Routing it Your Way Part 2: ssh + socat to Simplify Tunneling

In a previous post I’ve described of how ssh reverse tcp forwarding and socat forwarding can be used in combination to make the services of a server without a public IP address and no ssh access available to the outside world. The setup requires two intermediate gateway servers, one on the Internet and one in the local network. On the one hand, this is complicated but on the other hand offers a number of interesting simplifications if you have more than just one server in your local network that you want to expose to the world. Let me explain…

Continue reading Routing it Your Way Part 2: ssh + socat to Simplify Tunneling

Routing It Your Way Part 1: ssh + socat

Every now and then I get questions that make me think in new directions and the results are often useful far beyond the original intent. Here’s an example: For many years I’ve been using ssh reverse tcp port forwarding to make servers available on the Internet that are behind a NAT, for example in a home network without a public IP address. Here’s my original post from back in 2014 and here’s a post about a talk I gave on the topic in 2019. But what if one can’t initiate an ssh tunnel from the server behind the NAT? Well, I have a solution for that as well now: Combining ssh and socat!

Continue reading Routing It Your Way Part 1: ssh + socat

Confidential Computing – Some Thoughts

At the end of 2020, I first came across the term Confidential Computing for the first time over here. This article describes how to encrypt a virtual machine image and then upload and run it on a physical host of a cloud provider without the cloud provider being able to look into the VM and into the virtual disk image. If this was actually offered by a cloud hosting company in the future, it would go a long way to overcome my aversion of processing sensitive personal data in the cloud. Over the next months, however, it turned out that the term ‘Confidential Computing’ is used for quite a number of different things, so one has to be very careful what people mean when they are using this term. So let’s have a look at the different kinds of Confidential Computing.

Continue reading Confidential Computing – Some Thoughts

Coding and Deploying From the Edge of the Observable Internet

o.k., the title of this post is a bit of a mouthful but I found the analogy to the Observable Universe and what lies beyond interesting. This post is about an interesting learning experience I went through a number of times in recent weeks: Staying at places for several days with marginal Internet connectivity and trying to get my everyday projects done. The question: How much should I do locally, and how much do I push in the cloud and run from there?

Continue reading Coding and Deploying From the Edge of the Observable Internet

Running OBS Studio in the Cloud

In 2020, the Vintage Computing Festival had to happen online. For this, we used quite a number of virtual machines in the cloud (i.e. in a datacenter) to host the BBB video conference servers. The live streams of the talks, however, ran on a physical notebook and we used OBS Studio to record the screen of that notebook and stream it to to the CCC distribution network. And it looks like we are going to have at least a part of this year’s event in the cloud again. So it was time to think a bit about how to improve last year’s setup. Pretty high on my list: Virtualize that notebook with OBS on it and push it out into a virtual machine in the cloud.

Continue reading Running OBS Studio in the Cloud

5G – The SIM Card and the SUCI

One of the nice things of the 5G Core Network architecture is that it allows the concealment, i.e .the encryption of the user’s identifier. While in previous network generations, this ID is referred to as the IMSI (International Mobile Subscriber Identity), it has been renamed to SUPI (Subscription Permanent Identity) in 5G. Under normal circumstances, even 2G, 3G and 4G conceal the user’s identity with a temporary ID that changes frequently. Under some circumstances, however, e.g. when connecting to a roaming network for the first time, or when the home network has forgotten the temporary identifier, which can happen for a number of reasons, the network has to ask for the IMSI. Unfortunately, this loophole can be used by malicious base stations and other equipment to get to the real identities of devices and their users. The good news: The 5G core has a fix for this!

Continue reading 5G – The SIM Card and the SUCI

Proxy Jump(ing) Around Congestion

Every now and then I meet congestion out there in the cloud. And sometimes, particularly in the evening, a transit or peering link between networks is so congested, that packets are frequently dropping, and data transfer speeds are down to a few megabits per second. Not a very ‘sparkling’ experience one would probably say in the backbone community in Italy.

Anyway, if you are in the ‘engine room’ of a network operator, you could of course do something about this and find another peering or transit partner for a particular destination network. But I’m unfortunately not in such a position, so I needed a way to ‘route around the problem’ on a higher layer of the protocol stack. The solution: Multiple proxy jumps with ssh.

Continue reading Proxy Jump(ing) Around Congestion

EarlyOOM: How to Stop Linux From Halting

In case you use Linux on the desktop, you might have been here before: When running out of memory, the system suddenly crawls to a halt and becomes totally unusable. In such cases it is often not even possible anymore to ssh into the system to reboot it. Sometimes, the system recovers after a very long time once the kernel finally gives up and invokes its out of memory procedures to terminate a process to free up memory. But that requires a lot of patience and the typical ‘quick’ solution is a power cycle. But recently I found a better way to deal with this: EarlyOOM.

Continue reading EarlyOOM: How to Stop Linux From Halting

TinyPilot – Part 2

Remote-KVM hardware is a great way to control servers and PCs remotely when device control is required while the operating system is not yet loaded, or installing remote control software is not possible. In a previous post, I’ve had a look at TinyPilot, a remote-KVM solution based on a Raspberry Pi. I’m using it on a daily basis now and in this part I’ll have a look at some more technical details such as power consumption, the USB power splitter and VGA connectivity.

Continue reading TinyPilot – Part 2