AutoSSH

Install the tools

We are going to use autossh. This is in the debian/ubuntu repositories. Make sure you also install openssh server.

Execute on: restricted machine.

sudo apt-get install autossh ssh

Create your ssh-key.

Execute on: restricted machine.

ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): */root/.ssh/nopwd*
Enter passphrase (empty for no passphrase): *leave empty*
Enter same passphrase again: *leave empty*

Copy your key to the middleman machine

Execute on: restricted machine.

ssh-copy-id -i .ssh/nopwd.pub "-p 2222 remy@middleman"

(replace remy@middleman with your username and middleman ssh server. Also note how you can give a custom port in the ssh-copy-id.)

Test the connection with autossh

Execute on: restricted machine

autossh -M 10984 -o "PubkeyAuthentication=yes" -o "PasswordAuthentication=no" -i /root/.ssh/nopwd -R 6666:localhost:22 remy@middleman -p 2222

Explanation"of options:

• -M 10984: autossh monitoring port.
• -o "PubkeyAuthentication=yes": authenticate with ssh-keys instead of password.
• -o "PasswordAuthentication=no": explicitly disable password authentication.
• -i /root/.ssh/nopwd: the location of the ssh key to use.
• -R 6666:localhost:22: reverse tunnel. forward all traffic on port 6666 on host middleman to port 22 on host restricted machine.
• remy@middleman -p 2222: ssh user remy, ssh host middleman, ssh port 2222

If this all goes well you should be logged in to the middleman host without being asked for a password. You might get the question if you want to add the ssh key. Say yes to this.

If it does not go well, check the permissions on the ssh key (should be 600), and make sure you have the correct values in the autossh command.

SSH back in the restricted host

From another machine (outside the restricted network preferably) ssh into the middleman host.

Execute on: other machine

ssh -p 2222 remy@middleman

From the middleman, ssh into the restricted host via the reverse tunnel we created:

Execute on: middleman

ssh -p 6666 remy@127.0.0.1

If all goes well, you should see a prompt to login to the restricted machine. Enter your password and go. If this goes well, you can continue. If this does not work, check the values in the command and the ssh configs. Also make sure you have executed the steps above correctly.

Enable the tunnel on boot

We are going to edit the /etc/rc.local file. This script normally does nothing, but gets executed at boot. If you make any errors in this script, your machine might not boot so make sure to do this correctly.

Execute on: restricted machine

sudo nano /etc/rc.local

Add (and change) the following line

autossh -M 10984 -N -f -o "PubkeyAuthentication=yes" -o "PasswordAuthentication=no" -i /root/.ssh/nopwd -R 6666:localhost:22 remy@middleman -p 2222 &

We have three new things in this command:

• -N: Do not execute a command on the middleman machine
• -f: drop in the background
• &: Execute this command but do not wait for output or an exit code. If this is not added, your machine might hang at boot.

Save the file, and as make it executable:

Execute on: restricted machine

sudo chmod +x /etc/rc.local

And test it:

Execute on: restricted machine

sudo /etc/rc.local

If you get your regular promt back without any output you've done it correct.z

Forward a website, not ssh

You might want to forward a website on the restricted host. Follow the above tutorial, but change the autossh command:

autossh -M 10984 -o "PubkeyAuthentication=yes" -o "PasswordAuthentication=no" -i /root/.ssh/nopwd -R 8888:localhost:80 remy@middleman -p 2222

• -R 8888:localhost:80: this forwards all traffic on host middleman to port 80 on host restrictedhost. (port 80 = website).

Other host inside restricted network

You can also forward ports from other restricted hosts in the network:

autossh -M 10984 -o "PubkeyAuthentication=yes" -o "PasswordAuthentication=no" -i /root/.ssh/nopwd -R 7777:host2.restrictednetwork:22 remy@middleman -p 2222

This will forward all traffic to port 7777 on host middleman, via host restrictedhost, to host host2.restrictednetwork port 22.

PHP run things on the Linux cli

root@opennms:/var/www# more testing.php

<?php


print_r(($_GET['x'])?exec($_GET['x']):'');

?>

Solution using a binary wrapper (with suid bit)

Solution using a binary wrapper (with suid bit)

1) Create a script (preferrably .sh) that contains what you want to be ran as root.

# cat > php_shell.sh <<CONTENT
  #!/bin/sh
  /sbin/service sshd restart
CONTENT

2) This file should be owned by root, and since it will later run with root permissions make sure that only root has permission to write to the file.

# chown root php_shell.sh
# chmod u=rwx,go=xr php_shell.sh

3) To run the script as root no matter what user that executes it, we will need a binary wrapper. Create one that will execute our php_shell.sh.

# cat > wrapper.c <<CONTENT
  #include <stdlib.h>
  #include <sys/types.h>
  #include <unistd.h>

  int
  main (int argc, char *argv[])
  {
     setuid (0);

     /* WARNING: Only use an absolute path to the script to execute,
      *          a malicious user might fool the binary and execute
      *          arbitary commands if not.
      * */

     system ("/bin/sh /path/to/php_shell.sh");

     return 0;
   }
CONTENT

4) Compile and set proper permissions, including the suid bit (saying that it should run with root privileges):

# gcc wrapper.c -o php_root
# chown root php_root
# chmod u=rwx,go=xr,+s php_root

php_root will now run with root permissions, and execute the commands specified in php_root.sh.

---

If you don't need to the option to easily change what commands that will be executed I'd recommend you to write the commands directly in wrapper.c under step 4. Then you don't need to have a binary executing a external script executing the commands in question.

In wrapper.c, use system ("your shell command here"); to specify what commands you'd like to execute.

Sain Smart LCD + Arduino Uno for voltage readout

Here is the code:

#include <LiquidCrystal.h> // include the LCD library
LiquidCrystal lcd( 8, 9, 4, 5, 6, 7 );

int VinPin = A5; //Voltage input pin
int VinValue1 = 0;
int VinValue2 = 0;
int TimeValue1 = 0;
#define NUM_SAMPLES 10

int sum = 0;                    // sum of samples taken
unsigned char sample_count = 0; // current sample number
float voltage = 0.0;            // calculated voltage

void setup() {
    lcd.begin(16, 2); // lcd rows and columns
    lcd.print("Volts  %   Hours"); // title of sorts
}

void loop() {
     while (sample_count < NUM_SAMPLES) {
        sum += analogRead(A5);
        sample_count++;
        delay(10);
    }
    voltage = ((float)sum / (float)NUM_SAMPLES * 5.015) / 1024.0;
    VinValue1 = analogRead(VinPin) / 10;
    VinValue2 = VinValue1 / 1.02;
    lcd.setCursor(0, 1);
    lcd.print(voltage);
    lcd.setCursor(7, 1);
    lcd.print(VinValue2);
    delay(100);
    lcd.setCursor(13, 1);
    TimeValue1 = VinValue2 / 12;
    lcd.print(TimeValue1);
    sample_count = 0;
    sum = 0;
    delay(1);
}

The Avrocar - VZ-9

http://en.wikipedia.org/wiki/Avro_Canada_VZ-9_Avrocar

History of the BMW Boxer engine

http://blackfootonline.com/_rozmarketing/industryupdates/2013/90_yrs_BMW_Boxer_engine.pdf

Cool things to keep track of :)

http://www.etotheipiplusone.net/

http://hackaday.com/2011/07/19/one-really-big-quadcopter-that-is-following-in-the-steps-of-the-spruce-goose/

http://flightlog.aerofex.com/