Business - Justin Foell

Update

I have a new post about SSHFS that highlights the latest operating systems, including MacOS. However, I’m leaving this post here for historical purposes.

Original

At home I have what some may call a “back-office” server. Technically it’s in the laundry room, but it does all sorts of home automation type stuff: record TV, download files, store and play music, distribute files, run backups, etc. I may do a post on it later, but the gist is that it’s running Ubuntu Server with a bunch of disk drives.

Far and above, it’s main purpose in life is being a file server. There are several ways to connect to it: Samba (Windows file sharing), NFS (Unix Network File System). The server also runs SSH (Secure Shell) for terminal access – which can also be used a pass-through for secure local and remote file sharing.

Continue reading →

The Advantage of SSHFS

Windows shares don’t have options to change ports, SSH does – and internet service providers often block Windows file sharing ports both for their own customers safety and to CYOA (cover your [their] own a$$) regarding file sharing. SSH, however, can be run on any port and it’s secure. I simply set up a firewall rule on my router (OpenWrt) to pass SSH traffic to my file server.

Why not use “the cloud?”

I firmly believe that by putting your files in “the cloud” (whether it be with Google, Apple, Amazon, Dropbox, etc.) you lose a little freedom. That doesn’t mean I don’t use any of those services, I just use them selectively. For the record Dropbox is a great service that works cross-platform and you’ll get some extra space if you sign up using this link.

Connecting with SSHFS in Linux

The simplest way to connect to another computers file-system using SSHFS is to do it through the UI using the Nautilus file manager. This is default file manager for several Linux distributions. In Ubuntu with Unity, click the folder icon in the launcher to bring a Nautilus window showing your home folder. From Nautilus you can click the file menu and choose Connect to Server…

Which will bring up a dialog where you can input the info for your SSH server. Change the Type drop-down to “SSH” and you’ll see all of these options:

Once you’ve connected, you’ll have a folder on the left side of Nautilus (under Network) that you can click on to browse files on the file server. You can right click the folder and choose Add Bookmark which will make it a breeze to connect to again and again:

You’ll notice I have two folders under “Bookmarks”: sshfs-Local and sshfs-Remote. I set up an additional connection for when I’m away from home which uses my outside IP and port I set up on my firewall/router.

Nautilus uses the GVFS FUSE (filesystem in userspace) module to mount the remote drive. To make it easy to access from the command line I created a symbolic link from ~/Documents/sshfs-Local-Documents to my SSHFS directory. All of the GVFS mounts (on Ubuntu 12.04 and earlier) can be found in your ~/.gvfs folder. Mine is linked as such:

justin@lappy64:~$ ls -l ~/Documents/sshfs-Local-Documents
lrwxrwxrwx 1 justin justin 72 Oct 17  2011 /home/justin/Documents/sshfs-Local-Documents -> /home/justin/.gvfs/SFTP for justin on ghettivo/srv/home/justin/Documents

Starting with Ubuntu 12.10, the GVFS mounts are in /var/run/user. So my symlink in 12.10 looks like:

justin@lappy64:~$ ls -l ~/Documents/sshfs-Local-Documents
lrwxrwxrwx 1 justin justin 82 Nov  1 09:44 /home/justin/Documents/sshfs-Local-Documents -> /var/run/user/justin/gvfs/sftp:host=ghettivo,user=justin/srv/home/justin/Documents

Connection with SSHFS in Windows

To connect to the same files using Windows, there’s Dokan SSHFS. I will say that at the moment this library is a little buggy, but it will work in a pinch. I get the feeling that it probably works better in 32-bit windows, but I don’t have any claims to back that up – I just know it’s a bit unstable in 64-bit windows.

Since Dokan is a .NET application, you’ll need to install a couple of things (maybe 3), slightly better than installing a Java application 😉

There’s a small chance that you have the latest “Redistributable Package” already on your Windows computer, so you can maybe skip it, but honestly it doesn’t hurt to install.

Once you’ve got everything installed you can run DokanSSHFS.exe to connect to your SSHFS drive:

Happy (secure) file sharing!

← Summary Only

It’s about time I addressed the enigma that is working from home. My friend once called me around 1PM to tell me about the amazing 3D dinosaur movie he was watching on his new 3DTV. I said “aren’t you supposed to be at work?” He simply stated that he was working from home. That’s not working from home, that’s what I like to call “watching a movie.”

I work part time from home and to be honest, I do more actual work now than I ever have done at my previous full-time jobs. Continue reading →

Let’s outline a typical day for an office job:

8a – get to work
8-8:30 – drink coffee, eat breakfast (do whatever you skipped at home to sleep an extra :30)
8:30-9 – catch up with co-workers regarding the previous day’s TV shows, sporting events, news, etc.
9-10 – surf the web reading whatever news & weblogs you read daily
10-10:30 – discuss with co-workers where to go to lunch today
10:30-11:30 – maybe some actual work
11:30 – sneak out a little early for lunch
1p – arrive back at work
1-2 – “space out for about an hour” during a food induced coma
2-3 – attend a meeting
3-5 – possibly more actual work

By my count that’s 3 hours of work. Nowadays if I do 6 hours of actual work (which to my brain feels like a long day), I’ve doubled my output and I have a couple extra hours to do whatever I want – not to mention time saved with no commute.

I’m not sure why, but companies seem intent on holding their employees hostage at work, regardless if there’s anything to be done. At one job my boss actually had said “We don’t expect you to punch the clock [… but] we expect everyone to put in 45 hours a week.”

Nowadays I do punch a clock… I keep a religious record of what I work on and when, because I only bill for time that I’m actually working. This gives me motivation to work and ignore the distractions. To maintain focus, all you have to do is a little preparation.

Keep a routine

Set your alarm clock. I used to not have to set an alarm due to the human alarm clock (my infant son) living in the room next to me, but now I have to wake him up so I can get him to daycare and begin work at a reasonable hour.

If you’re a shower in the morning type, do it. Just because you don’t need to wear pants anymore doesn’t mean you shouldn’t. No pants to me means you probably didn’t shower. If that’s your thing, then fine. If you’re not wearing pants because your home office is too hot, you should probably address the problem differently (see below).

What you want to do is mentally prepare yourself for work. You’re getting ready for your day the same way you would normally, except instead of commuting, you just walk into your home office.

Work Comfort & Quelling Distractions

Have a dedicated office space free of distractions. I suggest no TV in the room (unless you get paid to watch TV) – many people like to leave it on as a force of habit when they’re at home, and that can be a huge distraction.

Get a desk that you like and is the appropriate height for you. Do yourself a favor and don’t cheap out on your chair. I’m not saying you need to take out a loan for a Herman Miller Aeron Chair. I have a fabric high-back chair from Office Depot. I like it because it’s got good lumbar support, and I was also used to sitting on it for 3-years at my previous job.

You’ll want to be comfortable, and it’s your house so adjust the thermostat to your liking. You can run as many fans or space heaters as you’d like. Leave the lights on or turn them off, this office is your oyster. Want to listen to the radio at a reasonable volume? Go ahead!

I like to wear “house shoes” (slippers with soles) since my office is in the basement. If I were at someone else’s office, I wouldn’t be comfortable barefoot or in just socks – so ask yourself, would you?

The Future

The 21st century may very well transform the way the employer/employee relationship is bonded. There are jobs like construction and manufacturing that will always require people “on site.” But for those that have the tools to do their job at home, I hope employers will loosen the reigns on imprisoning their employees. The cost of fuel may help influence this. Plus if employers switch to hourly wages for work-at-home employees, they may stand to save some money. Let’s face it, we’re all slaves to the clock, hourly or salaried. I don’t want to be a slave to the clock as well as some employer’s building that’s on the other end of town.

← Summary Only

This is part three of a three part series covering Dnsmasq’s uses regarding:

Local Development DNS
Local Area Network (LAN) DNS
Virtual Private Network (VPN) routing

IT savvy business often use a Virtual Private Network (VPN) connection to allow employees to connect to the (normally internal) work network while they’re traveling or working from home. Many VPNs (once connected) act at the default gateway for your computer. This is effectively like unplugging your computer from your local network and plugging it in at your workplace. This is probably for security reasons, and it’s certainly a simple configuration for most, as your computer is truly now on a remote network as if you were at your desk at work. But for some, this is becomes a restriction, and we’ll examine some cases and a workaround.

Continue reading →

Let’s say I’m connected to the VPN. All of my internet traffic goes through the VPN which is a thousand miles away. If I’m streaming a local radio station, that’s a long way to go out-and-back for something that is truly local. In addition, all of my local network resources are less usable because the VPN has instructed my computer to use the VPN’s DNS servers, so I can now only access them by IP.

It is possible to be connected to the VPN and still have access to local resources, and route (non-VPN) traffic though your normal gateway. Your VPN administrator might say this is poses a security risk, but s/he’ll be none the wiser if you don’t let on.

This configuration is for Dnsmasq and NetworkManager, which is used by Ubuntu & Fedora. But there’s no reason the concepts here can’t be applied to other Linux distributions and/or OSX.

VPN Gateway

Connect to your VPN per normal using NetworkManager. Once you’re connected you can probably deduce the default gateway by looking at output from running a traceroute to a known computer on the VPN (such as the nameserver – see below).

$ traceroute 10.20.0.26
traceroute to 10.20.0.26 (10.20.0.26), 30 hops max, 60 byte packets
 1  * * *
 2  10.20.44.253 (10.20.44.253)  101.294 ms  101.715 ms  102.610 ms
 3  10.20.0.26 (10.20.0.26)  100.205 ms  101.022 ms  101.486 ms

The first IP is likely the VPN’s default gateway, 10.20.44.253 in this case.

VPN Name Servers

You’ll also want to grab the name servers for your VPN. You can probably just inspect your /etc/resolv.conf file for this information:

$ cat /etc/resolv.conf
...
nameserver 10.20.0.26

Add new VPN connection

With this information at hand, disconnect from the VPN and create a new VPN connection in NetworkManager that is essentially the same as the existing one. Name the new connection something that indicates it’s custom (we’ll use this name later). In NetworkManager on the IPv4 Settings tab, set the Method to Automatic (VPN) addresses only:

Then click the Routes… button. In the Routes dialog you’ll want to put in the network information for your work, using the information you deduced using traceroute. My VPN addresses are all 10.x.x.x, and the VPN gateway is 10.20.44.253. So I added a line to the route table like this:

You can find the network address and netmask from the Private Network table on Wikipedia. The metric number should be fine at 10. Check the boxes to ignore obtained routes and to only use this network for resources contained within.

That gets you essentially halfway there, you can connect to the VPN and only requests for resources with network addresses that are part of the VPN will be routed through the VPN connection, everything else will gateway through your normal ISP. You can (and probably should) test this configuration by connecting to the VPN and ping-ing or traceroute-ing to a computer on the VPN (such as the nameserver) just to make sure the custom routing established is indeed working. Once routing is working, we need to fix the DNS as it’s kind of useless without it.

Create a NetworkManager dispatcher.d script to start Dnsmasq

In /etc/NetworkManager/dispatcher.d add a file called 05vpn:

#!/bin/sh

if [ "$2" = "vpn-up" ]; then
        CONN_NAME=`/usr/bin/nm-tool | grep VPN | sed 's/^.*\[\(.*\)\].*$/\1/'`
        if [ "$CONN_NAME" = "VPN Custom" ]; then
                /etc/init.d/dnsmasq start
        fi
fi

if [  "$2" = "vpn-down" ]; then
        /etc/init.d/dnsmasq stop
fi

Set the comparison to $CONN_NAME to the name of your new VPN connection. After saving the file, set it to be executable:

$ sudo chmod 755 /etc/NetworkManager/dispatcher.d/05vpn

The /etc/NetworkManager/dispatcher.d files are executed whenever a network interface goes up or down. The 05vpn file will start/stop Dnsmasq when the “custom” VPN connection is turned on/off.

Configure Dnsmasq for your VPN

Configuring Dnsmasq for your VPN really boils down to adding server entries for every domain that either resides on the VPN, or that you want to route through the VPN. Add a file in /etc/dnsmasq.d for your VPN DNS settings, such as /etc/dnsmasq.d/02_vpn

If your work has it’s own Top Level Domain (TLD), add a server line with the VPN DNS server IP and the TLD:

server=/tld/10.20.0.26

Similarly, if there are certain domains (like your company’s domain name) that act differently when you’re on the VPN, you’ll want to have them route through the VPN:

server=/mywork.com/10.20.0.26

That’s all there is to it. I’ve noticed some (newer) versions of NetworkManager automagically employ Dnsmasq to let you use any LAN resources, but other traffic (such as streaming music) would still go through the VPN.

Happy Hacking!

← Summary Only

This is part two of a three part series covering Dnsmasq’s uses regarding:

In my previous post I covered using Dnsmasq locally to bring some organization to local web development. Now I’d like to cover Dnsmasq’s use on a Local Area Network (LAN), you don’t need to be a developer to appreciate Dnsmasq as we kick it up a notch and spread the love across the network.

Continue reading →

Using Dnsmasq locally is nice and all, but what if you have a home network with multiple computers, each serving different purposes? You probably want them to inter-operate smoothly, and it’s nice to reference things by name rather than having to remember IP addresses.

OpenWrt & Dnsmasq

If you have a computer/server on your network that is on most of the time, this would be an appropriate candidate to run Dnsmasq on. Or, you can do it my preferred way, which is to buy a wireless router that supports OpenWrt (an open-source router firmware) – it includes Dnsmasq. If you decide to use an existing Mac or Unix box on your network to run Dnsmasq, see my first post regarding Dnsmasq installation and configuration, and read the documentation on Dnsmasq’s DHCP options.

For those that go the OpenWrt route, here are some tips on configuring Dnsmasq on OpenWrt Backfire (10.03.1 – latest stable as of 2012). Once your router has the OpenWrt firmware installed and you’ve logged into the web interface, navigate to the DHCP and DNS tab under Network:

The premise behind Dnsmasq is that it not only includes a DNS Server, it also includes a DHCP server. When DCHP is enabled, Dnsmasq will automagically create a DNS name for each computer that connects to the network, based on it’s hostname.

The Server Settings that determine the Top Level Domain (TLD) are Local server and Local domain, set to “lan” in my case. Every host that connects will get a “.lan” domain name. If you look at the list of Active Leases you can imagine each one getting a domain name like lappy64.lan (a play on Strongbad’s Lappy 486), printer.lan, mythtv.lan, etc. In fact, the “.lan” extension is not even needed, hosts can be address simply by their hostname – how easy is that?

For some stubborn devices, which do not report a hostname when asking for an IP address (see those with hostname of “?” in the Active Leases box), the Static Leases section can help out. Once the device is connected, click Add in the Static Leases box, then select the device’s MAC-Address from the list. Under Hostname, type in the name you’d like it to be referenced as, such as “printer.” Give the device a static IP address (something that’s not in the DHCP range specified on the Network > Interfaces > Lan tab – below .50 is probably safe). Save & Apply your changes – you might have to force the device to reconnect in order for it to get the new address.

If you’ve got computers/devices that report a hostname just fine but you’d still like to assign a static IP to, use the Static Leases section in the same way, but leave the hostname field blank.

← Summary Only

The Domain Name System (DNS) is arguably the best (and most used) service that the internet has spawned. Why leave all the fun Top Level Domain (TLD) stuff to ICANN & your registrar? You can have your own TLD using Dnsmasq.

This is part one of a three part series covering Dnsmasq’s uses regarding:

Continue reading →

The only prerequisites for running Dnsmasq is a Unix-based operating system (including Mac OSX). The only prerequisite for reading this article in the series is interest in doing any sort of web development locally. I’m going to cover a simple example using WordPress, but the principle is the same for any web site or service software written in any language. Basically, if your normal local development addresses look something like http://localhost/~me/bobscountrybunker/ then Dnsmasq is for you.

Installing & Starting Dnsmasq

I’m going to cover installation & configuration for Ubuntu 12.04, but over time I haven’t seen a lot of changes in the way Dnsmasq is configured. So configuration should apply to OSX and other Linux distros.

To install on a Debian-based system:

$ sudo apt-get install dnsmasq

Dnsmasq will probably start automatically the next time you boot, but to start it now execute:

$ sudo service dnsmasq start

Systems that don’t use upstart will probably start it like this

$ sudo /etc/init.d/dnsmasq start

Even with no configuration changes, your computer still should work as normal, but if you inspect your /etc/resolv.conf it probably now has a line like this:

nameserver 127.0.0.1

Dnsmasq is already up and running, taking in DNS requests from your computer and at this point just forwarding most of them to your upstream DNS provider. Nothing groundbreaking, but now we can control DNS ourselves and have a little fun.

Configuring Dnsmasq

The configuration files will be in /etc/dnsmasq.conf and/or /etc/dnsmasq.d. The addition of the /etc/dnsmasq.d directory is new to Ubuntu 12.04 (not sure which Dnsmasq version it corresponds to), and it’s a welcome addition because you can put your customized files in there without worrying about /etc/dnsmasq.conf getting overwritten during the next release upgrade.

The files in /etc/dnsmasq.d are executed by the order of their filename, so it would be wise to number your most important configuration with a `01` prefix, such as /etc/dnsmasq.d/01_localhost

Top Level Domains – not just for the big-boys (anymore)

You can invent a new Top Level Domain for use on your local system. On some distributions the convention is to use ‘.lan’ but you could name it what ever you’d like. I don’t recommend anything too long or the ‘.local’ extension which is used by multicast dns. Here’s a simple /etc/dnsmasq.d/01_localhost configuration file:

address=/lan/127.0.0.1

Now every address that ends in ‘.lan’ will belong to your local IP. After (re)starting Dnsmasq, try it out:

$ ping wordpress.lan
PING wordpress.lan (127.0.0.1) 56(84) bytes of data.
64 bytes from localhost (127.0.0.1): icmp_req=1 ttl=64 time=0.021 ms

Pairing Dnsmasq & Apache Web Server

Now let’s combine this with some Apache configuration for a real-world development example. I don’t want to get into the specifics of Apache configurations amongst different OSes and distributions, but on Ubuntu I put a config file in /etc/apache2/sites-available and symlink it to /etc/apache2/sites-enabled, however it can really go anywhere that Apache will read it:

<VirtualHost *:80>
    ServerName wordpress.lan
    ServerAlias *.wordpress.lan

    DocumentRoot /home/justin/wordpress
    <Directory /home/justin/wordpress/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        allow from all
    </Directory>
</VirtualHost>

Once I’ve restarted/reloaded Apache, I can visit http://wordpress.lan in my browser on my local system to bring up an instance of WordPress. You may have noticed the ServerAlias *.wordpress.lan line in the configuration. With mod_rewrite enabled in Apache, I can take the set up a step further and turn this single WordPress installation into a subdomain network installation. This is a great set up if you are working on several sites but want to maintain a single main codebase for your content management software.

← Summary Only

Justin Foell

Technology, Bicycling, Hobbies, Kids, Life.

Category Archives: Business

Cross-platform file sharing with SSHFS

Update

Original

The Advantage of SSHFS

Why not use “the cloud?”

Connecting with SSHFS in Linux

Connection with SSHFS in Windows

How to work from home

Keep a routine

Work Comfort & Quelling Distractions

The Future

(Re)routing VPN traffic with Dnsmasq

VPN Gateway

VPN Name Servers

Add new VPN connection

Create a NetworkManager dispatcher.d script to start Dnsmasq

Configure Dnsmasq for your VPN

Pimp your LAN with OpenWrt & Dnsmasq

OpenWrt & Dnsmasq

Pimpin’ your dev env with Dnsmasq

Installing & Starting Dnsmasq

Configuring Dnsmasq

Top Level Domains – not just for the big-boys (anymore)

Pairing Dnsmasq & Apache Web Server