. <<BR>> *2) These protocols are only enabled for the servers involved in the D-ITET mail system. <<BR>><<BR>> From the zones itet-isg and itet-staff to the internet the ip transport protocols udp/tcp are generally enabled. Every machine inside can initiate a connection to an arbitrary server port in the internet. |
* ¹ NFS access from unmanaged clients is not allowed for security reasons. * ² These protocols are only enabled for the servers involved in the D-ITET mail system. From the zones itet-isg and itet-staff to the internet the ip transport protocols TCP/ UDP are generally enabled. Every machine inside can initiate a connection to an arbitrary server port in the internet. |
Line 52: | Line 58: |
You can access your inbox and your mail folders with a web browser on any client with internet connectivity. Our web server with the Roundcube software can be reached under https://email.ee.ethz.ch . | You can access your inbox and your mail folders with a web browser on any client with internet connectivity. Our web server with the Roundcube software can be reached under https://email.ee.ethz.ch. |
Line 55: | Line 61: |
You can also access your mail with any IMAP/ SMTP based mail client software ( Thunderbird, Outlook, Smartphone Mail Programs, Windows 10 Mail, ......) over the internet. IMAP/ SMTP access to our mail servers is enabled for the internet. Detailed information is available in this Wiki under https://computing.ee.ethz.ch/Email . | You can also access your mail with any IMAP/ SMTP based mail client software ( Thunderbird, Outlook, Smartphone Mail Programs, Windows 10 Mail, ......) over the internet. IMAP/ SMTP access to our mail servers is enabled for the internet. Detailed information is available in [[Email|the Email overview page]]. |
Line 58: | Line 64: |
In the Unix/ Linux world remote terminals are widely used. The shell "ssh" (a replacement for deprecated tools like "telnet" or "rsh") allows secure (i.e. encrypted connection) remote terminal sessions. To establish such sessions, you will need an '''ssh''' client application. Under Linux and Mac OSX, the program is called {{{ssh}}} and is usually provided by the basic installation of the operating system. Unter MS Windows, a 3rd party manufacturer application like PuTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty), X-Win32, or the Cygwin SSH client must be installed separately. | In the Linux world remote terminals are widely used. The secure shell `ssh` allows secure (i.e. encrypted connection) remote terminal sessions. To establish such sessions, you will need an SSH client application. Under Linux and Mac OSX, the program is called `ssh` and is usually provided by the basic installation of the operating system. Under MS Windows, a 3rd party manufacturer application like PuTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty), X-Win32, or the Cygwin SSH client must be installed separately. |
Line 64: | Line 71: |
}}} After a successful login, a remote terminal session is established on the selected target host. If you omit {{{<account>@}}} in the {{{ssh}}} commandline, your shell's current session login username is used. * To connect to an ssh service from an ETH-external client, one must install and activate the [[Workstations/Network/VPN|VPN]] client software on that computer and then proceed in a way as if the client were an ETH-internal computer (see above). * Alternatively, for ETH-external clients, one may establish a "direct" connection (without VPN client) to the target host via our login server {{{login.ee.ethz.ch}}}. For the latter, use the following commandline (example for the Linux built-in ''ssh'' application): {{{ |
}}} After a successful login, a remote terminal session is established on the selected target host. If you omit <account>@}}} in the {{{ssh}}} commandline, your shell's current session login username is used. * To connect to an ssh service from an ETH-external client, one must install and activate the [[Workstations/Network/VPN|VPN]] client software on that computer and then proceed in a way as if the client were an ETH-internal computer (see above). Using ''fully qualified hostnames'' (e.g. "{{{ssh hostname.ee.ethz.ch}}}" instead of just "{{{ssh hostname}}}") allows you to access the target ETH server from anywhere (using the VPN client or the method described in the next paragraph), especially from selfmanaged/ private computers that are not in the ''ee.ethz.ch'' subdomain. * Alternatively<<FootNote(If possible use a VPN client connection to the ETH network to better distribute the access)>>, for ETH-external clients, one may establish a "direct" connection (without VPN client) to the target host via our login server {{{login.ee.ethz.ch}}}. For the latter, use the following commandline (example for the Linux built-in ''ssh'' application): {{{ |
Line 69: | Line 76: |
* For a key-based ssh login see https://computing.ee.ethz.ch/FAQ/SSHkeys .<<BR>><<BR>> | For a transparent access you can configure your client SSH configuration with something similar as {{{ Host login.ee.ethz.ch User username PreferredAuthentications publickey Host *.ee.ethz.ch !login.ee.ethz.ch User username ProxyJump login.ee.ethz.ch PreferredAuthentications publickey }}} * If you want to establish a "direct" connection (without VPN client) to the target host via our login server {{{login.ee.ethz.ch}}} '''from an ETH-external Windows client''' using '''PuTTY''', read [[WindowsDirectSSHAccess|this]] article. * For a key-based ssh login see https://computing.ee.ethz.ch/FAQ/SSHkeys . |
Line 82: | Line 101: |
For advanced users: If you want to make sure the remote SSH machine you are connecting to is in fact the machine you are expecting (and not modified/ hacked one, using man-in-the-middle-attack etc.), you can verify its hostkey on this website: https://computing.ee.ethz.ch/SshFingerprints | For advanced users: If you want to make sure a ''managed ISG.EE Linux computer'' you intend to access with `ssh` is in fact the machine you are expecting (and not a modified/ hacked one; e.g. with man-in-the-middle-attack), you can verify its hostkey. How that works is described on this website: https://computing.ee.ethz.ch/SshFingerprints |
Line 86: | Line 105: |
=== Windows RDP === The Microsoft Remote Desktop Protocol is the remote desktop solution in the windows world. An RDP-server component is integrated in all Microsoft operating systems and the protocol is widely used for terminal server access. An RDP client software (rdesktop, xfreerdp,..) is also available for linux, so it's no problem to get a windows remote desktop on a linux client. Here are the sample commands for rdesktop and xfreerdp: {{{ > rdesktop -u d\\pmuster -k de-ch -g 1280x1024 vega7.ee.ethz.ch > xfreerdp [-sec-nla] [/cert-ignore] /size:1920x1100 /u:pmuster /d:d /vega7.ee.ethz.ch }}} [ ] are optional parameters and their need depends on the configuration settings of the terminal server.<<BR>><<BR>> On windows machines you can start the RDP client with mstsc.exe . |
=== Windows Remote Desktop === To access your Windows computer remotely, please read [[RDS|Windows Remote Desktop Services]]. === X11VNC === `x11vnc` can be used to connect to a desktop session running on the physical display of a host. Please see the [[https://computing.ee.ethz.ch/FAQ/x11vnc|X11VNC HOWTO]] for further details. In case you have no running session on the physical display and need to login graphically, please contact [[mailto:support@ee.ethz.ch|support]] and provide the name of the host you need to access. |
Line 96: | Line 113: |
VNC is the preferred solution for remote desktop sessions on linux machines. A detailed description of the usage of VNC is in the FAQ (https://computing.ee.ethz.ch/FAQ/VNCUsage). | VNC is the preferred solution for remote desktop sessions on Linux machines. Please read the [[RemoteAccess/VNC|VNC article]] for more details. |
Line 100: | Line 117: |
=== Http download === The http download is a simple solution to transfer a data file to an external user. On the client side no additional software is needed, a web browser is sufficient.<<BR>><<BR>> |
=== HTTP download === The HTTP download is a simple solution to transfer a data file to an external user. On the client side no additional software is needed, a web browser is sufficient. |
Line 106: | Line 125: |
> htpasswd -c /home/pmuster/public_html/.htpasswd download | > htpasswd -s -c /home/pmuster/public_html/.htpasswd download |
Line 108: | Line 127: |
Create a file .htacces in the download folder /home/pmuster/public_html/transfer with content: | Create a file .htaccess in the download folder /home/pmuster/public_html/transfer with content: |
Line 118: | Line 137: |
Between two Unix/Linux machines you can transfer a file with the ssh-integrated secure file copy (SFTP). The command is: | Between two Linux machines you can transfer a file with the ssh-integrated secure file copy (scp). The command is: |
Line 120: | Line 140: |
ubuntu@home> scp <path-to-datafile> <user>@<dns hostname>:<path-to-target directory> | user@home> scp <path-to-datafile> <user>@<hostname>:<path-to-target directory> |
Line 124: | Line 144: |
ubuntu@home> scp document.pdf pmuster@login.ee.ethz.ch:Documents/ | user@home> scp document.pdf pmuster@login.ee.ethz.ch:Documents/ |
Line 128: | Line 148: |
=== Windows WinSCP/Filezilla === Windows has no ssh integrated, so you must use an additional software. The popular programs WinSCP (https://winscp.net) and Filezilla (https://filezilla-project.org) are the preferred choice. Filezilla is also available for the linux platform and is already installed on our managed linux clients. |
=== Windows WinSCP/ FileZilla === Windows has no SSH integrated, so you must use an additional software. The popular programs WinSCP (https://winscp.net) and FileZilla (https://filezilla-project.org) are the preferred choice. FileZilla is also available for the linux platform and is already installed on our managed linux clients. |
Line 132: | Line 153: |
ID provides 50 GB storage to every ETH member (https://www1.ethz.ch/id/services/list/polybox/index_EN). The polybox client software is available for different plattforms and synchronizes a local storage on the client with the owncloud server storage. If the client software is installed on two machines you can therefore transfer data between the two machines with the polybox client. | ID provides 50 GB storage to every ETH member [[https://www.ethz.ch/services/en/it-services/catalogue/storage/polybox.html]]. The polybox client software is available for different plattforms and synchronizes a local storage on the client with the owncloud server storage. If the client software is installed on two machines you can therefore transfer data between the two machines with the polybox/ownclound client. |
Line 135: | Line 157: |
ID offers also a service for the exchange of big sized files which can not be send by mail named Cifex (https://cifex.ethz.ch/). The mail size limit depends on the provider but normally files greater than 50-100 Mbyte can not be send by mail. It's a good solution for sporadic transfers of big sized data files to a site where no n-ethz account can be used. | ID offers also a service for the exchange of big sized files which can not be send by mail named Cifex (https://cifex.ethz.ch/). The mail size limit depends on the provider but normally files greater than 50-100 Mbyte can not be send by mail. It's a good solution for sporadic transfers of big sized data files to a site where no IAM account can be used. |
Line 138: | Line 161: |
Line 139: | Line 163: |
Because NFS is not enabled between the internal networks nor to the internet it has no significance in remote access solutions. NFS is only used by ISG managed linux clients to access user and project homes on servers and dedicated storage systems of ID and ITET by automount tables. | |
Line 141: | Line 164: |
=== SMB/CIFS access === This Microsoft network file sharing protocol has a user based authentication and therefore has a great significance for accessing data resources not only on windows file servers. Linux/Unix servers are also providing SMB/CIFS access with use of the '''samba''' software suite, an emulation of the windows file sharing protocol for Linux/Unix file servers.<<BR>><<BR>> |
Because NFS is not enabled between the internal networks nor to the internet it has no significance in remote access solutions. NFS is only used by ISG managed linux clients to access user and project homes on servers and dedicated storage systems of ID and ITET by Linux automount tables. === SMB/ CIFS access === This Microsoft network file sharing protocol has a user based authentication and therefore has a great significance for accessing data resources not only on windows file servers. Linux servers are also providing SMB/ CIFS access with use of the '''samba''' software suite, an emulation of the windows file sharing protocol for Linux file servers. |
Line 144: | Line 171: |
Contents
Introduction
The article Remote Access will show you possible solutions to remotely access a managed client or your data inside the D-ITET networks from the selfmanaged client network or from devices outside the ETH network. It will cover the following topics:
- mailbox access
- remote terminal session
- remote desktop session
- file transfer
- network file system access
Remote access and network restrictions
Remote access possibilities depend on firewall restrictions between the remote client and the target network. The networks are segmented into virtual private zones (VPZ). Each of these zones corresponds to a certain network security level profile and contains one or more subnets being protected by the appropriate zone firewall. Traffic between subnets belonging to the same VPZ does not pass the zone firewall and thus there are no traffic flow restrictions (no subnets or service ports blocked). The relevant VPZ's for D-ITET are:
itet-isg (ISG managed servers and clients)
itet-staff (Selfmanaged clients; most often these are selfmanaged laptops)
itet-iot (Internet of things; small unmanaged devices, often lacking a possibility to configure them in a secure way)
VPN zones (Public VPN zones like "guest", "student-net", "staff-net"; you will be assigned to this zone by default when you connect to the ETH network using the VPN client. An exception would be if a realm to enter a specific private VPZ zone is configured in the VPN client. The latter is only enabled in exceptional cases; contact ISG.EE for details.)
Internet (this is not a real VPZ, but it describes all networks outside of the ETHZ intranet)
Enabled remote access protocols
The following table shows protocols which are relevant for remote access:
protocol |
protocol long |
usage |
||
ICMP |
Internet Control Message Protocol |
protocol used by ping connection test |
||
SSH |
Secure Shell |
encrypted remote terminal session |
||
HTTP/ HTTPS |
[Secure] Hypertext Transfer Protocol |
web server access protocol |
||
RDP |
Remote Desktop Protocol |
remote desktop sessions on windows targets |
||
VNC |
Virtual Network Computing |
remote desktop sessions on linux targets |
||
SMB/ CIFS |
Server Message Block/ Common Internet Filesystem |
Microsoft network file sharing protocol |
||
NFS |
Network File System |
Linux network file sharing protocol |
||
IMAP |
Internet Message Access Protocol |
access to mailboxes on server |
||
SMTP |
Simple Message Transfer Protocol |
sending messages to server |
Remote access map of allowed traffic
The following table shows the allowed traffic flows for remote access related services:
Client source network -> Remote destination network |
ICMP |
SSH |
HTTP/ HTTPS |
RDP |
VNC |
SMB/ CIFS |
NFS¹ |
IMAP/ SMTP |
||||||||
internet -> itet-isg |
|
|
|
|
|
|
|
( |
||||||||
internet -> itet-staff |
|
|
|
|
|
|
|
|
||||||||
vpn network -> itet-isg |
|
|
|
|
|
|
|
|
||||||||
vpn network -> itet-staff |
|
|
|
|
|
|
|
|
||||||||
itet-staff -> itet-isg |
|
|
|
|
|
|
|
|
||||||||
itet-isg -> itet-staff |
|
|
|
|
|
|
|
|
- ¹ NFS access from unmanaged clients is not allowed for security reasons.
- ² These protocols are only enabled for the servers involved in the D-ITET mail system.
From the zones itet-isg and itet-staff to the internet the ip transport protocols TCP/ UDP are generally enabled. Every machine inside can initiate a connection to an arbitrary server port in the internet.
Mailbox Access
Web Access (Roundcube)
You can access your inbox and your mail folders with a web browser on any client with internet connectivity. Our web server with the Roundcube software can be reached under https://email.ee.ethz.ch.
IMAP/ SMTP Access
You can also access your mail with any IMAP/ SMTP based mail client software ( Thunderbird, Outlook, Smartphone Mail Programs, Windows 10 Mail, ......) over the internet. IMAP/ SMTP access to our mail servers is enabled for the internet. Detailed information is available in the Email overview page.
SSH - remote terminal session
In the Linux world remote terminals are widely used. The secure shell ssh allows secure (i.e. encrypted connection) remote terminal sessions. To establish such sessions, you will need an SSH client application. Under Linux and Mac OSX, the program is called ssh and is usually provided by the basic installation of the operating system. Under MS Windows, a 3rd party manufacturer application like PuTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty), X-Win32, or the Cygwin SSH client must be installed separately.
Establishing a remote terminal session
On an ETH-internal client you can simply enter
ssh <account>@<targethostname>.ee.ethz.ch
After a successful login, a remote terminal session is established on the selected target host. If you omit <account>@}}} in the ssh commandline, your shell's current session login username is used.
To connect to an ssh service from an ETH-external client, one must install and activate the VPN client software on that computer and then proceed in a way as if the client were an ETH-internal computer (see above). Using fully qualified hostnames (e.g. "ssh hostname.ee.ethz.ch" instead of just "ssh hostname") allows you to access the target ETH server from anywhere (using the VPN client or the method described in the next paragraph), especially from selfmanaged/ private computers that are not in the ee.ethz.ch subdomain.
Alternatively1, for ETH-external clients, one may establish a "direct" connection (without VPN client) to the target host via our login server login.ee.ethz.ch. For the latter, use the following commandline (example for the Linux built-in ssh application):
ssh -o ProxyJump=<account>@login.ee.ethz.ch <account>@<targethostname>.ee.ethz.ch
For a transparent access you can configure your client SSH configuration with something similar asHost login.ee.ethz.ch User username PreferredAuthentications publickey Host *.ee.ethz.ch !login.ee.ethz.ch User username ProxyJump login.ee.ethz.ch PreferredAuthentications publickey
If you want to establish a "direct" connection (without VPN client) to the target host via our login server login.ee.ethz.ch from an ETH-external Windows client using PuTTY, read this article.
For a key-based ssh login see https://computing.ee.ethz.ch/FAQ/SSHkeys .
SSH details
The ssh protocol has some integrated features like
- X11 forwarding (run a Linux GUI application remotely and display it's window on the local computer)
- encrypted file transfer, encrypted remote shell sessions
- ssh tunnelling (purpose is most often to bypass firewall restrictions)
With these features ssh also offers solutions to additional tasks which are covered in the following chapters.
The host login.ee.ethz.ch might be used to log in to the D-ITET network from anywhere (all D-ITET users are allowed to log in there). Use this host only as a starting point (i.e. to establish further connections to other D-ITET-internal computers from there), but do not execute processes that will consume a lot of CPU resources (e.g. do not run Matlab/ compute jobs on this machine!).
For advanced users: If you want to make sure a managed ISG.EE Linux computer you intend to access with ssh is in fact the machine you are expecting (and not a modified/ hacked one; e.g. with man-in-the-middle-attack), you can verify its hostkey. How that works is described on this website: https://computing.ee.ethz.ch/SshFingerprints
Remote Desktop Session
Windows Remote Desktop
To access your Windows computer remotely, please read Windows Remote Desktop Services.
X11VNC
x11vnc can be used to connect to a desktop session running on the physical display of a host. Please see the X11VNC HOWTO for further details. In case you have no running session on the physical display and need to login graphically, please contact support and provide the name of the host you need to access.
VNC
VNC is the preferred solution for remote desktop sessions on Linux machines. Please read the VNC article for more details.
File Transfer
HTTP download
The HTTP download is a simple solution to transfer a data file to an external user. On the client side no additional software is needed, a web browser is sufficient.
Here are the sample commands to provide a data file for download with a required authorization in your personal web page:
> mkdir /home/pmuster/public_html/transfer > cp /scratch/pmuster/datafile /home/pmuster/public_html/transfer/ > htpasswd -s -c /home/pmuster/public_html/.htpasswd download
Create a file .htaccess in the download folder /home/pmuster/public_html/transfer with content:
AuthUserFile "/home/pmuster/public_html/.htpasswd" AuthName "Downloads" AuthType Basic Require user download
Under the address http://people.ee.ethz.ch/~pmuster/transfer the file can now be downloaded with user download and the password set with the htpasswd command.
Linux scp
Between two Linux machines you can transfer a file with the ssh-integrated secure file copy (scp). The command is:
user@home> scp <path-to-datafile> <user>@<hostname>:<path-to-target directory>
With the command
user@home> scp document.pdf pmuster@login.ee.ethz.ch:Documents/
the file document.pdf on your linux machine is copied in the Documents subdirectory in your home at D-ITET.
Windows WinSCP/ FileZilla
Windows has no SSH integrated, so you must use an additional software. The popular programs WinSCP (https://winscp.net) and FileZilla (https://filezilla-project.org) are the preferred choice. FileZilla is also available for the linux platform and is already installed on our managed linux clients.
ID polybox - Own Cloud Storage
ID provides 50 GB storage to every ETH member https://www.ethz.ch/services/en/it-services/catalogue/storage/polybox.html. The polybox client software is available for different plattforms and synchronizes a local storage on the client with the owncloud server storage. If the client software is installed on two machines you can therefore transfer data between the two machines with the polybox/ownclound client.
Cifex
ID offers also a service for the exchange of big sized files which can not be send by mail named Cifex (https://cifex.ethz.ch/). The mail size limit depends on the provider but normally files greater than 50-100 Mbyte can not be send by mail. It's a good solution for sporadic transfers of big sized data files to a site where no IAM account can be used.
Network File System Access
NFS access
Because NFS is not enabled between the internal networks nor to the internet it has no significance in remote access solutions. NFS is only used by ISG managed linux clients to access user and project homes on servers and dedicated storage systems of ID and ITET by Linux automount tables.
SMB/ CIFS access
This Microsoft network file sharing protocol has a user based authentication and therefore has a great significance for accessing data resources not only on windows file servers. Linux servers are also providing SMB/ CIFS access with use of the samba software suite, an emulation of the windows file sharing protocol for Linux file servers.
More information how to access your data you find under:
If possible use a VPN client connection to the ETH network to better distribute the access (1)