Category Archives: Network Security

How to use free coffee shop wireless securely – part 3 – Your Own Virtual Private Network (VPN)

Create your own virtual private network with Hamachi

You can do things between computers on your home or office network you can’t do securely on a public WiFi network like listen to a shared iTunes library, access files in shared folders and corroborate on shared projects. But using the free virtual private network application Hamachi, you and your buddies can access your computers from anywhere on the internet anywhere on the planet as if you were all connected on your own private local network. This is called a Virtual Private Network.

Today we’ll use Hamachi to create a virtual private network between a PC, Mac and Ubuntu Linux box and listen to a shared iTunes library over the internet.

First what’s Hamachi VPN?

Hamachi is a free desktop application and gives you a secure, zero-configuration LAN over the internet. Any application that works over a local network can be used with Hamachi over the internet, like Windows file sharing, iTunes, Remote Desktop, FTP, VNC and gaming. All of Hamachi’s connections are secure, encrypted, authenticated and peer-to-peer. Though Hamachi acts as a mediator between your computers and creates the tunnels for their communication, Hamachi’s servers don’t listen in on or log your activity.

Here are some situations where you might use Hamachi:

Your company has a team of salesmen on the road with laptops and they want secure access to office network, printers. applications and files.

Your office or dorm room computer is behind a restrictive firewall that doesn’t let you reach it from the internet.

You want to add encryption to insecure network protocols like VNC.

You want to set up a shared folder of files for friends and family to access.

Sound useful? Let’s get started.

Set up Hamachi

1. Download and install Hamachi. For the most part, the Windows installation is the usual “just click next” routine, except for two notes: Hamachi will attempt to install a virtual network adapter which Windows XP says is not supported. – just hit the “Continue Anyway” button at that point. Also, if you have Windows Firewall enabled (or any firewall, for that matter), it will ask if you want to allow traffic to and from the Hamachi client. You do. Click the “Unblock” button to allow Hamachi traffic through your firewall, as shown.

For Mac and Ubuntu Linux users, the Hamachi installation is a bit more complicated. Even more disappointing, the application itself is command line, not point and click. (Warning: comfort in the Terminal required. UPDATE: HamachiX is a free GUI Hamachi client for the Mac.

2. Create your Hamachi network. Once Hamachi’s installed it will walk you through a quick tutorial to get you started. Read it – it’s worth it. Then, hit the network button (bottom right hand corner, second button to the left) and choose “Create new network” from the menu. Give your network a name (mine was “vancouverwest4″) and a password. Click the Create button.

Now your computer will be a member of the new network, and get its own Hamachi IP address (in addition to its regular IP address). It will also have a nickname that will identify it on your network. Mine was “socrates-pc.”

3. Join your Hamachi network. At this point you can tell your friends or co-workers your Hamachi network’s name and password so they too can join it with the Hamachi client installed. To connect my Mac to my new network, I issued a hamachi join gtrap-home command after setting my nickname to “powerbook.” Once my Mac was on the network.

4. Network away! Now you’re ready to share files or stream your iTunes library to other computers in your Hamachi virtual home network anywhere in the world the internet reaches. Within iTunes on my PC I turned sharing on and tried to listen on my Mac. At first the sharing didn’t work because Windows Firewall wasn’t allowing it. Once I opened up port 3689 (iTunes sharing port) within Windows Firewall, I was all set.

Then, I could see and play tunes in my PC’s shared library within iTunes on my Mac. (Be sure to check off “Look for shared libraries” in iTunes’ Preferences Sharing panel.)

Finally, you can manage your Hamachi networks and clients through a web interface as well. Register for a free account at My Hamachi and enter your client’s Hamachi IP. Once you grant the web site access to your network information, view all your networks and clients on the web site, like this (click to enlarge):

Streaming music (and, uh, copying uncopyrighted songs from others’ shared iTunes libraries) is only one example of what can be done with your virtual home network. Browse shared Windows folders, remote control your PC, access an FTP or web server (over Hamachi’s encrypted connection). Anything you can do locally you can do over the ‘net with Hamachi.

Are you a die-hard VPN/Hamachi user? Got questions or tips? Drop me an email or comment.

West 4 Communications can set up a secure Virtual Private Network for your force of global road warriors.

How to use free coffee shop wireless securely – part 2 – Create a secure tunnel using SSH

Create a secure tunnel using SSH

by John Davidson

In part 1, we learned that using Wi-fi in public hotspots can be dangerous because of packet sniffers which can view and log all unencrypted network data. You need to protect yourself by encoding both what you are sending and receiving over by using https:// (note the “s” for secure) connections whenever possible to connect securely to sites.

But some site don’t offer any kind of secure login. i’ll show you how to roll your own using SSH to create a secure tunnel connection from you remote laptop to a trusted home or office computer running an SSH server. All your network traffic will be sagely protected using encryption.

Laptop – Client Side Software: SSH Client
* Windows – PuTTY (I’m currently using Release 0.60)
* Linux/OSX – SSH from the command line

Server – Either at home or trusted remote web host with SSH access
* Windows – SSH server
* Linux/OSX – SSH server daemon

If you have trouble connecting to port 22 on your web host, double-check the port address. Some web hosts use oddball ports for SSH. My current web host uses port 2222 instead of 22.

I’ll use PuTTY on the client site for this walk-through. We will set up port 7000 as the secure channel.

1. Open PuTTY and click on the + sign beside SSH to see the tunneling options. Use the following tunnel settings:

PuTTY SSH Tunnel Configuration

* Source Port: 7000
* Destination: localhost
* Select Dynamic and Auto

2. Click Add. D7000 should show up in the forwarded port box.
3. Select Open and log in using your username and password.

You’re done setting up the secure channel.

4. In Firefox
a. Click Tools->Options->Advanced->Network->Settings
b. Click the “No Proxy” radio button
c. Click OK twice to close the configuration panes
d. Go to URL http://whatismyip.com
e. The ip address displayed is the ip address for the coffee shop

5. Configure Firefox to use the secure channel
a. Click Tools->Options->Advanced->Network->Settings
b. Click the “Manual proxy configuration” radio button.
c. Set SOCKS Host
d. Set SOCKS Port: 7000
e. Click the SOCKSv5 radio button
f. Close the configuration pane
g. Go to URL http://whatismyip.com
h. The ip address displayed should be the ip address for remote trusted computer.

You can also encrypt your BitTorrent traffic or your MSN connection by changing connection/proxy settings in the application connection options to point to localhost port 7000 and SOCKS v4 or v5.

You can use the applicatin proxifier to forward all your connections at once to the remote ip address.

An easy way to switch proxy settings in Firefox is to install the Switchproxy add-on — change proxy settings with just a click.

Enjoy your secure browser session!

How to use a secure tunnel to view US televison on hulu.com, nbc.com and comedycentral

Stream Hulu, NBC and Comedy Central to your computer while living or traveling outside the United States.

by John Davidson

Watch full episodes of all the best in US TV programming streamed to your home computer. Are you a fan of Highlander, Family Guy or Heroes? Well you can watch seasons of episodes the whole library of shows is clicks away any time you want! Hulu.com. nbc.com, thedailyshow.com, comedycentral.com are a few of the sites streaming US programming.

But there is a problem if you are living or traveling outside the United States. Content owners use sophisticated geographical ip filtering to block streaming of the videos outside the US. For example, when you try to view hulu.com from Canada, you get the following message, “We’re sorry, currently our video library can only be streamed within the United States.” I’ll describe a way to get around the blocks.

This method requires that you have a Virtual Private Server (VPS) account in the continental United States with Secure Shell (SSH) access. I use a VPS account with linode.com which costs $US 19.95/Month. The trick to avoid the geoblocking is to forward your IP connection from your home computer in Canada. Japan or anywhere outside the US to the US based server using an SSH secure tunnel. The server forwards all the data received back to the foreign client transparently. This works well because to the US-based website (HULU, NBC, Fox) you are now connecting from a US ip instead of a foreign ip address.

Important Caveat 1

It’s important that the latency (ping delay) between your true location and your US server is less than 100 ms to ensure an enjoyable video experience. Otherwise you’ll have to keep waiting for buffer delays. The latency from Vancouver, Canada to my New Jersey server is 88 ms.

Important Caveat 2

Verify the bandwdth caps or limitations on your US server. I’m allowed 200 GB of traffic on my account. A couple of hours of daily TV works out to about a giga-byte of traffic daily or less than 50 giga-bytes a month.

Here we go:

1. Sign up for a VPS account on Linode. Log into your Linode account and create a Ubuntu linode instance. Note the IP address of your server.

SERVER side

2. SSH into the root account of your fresh Ubuntu server
apt-get update
apt-get install
apt-get upgrade
adduser tunnel

Client running OSX or Ubuntu:

3. Open a terminal window
4. ping yourserver.com ; verify connectivity to the server
5. ssh -D 8080 -p 22 -f -N tunnel@yourserver.com ; forward port and then go into background
6. enter password for tunnel when prompted

The ssh command is used to create an encrypted secure connection between a client port and a server port.

The “-D port” option specifies dynamic port forwarding. This works by allocating a socket to listen at a port on the local side. The port can be any number greater than 1024. Whenever a connection is made to this port, the connection is forwarded over the secure channel, and the application protocol is then used to determine where to connect to from the remote machine. Currently the SOCKS4 and SOCKS5 protocols are supported,

The “-p port” option specifies the port to connect to on the remote server. Port 22 is the standard port an SSH server to listen on. If you have troubles connecting, check to ensure the remote server is using the standard port. Sometimes servers use oddball ports – hostgator for example uses port 2222.

The “-f ” option requests ssh to go to background just before command execution. This is useful if ssh is going to ask for passwords or passphrases. After the password is entered SSH goes into the background.

The “-N” option means do not execute a remote command. This is useful for just forwarding ports (SSH version 2 only).

Client is running Windows:

3. Download PuTTy from http://www.filehippo.com
4. Open the PuTTy SSH client. Look under Connection -> SSH -> Tunnels.
Add a dynamic port forward, use port 8080 and no need to specify the destination.
5. Click on the open button and enter password when prompted

Client Side: Now set up Firefox to use the local SOCKS server (localhost:8080).

6. Open up Firefox

7. Verify connectivity
a. go to URL http://whatismyip.com and write down the ip address for your client computer
b. click on the speed test button and write down the upload and download speeds

UPDATE Hulu has updated their geo-blocking use new step 8

OLD STEP 8
Click on Tools -> Options -> Advanced -> Network -> Settings
Click the Manual proxy configuration radio button
On the SOCKS option enter localhost and 8080 as the port.

NEW STEP 8
a. Download Proxifier (30 days free trial version) http://www.proxifier.com/download.htm
b. Install and launch proxifier
c. Click option > proxy settings> add
IP address: localhost
Port: 8080
Type: SOCKS5
d. Click OK button

Testing

9. Verify your port is being forwarded.
a. go to URL http://www.whatsmyip.org/ and verify that the ip is different than in step 5a
b. click on the speed test button to confirm you are getting reasonable upload and download speeds

This entry was posted on Tuesday, May 5th, 2009 at 1:11 pm and is filed under Technology, Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed.

How to set-up a secure tunnel to use public WiFi safely

Using Wi-fi in public hotspots can be dangerous with packet sniffers so readily available. You need to protect yourself by encoding both what you are sending and receiving over an unsecured public network.

Even at work if you want to avoid having your activities logged (for whatever reason) you should encrypt your traffic. An excellent way to do this is to set up a secure tunnel using an SSH connection to a trusted computer running a proxy server.

Laptop – Client Side Software: SSH Client
* Windows – PuTTY (I’m currently using Release 0.60)
* Linux/OSX – SSH from the command line

Server – Either at home or trusted remote web host with SSH access
* Windows – SSH server
* Linux/OSX – SSH server daemon

If you have trouble connecting to port 22 on your web host, double-check the port address. Some web hosts use oddball ports for SSH. My current web host uses port 2222 instead of 22.

I’ll use PuTTY on the client site for this walk-through. We will set up port 7000 as the secure channel.

1. Open PuTTY and click on the + sign beside SSH to see the tunneling options. Use the following tunnel settings:

PuTTY SSH Tunnel Configuration

* Source Port: 7000
* Destination: localhost
* Select Dynamic and Auto

2. Click Add. D7000 should show up in the forwarded port box.
3. Select Open and log in using your username and password.

You’re done setting up the secure channel.

Now you need to configure your applications to use the secure channel.

4. In Firefox 3.x go to

Tools->Options->Advanced->Network->Settings and set the following proxy configuration:

* Manual proxy config
* SOCKS Host: localhost
* Port: 7000
* SOCKSv5 (or v4, doesn’t matter)

Then hit OK and you’re done.

To make sure the proxy is working, you can go to a site that will display your IP address or location. You can try this post to see if it displays the city of your proxy correctly (ineffective if your proxy and your current location is the same). You can also encrypt your BitTorrent traffic or your MSN connection by changing connection/proxy settings to point to localhost port 7000 using either SOCKS v4 or v5.

An easy way to switch proxy settings in Firefox is to install the Switchproxy add-on — change proxy settings with just a click. Enjoy your secure browser session!

How to use free coffee shop wireless securely – part 1

There are lots of coffee shops in Vancouver that offer free wireless. It’s common to meet clients, surf the net, work on projects, read email, shop and do banking all while sipping on a latte and gorging on the free bandwidth. In this post I’ll tell you how to work more securely over an insecure public network like you find in coffee shops and libraries. But first why worry about security?

From my experience, the security at coffee-shops is minimal; a password to log on to the network at most. About a quarter of the time the coffee shop router still has the default password. I’m not knocking the shop owners.  They make money selling drinks and food. The wireless is a freebie to get people in the door. They want to minimize their head-aches from customers saying why doesn’t this or that work. So they leave the network as open as possible to minimize complaints about things not working. The lack of security is aggravated by the fact that most shops never change the password to access the wireless network. This makes a great opportunity for anyone parked close by or living nearby to eavesdrop on your unencrypted data and passwords as they whip past on the air-waves.

The security at the coffee shops is similar to a gated libertarian community where everyone trusts each other. Once you get in the gate (know the password) you’re a trusted member of the network. And responsible for your own security. If you don’t lock you bedroom door, don’t be surprised to find someone in there with a camera or thumbing through your bank account.

The first tip is to use encrypted connections as much as possible. Whenever the URL for a site begins with “https://” (notice the “s” for secure),  it’s an encrypted connection. When the internet was in it’s youth it was common to assume everyone could be trusted so it was rare to see secure https:// connections, but they’re becoming very common. Sometimes the default  logon page is an unencrypted connection, but there is also a secure logon available.   If the URL for a page is “http:” (without an “s”), look for an option on the home page that says something like connect securely. For example:

use https://gmail.google.com instead of http://gmail.com to access your gmail google account

use https://www.godaddy.com instead of http://www.godaddy.com to access your godaddy account

An even better approach is to set up a Virtual Private Network (VPN) or secure tunnel between your laptop and a trusted computer at your home or office.  You create an encrypted virtual network or tunnel on  top of the insecure public network.

Look at my future postings for more details.