<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
On 06/06/2024 11:07, Paul Gardiner wrote:<br>
<blockquote type="cite"
cite="mid:07dd3fb1-ca1a-4bef-888c-fbffc56b4006@glidos.net">On
06/06/2024 02:57, Mike Hodson wrote:
<br>
<blockquote type="cite">On Wed, Jun 5, 2024, 17:53 Paul Gardiner
<<a class="moz-txt-link-abbreviated" href="mailto:lists@glidos.net">lists@glidos.net</a> <a class="moz-txt-link-rfc2396E" href="mailto:lists@glidos.net"><mailto:lists@glidos.net></a>> wrote:
<br>
<br>
<br>
On 05/06/2024 22:21, James Linder wrote:
<br>
>
<br>
> Methinks a ssh tunnel is much easier.
<br>
> ssh -p 1234 -R 1200:localhost:6544 <a class="moz-txt-link-abbreviated" href="mailto:me@tigger.ws">me@tigger.ws</a>
<a class="moz-txt-link-rfc2396E" href="mailto:me@tigger.ws"><mailto:me@tigger.ws></a>
<br>
>
<br>
> Then <a class="moz-txt-link-freetext" href="http://localhost:1200">http://localhost:1200</a>
<a class="moz-txt-link-rfc2396E" href="http://localhost:1200"><http://localhost:1200></a>
<br>
<<a class="moz-txt-link-freetext" href="http://localhost:1200/">http://localhost:1200/</a>
<a class="moz-txt-link-rfc2396E" href="http://localhost:1200/"><http://localhost:1200/></a>>
<br>
>
<br>
> I believe putty can do port forwarding
<br>
<br>
That's a nice alternative, but I don't get how doing two
things on
<br>
every
<br>
use is easier than one. It's not like one has to configure
apache on
<br>
every use. If you're (say) in an internet cafe then that's
google putty
<br>
or plink, download it, then create your tunnel then open the
<br>
browser. Am
<br>
I missing something?
<br>
<br>
<br>
No, you're not missing anything in the actions involved, but
there is an unmentioned inherent risk of exposing 'too much' to
the public facing Internet.
<br>
<br>
There is also the implied 'single command that works most
places' vs 'setting up an entirely new service with the
configuration and maintenance required thereafter'
<br>
<br>
One could create a batch file / shell script that starts up the
SSH tunnel with a pubkey, and then launches the URL afterward.
<br>
<br>
<br>
If your proxy is secure, and you properly password protect it
and use SSL, you likely are secure enough, however having a
[presumably] battle-tested and secure SSH server open is a
potentially smaller ongoing risk/config/maintenance concern.
<br>
<br>
<br>
Then, there are VPN solutions like Zerotier and Tailscale that
provide a very simple to use and self-contained mesh network of
your hosts, no open ports needed. I use both myself on a daily
basis for work and personal uses.
<br>
<br>
<br>
Finally there is always the old standby of OpenVPN but I wager
it is potentially harder to get right than the entirety of other
software mentioned so far in this thread.
<br>
<br>
I'm a fan of keeping as few open ports as possible accessible to
the public. [And on Lumen/CenturyLink/QuantumFiber some of their
modems change IPs every 2 hours... So dynamic DNS would be
another concern in my case.
<br>
<br>
Lots of potentials here, and you've got a working setup.
Changing to another would be a question of risk presented now vs
time involved to switch to something different.
<br>
</blockquote>
<br>
I think that's a very nice overview of the issues. Certainly, I
would have given up on the apache proxy if SSL and password
protection had not been achievable. And for some, I agree the
ongoing maintenance could be a pain. For me, not so much because
that new conf file is a small increment to my existing config.
<br>
<br>
Paul.
</blockquote>
<br>
<p>There's then the further extension where you come in over
SSH-port-tunnel (or OpenVPN or Wireguard) and then have the apache
proxy with a separate password in the mix as well. Then you need
multiple levels of compromise before things are really at risk,
but it does depend on your level of paranoia!</p>
<p>If you haven't looked at Wireguard for secure remote access, then
it is relatively trivial to setup compared to OpenVPN and may be
worth a look, and a much more compact code base.</p>
<p><br>
</p>
<p>As an aside - I recently did a v0.30 to v0.32 to v0.34 ppa
upgrade along with an Ubuntu 18.04 LTS to 20.04 LTS to 22.04 LTS
upgrade. It went incredibly smoothly thanks to everyone's hard
work.</p>
<p>( Upgraded myth ppa on 18.04 as far as I could, did the 18.04 to
20.04 update. Upgraded myth ppa to the furthest I could.
Upgraded 20.04 to 22.04. Upgraded myth to the furthest I could.
I haven't yet done the 22.04 to 24.04 upgrade because of the
release driver for TBS6205 not supporting Ubuntu 24.04's 6.8.x
linux kernel just yet, though there are some relatively minor
patches to make it work in the pipeline.
<a class="moz-txt-link-freetext" href="https://github.com/tbsdtv/linux_media/issues/344">https://github.com/tbsdtv/linux_media/issues/344</a> )</p>
<p><br>
</p>
<p>Cheers,</p>
<p>Mark<br>
</p>
</body>
</html>