[I wasn't sure whether this is more suited to comp.os.linux.misc
or comp.os.linux.networking ]

I have 2 Linux computers connected to the same router through
ethernet cables. Computer A runs Devuan , computer B an older
version of Debian. I want to connect from B to A and execute
shell commands on A. X11 forwarding would be a plus.

I assume that something SSH related is the right approach and
my questions are:

1. Which packages need to be installed on the computers ?

2. What should I enter into which configuration files for A to
only accept connections from B ?

3. Can it be done safely without having to enter a password on
B when I want to connect to A ?

I can read man pages but some pointers on what terms or files I
should look for would be useful.

--
vlaho.ninja/prog

On 11/06/2023 11:11, Spiros Bousbouras wrote:
> [I wasn't sure whether this is more suited to comp.os.linux.misc
> or comp.os.linux.networking ]
>
> I have 2 Linux computers connected to the same router through
> ethernet cables. Computer A runs Devuan , computer B an older
> version of Debian. I want to connect from B to A and execute
> shell commands on A. X11 forwarding would be a plus.
>
Mmm. I never had a lot of success with X11 forwarding

> I assume that something SSH related is the right approach and
> my questions are:
>
> 1. Which packages need to be installed on the computers ?
>
> 2. What should I enter into which configuration files for A to
> only accept connections from B ?
>
> 3. Can it be done safely without having to enter a password on
> B when I want to connect to A ?
>
> I can read man pages but some pointers on what terms or files I
> should look for would be useful.
>

First of all it is helpful to configure the machines on fixed IP address
rather than dynamically allocated ones . You can do this my causing your
router to recognise theor MAC addresses and associating them with a
static IP address, or you can assign a static IP address (and gateway
and nameserver) and not use DHCP.

The second handy tip is, unless you want to set up local DNS, to set up
/etc/hosts on both machines to reflect the other machines address, so
you can contact them by name.

To get secure passwordless ssh connections is a matter of installing the
ssh packages and looking up one of the many in depth tutorials on how to
set up using public/private keys.

https://linuxize.com/post/how-to-setup-passwordless-ssh-login/

ssh can be restricted to access from specified IP address, by specified
users. Again tutorials are numerous. But if you disable password access
and use keys to validate, you achieve the same results anyway.

Once you have seamless ssh, you can access files systems that you as a
user have authority over using sshfs protocols

I am not up to day on X fowarding, so I will pass on that. I believe
that too can pass over ssh.

--
I would rather have questions that cannot be answered...
....than to have answers that cannot be questioned

Richard Feynman

On 2023-06-11 12:11, Spiros Bousbouras wrote:
> [I wasn't sure whether this is more suited to comp.os.linux.misc
> or comp.os.linux.networking ]
>
> I have 2 Linux computers connected to the same router through
> ethernet cables. Computer A runs Devuan , computer B an older
> version of Debian. I want to connect from B to A and execute
> shell commands on A. X11 forwarding would be a plus.
>
> I assume that something SSH related is the right approach and
> my questions are:

ssh is indeed the right approach.

>
> 1. Which packages need to be installed on the computers ?

I'll leave this question to others, as I'm not familiar with your distro.

You need the client, and the daemon. In openSUSE, it is openssh-clients
and openssh-server, and they are installed by default.

>
> 2. What should I enter into which configuration files for A to
> only accept connections from B ?

Huh. I do that in the firewall.

> 3. Can it be done safely without having to enter a password on
> B when I want to connect to A ?

That can be done exchanging encrypted keys between both machines, and
protecting those keys with no password. Or, the desktop can cache the
password.

--
Cheers, Carlos.

On 2023-06-11 12:47, The Natural Philosopher wrote:
> On 11/06/2023 11:11, Spiros Bousbouras wrote:

> I am not up to day on X fowarding, so I will pass on that. I believe
> that too can pass over ssh.

Yes.

You do:

ssh -X username@192.168.2.18

--
Cheers, Carlos.

"Carlos E.R." <robin_listas@es.invalid> writes:

> On 2023-06-11 12:47, The Natural Philosopher wrote:
>> On 11/06/2023 11:11, Spiros Bousbouras wrote:
>
>
>> I am not up to day on X fowarding, so I will pass on that. I believe
>> that too can pass over ssh.
>
> Yes.
>
> You do:
>
> ssh -X username@192.168.2.18
You can also reduce overhead using the compression flag:

ssh -CX username@192.168.2.18

On Sun, 11 Jun 2023 06:11:48 -0400, Spiros Bousbouras <spibou@gmail.com> wrote:
> [I wasn't sure whether this is more suited to comp.os.linux.misc
> or comp.os.linux.networking ]
>
> I have 2 Linux computers connected to the same router through
> ethernet cables. Computer A runs Devuan , computer B an older
> version of Debian. I want to connect from B to A and execute
> shell commands on A. X11 forwarding would be a plus.
>
> I assume that something SSH related is the right approach and
> my questions are:

For computers accessed over the internet, I use ssh with X forwarding, and
within my lan where I want the program running on one computer with the gui
displayed on another.

For sharing files within my lan, I use sshfs.

I also use synergy. I log in on both computers and start synergy on both.
The server is the one which has the keyboard/mouse I prefer connected,
the other is the client. Both computers must be running the same version
of synergy.

Note the program synergy-gui which can be used to create config files is
payware, but it's not needed as the config files can be created manually.
The actual synergy server/client programs are open source.

Creating the config file manually is a bit of a pain, but there are examples
available on the net. The synergy program allows me to move the mouse to the
right of my main screen to the second computer's screen. The keyboard input
goes to which ever computer's screen the mouse pointer is on. The clipboard
is shared, so I can copy/paste text and pictures between the two computers.

Regards, Dave Hodgins

Spiros Bousbouras <spibou@gmail.com> wrote:
> I have 2 Linux computers connected to the same router through
> ethernet cables. Computer A runs Devuan , computer B an older
> version of Debian. I want to connect from B to A and execute
> shell commands on A. X11 forwarding would be a plus.
>
> I assume that something SSH related is the right approach

Without knowing how old your old version of Debian is and how long
you intend to keep using it without upgrading, my recommendation
would be to not use SSH because either now or later it will be
unable to connect with the newer Devuan system because all the
supported authentication or encryption systems will be depreciated
in the newer software.

For this reason on my home LAN, which I know nobody is snooping
on, I avoid SSH wherever possible and use Telnet instead (usually
the GNU Inetutils implementation). The DISPLAY environment variable
is automatically set to the hostname of the computer that you've
connected from, so if this is associated with the correct IP
address in /etc/hosts (or the DNS server on your LAN if present and
configurable), you can just start X programs normally and they'll
display on the computer that you're working from so long as its X
server has TCP enabled (the latest versions of Xorg must be started
with the "-listen tcp" command line parameter to enable this, eg.
in ~/.xserverrc).

> 1. Which packages need to be installed on the computers ?

inetutils-telnet, inetutils-telnetd, and inetutils-inetd. Set up
/etc/inetd.conf with a line like:

telnet stream tcp nowait root /usr/sbin/telnetd telnetd

and start inetd at boot.

> 2. What should I enter into which configuration files for A to
> only accept connections from B ?

With Telnet I think this would need to be done in firewall settings
on the computers or a router.

> 3. Can it be done safely without having to enter a password on
> B when I want to connect to A ?

If you care about this then perhaps Telnet isn't for you because
"safely" probably means that you don't want plain-text passwords
and anything else will mean raising version incompatibility
problems with authentication systems such as are used by SSH.

If you want this, then you'll have to give up on the old Debian
version either now or sometime later. If you're willing to compile
newer versions of OpenSSH yourself then you might be able to delay
this for many years though. Other options are setting up a
physically secure network connection from the old Debian system to
a newer computer, using SSH to connect to the newer system, which
runs a script that connects to the older system via Telnet. The
"newer computer" might even be a virtual machine running on the old
system with the emulated network interface in Bridge mode so that
it appears as a unique IP on your LAN.

But life is much easier if you can trust that nobody is snooping on
your LAN in the first place.

--
__ __
#_ < |\| |< _#

On Sun, 11 Jun 2023 13:34:51 +0200, Carlos E.R. wrote:
>
> On 2023-06-11 12:47, The Natural Philosopher wrote:
>
>> I am not up to day on X fowarding, so I will pass on that. I believe
>> that too can pass over ssh.
>
> Yes.
>
> You do:
>
> ssh -X username@192.168.2.18

And add an app. Like

ssh -X username@192.168.2.18 firefox

On the other side X must be allowed. Suppose that's default though.
--
Andreas

On Sun, 11 Jun 2023 16:16:58 -0400, David W. Hodgins wrote:
>
> On Sun, 11 Jun 2023 06:11:48 -0400, Spiros Bousbouras <spibou@gmail.com> wrote:
>> [I wasn't sure whether this is more suited to comp.os.linux.misc
>> or comp.os.linux.networking ]
>>
>> I have 2 Linux computers connected to the same router through
>> ethernet cables. Computer A runs Devuan , computer B an older
>> version of Debian. I want to connect from B to A and execute
>> shell commands on A. X11 forwarding would be a plus.
>>
>> I assume that something SSH related is the right approach and
>> my questions are:
>
> For computers accessed over the internet, I use ssh with X forwarding, and
> within my lan where I want the program running on one computer with the gui
> displayed on another.

You could also use VNC or RDP. But I suppose SSH has the least overhead,
thus is fastest.

> For sharing files within my lan, I use sshfs.

You can also transparently (net-) mount the file system from another
computer. Looks like a part of the local file system then.
--
Andreas

>>>>> On 2023-06-11, Computer Nerd Kev wrote:
>>>>> Spiros Bousbouras <spibou@gmail.com> wrote:

>> I have 2 Linux computers connected to the same router through
>> ethernet cables. Computer A runs Devuan , computer B an older
>> version of Debian. I want to connect from B to A and execute
>> shell commands on A. X11 forwarding would be a plus.

>> I assume that something SSH related is the right approach

> Without knowing how old your old version of Debian is and how long
> you intend to keep using it without upgrading, my recommendation
> would be to not use SSH because either now or later it will be
> unable to connect with the newer Devuan system because all the
> supported authentication or encryption systems will be depreciated
> in the newer software.

"Deprecated," but so far as I can tell, not "unsupported."
For details, refer to the Cipher and HostKeyAlgorithms options
description in ssh_config(5) and sshd_config(5).

Granted, there /are/ interoperability issues between different
SSH implementations IME, but frankly, I don't recall any between
different ('stable') OpenSSH versions.

More specifically, it looks like exactly one cipher is no longer
supported by OpenSSH as of Bookworm that was available in Buster:

BOOKWORM$ wdiff -- <(ssh -n -- BUSTER ssh -Q cipher | LC_ALL=C sort -st-) \
<(ssh -Q cipher | LC_ALL=C sort -st-)
3des-cbc
aes128-cbc
aes128-ctr
aes128-gcm@openssh.com
aes192-cbc
aes192-ctr
aes256-cbc
aes256-ctr
aes256-gcm@openssh.com
chacha20-poly1305@openssh.com
[-rijndael-cbc@lysator.liu.se-]

(And I'd venture to guess it was deprecated long before it got
removed.)

For the SSH key types, the lists of supported ones are identical:

BOOKWORM$ cmp -- <(ssh -n -- BUSTER ssh -Q HostKeyAlgorithms | sort -st-) \
<(ssh -Q HostKeyAlgorithms | sort -st-)
BOOKWORM$

--
FSF associate member #7257 http://am-1.org/~ivan/

O 12/06/23 ás 04:10, Andreas Kohlbach escribiu:
> On Sun, 11 Jun 2023 13:34:51 +0200, Carlos E.R. wrote:
>>
>> On 2023-06-11 12:47, The Natural Philosopher wrote:
>>
>>> I am not up to day on X fowarding, so I will pass on that. I believe
>>> that too can pass over ssh.
>>
>> Yes.
>>
>> You do:
>>
>> ssh -X username@192.168.2.18
>
> And add an app. Like
>
> ssh -X username@192.168.2.18 firefox
>
> On the other side X must be allowed. Suppose that's default though.

You can even run an entire DE through SSH.

Ivan Shmakov <ivan@siamics.netnospam.invalid> wrote:
>>>>>> On 2023-06-11, Computer Nerd Kev wrote:
>>>>>> Spiros Bousbouras <spibou@gmail.com> wrote:
>
> >> I have 2 Linux computers connected to the same router through
> >> ethernet cables. Computer A runs Devuan , computer B an older
> >> version of Debian. I want to connect from B to A and execute
> >> shell commands on A. X11 forwarding would be a plus.
>
> >> I assume that something SSH related is the right approach
>
> > Without knowing how old your old version of Debian is and how long
> > you intend to keep using it without upgrading, my recommendation
> > would be to not use SSH because either now or later it will be
> > unable to connect with the newer Devuan system because all the
> > supported authentication or encryption systems will be depreciated
> > in the newer software.
>
> "Deprecated," but so far as I can tell, not "unsupported."
> For details, refer to the Cipher and HostKeyAlgorithms options
> description in ssh_config(5) and sshd_config(5).

Yes I answered the question in a generic sense assuming computer B
could be running _any_ older version of Debian because the version
wasn't specified. I'm posting from Debian version 3 right now, so
that makes sense to me, but it did occour to me afterwards that the
OP may have meant an old but still supported Debian version.

The IETF recommends not implementing some old key exchange
algorithms for SSH:
https://datatracker.ietf.org/doc/id/draft-ietf-curdle-ssh-kex-sha2-13.html

But indeed up to a point you can enable many depreciated options
with the "ciphers" and "KexAlgorithms" settings in
/etc/ssh/sshd_config on "computer A".

But if you can just use Telnet happily on a secure LAN, then this
is all lots of unnecessary work (especially because SSH isn't very
helpful with its error messages, and old versions don't support the
-Q option).

--
__ __
#_ < |\| |< _#

On 2023-06-11, David W. Hodgins wrote:

> On Sun, 11 Jun 2023 06:11:48 -0400, Spiros Bousbouras <spibou@gmail.com> wrote:
>> [I wasn't sure whether this is more suited to comp.os.linux.misc
>> or comp.os.linux.networking ]
>>
>> I have 2 Linux computers connected to the same router through
>> ethernet cables. Computer A runs Devuan , computer B an older
>> version of Debian. I want to connect from B to A and execute
>> shell commands on A. X11 forwarding would be a plus.
[...]
>
> I also use synergy. I log in on both computers and start synergy on both.
> The server is the one which has the keyboard/mouse I prefer connected,
> the other is the client. Both computers must be running the same version
> of synergy.
>
> Note the program synergy-gui which can be used to create config files is
> payware, but it's not needed as the config files can be created manually.
> The actual synergy server/client programs are open source.
>
> Creating the config file manually is a bit of a pain, but there are examples
> available on the net. The synergy program allows me to move the mouse to the
> right of my main screen to the second computer's screen. The keyboard input
> goes to which ever computer's screen the mouse pointer is on. The clipboard
> is shared, so I can copy/paste text and pictures between the two computers.
>
> Regards, Dave Hodgins

Just make sure your keyboard layout is compatible with synergy, at least
the version I used many years ago would convert key to glyph and then
glyph to key, which resulted in the wrong key press possibly being
"executed" if there was more than one way to produce the same glyph
(IIRC this affected "|" in the Finnish layout).

After that, I think I moved to x2x, as I was using synergy between two
machines running X11.

--
Nuno Silva

On 2023-06-12 04:10, Andreas Kohlbach wrote:
> On Sun, 11 Jun 2023 13:34:51 +0200, Carlos E.R. wrote:
>>
>> On 2023-06-11 12:47, The Natural Philosopher wrote:
>>
>>> I am not up to day on X fowarding, so I will pass on that. I believe
>>> that too can pass over ssh.
>>
>> Yes.
>>
>> You do:
>>
>> ssh -X username@192.168.2.18
>
> And add an app. Like
>
> ssh -X username@192.168.2.18 firefox

That can be done later, typing on the terminal, if you want.

Notice, though, that firefox is "different" in this respect.

>
> On the other side X must be allowed. Suppose that's default though.

--
Cheers, Carlos.

On 12/06/2023 00:38, Computer Nerd Kev wrote:
> Spiros Bousbouras <spibou@gmail.com> wrote:
>> I have 2 Linux computers connected to the same router through
>> ethernet cables. Computer A runs Devuan , computer B an older
>> version of Debian. I want to connect from B to A and execute
>> shell commands on A. X11 forwarding would be a plus.
>>
>> I assume that something SSH related is the right approach
>
> Without knowing how old your old version of Debian is and how long
> you intend to keep using it without upgrading, my recommendation
> would be to not use SSH because either now or later it will be
> unable to connect with the newer Devuan system because all the
> supported authentication or encryption systems will be depreciated
> in the newer software.
>
"deprecated"

Like telnet is

--
“Puritanism: The haunting fear that someone, somewhere, may be happy.”

H.L. Mencken, A Mencken Chrestomathy

>>>>> On 2023-06-12, Andreas Kohlbach wrote:
>>>>> On Sun, 11 Jun 2023 16:16:58 -0400, David W. Hodgins wrote:

[Cross-posting to news:comp.windows.x.]

>> For computers accessed over the internet, I use ssh with X
>> forwarding, and within my lan where I want the program running
>> on one computer with the gui displayed on another.

> You could also use VNC or RDP. But I suppose SSH has the least
> overhead, thus is fastest.

I think it conflates 'transport' and 'application' protocols.

As is pointed elsewhere in this thread, you can use X over
TCP, which will have even less overhead than X over SSH.

OTOH, it's certainly possible to use VNC over SSH (whether
via port forwarding, or as described in Debian Bug#1018240,
though there're some fixes pending to the recipe), which
will have more overhead than VNC over (unencrypted) TCP,
yet possibly /less/ than X over SSH.

http://bugs.debian.org/1018240

Now, I don't have any measurements to back this claim, but
note that while /classic/ X software sends short commands
to the X server (draw a line here, render a string there),
/modern/ software mostly just pushes pre-rendered pixmaps
to the server. There, VNC protocol may have an advantage,
as it's pretty much dedicated to shoving image data around,
and does not support requests such as drawing polygons on
the server, which modern software won't use anyway.

To summarize, if you mostly want to use classic, libXt- or
libX11- based software, like, say, xedit, vtwm, xterm (though
note that at least xterm /can/ be configured to render text
on the client), use X over SSH. (Unless SSH overhead becomes
critical /and/ the communication is secured in some other manner.)

If you mostly want to use modern software (Darktable, Chromium,
Libreoffice, Merkaartor, that sort of thing) it's worth trying
VNC, which may happen to have less overhead in this case.

PS. Reading http://bugs.debian.org/947713 recently made me wonder,
yet again, if opting for a modern GUI toolkit for your
software is a perfectly valid choice, provided you're willing
to rewrite it from scratch every decade or so. (Conversely,
I don't suppose libXaw API has had major incompatible changes
since at least early 1990s?)

--
FSF associate member #7257 http://am-1.org/~ivan/

Thanks for all the replies everyone. That's a lot to read on.

Assuming I go the SSH route , I would need to make sure that the SSH daemon
runs on computer A. Does installing the correct package (it seems to be
openssh-server) make sure that the server gets started on boot or do I also
need to edit something in the start-up scripts ?

On 12 Jun 2023 09:38:19 +1000
not@telling.you.invalid (Computer Nerd Kev) wrote:
> Spiros Bousbouras <spibou@gmail.com> wrote:
> > I have 2 Linux computers connected to the same router through
> > ethernet cables. Computer A runs Devuan , computer B an older
> > version of Debian. I want to connect from B to A and execute
> > shell commands on A. X11 forwarding would be a plus.
> >
> > I assume that something SSH related is the right approach
>
> Without knowing how old your old version of Debian is and how long
> you intend to keep using it without upgrading, my recommendation
> would be to not use SSH because either now or later it will be
> unable to connect with the newer Devuan system because all the
> supported authentication or encryption systems will be depreciated
> in the newer software.

Debian 5. If there is no incompatibility issue now then one won't arise if I
don't upgrade the newer system. Whether I want to upgrade the older one
depends on how smoothly I can make things work with doing certain tasks on
computer A. Details on what "certain tasks" means would be too much of a
digression and in fact I don't even have a complete list myself.

> For this reason on my home LAN, which I know nobody is snooping
> on, I avoid SSH wherever possible and use Telnet instead (usually
> the GNU Inetutils implementation).

[ Snip useful information. ]

> > 2. What should I enter into which configuration files for A to
> > only accept connections from B ?
>
> With Telnet I think this would need to be done in firewall settings
> on the computers or a router.
>
> > 3. Can it be done safely without having to enter a password on
> > B when I want to connect to A ?
>
> If you care about this then perhaps Telnet isn't for you because
> "safely" probably means that you don't want plain-text passwords
> and anything else will mean raising version incompatibility
> problems with authentication systems such as are used by SSH.

Ideally , I don't want passwords at all , as I've said. But I think
I'm missing your point.

> If you want this, then you'll have to give up on the old Debian
> version either now or sometime later. If you're willing to compile
> newer versions of OpenSSH yourself then you might be able to delay
> this for many years though. Other options are setting up a
> physically secure network connection from the old Debian system to
> a newer computer, using SSH to connect to the newer system, which
> runs a script that connects to the older system via Telnet. The
> "newer computer" might even be a virtual machine running on the old
> system with the emulated network interface in Bridge mode so that
> it appears as a unique IP on your LAN.
>
> But life is much easier if you can trust that nobody is snooping on
> your LAN in the first place.

Ok , lets focus on whether I have a physically secure network connection
and whether anyone can snoop on my LAN. I'm not sure which are the
relevant factors but I will give some information which hopefully is
relevant. Noone but me has physical access to the 2 computers or the
router. The wireless signal on the router is turned off most of the time
but I turn it on occasionally. I believe the password for wireless
connection to be secure. I seed some torrents from computer B so the
router accepts connections for those. As I've said , computers A and B
would be connected through cable to the router. With that in mind ,
could an attacker connect to the router and intercept communications
between A and B ? Is the attack surface greater with wireless signal on ?

To return to what you say above :
> With Telnet I think this would need to be done in firewall settings
> on the computers or a router.

Perhaps I'm asking a very naive question but why is it not enough to
enter into some configuration file (whether one for telnet or SSH or
whatever) something which tells the relevant server "Only accept
connections coming from a computer which is physically connected to the
router through a cable" ? Can the router itself be tricked in that
regard ? Is there no standard way for the router to pass the information
to the computer accepting connections ? Is the point to defend from bugs
in the router software ?

--
vlaho.ninja/prog

On 12/06/2023 15:51, Spiros Bousbouras wrote:
> Thanks for all the replies everyone. That's a lot to read on.
>
> Assuming I go the SSH route , I would need to make sure that the SSH daemon
> runs on computer A. Does installing the correct package (it seems to be
> openssh-server) make sure that the server gets started on boot or do I also
> need to edit something in the start-up scripts ?
>
Unlesds yuou have a very weird package, itr will assume you want it to
start and stat every time the machine is booted

>> But life is much easier if you can trust that nobody is snooping on
>> your LAN in the first place.
>
> Ok , lets focus on whether I have a physically secure network connection
> and whether anyone can snoop on my LAN. I'm not sure which are the
> relevant factors but I will give some information which hopefully is
> relevant. Noone but me has physical access to the 2 computers or the
> router. The wireless signal on the router is turned off most of the time
> but I turn it on occasionally. I believe the password for wireless
> connection to be secure. I seed some torrents from computer B so the
> router accepts connections for those. As I've said , computers A and B
> would be connected through cable to the router. With that in mind ,
> could an attacker connect to the router and intercept communications
> between A and B ? Is the attack surface greater with wireless signal on ?
>
In theory anything is possible, In practice no.
Far easier to break into your home and installl some malware on your
computers.

> To return to what you say above :
>> With Telnet I think this would need to be done in firewall settings
>> on the computers or a router.
>
> Perhaps I'm asking a very naive question but why is it not enough to
> enter into some configuration file (whether one for telnet or SSH or
> whatever) something which tells the relevant server "Only accept
> connections coming from a computer which is physically connected to the
> router through a cable" ? Can the router itself be tricked in that
> regard ? Is there no standard way for the router to pass the information
> to the computer accepting connections ? Is the point to defend from bugs
> in the router software ?
>
In theory, no. In practice yes, as you can use the router to control the
IP address of the computers and use that as a proxy for how they are wired.

--
There is nothing a fleet of dispatchable nuclear power plants cannot do
that cannot be done worse and more expensively and with higher carbon
emissions and more adverse environmental impact by adding intermittent
renewable energy.

Spiros Bousbouras <spibou@gmail.com> wrote:
> Perhaps I'm asking a very naive question but why is it not enough to
> enter into some configuration file (whether one for telnet or SSH or
> whatever) something which tells the relevant server "Only accept
> connections coming from a computer which is physically connected to
> the router through a cable" ?

This is typically done by setting up a firewall rule. For your stated
"rule" above, and assuming by 'router' you actually mean one of those
boxes that is both a router and a 4-port ethernet switch combination
box, you would add a rule to the machine's firewall to only accept
packets with a source IP of the local LAN. Which is most likely a
/24, so X.Y.Z.??? where X.Y.Z are the first three octets of your LAN's
IP address range, and ??? is anything.

The exact way to formulate and install such a rule requires more
specifics than we are cognizant of over USENET.

On 2023-06-12 16:51, Spiros Bousbouras wrote:
> Thanks for all the replies everyone. That's a lot to read on.
>
> Assuming I go the SSH route , I would need to make sure that the SSH daemon
> runs on computer A. Does installing the correct package (it seems to be
> openssh-server) make sure that the server gets started on boot or do I also
> need to edit something in the start-up scripts ?

That's up to the distribution. For example, on openSUSE, no. I don't
know about Debian.

....

>> But life is much easier if you can trust that nobody is snooping on
>> your LAN in the first place.
>
> Ok , lets focus on whether I have a physically secure network connection
> and whether anyone can snoop on my LAN. I'm not sure which are the
> relevant factors but I will give some information which hopefully is
> relevant. Noone but me has physical access to the 2 computers or the
> router. The wireless signal on the router is turned off most of the time
> but I turn it on occasionally. I believe the password for wireless
> connection to be secure. I seed some torrents from computer B so the
> router accepts connections for those. As I've said , computers A and B
> would be connected through cable to the router. With that in mind ,
> could an attacker connect to the router and intercept communications
> between A and B ? Is the attack surface greater with wireless signal on ?

Using ssh and passwords, no, and no.

>
> To return to what you say above :
>> With Telnet I think this would need to be done in firewall settings
>> on the computers or a router.
>
> Perhaps I'm asking a very naive question but why is it not enough to
> enter into some configuration file (whether one for telnet or SSH or
> whatever) something which tells the relevant server "Only accept
> connections coming from a computer which is physically connected to the
> router through a cable" ? Can the router itself be tricked in that
> regard ? Is there no standard way for the router to pass the information
> to the computer accepting connections ? Is the point to defend from bugs
> in the router software ?

And how would it know?

You can limit connections to the IP range given by your router, but an
intruder might fake that.

There is no direct way to know if a connection comes from the WiFi. You
might tell the router to assign different IP numbers, but again, there
is no warranty.

--
Cheers, Carlos.

The Natural Philosopher <tnp@invalid.invalid> wrote:
> On 12/06/2023 00:38, Computer Nerd Kev wrote:
>>
>> Without knowing how old your old version of Debian is and how long
>> you intend to keep using it without upgrading, my recommendation
>> would be to not use SSH because either now or later it will be
>> unable to connect with the newer Devuan system because all the
>> supported authentication or encryption systems will be depreciated
>> in the newer software.
>>
> "deprecated"
>
> Like telnet is

No it isn't. Debian even has multiple implementations to choose
from as packages, and there's no indication that they're all going
to go away any time soon.

Using it over the internet certainly isn't recommended anymore, but
that's not what was being discussed.

--
__ __
#_ < |\| |< _#

Spiros Bousbouras <spibou@gmail.com> wrote:
> Thanks for all the replies everyone. That's a lot to read on.
>
> Assuming I go the SSH route , I would need to make sure that the SSH daemon
> runs on computer A. Does installing the correct package (it seems to be
> openssh-server) make sure that the server gets started on boot or do I also
> need to edit something in the start-up scripts ?

I think so. Check with "/etc/init.d/sshd status" to see if it's
running after a reboot.

> On 12 Jun 2023 09:38:19 +1000
> not@telling.you.invalid (Computer Nerd Kev) wrote:
>> Spiros Bousbouras <spibou@gmail.com> wrote:
>> > I have 2 Linux computers connected to the same router through
>> > ethernet cables. Computer A runs Devuan , computer B an older
>> > version of Debian. I want to connect from B to A and execute
>> > shell commands on A. X11 forwarding would be a plus.
>> >
>> > I assume that something SSH related is the right approach
>>
>> Without knowing how old your old version of Debian is and how long
>> you intend to keep using it without upgrading, my recommendation
>> would be to not use SSH because either now or later it will be
>> unable to connect with the newer Devuan system because all the
>> supported authentication or encryption systems will be depreciated
>> in the newer software.
>
> Debian 5. If there is no incompatibility issue now then one won't arise if I
> don't upgrade the newer system.

Sure.

>> > 3. Can it be done safely without having to enter a password on
>> > B when I want to connect to A ?
>>
>> If you care about this then perhaps Telnet isn't for you because
>> "safely" probably means that you don't want plain-text passwords
>> and anything else will mean raising version incompatibility
>> problems with authentication systems such as are used by SSH.
>
> Ideally , I don't want passwords at all , as I've said. But I think
> I'm missing your point.

Yeah, any secure passwordless authentication system has the same
issues as SSH. Telnet itself only supports not having any
authentication, or passwords. If only computer B can connect to A
over Telnet due to firewall settings then going without
authentication should be OK, but it's not necessarily "safe"
against all attacks. Probably safe against any attacks that you're
likely to experience in many cases though.

>> If you want this, then you'll have to give up on the old Debian
>> version either now or sometime later. If you're willing to compile
>> newer versions of OpenSSH yourself then you might be able to delay
>> this for many years though. Other options are setting up a
>> physically secure network connection from the old Debian system to
>> a newer computer, using SSH to connect to the newer system, which
>> runs a script that connects to the older system via Telnet. The
>> "newer computer" might even be a virtual machine running on the old
>> system with the emulated network interface in Bridge mode so that
>> it appears as a unique IP on your LAN.
>>
>> But life is much easier if you can trust that nobody is snooping on
>> your LAN in the first place.
>
> Ok , lets focus on whether I have a physically secure network connection
> and whether anyone can snoop on my LAN. I'm not sure which are the
> relevant factors but I will give some information which hopefully is
> relevant. Noone but me has physical access to the 2 computers or the
> router. The wireless signal on the router is turned off most of the time
> but I turn it on occasionally. I believe the password for wireless
> connection to be secure. I seed some torrents from computer B so the
> router accepts connections for those. As I've said , computers A and B
> would be connected through cable to the router. With that in mind ,
> could an attacker connect to the router and intercept communications
> between A and B ?

Not unless they've found an exploit that allows them to control the
router, in which case you potentially have a lot of other problems
too.

> Is the attack surface greater with wireless signal on ?

Yes but if you believe that the wireless is secure then it's not an
issue. Unless you're using an old encryption method for the
wireless network.

> To return to what you say above :
>> With Telnet I think this would need to be done in firewall settings
>> on the computers or a router.
>
> Perhaps I'm asking a very naive question but why is it not enough to
> enter into some configuration file (whether one for telnet or SSH or
> whatever) something which tells the relevant server "Only accept
> connections coming from a computer which is physically connected to the
> router through a cable" ?

You can, but it's your firewall's configuration that you need to
edit on the computer running the SSH server (or the router, as some
have suggested, but many cheap routers don't come with firewall
software). What/how you edit depends on the firewall you're
running. If you're not running one, then pick one and this should
be a basic thing described in its documentation.

> Can the router itself be tricked in that regard ?

Only if people can get onto your LAN. In which case odds are
they'll be more interested in stealing access to your internet
connection than hacking into your old Debian machine anyway.

> Is there no standard way for the router to pass the information
> to the computer accepting connections ? Is the point to defend
> from bugs in the router software ?

The firewall suggestion protects against potential devices on your
network that are already infected by some sort of malware. If the
router is infected then it won't help.

--
__ __
#_ < |\| |< _#

On Mon, 12 Jun 2023 10:53:44 +0200, Carlos E.R. wrote:
>
> On 2023-06-12 04:10, Andreas Kohlbach wrote:
>> On Sun, 11 Jun 2023 13:34:51 +0200, Carlos E.R. wrote:
>>>
>>> On 2023-06-11 12:47, The Natural Philosopher wrote:
>>>
>>>> I am not up to day on X fowarding, so I will pass on that. I believe
>>>> that too can pass over ssh.
>>>
>>> Yes.
>>>
>>> You do:
>>>
>>> ssh -X username@192.168.2.18
>> And add an app. Like
>> ssh -X username@192.168.2.18 firefox
>
> That can be done later, typing on the terminal, if you want.
>
> Notice, though, that firefox is "different" in this respect.

ssh -X 192.168.2.18

without an app should just drop you on a shell.

Suppose you could give an argument like "mate-session" to get into the
MATE GUI.
--
Andreas

Ivan Shmakov <ivan@siamics.netNOSPAM.invalid> writes:

> Now, I don't have any measurements to back this claim, but
> note that while /classic/ X software sends short commands
> to the X server (draw a line here, render a string there),
> /modern/ software mostly just pushes pre-rendered pixmaps

This is untrue. The GTK toolkit uses Cairo, which utilizes the X
rendering extension to composite trapezoids, glyphs and pictures.
Little if any rendering is done by the client itself.

> to the server. There, VNC protocol may have an advantage,
> as it's pretty much dedicated to shoving image data around,
> and does not support requests such as drawing polygons on
> the server, which modern software won't use anyway.

Only if you're using software that uses direct GL rendering. Most
software (both Qt and GTK+) makes ample use of the X rendering
extension.

> If you mostly want to use modern software (Darktable, Chromium,
> Libreoffice, Merkaartor, that sort of thing) it's worth trying
> VNC, which may happen to have less overhead in this case.

I don't know what Merkaartor is, but both Darktable (Qt) and Libreoffice
will use the X rendering extension.

not@telling.you.invalid (Computer Nerd Kev) writes:
> Spiros Bousbouras <spibou@gmail.com> wrote:
>> I have 2 Linux computers connected to the same router through
>> ethernet cables. Computer A runs Devuan , computer B an older version
>> of Debian. I want to connect from B to A and execute shell commands
>> on A. X11 forwarding would be a plus.
>>
>> I assume that something SSH related is the right approach
>
> Without knowing how old your old version of Debian is and how long you
> intend to keep using it without upgrading, my recommendation would be
> to not use SSH because either now or later it will be unable to
> connect with the newer Devuan system because all the supported
> authentication or encryption systems will be depreciated in the newer
> software.

Deprecated (sic) doesn’t mean disabled.

Eventually older ciphers do get disabled, for good reason. The sensible
thing to do at that point is upgrade the older endpoints, rather than
falling back to telnet.

--
https://www.greenend.org.uk/rjk/