Suggestions for remote admin of linux machines

Suggestions for remote admin of linux machines

Post by George Patto » Thu, 20 May 2004 01:00:41



I need to move some servers to an unattended location and haven't been
pleased with the methods for remote administration that have come to
mind so far:

Solution #1: XDMCP, pcanywhere, vnc, etc.  Problem:  An X-Server imposes
too much overhead given the limited capabilities of the machines
involved.  (No, I don't want to replace the machines with the latest and
greatest hardware :-)).

Solution #2: Serial console via cable and modem.  Problem: We have a
network interface but no spare phone line at the remote location.

Solution #3: KVM over IP.  Problem:  I've priced out KVM switches with a
network interface and they appear to be too expensive ($1500+).
Unaffordable in the case at hand.  For less money I could install a
multiport serial card on a machine running x-windows and use this to
control the machines via serial consoles.  Still a bit pricey however
because of limited sources for multiport serial cards.

All of these solutions are less than appealing.  Can someone recommend a
better method?  Or perhaps point me to an affordable source for KVM
switches with network interfaces?

 
 
 

Suggestions for remote admin of linux machines

Post by Dances With Crow » Thu, 20 May 2004 01:20:30


["Followup-To:" header set to comp.os.linux.misc.]
On Tue, 18 May 2004 11:00:41 -0500, George Patton staggered into the
Black Sun and said:

Quote:> I need to move some servers to an unattended location and haven't been
> pleased with the methods for remote administration that have come to
> mind so far:

> Solution #1: XDMCP, pcanywhere, vnc, etc.  Problem:  An X-Server
> imposes too much overhead

Keep in mind that VNC or X is not a complete "remote administration
solution".  You won't be able to get into the BIOS Setup, f'rexample.
If you don't *need* that capability, X or VNC would work fine, but you
need to be specific about your real needs.

Quote:> Solution #2: Serial console via cable and modem.  Problem: We have a
> network interface but no spare phone line at the remote location.

Same deal as VNC/X.

Quote:> Solution #3: KVM over IP.  Problem:  I've priced out KVM switches with
> a network interface and they appear to be too expensive ($1500+).

That might allow you to get into the BIOS Setup, but if it costs too
much, it costs too much.

Quote:> All of these solutions are less than appealing.  Can someone recommend
> a better method?

How about using ssh?  This will work very similarly to option 2, but you
won't need a phone line.  You won't be able to get into the BIOS Setup,
of course, and dealing with power failures/disk crashes at the remote
site may require a road trip (make sure you're using ext3 or ReiserFS,
so you'll have less chance of losing data) but it's something that's
easy to implement and secure.

--
Matt G|There is no Darkness in Eternity/But only Light too dim for us to see
Brainbench MVP for Linux Admin /    mail: TRAP + SPAN don't belong
http://www.brainbench.com     /                Hire me!
-----------------------------/ http://crow202.dyndns.org/~mhgraham/resume

 
 
 

Suggestions for remote admin of linux machines

Post by nob.. » Thu, 20 May 2004 01:27:01



: I need to move some servers to an unattended location and haven't been
: pleased with the methods for remote administration that have come to
: mind so far:

: Solution #1: XDMCP, pcanywhere, vnc, etc.  Problem:  An X-Server imposes
: Solution #2: Serial console via cable and modem.  Problem: We have a
: Solution #3: KVM over IP.  Problem:  I've priced out KVM switches with a

Am I missing something ? - what's wrong with basic terminal login
using SSH or the like?

Stan
--
Stan Bischof ("stan" at the below domain)
www.worldbadminton.com

 
 
 

Suggestions for remote admin of linux machines

Post by Dave Uhrin » Thu, 20 May 2004 01:44:55



> I need to move some servers to an unattended location and haven't been
> pleased with the methods for remote administration that have come to
> mind so far:

> Solution #1: XDMCP, pcanywhere, vnc, etc.  Problem:  An X-Server imposes
> too much overhead given the limited capabilities of the machines
> involved.  (No, I don't want to replace the machines with the latest and
> greatest hardware :-)).

I admin 8 servers located at a local ISP from my home and I don't need no
steeenking X to do it.  Why do you?  BTW, opening the X ports just
provides another avenue of attack from the script kiddiez.

Quote:> Solution #2: Serial console via cable and modem.  Problem: We have a
> network interface but no spare phone line at the remote location.

Then you do the job over the Internet.  Use ssh.

Set up the machines to reboot after a power outage, use journalling
filesystems on them and firewall them.

 
 
 

Suggestions for remote admin of linux machines

Post by Andy Frase » Thu, 20 May 2004 02:11:46


In comp.os.linux.misc, George Patton uttered these immortal words:

Quote:> I need to move some servers to an unattended location and haven't been
> pleased with the methods for remote administration that have come to
> mind so far:

Like most of the others said, use SSH. You might like to try Webmin over
HTTPS too or a combination the two.

--
Andy.

 
 
 

Suggestions for remote admin of linux machines

Post by Bill Unr » Thu, 20 May 2004 03:06:24


]I need to move some servers to an unattended location and haven't been
]pleased with the methods for remote administration that have come to
]mind so far:

I am confused. These machines have network connections you seem to say
below. So just do it, by command line and scripts, via the network. No
need for X, or pcanywhere or .... What kind of admin tasks?
The only problem is that the machines may need on site if they crash
(power failure, etc). YOu still cannot push the big red switch from a
remote location.

]Solution #1: XDMCP, pcanywhere, vnc, etc.  Problem:  An X-Server imposes
]too much overhead given the limited capabilities of the machines
]involved.  (No, I don't want to replace the machines with the latest and
]greatest hardware :-)).

]Solution #2: Serial console via cable and modem.  Problem: We have a
]network interface but no spare phone line at the remote location.

So, use the network!

]Solution #3: KVM over IP.  Problem:  I've priced out KVM switches with a

No idea what KVM is.
It depends on how much remote admin you want to do. IF you really want
to control the systems remotely as they boot up, then the network idea
above will not work. But neither would the modem idea since there has to
be something running on the machine to get at the modem. Xserver means
that the machine is already up and running.

]network interface and they appear to be too expensive ($1500+).
]Unaffordable in the case at hand.  For less money I could install a
]multiport serial card on a machine running x-windows and use this to
]control the machines via serial consoles.  Still a bit pricey however
]because of limited sources for multiport serial cards.

]All of these solutions are less than appealing.  Can someone recommend a
]better method?  Or perhaps point me to an affordable source for KVM
]switches with network interfaces?

Tell us what you want to be able to do via this "remote administration".

 
 
 

Suggestions for remote admin of linux machines

Post by Bob Hauc » Thu, 20 May 2004 02:32:10


On Tue, 18 May 2004 11:00:41 -0500, George Patton


> I need to move some servers to an unattended location and haven't been
> pleased with the methods for remote administration that have come to
> mind so far:

> Solution #1: XDMCP, pcanywhere, vnc, etc.  

Does PC Anywhere even have a Linux version?  If not, then that won't
work.  I wouldn't trust XDMCP over the Internet either.

It kind of sounds like you might think X works like the Windows GUI
where you somehow need to copy the display to the remote station.  It is
actually very different.  X is a client-server system that inherently
supports what you're trying to do.  The X server needs to be running on
the machine you sit in front of but not necessarily on the machine
running the app.  All that the remote machine needs is the X libraries
which are a lot "lighter" than the X server itself.

So my first suggestion would be SSH.  It gives you an encrypted command
line and you can also run X apps on the remote machine and forward the
display back to your workstation.  This is actually a lot easier than it
sounds, just a one-time setup.  You will need to run an X server on the
machine you're sitting in front of but there is no need at all for an X
server on the remote machine.

Your Linux distro probably already has SSH included.  If you will be
administering from Windows, I'd google for "Cygwin".  It provides an
Unix enviornment on top of Windows that includes an X server and SSH.
If you're using Linux or another Unix then all you need to do is install
SSH since you probably have an X server.

FWIW, another possibility would be something like Webmin.  That lets you
do many admin tasks using a web browser.  Don't forget to use https!

Finally, you really don't need all the "stuff".  Just a command line
running over SSH is quite sufficient once you learn the ropes.

Quote:> Solution #3: KVM over IP.  Problem:  I've priced out KVM switches with a
> network interface and they appear to be too expensive ($1500+).

Indeed.  That might be the only answer if you want to be able to change
BIOS settings and such.  Short of that it is probably overkill.

--
 -| Bob Hauck
 -| To Whom You Are Speaking
 -| http://www.haucks.org/

 
 
 

Suggestions for remote admin of linux machines

Post by Alan Conno » Thu, 20 May 2004 04:07:24




>: I need to move some servers to an unattended location and haven't been
>: pleased with the methods for remote administration that have come to
>: mind so far:

>: Solution #1: XDMCP, pcanywhere, vnc, etc.  Problem:  An X-Server imposes
>: Solution #2: Serial console via cable and modem.  Problem: We have a
>: Solution #3: KVM over IP.  Problem:  I've priced out KVM switches with a

> Am I missing something ? - what's wrong with basic terminal login
> using SSH or the like?

> Stan

I like good old telnet. There's a script on the servers that accesses a VERY long
list of names (runs as root).  The list is not sent over the internet, and
each name is used only once.

Each time I login I have to create a file with the current name within a few seconds
or it logs me out. Until that file is created, the shell is VERY restricted.

Ssh takes a lot of space and other system resources that I have better uses for.

AC

--
Pass-List -----> Block-List ----> Challenge-Response
The key to taking control of your mailbox.  Design Parameters:
http://tinyurl.com/2t5kp ||   http://tinyurl.com/3c3ag
Challenge-Response links -- http://tinyurl.com/yrfjb

 
 
 

Suggestions for remote admin of linux machines

Post by John-Paul Stewar » Thu, 20 May 2004 03:56:23




> ]I need to move some servers to an unattended location and haven't been
> ]pleased with the methods for remote administration that have come to
> ]mind so far:

> I am confused. These machines have network connections you seem to say
> below. So just do it, by command line and scripts, via the network. No
> need for X, or pcanywhere or .... What kind of admin tasks?
> The only problem is that the machines may need on site if they crash
> (power failure, etc). YOu still cannot push the big red switch from a
> remote location.

Not without special hardware.  APC make smart power switches that you
can telnet to and power cycle individual outlets remotely.  Some remote
administration tools (notably Sun's ALOM for their SPARC-based servers
and ERA from Dell, presumably Compaq and IBM have similar offerings for
their Intel-based servers) do actually allow remotely power cycling the
machine.

[snip]

Quote:> ]Solution #3: KVM over IP.  Problem:  I've priced out KVM switches with a

> No idea what KVM is.

KVM = Keyboard, Video, Mouse switch---a common method for using one
monitor/mouse/keyboard combination on several (local) systems.
 
 
 

Suggestions for remote admin of linux machines

Post by Michael Heimin » Thu, 20 May 2004 04:23:43


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NotDashEscaped: You need GnuPG to verify this message


Quote:> I need to move some servers to an unattended location and haven't been
> pleased with the methods for remote administration that have come to
> mind so far:

[..]

Quote:> All of these solutions are less than appealing.  Can someone recommend a
> better method?  Or perhaps point me to an affordable source for KVM
> switches with network interfaces?

As others already answered, you just need ssh, it can do
everything for you and more, while needing just one port. You can
forward X through the ssh tunnel if you want/need to run X apps
on the remote host.

Here's a good starting point:

http://www.openssh.org/faq.html

You probably don't even need to install sshd at all, it should be
installed per default on most Linux distro. Perhaps it is already
running? Just make sure there's a recent version/vendor update
installed.

There are windoze clients, if you are limited to some M$ desktop,
putty/winscp try a google search.

Good luck

--
Michael Heiming (GPG-Key ID: 0xEDD27B94)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFAqmK+AkPEju3Se5QRAmrUAJ0a31iqXqmLnPZ1ACEoGtirdFWoBACfawAw
Aam1zThMhh3onoLwgM32VTA=
=+M6E
-----END PGP SIGNATURE-----

 
 
 

Suggestions for remote admin of linux machines

Post by Michael Heimin » Thu, 20 May 2004 04:43:09


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NotDashEscaped: You need GnuPG to verify this message



> ]I need to move some servers to an unattended location and haven't been
> ]pleased with the methods for remote administration that have come to
> ]mind so far:
> I am confused. These machines have network connections you seem to say
> below. So just do it, by command line and scripts, via the network. No
> need for X, or pcanywhere or .... What kind of admin tasks?

Yep, ssh is all he needs.

Quote:> The only problem is that the machines may need on site if they crash
> (power failure, etc). YOu still cannot push the big red switch from a
> remote location.

Sure you can, it just depends on your hardware, there are various
vendors offering servers including such things. Allowing you to
completely power down/up a system remotely, *nix(tm) server have
this ability since decades. In absence of a graphic card, those
can be controlled via serial connection. You can use a
terminal-server or build your own, to concentrate those serial
connections and make them available on the network.

There are some add-on cards that make nearly the same possible:
http://www.realweasel.com/

--
Michael Heiming (GPG-Key ID: 0xEDD27B94)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFAqmdMAkPEju3Se5QRArFVAKDP4dFYSH6rB2nipowPj3BaYXQksACfYYM1
Ymupv9tCsTP6xtZOysmQjlA=
=7OHX
-----END PGP SIGNATURE-----

 
 
 

Suggestions for remote admin of linux machines

Post by Alan Conno » Thu, 20 May 2004 04:58:08



> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> NotDashEscaped: You need GnuPG to verify this message

Which almost NO ONE has.

And you KNOW that almost no one has it.

So what the HELL is the point?

The only person who ever forged your headers was someone
that you were abusing and harassing the hell out of.

As with me, you tried to bully them and they wouldn't back down.

<snip>

AC

 
 
 

Suggestions for remote admin of linux machines

Post by Kirk Strause » Thu, 20 May 2004 05:20:06


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Quote:> I like good old telnet.

All I know of is horrible old telnet.  Where do you get the good, encrypted
version?

Quote:> There's a script on the servers that accesses a VERY long list of names
> (runs as root).  The list is not sent over the internet, and each name is
> used only once.

Look for a Linux version of "opiekey" which generates one-time passwords.
Same idea, but more standardized and in widespread use on other system.

Quote:> Ssh takes a lot of space and other system resources that I have better
> uses for.

I'm running a giant make job on a remote machine, which is dumping tens of
thousands of lines over SSH to my local console, and `top' shows that ssh is
using less that 0.1% of my CPU.  Which resources does it use that you don't
have in abundance?
- --
Kirk Strauser
The Strauser Group
Open. Solutions. Simple.
http://www.strausergroup.com/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAqm/q5sRg+Y0CpvERAhTdAJ9jeH1ruNHl26++vg8Z8sgL15krLgCdFm5p
zKxTI5h8olXTywO6qtSns5M=
=xBga
-----END PGP SIGNATURE-----

 
 
 

Suggestions for remote admin of linux machines

Post by Michael Heimin » Thu, 20 May 2004 05:37:58


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NotDashEscaped: You need GnuPG to verify this message



>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>> NotDashEscaped: You need GnuPG to verify this message
> Which almost NO ONE has.

That you don't have it doesn't make your statement anymore true,
gpg comes with almost any distro and many popular newsreader can
make use of it, with just three clicks.

Just a few seconds using google and it looks like YOUR newsreader
slrn can use it perfectly:

[http://digilander.libero.it/ebassi/slrn/index.html#macros]

SLRN + GnuPG

SLRN + GnuPG is a macro that allows you to sign and verify Usenet
articles using GnuPG. It could also be used with PGP, although I
reccomend using GnuPG, since it's open and free (as in Free
Software).
[download] [code]

I'm sure you can get it working.

Quote:> And you KNOW that almost no one has it.
> So what the HELL is the point?
> The only person who ever forged your headers was someone
> that you were abusing and harassing the hell out of.

Alan, it doesn't matter how often you repeat that, it doesn't get
any more right. I can't remember "abusing and harassing the hell
out of" anyone.

My posts are perhaps not as polished, but that might be my
"style" and you can be lucky, it's not my native language.

I'm just helping others, as others help me, that's how
GNU/Linux/GPL works, it's as simple.;)

Quote:> As with me, you tried to bully them and they wouldn't back down.

?

Don't understand what you mean Alan, but then, I keep on reading
rants from you, as soon as I take you out of my kill-file and I'm
not really interested anymore in reading them.

--
Michael Heiming (GPG-Key ID: 0xEDD27B94)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFAqnQlAkPEju3Se5QRAi+5AJ9ZMLyYrxl0ZPhvlblW0qhiAWVguACdHA4c
iBi3cIqcMYmchN3qK01DN/k=
=iJru
-----END PGP SIGNATURE-----

 
 
 

Suggestions for remote admin of linux machines

Post by Christopher Brown » Thu, 20 May 2004 07:52:26



Quote:> I need to move some servers to an unattended location and haven't been
> pleased with the methods for remote administration that have come to
> mind so far:

> Solution #1: XDMCP, pcanywhere, vnc, etc.  Problem:  An X-Server
> imposes too much overhead given the limited capabilities of the
> machines involved.  (No, I don't want to replace the machines with the
> latest and greatest hardware :-)).

> Solution #2: Serial console via cable and modem.  Problem: We have a
> network interface but no spare phone line at the remote location.

> Solution #3: KVM over IP.  Problem:  I've priced out KVM switches with
> a network interface and they appear to be too expensive
> ($1500+). Unaffordable in the case at hand.  For less money I could
> install a multiport serial card on a machine running x-windows and use
> this to control the machines via serial consoles.  Still a bit pricey
> however because of limited sources for multiport serial cards.

> All of these solutions are less than appealing.  Can someone recommend
> a better method?  Or perhaps point me to an affordable source for KVM
> switches with network interfaces?

Solution #4:

98% of what you need to do you can do with an SSH connection, using
whatever kind of "network plumbing" you already have in the
environment.  It requires that there be an sshd server on each box
that accepts connections.

The other 2% is for those cases where you need to do hardware
reconfiguring that requires having access to BIOS.  To do that, you'd
need KVM over IP, and yes, that's likely to be pricey.

If you type "ssh -X", then that will try to export your local X
display connection across the wire so that you'll have something as
equivalent to VNC as you can get.  There is NO need to have an X
server running in the server environment.

Solution #5, which is relevant to "console" stuff on Real UNIX(tm)
system:

Modify #2 to have some sort of serial console server that connects to
IP.  That way, you telnet to the "console server" which then allows
you to hook up to the serial consoles.  No need for ANY phone line.
--

http://cbbrowne.com/info/lisp.html
"Bonus!  The lack of multitasking is one of the most important reasons
why DOS destroyed Unix in the marketplace." -- Scott Nudds

 
 
 

1. suggestions for terminal servers for remote admin?

Hi all,
        I'm needing to setup a terminal server so that I can remote
admin some solaris boxes and I'd like to know what terminal servers
people are using and what I should look out for.
        Idealy, it'd be accessible via an ip address and have about 8
ports that I can hook up to the sun console ports.
        Any suggestions are much appreciated.

-mark

2. SNMP manager

3. Remote Printing w/o Remote Machine - How do I do it?

4. problems with DNS Server(named) HELP ME OUT!!

5. Remote Printing w/o Remote Machine

6. collisions and dropped packets

7. My Solaris 2.8 machine resolves remote host names differently than my other UNIX machines

8. C Shell Scripts - files manipulation

9. How to specify different remote printers from single remote machine?

10. Setting up mail on a linux machine, with ml.org DNS ... any suggestions??

11. Any suggestions for a "dream" linux machine?

12. Installing Linux on dual boot 95/NT machine suggestions requested

13. Remote Admin of a Linux Box