NAT,DMZ,PAT,Portforwarding,Machine to Machine

1.https://supportforums.cisco.com/message/3190440
2.
Router has:
inner bound || DMZ || outer bound
NAT SPAM NAT

1.DMZ input is a local ip
2.NAT is a wrapper around DMZ
3.NAT has a ART table
4.if there is only single public ip,in the ART public ip,port local ip,port will be the entry
5.NAT is inbound initiated by default,it acts similar to a firewall since only the applications
that seeks a connection will have entry in the ART

6.static nat,port forwarding are similar
7.nat can be interface,ip,port based
8.NAT from inner to outer,portforward,dmz,static nat outer to inner

9.Subnets
1.all nodes behind a single gw assigned ip addresses in different subnets is of less use
arp will resolve the mac and that will direct the packets
2.if the nodes are on two sides of the gw it will be more useful
the gw will have routing information about two subnets and packets will trascend the gw
3.

10.Use ip tables to setup DMZ and NAT entries

11.Illustrated nat setup
http://doc.m0n0.ch/handbook/examples.html

12.typical nat rule
Original Packet:
==============
Source: DMZ Network (or object for DMZ server)
Destination: Internal Network (usually a group object containing all your internal subnets)
Service: Any

Translated Packet:
=================
Source: Original
Destination: Original
Service: Original

12.Features
In current router,dmz is single ip based,any malware with access on dmz ip can access other pc on lan

Next advanced is router with wan ,wifi,lan + optional interface.This optional i/f can be configured for a dmz subnet.That subnet can be prevented from accessing lan subnet

13.wherever iptables command is accessible in firmware..advanced configurations can be tested

14.For VPN on Router the server acts like a gw with dhcp and different subnet/same subnet
the configuration can be software switch with one port bridged to hardware switch ... ??

webdav on linux windows

1.http://andres.jaimes.net/setting-up-a-webdav-server/
2.use webdav to rsync
http://forums.dropbox.com/topic.php?id=8957

apache virtual host

1.single machine -- running multiple web server simulation
follow
http://www.debuntu.org/2006/02/22/7-virtual-hosting-using-apache-2

2.directory access
http://www.cyberciti.biz/faq/apache-restrict-access-based-on-ip-address-to-selected-directories/
http://httpd.apache.org/docs/1.3/howto/auth.html#basic

git and ssh

1.initialize the git in git user login home ... link ssh public key with git home
2.it will create .gitosis.conf
3.next to clone gitosis-admin

Server
=====
install gitosis and git

Configuration
=============
create a user called git
give appropriate permissions to critical files
ensure .ssh folder

git unlike ssh uses gitosis-init to append public key(id_rsa.pub) to authorized_keys file(please remove the previous conflicting entries if any)

Client
======
use git clone to get the init files

follow http://www.hackido.com/2010/01/installing-git-on-server-ubuntu-or.html

At any point to reset
rm -r gitosis,repositories,.gitosis.conf

Creating a new repo
====================
in the gitosis-admin folder cloned initialially on the client there is the file gitosis.conf
Add entries for the new repo in it,note that the writable should have "folder(project)" name
Add group can be arbitrary
add this to remote using commit

follow the link
http://scie.nti.st/2007/11/14/hosting-git-repositories-the-easy-and-secure-way

on any client use git clone git@localhost:test.git

ssh and localhost

server
/etc/init.d/ssh restart
/etc/ssh/sshd_conf
PermitRootLogin no

#RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys

ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no

UsePAM no
AllowUsers git

Directory
=========
using adduser ..created user git
using sudo -u git -i ..logged in on the client as git

Permissions
===========
chown -R git:git /home/git/.ssh
chmod 700 /home/git/.ssh
chmod 700 /home/git/.ssh/id_rsa
chmod 700 /home/git/.ssh/id_rsa.pub
chmod 700 /home/git/.ssh/authorized_keys === id_rsa.pub

Debug
=====
/usr/sbin/sshd -d -p 54321
ssh -p 54321 -v git@localhost

Client
======
/etc/ssh/ssh_conf

creating and deleting user accnt

1.adduser ....user --interactive
2.userdel user
3.su -s -u user
4.useradd -- non interactive
5.passwd user
6./etc/adduser.conf
7.deluser user
8.difference of system and non system user

9.useful ssh
http://kimmo.suominen.com/docs/ssh/

10.a client server setup
11.need to start a ssh session with the server,as a user on the server
12.the user account needs private and public key
13.the client gets the public key and is used with the server
14.article
http://www.symantec.com/connect/articles/ssh-host-key-protection
15.ssh-add can be used to add keys to frequently used secure sessions
16.ssh-agent

17.ssh has a client d and server daemon
/etc/init.d/ssh restart

18.ssh checklist
http://ubuntuforums.org/showthread.php?t=231451
19.ssh test
http://sial.org/howto/openssh/publickey-auth/
20.#ChallengeResponseAuthentication no -- modification in /etc/ssh/sshd_conf
AllowUsers gitosis,git
21.whoami .....login commands
22.basics of shell
http://www.linuxfromscratch.org/blfs/view/cvs/postlfs/profile.html

23.sudo -u git -i .... resets the $HOME etc

24.sudo useful
http://www.freesoftwaremagazine.com/articles/command_line_intro

25.Each user needs to be at /etc/sudoers file..use visudo ...use passwd to change password

26.standalone testing openssh
/usr/sbin/sshd -d -p 54321
ssh -p 54321 localhost
http://docstore.mik.ua/orelly/networking_2ndEd/ssh/ch12_01.htm

sshd configuration

1.http://www.faqs.org/docs/securing/chap15sec122.html