SSH port changes and the openSuSE firewall

Note to self - when changing the SSH port from default 22, keep in mind:

• Change listening port in Webmin (port number > 1024 recommended)
• Let Webmin handle the sighup (existing connections are kept)
• No webmin available: Change port in /etc/ssh/sshd_config (right where it says "Port") . It's easier just to restart (but all connections are killed)
  sudo /etc/init.d/ssh restart
  If you need a sighup (e.g. when you administrate over ssh):
  $ sudo -s
  # ps -alxww | grep ssh
  # kill -9 <process (3rd column) with 4th column "1">
• YaSt and firewall: YaST->Security and Users->Firewall->Allowed Services. To simply allow SSH in the drop-down list is no use, as YaST automatically assumes port 22.
  Go to "Advanced..." and open the matching TCP and UDP ports.
• Now I can't log in any more...: a ssh connection from shell needs the -p option
  $ ssh -p <portnum> <username>@<IP>;
  scp wants the -P option (capital P - can't they unify that?);
  other services like Unison (modify the profile files) or fish:// specify the portwith <user>@<IP>:<port>
• I want to mount a remote ssh share:
  sshfs -p <portnum> <username>@<IP>:<folder> <share>
  
  

Most of the research by daWuzzzz.

Security bugfix in CUPS 1.3.9

Once again according to Heise, CUPS 1.3.9 fixes some possible exploits, so I was a bit miffed to find nothing more recent than 1.2.12 in the openSuSE main repos (on 10.3, at least).
However, CUPS 1.3.9 is available from the openSuSE Printing repo.

Firefox 3.0.2

According to the German Heise Security page Mozilla has patched some important security issues in Firefox 3.0.2. As of this morning, that version is not yet available in the main update repo, but you can get it from the Mozilla Build Service Repo.
Update: 3.0.2 had another bug, passwords containing non-ASCII characters can't be accessed. 3.0.3 is already out and fixed (same repo).

Setting up an Apache server for testing purposes

First, why the hell would we do that? In my case, I have to play around with some simple PHP gallery scripts at the moment, and I am not very keen on testing them instantly on our university server (I expect the sysadmins aren't very keen on that, either, I'm a complete noob on a steep learning-by-doing curve).
Note: I include some MySQL directions here, because a lot of scripts manage MySQL databases. However, e.g. for a not-too-complicated image gallery PHP alone should do the job.
Warning: Don't follow this to configure a fully functional web server: a little knowledge is a dangerous thing - and who lets a total noob configure a web server anyway? This is just to get some practice - reduce my amount of noobness, so to say - working locally, I didn't care too much about security.
Packages to install: Either go for the full LAMP glory (YaST->Software->Patterns>Web and LAMP server), or install by hand apache2, php5, apache2_mod_php5 (if you want php4, find a repo, it's not in the official openSuSE 11 distro any more), if you want Mysql, also mysql, php5-mysql and probably phpMyAdmin. For any kind of server administration, Webmin is also not a bad idea.
To start the apache daemon: run sudo /etc/init.d/apache2 start (at least that's where the http daemon is on my system - you need the full path because it's not in PATH). Guess the code for stopping…

Check your firewall (YaST->Security and users). The allowed services for the External zone should include nothing like 'Apache' or 'HTTP daemon'. Thus, you won't need to fiddle with access control settings, the server is only accessible from localhost (however, some good information on that subject is here and here).
I don't know about other distros, but on openSuSE there is a public_html directory in your home folder. Any HTML documents you store there can be accessed on http://localhost/~<your user name>.
This is comfy if you keep the server local. On a public server I would strongly advise against public folders in one's home directory. However, you can change that in the Apache config files: Remove the userdir entry from the APACHE_MODULES list in /etc/sysconfig/apache2 (either modify the file directly or use the YaST module System->/etc/sysconfig Editor).

HowTo configure an SSH tunnel via PuTTY

Not really OpenSuSE-related, well somewhat: how to tunnel to a ssh box from a Windows Machine using PuTTY

1. Start PuTTY
2. Enter the Host Name or IP address of the machine you want to connect in the appropriate field
3. Change to Connection --> SSH --> Tunnel
4. Enter the LOCAL Port Number in "Source Port"
5. Enter the REMOTE host and port in the form: remotehost.tld:PortNumber in "Destination"
6. Double Check whether "Local" and "Auto" is marked in the settings
7. Click "Add"
8. Something like "L12345 remotehost.tdl:23456" should appear in the "Forwarded Ports" box
   
9. Go back to "Session" and save the session in order to keep the settings for the next start of PuTTY
10. Connect to your machine - the terminal needs to stay open as long as you want to use the SSH-Tunnel
    

BTW: if you want to start PuTTY from the command line easily, just copy putty.exe into the /Windows/system32/ folder and rename it to ssh.exe, then you can start it by commanding ssh on a console or in the "run" dialog.

How to get the latest NTFS-3g

Due to a charming display of eccentric version numbering, you might be stuck with a year-old NTFS-3g version and not even be aware of it.
The developers are in the habit of tagging their versions by month and day of the release date, so 1.913 was released on 07/09/13, 1.1120 on 07/11/20 and 1.2506 (sic!) on 05/06/08. Some nice kind of mini-Y2K here, I wonder what they will surprise us with in October. Don't get me wrong: I love ntfs-3g, couldn't live without it on my dual-boot systems. Kudos to the developers!

Installing the latest:
Add one of the following software repositories in YaST (use "specify URL"):
http://ftp.gwdg.de/pub/linux/misc/suser-jengelh/SUSE-10.3/ http://download.opensuse.org/repositories/home:/benkai:/ntfs/openSUSE_Factory/
Both ship the 1.2506 release and according to ntfs.org that one is heavily recommended, the main repo still has 1.913. Note: I am not altogether comfortable about using a factory repo on a day-to-day system, and for whatever reasons, YaST reported conflicts for the 1.2506 version from the benkai repo, the jengelh repo works fine.

Graphical secure remote server administration

In short: install webmin on the server you want to administrate remotely, but allow only connections from "localhost". Give an account of your choice - preferably not any root-like one - ssh access. Build a tunnel to your server's local port 10000
via

ssh -L <chooseaport>:localhost:10000 <username>@<IPofremotemachine>

Now you can access the remote webmin interface simply by opening a browser of your choice on your machine and typing

localhost:<chooseaport>

into the address bar. Nice easy, and secure!

Additionally: if your SSH server is listening on a different port than the standard port 22, you can connect to it using the -p option, i.e.

ssh -p <portnumber> -L <chooseaport>:localhost:10000 <username>@<IPofremotemachine>