Pretend to be a server with two PCs
motivation
The difference between a personal computer and a server is mainly in terms of specifications and intended use, and the boundaries are more ambiguous than expected. In fact, you can use your computer as if it were a server on another network. So, let's simulate remote server work by making an SSH connection from one to the other using two PCs at home.
Things to prepare / premise
--Connection source PC: Those that can use SSH. OS is optional. --Connected PC: Ubuntu or MacBook. Other Linux distributions have different commands. In the case of Windows, the settings are different, so I will omit it. --Both PCs are connected to the same network
Check the IP of the connection destination PC
For Ubuntu
# server ubuntu
$ ip a
...
inet 192.168.X.Y/24 ...
...
For MacBook
# server macbook
$ ifconfig
...
inet 192.168.X.Y netmask 0xffffff00 ...
...
The above command will display the private IP of the connected network. Usually in the format 192.168.X.Y, where X and Y are numbers from 0 to 255.
About IP address
The IP address is a 32-bit number, and if you represent it by a number separated by 8 bits, it becomes an IP address that you often see. Since 8 bits represent numbers from 0 to 255, 4 numbers in this range will be the IP address.
If there is a / 24, it means that the first 24 bits of the IP address are fixed within the group. That is, the first three numbers are fixed and the last numbers are different.
netmask 0xffffff00 expresses the same thing. That is, if the fixed bit is written in hexadecimal so that the fixed bit is 1 and the variable part is 0, this is the case.
I wasn't sure why private addresses usually start with 192.168.
Start SSH service on the server side
In the initial state, SSH connection is not possible from the outside. Let's check it with ping.
#Connection source
$ ping 192.168.X.Y
Request timeout for icmp_seq 0
...
For X and Y, enter the values you confirmed earlier. This result means that you cannot access the IP.
Therefore, try starting the SSH service at the connection destination.
For Ubuntu
#Connection destination Ubuntu
$ sudo apt-get install -y openssh-server
ʻWhen you install openssh-server`, the SSH service will start automatically. You can check it with the following command.
#Connection destination Ubuntu
$ sudo systemctl status ssh
...
Active: active (running)
...
The SSH service will start automatically the next time you start your PC. If you want to stop the automatic startup, there seems to be the following method (Reference) ..
-
Rename the
ssh.conffile with the following command (restore the name for automatic startup)$ sudo mv /etc/init/ssh.conf /etc/init/ssh.conf.disabled -
Comment out the part related to automatic startup in
/etc/init/ssh.conf
...
#start on filesystem or runlevel [2345]
...
For MacBook
In System Preferences> Sharing, select "Remote Login" and select an accessible user (Reference -access-your-mac-mchlp1066 / mac)).
A screen like the one below. It politely teaches you SSH commands.
Now try ping again.
$ ping 192.168.X.Y
64 bytes from 192.168.10.224: icmp_seq=0 ttl=64 time=108.883 ms
...
If all goes well, you can see access to the IP.
Connect with SSH
The connection method is the same as a normal server.
#Connection source
$ ssh <user>@192.168.X.Y
Since ordinary PCs have password login, you will often be asked for your password after this. You should be able to connect by entering the login password you normally use at the connection destination.
Set up a firewall
If you just started the SSH service, the only protection against unauthorized access is the password. By setting a firewall at the connection destination, you can limit the access method.
For Ubuntu
Check the current status of the firewall.
$ sudo ufw status
Status: inactive
ʻInactive` means that the firewall is not configured.
First of all, we will prohibit access in principle and allow only SSH.
$ sudo ufw default deny
$ sudo ufw allow ssh
$ sudo ufw enable
This will prevent access to anything other than SSH (port 22). You can check it with the following command.
$ sudo ufw status
Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
22/tcp (v6) ALLOW Anywhere (v6)
To make it a little more secure, you can limit the source to the same network segment.
$ sudo ufw reset
$ sudo ufw default deny
$ sudo ufw allow from 192.168.X.0/24 to any port ssh
$ sudo ufw enable
Replace X with the number of the confirmed IP address. / 24 allows access only from networks where the first 24 bits (three numbers) of this IP match.
$ sudo ufw status
Status: active
To Action From
-- ------ ----
22/tcp ALLOW 192.168.10.0/24
For MacBook
It can be set from the "Firewall" tab in System Preferences> Security & Privacy. If you allow SSH access, it seems that only the SSH port is automatically set to be accessible.
Recommended Posts