Commit dbbce126 authored by Yvan Masson's avatar Yvan Masson
Browse files

Many important and minor fixes

README.md:
- rewrite Debian packaging to keep everything in one directory
- add a FAQ
- uniformize "license" writting
- various minor changes and improvements

Linux-client/linux-client:
- fix public key filename
- use dummy UserKnownHostsFile to make it work even when server changes key
- remove x11vnc's ncache option which is already the default
parent 446c80b2
......@@ -43,7 +43,15 @@ if [ $? != 0 ]; then exit; fi
# SSH connection
################
export SSHPASS="$pwd"
sshpass -e ssh -o "GlobalKnownHostsFile=/usr/share/$debian_package_name/ssh_known_hosts" -p "$ssh_port" -T -N -R \*:"$vnc_port":localhost:"$vnc_port" "$remote_user"@"$server" &
# We use dummy UserKnownHostsFile to avoid remembering of server's SSH key: if
# the server had a new public key, ssh client would complain that key in
# GlobalKnownHostsFile and UserKnownHostsFile are different.
sshpass -e ssh \
-o "GlobalKnownHostsFile=/usr/share/$debian_package_name/ssh-server-public-key" \
-o "UserKnownHostsFile=/dev/null" \
-p "$ssh_port" -T -N \
-R \*:"$vnc_port":localhost:"$vnc_port" \
"$remote_user"@"$server" &
sshpass_pid=$!
yad \
......@@ -77,7 +85,7 @@ fi
#####################
# Starting VNC server
#####################
x11vnc -localhost -forever -ncache 10 2> "$vnc_error_file" &
x11vnc -localhost -forever 2> "$vnc_error_file" &
x11vnc_pid=$!
yad \
--title "$window_title" \
......
......@@ -11,7 +11,7 @@ vnc_port="5900"
# main icon name, or empty quotes ("") if you do not want an icon
icon="my-remote-help"
# icon that appears when an error is detected
# icon that appears when an error is detected
error_icon="dialog-warning"
# title that appear on every windows
......@@ -23,7 +23,7 @@ initial_button="Validate"
initial_msg="To get help:
- give me a phone call so that I give you a password
- type this password in the box
- click on $initial_button to initiate connection"
- click on \"$initial_button\" to initiate connection"
# first window entry label
initial_msg_pwd="password:"
......
......@@ -53,7 +53,7 @@ submit pull requests!
- [Desktop entry](#desktop-entry)
- [Software, strings and parameters](#software-strings-and-parameters)
- [Intermediate server's SSH public key](#intermediate-servers-ssh-public-key)
- [Building the Debian and derivatives package](#building-the-debian-and-derivatives-package)
- [First build of the Debian and derivatives package](#first-build-of-the-debian-and-derivatives-package)
- [Update the Debian and derivatives package](#update-the-debian-and-derivatives-package)
- [When you need to fix packaging](#when-you-need-to-fix-packaging)
- [For everything else](#for-everything-else)
......@@ -66,9 +66,12 @@ submit pull requests!
- [license](#license)
- [Software icon](#software-icon-1)
- [Building with InnoSetup](#building-with-innosetup)
- [Build a new client version](#build-a-new-client-version)
- [Building a new client version](#building-a-new-client-version)
- [Usage](#usage)
- [Release policy](#release-policy)
- [Frequently asked questions](#frequently-asked-questions)
- [Icon is not displayed when running the Linux client](icon-is-not-displayed-when-running-the-Linux-client)
- [How to run the VNC client on your computer and not on the server](how-to-run-the-VNC-client-on-your-computer-and-not-on-the-server)
- [License](#license)
......@@ -104,7 +107,7 @@ Download all the files so that you can work easily on them, for example with
Git:
```
$ cd ~ && git clone https://framagit.org/Yvan-Masson/RemoteHelpBuilder
$ cd ~ && git clone https://framagit.org/Yvan-Masson/RemoteHelpBuilder.git
```
......@@ -130,14 +133,14 @@ him from doing anything else. Add the following section in
```
Match User remote-help
AllowAgentForwarding no
AllowTcpForwarding yes
AuthenticationMethods "password"
ForceCommand echo 'This account can only be used for VNC port forwarding'
PermitOpen localhost:5900
PermitTunnel no
PermitTTY no
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding yes
AuthenticationMethods "password"
ForceCommand echo 'This account can only be used for VNC port forwarding'
PermitOpen localhost:5900
PermitTunnel no
PermitTTY no
X11Forwarding no
```
Optionnaly, you can change in the above file the port OpenSSH listens on (some
......@@ -232,8 +235,8 @@ that provides it:
As always, making things securely is a complicated task. Even if the helper and
the helped will be able to mutually authenticate themselves by a phone call when
transmitting the one-time password, it can be a good thing for the helped to
also authenticate the SSH server with its public key.
transmitting the one-time password, it can be a good thing for the client
software to also authenticate the SSH server with its public key.
Your server probably provides different signature algorithms, and corresponding
public and private keys are stored in `/etc/ssh/ssh_host_*` files. To simplify
......@@ -245,8 +248,8 @@ However, ed25519 public key is easier to get from Windows.
Practically, this means you will have to keep a backup of the public and
corresponding private key in case of a disaster, failing that you would have to
make a new release of the Windows and Linux client with including a new public
key. As we use ed25519, backup `/etc/ssh/ssh_host_ed25519_key` and
make a new release of the Windows and Linux client including the new public key.
As we use ed25519, backup `/etc/ssh/ssh_host_ed25519_key` and
`/etc/ssh/ssh_host_ed25519_key.pub` and keep it in a secure place.
Then, you have to get the server's public key in a format that the SSH client
......@@ -271,6 +274,7 @@ new RemoteHelpBuilder's version is published, the version would be `2.2`.
You first need to choose a custom and unique software name, so that the helped:
- understands that only you can make use of this tool to help him,
- can eventually install more than one software like yours.
This documentation assumes that this name is "My remote help tool". Replace it
with the name you chose everytime you see it in this documentation.
......@@ -303,7 +307,7 @@ You can provide one or many sizes so that the desktop environment can pick the
best size for the user. You can have a look at what sizes and formats are
usually provided on Debian and derivatives by looking in `/usr/share/icons/`. If
you target Gnome, you should probably read the
[Gnome guidelines](https://developer.gnome.org/hig/3.32/icons-and-artwork.html.en)
[Gnome guidelines](https://developer.gnome.org/hig/3.32/icons-and-artwork.html.en).
If you want to provide an icon, you can put it in the following layout depending
on the sizes:
......@@ -357,7 +361,8 @@ if you have any question regarding this file.
### Software, strings and parameters
First copy the client software/script to include it in your upstream release:
First copy the client software/script to include it in your upstream release
(remember to replace `my-remote-help-tool` by the name you chose previously):
```
cp ~/RemoteHelpBuilder/Linux-client/linux-client ~/my-remote-help-tool/my-remote-help-tool
......@@ -380,17 +385,17 @@ Ensure these two files have execute rights.
### Intermediate server's SSH public key
As said earlier, we also include the server's public key, ed25519 in this
document. In the following command, be sure to use the IP address of you server
example. In the following command, be sure to use the IP address of you server
or its FQDN exactly the same way that you wrote it in
`~/my-remote-help-tool/linux-strings.sh` (otherwise the client will not use it):
```
$ ssh-keyscan -t ed25519 <you server's IP address or FQDN> > ~/my-remote-help-tool/ssh-server-public-key
$ ssh-keyscan -t ed25519 <you server's FQDN or IP address> > ~/my-remote-help-tool/ssh-server-public-key
```
If you changed the port SSH listens on, use the `-p` option.
For more information on this file formate see `SSH_KNOWN_HOSTS FILE FORMAT`
For more information on this file format see `SSH_KNOWN_HOSTS FILE FORMAT`
section in `man 8 sshd`.
......@@ -411,28 +416,26 @@ made easier by using tools from `dh_make` and `devscripts`:
# apt install build-essential dh_make devscripts
```
First make a copy of your source directory `~/my-remote-help-tool/` to include
the version number. This "simulates" an upstream release. The first time you
build your package, you will probably do:
Go inside `~/my-remote-help-tool/` and generate all files needed for proper
packaging. Modify the following command to match:
* your name/company
* your package name (still "my-remote-help-tool" in our example)
* the "upstream" version number (for example "1.1" if RemoteHelpBuilder is in
version 1 and if you publish it for the first time)
* your email address
```
$ cp -r ~/my-remote-help-tool/ ~/my-remote-help-tool-1.1/
```
Go inside this directory and generate all files needed for proper packaging
(replace the content in brackets to match your name/company and e-mail):
```
cd ~/my-remote-help-tool-1.1 && \
cd ~/my-remote-help-tool/ && \
DEBFULLNAME="<your name>" dh_make \
--packagename my-remote-help-tool_<upstream version> \
--copyright gpl3 \
--email <your email address> \
--indep
--createorig
```
Many useless files have been created in the `debian/` subdirectory, so we delete
them:
Many files useless for this simple package have been created in the `debian/`
subdirectory, so we delete them:
```
$ cd debian && rm manpage.* menu.ex postinst.ex postrm.ex preinst.ex prerm.ex README.Debian README.source *.cron.d.ex *.doc-base.EX *-docs.docs watch.ex
......@@ -442,9 +445,10 @@ You now need to edit some of the remaining files:
* `changelog`: modify the changelog of the initial release
* `compat`: do not modify
* `control`: edit homepage, description and add the following dependencies
instead of `${misc:Depends}`:
`Depends: openssh-client, sshpass, x11vnc, yad, gnome-icon-theme`
* `control`:
* edit homepage and description (each line of the long description must begin
with a space)
* replace line `Depends: ${misc:Depends}` by `Depends: openssh-client, sshpass, x11vnc, yad, gnome-icon-theme`
* `copyright`: add the source and copyright for all the files (normally you
would have to give credits to this project: this is great if you do so, but
currently I do not require it)
......@@ -452,12 +456,13 @@ You now need to edit some of the remaining files:
* `source/format`: do not modify
Still in the new `debian/` subdirectory, create a file called
`my-remote-help-tool.install` that defines where all files must be installed to:
`my-remote-help-tool.install` that defines where all files must be installed to.
Do not forget to modify it:
```
my-remote-help-tool usr/bin/
my-remote-help-tool.desktop usr/share/applications/
my-remote-help-tool.strings usr/share/my-remote-help-tool/
variables usr/share/my-remote-help-tool/
ssh-server-public-key usr/share/my-remote-help-tool/
icons/48x48/my-remote-help-tool.png usr/share/icons/hicolor/48x48/apps/
icons/128x128/my-remote-help-tool.png usr/share/icons/hicolor/128x128/apps/
......@@ -466,41 +471,37 @@ icons/512x512/my-remote-help-tool.png usr/share/icons/hicolor/512x512/apps
icons/scalable/my-remote-help-tool.svgz usr/share/icons/hicolor/scalable/apps/
```
Finaly, go back to `~/my-remote-help-tool-1.1/` and build the package:
Finaly, go back to `~/my-remote-help-tool/` and build the package:
```
$ dpkg-buildpackage --unsigned-source --unsigned-changes
```
Resulting package and associated files (useless for us) ar created in the parent
directory. Just test it and you are now ready to help Debian and derivatives
users!
Resulting package and associated files (useless for us) are created in the
parent directory. Just test it and you are now ready to help Debian and
derivatives users!
Be carefull to keep/backup `~/my-remote-help-tool-1.1/`: you will use it if you
need to build a new version of you package.
Note: If your icon does not appear when running the client, see
(this entry)[#icon-is-not-displayed-when-running-the-linux-client] of the FAQ.
## Updating the Debian and derivatives package
### When you need to fix packaging
If you change any file in `~/my-remote-help-tool-<some_version>/debian` you need
to rebuild the package.
`cd` into the last 'upstream release' directory, for example
`~/my-remote-help-tool-1.1/`.
Edit the changelog (`--no-auto-nmu` ensure a proper version number even if the
email or full name are different from previous release):
If you change any file in `~/my-remote-help-tool/debian` you need to rebuild the
package. `cd` into `~/my-remote-help-tool/` and use the following command to
edit the changelog. Be careful to increment the Debian revision (the number
after the `-`), `1.1-2` in this example:
```
$ DEBFULLNAME=<your name> DEBEMAIL=<your email> debchange --no-auto-nmu --rebuild
$ DEBFULLNAME=<your name> DEBEMAIL=<your email> debchange --newversion 1.1-2 --preserve
```
Finalize the changelog:
```
$ DEBFULLNAME=<your name> DEBEMAIL=<your email> debchange --no-auto-nmu --release ""
$ DEBFULLNAME=<your name> DEBEMAIL=<your email> debchange --release ""
```
And rebuild the package:
......@@ -516,26 +517,32 @@ When there is a new version of RemoteHelpBuilder that you want to use, or if you
need to change one of your files (`variables`, `ssh-server-public-key` or
`my-remote-help-tool.desktop`), you will have to build a new package.
Copy the directory of the last 'upstream version' and increment the version, for
example:
Make the changes in `~/my-remote-help-tool/`. Do not forget to adapt
`~/my-remote-help-tool/debian/` files if needed.
Define what will be the new version number of your package:
- If you include some RemoteHelpBuilder changes, increase the first number,
- If you modify one of your files, increase the second number,
- In all cases, reset the Debian revision to `1`.
Edit the changelog, specifying the version (`1.2-1` in this example):
```
cp -r ~/my-remote-help-tool-1.1 ~/my-remote-help-tool-1.2
$ DEBFULLNAME=<your name> DEBEMAIL=<your email> debchange --newversion 1.2-1 --preserve
```
Apply the changes in this new directory (new variables files for example). Do
not forget to adapt `~/my-remote-help-tool-1.2/debian/` files if needed.
Inside this new directory, edit the changelog:
Finalize the changelog:
```
$ DEBFULLNAME=<your name> DEBEMAIL=<your email> debchange --from-dir-name
$ DEBFULLNAME=<your name> DEBEMAIL=<your email> debchange --release ""
```
Finalize the changelog:
Create a tarball to simulate the upstream release (otherwise dpkg-buildpackage
will not work), with a filename ending with `_<version>.orig.tar.gz` (note that
the version must not include the Debian revision):
```
$ DEBFULLNAME=<your name> DEBEMAIL=<your email> debchange --no-auto-nmu --release ""
$ tar -caf my-remote-help-tool_1.2.orig.tar.gz .
```
And rebuild the package:
......@@ -554,9 +561,9 @@ $ dpkg-buildpackage --unsigned-source --unsigned-changes
This requires the use of a Windows computer.
Create a directory that will contain all your custom files in it. It is easier
to use the "computer friendly" name chosen above, so in this documentation we
will use `my-remote-help-tool\`. It is advised that you create it in a VCS to
keep track of your changes.
to use your "computer friendly" software name chosen above, so in this
documentation we will use `my-remote-help-tool\`. It is advised that you create
it in a VCS to keep track of your changes.
Also, ensure you have access to files inside the `Windows-client` directory of
RemoteHelpBuilder.
......@@ -615,7 +622,7 @@ Linux using Wine), run:
plink.exe -v -batch -P <ssh port> <FQDN or IP address>>
```
The variable that will be used just after is the like that looks like
The variable that will be used is the line that looks like
`ssh-ed25519 255 e5:32:8f:c3:fb:c6:e3:6e:8a:45:78:dc:d8:5c:84:03`.
If you chose a signature algorithm other than ed25519, like RSA, you can get the
......@@ -707,10 +714,38 @@ Windows or Linux client (except when modification is only on examples, comments
or formatting). No release is published when documentation is modified.
# license
# Frequently asked questions
## Icon is not displayed when running the Linux client
If your home directory contains a directory with the exact same name of
your icon, your icon will not appear where running the client software: this is
because the prompt is done with Yad, which uses GTK, which tries to use the
folder as the icon.
## How to run the VNC client on your computer and not on the server
By default, OpenSSH server does not expose on the network the ports forwarded by
clients. This is very good thing! If you want to be able to run the VNC client
on your computer and not on the server, you need to add the following line in
`/etc/ssh/sshd_config`:
```
Match User remote-help
GatewayPorts yes
```
Warning: As there is no VNC password, be very careful to properly restrict
access to TCP port 5900 on your server. If you do not know how to do this, do
not use this setting!
# License
Copyright (C) 2019 Yvan Masson
https://masson-informatique.fr
Copyright (C) 2019 Yvan Masson, https://masson-informatique.fr,
yvan@masson-informatique.fr
This program is free software: you can redistribute it and/or modify
......
This software uses files from different softwares and under different licences
and copyright (following files paths refer to the installation directory):
- PuTTY, under the MIT licence. Files are located under "PuTTY\" directory,
and full licence and copyright in "PuTTY\LICENCE"
- UltraVNC, under the GPL version 2 or higher. Files are located under
"UltraVNC\, and full licence and copyright in "UltraVNC\Readme.txt"
- RemoteHelpBuilder, under the GPL version 3. File is "RemoteHelp.vbs" and
includes copyright information.
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment