How to: Mount remote storage using sshfs

Mount SSHFS

For me, SSH has replaced three very flaky protocols. Telnet (true story) for an networked shell, FTP handling simple file transfers and finally NFS mounting network attached storage.

SSH provides the -encrypted- networked shell, handles simple file transfers using SCP or SFTP, and has the power to mount filesystems using SSHFS. All in one protocol!

Here’s how:
~$ sshfs USER@HOST:DIR mountpoint [options]

  • USER Remote user
  • HOST Remote host
  • DIR Remote directory to mount
  • mountpoint Local mountpoint

Example options:

  • -p PORT Specify alternate port to use
  • -C Enable compression
  • -F FILE Specify alternate ssh config file

sshfs is available on most Linux package repositories and can also be found on the fuse project page: http://fuse.sourceforge.net/sshfs.html

Happy Mounting!

How To: Avoid password theft, Faceraping, Email hijacks etc. On public networks

Network SendHas your email been blacklisted? Does your forum-posts suddenly contain nothing but kittens? Did your relationship status become same-sex over night? Well, physical access to your box may be the answer to most of these scenarios. But everything you send on public wire, in plain-text that is, has the potential to be sniffed out or otherwise phished if you are careless.

Here are a few tips in avoiding disaster:

* SSL/TLS
Encrypt, encrypt, encrypt and make sure the certificate in question is properly signed – its mandatory. Wether if its web, email or chat. Most online services today allow an encrypted alternative and that includes popular services like Google, Facebook and Twitter. Just be on the lookout for https:// and not plain http:// in the address-bar. Never trust a pretty “Lock Icon”, those can be injected onto the session while SSL is being striped out, in an attempt to fool the user.

Secure Address-Bar

The same mindset applies to SMTP/IMAP/POP3-email and various chat protocols. Enable, if any, SSL option that is available. For email, the default SSL port numbers are as follows: 993 for IMAP(S), 995 for POP3(S) and 465 for SMTP(S). The port number may vary depending on your email provider.

* SSH Tunnel
When encrypted alternatives are not available, or doesn’t exist, an SSH-tunnel can be used. Simply, tunnel the traffic through an encrypted SSH-session and relay it through the trusted network where the SSH-server is located. I have a tutorial on how to do just that, complete with syntax and resources required here: http://peppoj.net/2012/10/tunnel-http-traffic-encrypted-using-polipo-and-ssh/.

* BYOIC (Bring Your Own Internet Connection)
If all else fails and trust is an issue, avoid public networks completely and use your own connection. If you already made the leap to the new generation and bought a smartphone with a generous dataplan, why not use it? Most smartphones today (and some older devices I’ve seen) allow tethering to computers and other devices. Simply enable tethering, hock it up and mess with the network settings on your host.

Disclaimer:
None of the tips above will protect you from Phishing, or otherwise plain fraudulent websites. Use you’re brain.

Feedback welcome

External Resources
CompariTech: Common phishing scams and how to recognise and avoid them

Tunnel HTTP traffic encrypted, using Polipo and SSH

SSH can be used to do allot of great things. Login remotely, transfer files with scp and run single commands for a quick fix. All encrypted! Another great and well-known feature of SSH is SSH tunnelling.

SSH tunneling can be used to tunnel any kind of traffic, and in this guide I’ll focus on HTTP tunneling in conjunction with the proxy client Polipo (encrypted of course).

Things you will need:

  • Linux server
  • SSH daemon running on the server (openssh-server recommended)
  • Polipo daemon running on the server
  • SSH client (openssh-client recommended)

How to:

~$ ssh username@server -L 8118:localhost:8123 -N [Enter]
(Enter password)
Point your web-browsers proxy (Firefox, Chrome, etc) to localhost, port 8118

Syntax:

  • -L Specifies the remote address, remote port and local port ([local port]:[remote address]:[remote port])
  • -N Don’t execute any command on the remote machine when connected

Tunnel initiated!