<div dir="ltr">James,<div style>As you can see we don't pretend to have all the details worked out :)</div><div style><br></div><div style>We hope that this incentive help encourages a public feedback loop between ideas and implementations like this thread.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Jul 3, 2013 at 4:38 AM, George Hunt <span dir="ltr"><<a href="mailto:georgejhunt@gmail.com" target="_blank">georgejhunt@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">The central openvpn server would be configured to pass out local (unroutable in the wider internet) addresses in the <a href="http://10.0.0.0/8" target="_blank">10.0.0.0/8</a> subnet to each client. <div>
<br></div><div>
There would be one public/private key pair distributed with the XSCE software distribution, for testing. The server would be configured to accept multiple conections from the same key pair. Effectively this would create a "party line', where everyone who had access to the key pair, would have access to the "party line". Then they would be able to ping all the other XSCE servers, on the local <a href="http://10.0.0.0/8" target="_blank">10.0.0.0/8</a> virtual private network (which is worldwide) -- assuming that the firewalls were set to enable ping responses. And they could log into any servers on that party line, for which they had ssh authentication credentials.</div>
<div><br></div><div>Then, most likely with passwords turned off, deployments could use public/private key pairs they generate themselves to access their own servers.</div><div><br></div><div>For an additional level of security, deployments could contact activitycentral to get their own public/private key pairs, one for each machine, and a config file which connects to different ports, openvpn instances, virtual box instances, or whole physical machines.</div>
<div><br></div><div>At the extreme, a deployment could have it's own virtual private network, protected by key pairs known only to itself, on it's own machine, running under lock and key, in its own back room, and then ssh (password or key pair) connection to each of its machines.</div>
<div><br></div><div>George</div><span class="HOEnZb"><font color="#888888"><div>George</div></font></span></div><div class="gmail_extra"><br><br><div class="gmail_quote"><div><div class="h5">On Wed, Jul 3, 2013 at 4:36 AM, Anish Mangal <span dir="ltr"><<a href="mailto:anish@activitycentral.com" target="_blank">anish@activitycentral.com</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><br><br><div class="gmail_quote"><div>On Wed, Jul 3, 2013 at 1:54 PM, James Cameron <span dir="ltr"><<a href="mailto:quozl@laptop.org" target="_blank">quozl@laptop.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>On Wed, Jul 03, 2013 at 12:45:35PM +0530, Anish Mangal wrote:<br>
> James wrote:<br>
> > Would the person accessing their XSCE remotely then establish<br>
> > another tunnel to your OpenVPN server, or would your server do<br>
> > inbound connection forwarding?<br>
><br>
> Hmm. I'm not so clear on that. I can give the example of a setup in<br>
> Bhagmalpur (a pilot we recently did).<br>
><br>
> 1. There is an openVPN server hosted by Sameer.<br>
> 2. The XSCE when connected to the internet dials into this open vpn<br>
> server.<br>
<br>
</div>Thanks, I understand the first two steps, and they sound good.<br>
<div><br>
> 3. I can login to the XSCE through the openVPN connection through<br>
> ssh and administer remotely.<br>
<br>
</div>How is this last step achieved? There's much flexibility, so I'm<br>
curious. I imagine one of three methods:<br>
<br>
a. does the user first SSH into an account on the OpenVPN server and<br>
then SSH again to the XSCE, or;<br>
<br>
b. does the user SSH to a particular port on the OpenVPN server that<br>
is automatically forwarded to the XSCE, or;<br>
<br>
c. does the XSCE have a routable IP address, courtesy of the OpenVPN<br>
server, to which SSH is directed?<br>
<div><div><br></div></div></blockquote><div><br></div></div><div>I'm not sure... let me explain (perhaps Sameer or Santi can chime in)...</div><div><br></div><div>I have a set of openVPN keys on may laptop through which I connect to the openVPN server automatically (and a network called tun0 is created)</div>
<div><br></div><div>I know the IP address of the XSCE in Bpur</div><div><br></div><div>So, from my laptop, I just do ssh root@<ip address of XSCE on the openVPN network></div><div><br></div><div>Does it make things any clearer?</div>
<div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>
--<br>
James Cameron<br>
<a href="http://quozl.linux.org.au/" target="_blank">http://quozl.linux.org.au/</a><br>
</div></div></blockquote></div></div><br>
<br></div></div><div class="im">_______________________________________________<br>
support-gang mailing list<br>
<a href="mailto:support-gang@lists.laptop.org" target="_blank">support-gang@lists.laptop.org</a><br>
<a href="http://lists.laptop.org/listinfo/support-gang" target="_blank">http://lists.laptop.org/listinfo/support-gang</a><br>
<br></div></blockquote></div><br></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>David Farning<br>Activity Central: <a href="http://www.activitycentral.com" target="_blank">http://www.activitycentral.com</a>
</div>