Slashdot Mirror
Easy Remote Access?
TinyApps asks: "How do Slashdot readers make remote connections through firewalls and NAT routers when assisting friends/family/customers? Reverse VNC connection are relatively easy to setup, but there is also the free LogMeIn and WebEx's new free service that startstarted, this week. Do you all have any other ideas?"
vnc works fine. i usally do a linux firewall and vnc in to it and then on to whatever i need on the network not pretty but it works
Linux modi 2.6.26-2-parisc
Tunnel X through ssh.
Slashdot: Where people pretend to be twice as smart as they really are by behaving like children.
...use a (cell)phone and talk to the user in front of the other computer :P
;)
A joke ? In some cases, yes (I meant the other user, har har).
Secure ? Depends on the user on the other end too
By reading this signature you agree to not disagree with the post you just read.
On XP Remote assistance works well, you instruct them to go Start -> Help & Support -> Ask for assistance.
On other windows platforms i've been able to help people out with Netmeeting as well.
Otherwise VNC works fine..
Sample this!
why not just turn off ask slashdot for yourself?
Those who know, do not speak. Those who speak, do not know. ~Lao Tzu
I use VNC. I do not trust those companies that offer the service of allowing you to log into your own pc remotely, using a password that is stored in their database. But hey, I'm paranoid in that I don't like big corporations having a way to get into my pc.
Video Production Support
Set up a VPN, which you need anyway to automate the transfer of files and do automated registry maintenance on Windows computers.
Then run VNC, such as TightVNC or UltraVNC over the VPN. If the VPN is secure, and remote network is not suspect, then VNC over the VPN is secure.
Beware, however, of Netgear's VPN routers. In my experience they are quirky and the technical support is very, very poor.
I have questions myself. What is the best way to form a VPN? What is the best VNC?
Why do angry people read and post comments to Slashdot stories they don't like?
Do these people complain about having to read the supermarket tabloids just because they are there?
The article referenced by the Slashdot article, Reverse VNC connection, recommends TightVNC version 1.2.9. However, the TightVNC 1.3dev6 development version is a release candidate, and in my experience works fine.
Read the TightVNC Windows Documentation.
1) Compile up a custom UltraVNC server that reads the initial settings (which should be pretty much disabling all listening and ability to accept connections, etc) out of an ini so that it does not prompt the user for a bunch of confusing settings and instead immediately throws up the 'add new client' dialog box (with the form prefilled of course). Also, your custom compile should use the RC4 crypto plugin with some pregenerated keys. It's a little insecure but better than nothing. Bonus points to regenerate the keys on a per-week/day/user basis.
2) Package the whole thing up into one exe with pebundle and upx it for size.
3) Send to your users!
It isnt free but it ALWAYS works. You can even run it with only 2 files without an install. All you need is r_server.exe and adm(something).dll.
Myself and some other IT workers (different companies) use it constantly. One of the nice features is you can connect through one computer with the open port and bounce to the others in the local lan.
If you haven't tried it you should at least download and install it. It has a 30 day trial and is $35 per 2 computers. You can even install the serial number remotely... when expired it prompts you to enter the install key.
It is so popular it has been featured in worms to make zombies. So when it asks for a password... you better use one! famatech.com
Boredom's not a burden anyone should bear.
Another point: I understand that Microsoft's Remote Desktop does not allow you to log in as another user. Logging out breaks the RD connection. So, you can't log in as administrator, but must ask someone at the remote computer to do that, meaning they must sit there in boredom while you work.
VNC does not have that limitation.
but no one seems to understand the question.
;)
I'll try to make this as easy to understand as possible. Imagine this scenario...
Your |insert computer illiterate relation| needs help fixing something that VNC'ing into their box would easily fix. However, because you recommended that they put their windows box behind a firewall, which oddly enough they did, leaves you without the ability to easily connect to their machine without yet another couple steps, mainly setting up their firewall to allow you to connect to their machine.
How do some of you make the task of connecting through this firewall easy without the more daunting task of walking them through re-configuring their firewall to forward your request to their desktop. Since, if your walking them through that you could have probably just walked them through the other problem they had, like not knowing whether or not they wanted to continue or cancel what they had been doing.
I use Putty to make an SSH tunnel for VNC.
http://www.google.com/profiles/malachid
All of my remote access needs are satisfied using ssh. I use NXClient for GUI stuff (when a GUI is needed) and plain old ssh when a GUI is not needed (like when doing a remote "emerge world").
NXClient will do remote X (with or without a remote desktop), RDP, VNC all wit hvery good performance (as long as the latency of the link is low enough).
Ghetto moderation in effect.
It's always a long day... 86400 doesn't fit into a short.
It should be, "Works 'well', not 'good'," not "Works well, not good."
It's always a long day... 86400 doesn't fit into a short.
Everyone talking about Remote Desktop, Terminal Services, VNC - but these solutions require a port open on the server and firewall.
LogMeIn and GoToMyPC only need an outgoing connection.
I use GoToMyPC, and with a keyphrase plus a one time password automatically generated.
I bought 5 copies of Radmin and used them for a while. However, I got nervous because Radmin would leave icons in the system tray when it was not supposed to be running.
Famatech is a Russian company, apparently. What would keep them from installing a back door? Granted, Russians haven't been killing Iraqis, but Russia is a relatively unlawful country.
A back door might be justified by management as a way of insuring that you are using legal copies. A back door might mean that Famatech had access to any password that you used while using Radmin. A back door might mean that a Famatech employee could withdraw funds from your customer's bank account using your customer's computer. I don't have those worries with an open source product like TightVNC.
Also, I found that, as with most companies, the Famatech technical support is poor. They will be glad to give you the easy answers. Ask them something requiring thinking, and they will finesse the question.
An advantage with Famatech is that the technical support is by Russians, and not in India.
Recently I called Famatech recently and got the message, "This service has been temporarily suspended." Two people at Famatech said the service had been restored, but I got the same message again, several times.
However, I found that Radmin did work. But so does the free TightVNC.
Radmin has encryption, TightVNC doesn't. However, that is not a problem if you are running TightVNC over a VPN, which is a very convenient way to do remote maintenance.
It's the old story. Commercial software companies want to limit their quality as a way of maximizing their profits. Open source software just keeps on truckin'.
Runas gets tiring when you have a lot of work to do.
The Workstation edition of Remotely Anywhere is a VERY solid application. It costs about a hundred bucks, and is for Windows, but it offers excellent remote features including file transfer, remote computer management of resources and services, and full remote desktop control that in my opinion surpasses Microsoft Remote Desktop in speed and function. It uses either Active X, Java, or plain HTML for remoe access providing you maximum flexibility.
/.ers. It also doesn't blank the host screen or lock the keyboard by default, though it can.
It is highly configurable and full of "geekiness" that should please most Windows-based
Also, it only works with one host per license, which can be expensive if you manage multiple hosts, but if you are looking for a remote access solution, this is a solid one. It's certainly not a cheap solution, but if you want rock-solid and secure access, Remotely Anywhere is worth a look.
Not affiliated with the company, just using Remotely Anywhere and certaily enjoying it.
My mom always said, "Jim, you're 1 in a million." Given the current population, there are 7000 of me. God help us all!
Are any of these mentioned softwares suitable for slow dial-up modem connections that average about 3 KB/sec?
I know text mode like SSH, telnet (insecured), etc. is fine, but how about GUI based?
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
These sollutions all seem to work only if only one side is behind a nat, or if a dedicated third party server is available that both sides can use.
From my rudimantary understanding of tcp/ip, I am wondering if the following would work too:
A and B are behind a NAT or a firewall that blocks all incomming connections.
Asuming A and B have some (inefficient) way to communicate, like email:
- A and B agree on a TCP sequence number and a time per mail.
- Both A and B send a SYN with that number at the defined time. Both SYNs are blocked by the firewall on the other end.
- Both A and B send a ACK with the correspondending sequence number, as if they had received each others SYN. The ACK should not get blocked by the firewall, since it is a response to a previous SYN.
- Both A and B send a SYN/ACK as usual.
Now A and B should have an open TCP connection between them (or two, but since they have the same sequence no. they might be indistinguishable)
As long as they keep it open, it should allow them to communicate despite the firewalls.
I had been searching for this for a long time myself, and found...
.exe that you can send you your client/brother/friend etc.
;)
http://gotovnc.dynalias.com/
Totally recommended. Rudi there has made a package of UltraVNC that is a single exe, no-install system.
Basically, you download a zip file with some configs and bitmaps in, and customise them.
I got a free dyndns alias to use for this purpose.
Then you upload the files, and you get back a 160KB
They run it, and it establishes a reverse-vnc connection to the server you specify. You have to be running vncviewer in listen mode, natch.
It works a treat, and even has optional encryption and file transfer. A brilliant tool.
I christened mine 'lifejacket'
That is someone's personal scheme. It is not connected with Sourcforge, although there is a link to Sourceforge. It is not connected with UltraVNC, apparently.
In this scheme, you give away the password to your UltraVNC sessions, and send the password over the Internet. If you change your IP address, you must go back to that website and disclose again how you plan to connect.
I have two One-way NAT firewalls and a way to get around them. Of course, this requires a machine with a public IP and ssh account to work...
p hp
:)
http://www.linuxlogin.com/linux/admin/sshtunnels.
I then use a cron script to check the tunnel at home, if it's down it reconnects so I can always get back into my network at home. I use ssh-keys with ssh-agent to keep my passphrase. The box can then login without a password.
You can foward as many ports as you like and don't need to change your firewall rules. Works great for me!
Tip: use a port number > 1024 so you don't need root access.
Note to mods, this isn't redundant since it actually has the how-to in it and not just another "use ssh tunnels."
well: adverb, ie, the kind of word that modifies an adjective or a verb. In casu, the verb is "to work": Something works well. Spanish: "bien"; in casu, "algo funciona bien".
good: adjective, ie, the kind of word that modifies a noun. E.g.: She is a good friend. Spanish: "buen", "bueno", "buena"; "ella es una buena amiga".
Ok?
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
opening up the RDP service to the internet? i'm sure you could use ssh etc etc but what'd be really useful is being able to connect to an non-tech savvy users' pc without extra installs on their end...just opening up the ports for RDP on the firewall sounds pretty dangerous...
I have my family connect their Windows machines directly to the Internet and to not bother with those pesky security updates. Within an hour, the internet installs all the remote access tools I need. Ftp servers, irc bots and keystroke loggers are just some of the handy tools that come through this way. I have to go, I just got an email about Snow White and I can't wait to check out the attachment.
SD
âoeWho knew something as harmless as willful ignorance could end up having real consequences?â
First, my universal advice: DON'T get in the habit of fixing remote systems for free. It is a huge time-sink & it would be better if you don't foster that dependence. I sometimes fix problems over email or in person for friends/family, but I also usually weasel some free beer out of the deal.
That being said, many have to remotely administer machines for OTHER reasons. Oftentimes, a shell is all that is needed & having OpenSSH is good enough. It is available for win32 too. This can also be used for port forwarding if other daemons are needed.
If you don't need SSH/SFTP & do need a secure connection, setup a VPN. OpenVPN is great:cross-platform, secure, and easy to install. IPSec is still the standard, but I don't bother with it unless I have to (like when my company would buy a hardware implementation). I try to avoid PPTP. It works OK on windows. Not so well on other platforms (poptop does a pretty fair job, though). It also believe it has some known (but, I again believe, still unexploited) security weaknesses.
You hooked on the GUI? I use VNC over VPN or stunnel. I don't really like remote desktop, but if you have to support it put RDesktop on your *nix box. FreeNX is, in many ways, better than both. I like it a lot, but I haven't used it under windows (it can be done & someone might have made it quick-and-easy, but I try to avoid supporting windows machines).
I use TightVNC for remote connectivity, and it works great. All you have to do is initially install, configuure, and place an icon on the desktop for it. You would also need to forward a port(5900 is the default) on the person's firewall to their computer if one is in use. This could enabled and disabled with extra work if you weren't okay with leaving it open. As long the TightVNC server wasn't running, nothing would be listening on the port 24/7 anyway.
In order to connect, you would need to know the user's public IP, and there are different ways to do this. I refer my family members to a webpage I have that displays this. They give it to you on the phone, and I then tell the person to double-click the icon. Out through NAT and back in through NAT works fine for me. It's much easier to drive than to tell the person how to over a phone.
-Slashdot Junky
.
Landfill Mining Co.
Managing the (Un)natural Resources of Tomorrow
The new (devlopment, IIRC) TightVNCs can transfer files as well as doing the standard "view my desktop" thing.
The software allows you to pass screen sharing, keyboard/mouse control, etc. from participant to participant. For our customers, it's a quick download that uninstalls itself after the meeting is over - I believe it tunnels through port 80, I don't think we've run into an instance of a firewall blocking the connection. All the customer needs to know is www.gotomeeting.com and the meeting ID (a 10-digit number, easy to read over the phone, send via e-mail, etc.).
The subscription model (at least at the time we signed up, about 6 months ago now) was on a per-organizer basis ("organizer" being the person who sets up and controls the meeting), with no limits on how many meetings each organizer can hold, or how many participants can be in each meeting. We were originally looking at GoToAssist (same company again, of course), but found GoToMeeting was much more flexible.
If I had one complaint about the service, it would be the speed/latency of the connection - it's about the same as VNC, quite acceptable when everyone involved is on a broadband connection, but somewhat frustrating when working with someone on a dial-up or satellite connection.
Hope that helps.
Corporate Jenga: You take a blockhead from the bottom and you put him on top...
I dont assist them because they refuse to ever take my advice:
Jerk: My computer isn't working. Will you fix it?
Me: *sigh* Okay.
(Removes a metric tonne of spyware.)
Me: Dont use IE. Dont install stuff you find on the internet. If you get an email with what looks like a cute or funny app on it, dont run it.
Jerk: *sigh* Okay.
(Two weeks later)
Jerk: My computer isn't working. Will you fix it?
We evaluated several "remote control" solutions over the last few months and found that Remote-Anything from TWD Industries provided an affordable and easy to use solution. After we configured our server component, clients are able to download a 90k "slave" execuatable when they need help. When executed the slave .exe just runs...there is no install process for the user to go through. We set it up so that it uses port 443 and it seems to work fine through NAT and firewalls on both sides
Too many VNCs. I found an FAQ that lists more than I evern knew existed with a short description of each.
'SBEMAIL!' is better than a goat!!
The NX software is absolutely wonderful - I could log in to my home linux box in California from my parent's dial-up connection across the country, and the GUI was usable, beautiful, and secure.
;)
However, when I'm behind a bunch of firewalls at work, 20 minutes away, I have a difficult time getting the connection going - So I have a few reservations about fully recommending it for everyone. As soon as I figure out WTH I can do about it, I think it should quickly conquer the world.
"What do you think?" "I think 'What, do you think?!'"
I agree that setting up your own remote access infrastructure, as you describe, is the most secure method -- if you have the expertise to do it right. (Using the method you describe, or something similar.) You do it wrong, and some script kiddie will use your mistakes to take over your computer.
But we're talking about technically-challenged home users seeking help from friends and family members. If they had that kind of expertise, they wouldn't need somebody looking over their shoulder in the first place. For people like that, trusting a company like GoToMyPC or LogMeIn, with a proven track record for good security and respect for privacy, is a reasonable tradeoff. It's not the most security theoretically possible, but its as much security as you'll get without making the application impractical.
IPSec is probably the "standard." Most hardware implementations use this. There are client/servers on all platforms & encryption doesn't have the same weaknesses. Depending on the implementation, this can be either tedious or non-free to setup.
I like OpenVPN, which uses SSL, is VERY portable, and very easy to use. Plays well with both NAT and dynamic addresses. The only reason to use IPSec, in my opinion, is if there are hardware devices in the way. But OpenVPN is beginning to be found on some devices too.
I let them connect to my VPN server, and then I connect to them based upon what software they got, be it remote desktop, VNC, X etc...
Change is certain; progress is not obligatory.
Any attempts to connect to the poll.gotomypc.com server are refused, and queries are redirected to the appropriate contact inside your company.
LogMeIn doesn't have an equivalent free service, they do provide something called "LogMeIn Scout" which claims to scan your network for remote access apps.
I do not deploy Linux. Ever.
Interesting.
I've been using UltraVNC. It's as fast as TightVNC, and supports the Java downloadable client.
When used with it's own client, you get file transfer as well (over the VNC connection so no additional ports). You can also run it as a service on NT/2K/XP and connect to the remote machine when logged off, reboot and log back in if needed, etc.
I run secure vnc connections over SSH proto version 2 local port redirections.
ssh -L {localport}:{remote machine name/ip address inside netowork}:{remote port} username@firewall's.internet.name
ssh -L 5700:192.168.0.2:5900 sshuser@sshhost.com
It then opens a terminal session on the host running sshd. Keep the window open. Open your vncviewer software client and connect to localhost at port 5700. Viola!.
After the session is finished. Close vncviewer, then type 'exit' in the terminal session.
This gives you the flexiblity to use any port inside your office/offsite network without opening every port under the sun.
What I am I once was. What I now become I long to be. Life is a journey not a destination.