3

My primary goal is making it possible to remotely connect to my home PC and have remote desktop-like functionality.

What software combo would satisfy the five requirements below?


I've got five main constraints:

  1. It has to be secure, so that it'll be 99.8% sure only I will access my PC.

  2. Local PC monitor must not show the screen image of the initiated session.

  3. There is software that is able to connect to it for a Windows 7 PC

  4. It would start on boot and would require no user interaction on the host after boot

  5. The framerate has to be high (~20-30) and it should be high-resolution (1280x1024)


More questions:

Would VNC be fast enough to satisfy requirement 5?

Is it possible to secure a VNC server with key based auth or 2FA to satisfy requirement 1?

Could I make my PC automatically do the necessary port forwarding with UPnP?


Hopefully I managed to explain myself clearly enough, sorry if something is unclear. Feel free to ask for clarification.

10
  • what about using ssh? Jan 29, 2016 at 0:41
  • @incBrain But SSH only allows access to command line, no display as far as I know.
    – Avamander
    Jan 29, 2016 at 5:28
  • 4
    It's quite common to tunnel VNC over SSH, since the former has much more mature security and authentication features. Jan 29, 2016 at 20:59
  • 2
    I don't remember exactly any more for which reason I voted. SE lumps all off-topic votes together and closes the question with the most common reason. My guess: many of your requirements are more or less orthogonal to the other requirements and are achieved on different, independent protocol layers. Reviewing your question now, I think it's borderline too broad. It would be better to state your main goal and specify a number of secondary constraints to clarify the main point of the question and then follow up with more question for more details on the constraints. I'd gladly vote to reopen. Feb 7, 2016 at 19:48
  • 1
    Thanks for the improvement. Upvoted and voted to reopen. Feb 7, 2016 at 20:57

1 Answer 1

10

1. Installing SSH

First thing that has to be done is to install a SSH (Secure Shell protocol) server. For ubuntu it's easy as writing one command. Just copy-paste the following command and the server will be installed.

sudo apt install openssh-server

If it exists, it might be a good idea to

sudo apt purge openssh-server

before and resinstall to avoid any issues with the installation.

Another good idea might be installing the client too, if you want to test if your server works.

sudo apt install openssh-client

2. Configuring SSH server

Now SSH has to be configured to enable key based authentication for increased security. As the first step here, the original configuration should be backed up, but you could skip this part if you are sure you won't mess it up.

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
sudo chmod a-w /etc/ssh/sshd_config.bak

Now you can use text editor you wish to edit the configuration file. You can use for example gedit, nano or vim as the editor.

sudo <TEXT EDITOR HERE> /etc/ssh/sshd_config

Now that you've opened the configuration file. The first thing that should be done is to change the port. It's usually recommended to change the port of the SSH server to hide it a bit. It also stops most bots from trying to get into your machine.

To change the port

Port <Port number>

Change it to for example

Port 2213

To enable X11 forwarding (remote displaying your PC's screen) change.

X11Forwarding <Value>

to

X11Forwarding yes

Now run this command to restart the server (for the configuration changes to apply.

sudo systemctl restart sshd

Let's check the status. It must be green "active (running)".

sudo systemctl status sshd -l

Now try to connect to your ssh server by using this command.

ssh -p <Port number> <Username>@localhost

3. Setting up the RSA keys

First steps that should be taken is creating the folder for the keys.[1]

mkdir ~/.ssh

Now let's generate the key. Follow the instructions.

ssh-keygen

Encrypted home

If you have an encrypted home directory, SSH cannot access your authorized_keys file because it is inside your encrypted home directory and won't be available until after you are authenticated. Therefore, SSH will default to password authentication.

To solve this, create a folder outside your home named

sudo mkdir /etc/ssh/<username>

This directory must have 755 permissions and be owned by the user. Move the authorized_keys file into it. The authorized_keys file must have 644 permissions and be owned by the user.

Then edit your /etc/ssh/sshd_config and add:

AuthorizedKeysFile    /etc/ssh/%u/authorized_keys


After the key is generated, let's copy it to the host.

ssh-copy-id -p <Port number> <User name>@<Host (localhost)>

After that is done. Correct permissions on the key and folder must be set to secure it.

chmod go-w ~/
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
(If you have encrypted home look at that section's folder permissions)

If the permissions are wrong you will most likely encounter errors. (Source: Ubuntu Wiki)


Now to secure the authentication finally, find these lines.

RSAAuthentication <Value>
PubkeyAuthentication <Value>
PasswordAuthentication <Value>
ChallengeResponseAuthentication <Value>

Change them to.

RSAAuthentication no
PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no

< optional> Also add/edit these following lines to your configuration file to further secure ("harden") your system. Read more about these lines here or from the man pages of sshd.

TCPKeepAlive no
ClientAliveInterval 60
ClientAliveCountMax 5
UsePrivilegeSeparation yes
PermitEmptyPasswords no
PermitRootLogin no
UseLogin no
UsePAM no
MaxAuthTries 2

Allow compression to be used if client requests it. Use the compression flag in the client to either save bandwidth(yes) or CPU (no).

Compression yes

< /optional>

Finalizing install

Now run this command to restart the server (for the configuration changes to apply.

sudo systemctl restart sshd

Let's check the status with

sudo systemctl status sshd -l

Make sure it's green and "active (running)". If it is not, you need to check the error messages. If all is okay, try to connect to your ssh server by using this command.

ssh -p <Port number> <Username>@localhost

If it fails, starts sshd via command line with debugging enabled. That way it'll print you instantly what's wrong.

4. Setting up a portable USB drive for X11 forwarding

Download PuTTY portable. Then just import the keys, enable x11forwarding. Set your port and username. Then the x server location.

Download Xming X Server for Windows. As Windows does not have a X server by default, you need to download one. It works portably too (it should at least). Start it before connecting to the ssh server with PuTTY.

5. Setting up dynamic DNS.

The first step that should be taken is to select the dynamic dns provider, I, myself chose dynu.com. Now let's install the required software. For that copy-paste this command to your terminal. This time we'll use ddclient.

sudo apt install ddclient

It'll launch a configuration screen, just skip it and let's edit the configuration file ourselves. (Use nano, gedit whatever you wish to edit the file as previously)

sudo <your text editor> /etc/ddclient.conf

Now let's copy the contents from here.

# ddclient configuration for Dynu
#
# /etc/ddclient.conf
daemon=60                                                    # Check every 60 seconds.
syslog=yes                                                   # Log update msgs to syslog.
mail=root                                                    # Mail all msgs to root.
mail-failure=root                                            # Mail failed update msgs to root.
pid=/var/run/ddclient.pid                                    # Record PID in file.
ssl=yes                                                      # Use ssl-support.  Works with ssl-library .
use=web, web=my.ip.fi/                                              # Get ip from hardware interface.
server=api.dynu.com                                          # IP update server.
protocol=dyndns2                        
login=YOURUSERNAME                                             # Your username.
password=YOURPASSWORD                                        # Your password or MD5 of password.
MYDOMAIN.DYNU.COM                                            # List one or more hostnames one on each line.

Edit the network interface, hostname, username and password line to make it work properly. You also need to have IO::Socket::SSL. You can install it by using this command.

sudo apt install libio-socket-ssl-perl

Now let's set up the ddclient to run in background.[2]

sudo <your text editor> /etc/default/ddclient

Find the lines that say

run_dhclient=<value>
run_ipup=<value>
run_daemon=<value>

Change them to

run_dhclient="false"
run_ipup="false"
run_daemon="true"

Now let's start it

sudo systemctl start ddclient

Let's check if it works properly

sudo systemctl status -l ddclient

Make sure it is green ("Active = active(running)")

Dynamic DNS should now be set up. You can now test it with

ssh -p <Port number> <Username>@<Hostname (your dynamic DNS one)>

It should say

The authenticity of host '[<Dynamic DNS hostname>]:<Port> ([<Your IP address>]:<Port>)' can't be established.

It'll also print the ECDSA key fingerprint, you can use

ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub

To verify if the fingerprints are identical and then write "yes" to continue. NB! It should NEVER again ask the same question on the same machine when you have not cleared the known hosts file and the IP has nto changed (if you use dynamic DNS it will change). If it does absolutely do not proceed unless you can again verify it's the same fingerprint key as yours on the server.

It should now have connected just fine, maybe asking your key's passphrase, but nothing else.

6. Port forwarding

Now that dynamic DNS and server has been set up and you wish to connect to your PC from other networks. Then you must somehow open your router's settings and forward the port you set in the sshd configuration file. Otherwise you can't connect to the PC, because the router will block it. This is highly dependant on the manufacturer of the router so just Google " port forward" or " port forward". You could also read the manual.


If something was left unclear or is wrong, do let me know, please.

1
  • 1
    Who would've thought that this tutorial would be useful so soon for me. Thanks, past-me. :D
    – Avamander
    Feb 19, 2016 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .