LinuxQuestions.org - Help a Newb.. allowing root to telnet and ftp in.

- Linux - General (https://www.linuxquestions.org/questions/linux-general-1/)

- - Help a Newb.. allowing root to telnet and ftp in. (https://www.linuxquestions.org/questions/linux-general-1/help-a-newb-allowing-root-to-telnet-and-ftp-in-41266/)

right ok, thanks a lot for your help btw, i really appreciate it :).

>How do you know? Can you access it via http if the webserver is running?

hmm, no? i started the httpd successfully, then on my windows box i tried http://myip and got page cannot be displayed? do i need to set up an index.html or anything or does this mean it is not working?

>Looks like you're using xinetd. It must be running.
>do a cat /etc/xinetd.d/* | grep -H 22

returned no results :(

>check to see if /etc/rc.d/init.d/sshd exists.

yep it does.

i also did nmap -sS localhost and it said ssh (and http) were open and listening.

so i assume that my linux box is not on the network? when you say not on the network, what exactly do you mean? it is connected to the internet, is that what u mean? my linux box is on a broadband connection, and the windows box is on a 56k connection.

any other suggestions?

damn dude get your own thread. No one is helping me anymore they are to busy helping you.

lol

jk

To come back at pico, you could also try nano, it's the one I use for console...

>hmm, no? i started the httpd successfully, then on my windows box i tried http://myip and got page cannot be displayed? do i need to set up an index.html or anything or does this mean it is not working?

Try to see if you can pull up your own homepage from the linux box. http://localhost and http://<your ip> in your location bar.

post output of
1) ps -axfw
2) netstat -na
3) cat /etc/ssh/sshd_config
4) /sbin/ifconfig eth0

>Looks like you're using xinetd. It must be running.
>do a cat /etc/xinetd.d/* | grep -H 22

returned no results :(

>check to see if /etc/rc.d/init.d/sshd exists.
do a /etc/rc.d/init.d/sshd reload
To make sure it picks up the latest config files. Or better, do a restart instead of a reload. (Well, if you cant hit your httpd, then there's no worries about ssh for the time being, but still)

>so i assume that my linux box is not on the network? when you say not on the network, what exactly do you mean? it is connected to the internet, is that what u mean? my linux box is on a broadband connection, and the windows box is on a 56k connection.

Yeah something like that. The more descriptive the better.
Are you trying to connect to your HOME broadband box from your HOME windows box ? Need to know this, so we can rule out a lot of things if you are.

ok, i cant get to my linux box until this evening, so the only question i can answer is :

>Yeah something like that. The more descriptive the better.
Are you trying to connect to your HOME broadband box from your HOME windows box ? Need to know this, so we can rule out a lot of things if you are.

yes i am. im trying to connect to my home broadband linux box from my home 56k windows98se box.

i will post the rest when i get to my linux box.
cheers again for helping :)

CHarlie

>Try to see if you can pull up your own homepage from the linux box. http://localhost and http://<your ip> in your location bar.

HTTPD - ran successfully, visited it from within my linux box and recieved the default webpage stating it has started/installed correctly.

here is the output of the 4 commands you requested. i was not sure what parts were important so i attached them all, which makes this a VERY large post, so i appologise. <myip> has been substituted in by me.

thanks a lot for help :)

1) ps -axfw

********************

PID TTY STAT TIME COMMAND
1 ? S 0:04 init [5]
2 ? SW 0:00 [keventd]
3 ? SW 0:00 [kapmd]
4 ? SWN 0:00 [ksoftirqd_CPU0]
5 ? SW 0:00 [kswapd]
6 ? SW 0:00 [bdflush]
7 ? SW 0:00 [kupdated]
8 ? SW 0:00 [mdrecoveryd]
12 ? SW 0:00 [kjournald]
67 ? SW 0:00 [khubd]
291 ? SW 0:00 [kjournald]
559 ? SW 0:00 [eth0]
612 ? S 0:00 /sbin/dhclient -1 -q -lf /var/lib/dhcp/dhclient-eth0.leases -pf /var/run/dhclient-eth0.pid -cf /etc/dhcli
661 ? S 0:00 syslogd -m 0
665 ? S 0:00 klogd -x
682 ? S 0:00 portmap
701 ? S 0:00 rpc.statd
781 ? S 0:00 /usr/sbin/apmd -p 10 -w 5 -W -P /etc/sysconfig/apm-scripts/apmscript
793 ? S 0:00 /usr/sbin/sshd
807 ? S 0:00 xinetd -stayalive -reuse -pidfile /var/run/xinetd.pid
822 ? S 0:00 lpd Waiting
833 ? S 0:00 gpm -t imps2 -m /dev/mouse
842 ? S 0:00 crond
875 ? S 0:00 xfs -droppriv -daemon
893 ? S 0:00 /usr/sbin/atd
904 ? S 0:00 rhnsd --interval 120
910 tty1 S 0:00 /sbin/mingetty tty1
911 tty2 S 0:00 /sbin/mingetty tty2
912 tty3 S 0:00 /sbin/mingetty tty3
913 tty4 S 0:00 /sbin/mingetty tty4
914 tty5 S 0:00 /sbin/mingetty tty5
915 tty6 S 0:00 /sbin/mingetty tty6
916 ? S 0:00 /usr/bin/gdm-binary -nodaemon
961 ? S 0:00 \_ /usr/bin/gdm-binary -nodaemon
962 ? S<L 0:17 \_ /usr/X11R6/bin/X :0 -auth /var/gdm/:0.Xauth
983 ? S 0:00 \_ /bin/sh /usr/bin/startkde
1026 ? S 0:00 \_ /usr/bin/ssh-agent /usr/share/apps/switchdesk/Xclients.kde
1099 ? S 0:00 \_ kwrapper ksmserver --restore
1069 ? S 0:00 kdeinit: Running...
1089 ? S 0:00 \_ /usr/bin/artsd -F 10 -S 4096 -s 60 -m artsmessage -l 3 -f
1102 ? S 0:02 \_ kdeinit: kwin -session 117f000001000104189231100000253540000
1108 ? S 0:00 \_ /usr/bin/autorun -l --interval=1000 --cdplayer=/usr/bin/kscd
1112 ? S 0:00 \_ /usr/bin/pam-panel-icon --sm-client-id 117f000001000104189231300000253540004
1117 ? S 0:00 | \_ /sbin/pam_timestamp_check -d root
1172 ? S 0:16 \_ /usr/lib/mozilla-1.0.1/mozilla-bin
1392 ? S 0:00 \_ kdeinit: konsole
1394 pts/1 S 0:00 \_ /bin/bash
1593 pts/1 S 0:00 \_ su -
1596 pts/1 S 0:00 \_ -bash
1636 pts/1 R 0:00 \_ ps -axfw
1072 ? S 0:00 kdeinit: dcopserver --nosid
1075 ? S 0:00 kdeinit: klauncher
1077 ? S 0:00 kdeinit: kded
1098 ? S 0:00 kdeinit: knotify
1101 ? S 0:00 kdeinit: ksmserver --restore
1104 ? S 0:00 kdeinit: kdesktop
1106 ? S 0:04 kdeinit: kicker
1139 ? S 0:00 \_ everybuddy
1111 ? S 0:00 kdeinit: kwrited
1121 ? S 0:00 kalarmd --login

********************

2) netstat -na

*********************

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:32768 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:32769 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:33282 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:515 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:6000 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 <myip>:32771 207.46.106.69:1863 ESTABLISHED
udp 0 0 0.0.0.0:32768 0.0.0.0:*
udp 0 0 <myip>:32770 205.188.153.97:4000 ESTABLISHED
udp 0 0 0.0.0.0:68 0.0.0.0:*
udp 0 0 0.0.0.0:111 0.0.0.0:*
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 1620 /dev/gpmctl
unix 2 [ ACC ] STREAM LISTENING 2289 /tmp/ksocket-Mark/kdeinit-:0
unix 2 [ ACC ] STREAM LISTENING 2316 /tmp/ksocket-Mark/klauncher24bFsc.slave-socket
unix 9 [ ] DGRAM 1087 /dev/log
unix 2 [ ACC ] STREAM LISTENING 1784 /tmp/.X11-unix/X0
unix 2 [ ACC ] STREAM LISTENING 2389 /tmp/mcop-Mark/charlie_localdomain-0441-3e245dc9
unix 2 [ ACC ] STREAM LISTENING 1583 /var/run/lprng
unix 2 [ ACC ] STREAM LISTENING 1775 /tmp/.gdm_socket
unix 2 [ ACC ] STREAM LISTENING 2722 /home/Mark/.everybuddy/eb_socket
unix 2 [ ACC ] STREAM LISTENING 1862 /tmp/ssh-XXN7tBMj/agent.983
unix 2 [ ACC ] STREAM LISTENING 2294 /tmp/.ICE-unix/dcop1072-1042570692
unix 2 [ ACC ] STREAM LISTENING 1659 /tmp/.font-unix/fs7100
unix 2 [ ACC ] STREAM LISTENING 2411 /tmp/.ICE-unix/1101
unix 3 [ ] STREAM CONNECTED 7638 /tmp/mcop-Mark/charlie_localdomain-0441-3e245dc9
unix 3 [ ] STREAM CONNECTED 7637
unix 3 [ ] STREAM CONNECTED 6180 /tmp/.ICE-unix/dcop1072-1042570692
unix 3 [ ] STREAM CONNECTED 6179
unix 3 [ ] STREAM CONNECTED 6176 /tmp/.ICE-unix/1101
unix 3 [ ] STREAM CONNECTED 6175
unix 3 [ ] STREAM CONNECTED 6173 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 6172
unix 3 [ ] STREAM CONNECTED 3325 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 3324
unix 3 [ ] STREAM CONNECTED 2718 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 2717
unix 3 [ ] STREAM CONNECTED 2558 /tmp/.ICE-unix/1101
unix 3 [ ] STREAM CONNECTED 2557
unix 3 [ ] STREAM CONNECTED 2555 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 2554
unix 3 [ ] STREAM CONNECTED 2538 /tmp/.ICE-unix/dcop1072-1042570692
unix 3 [ ] STREAM CONNECTED 2537
unix 3 [ ] STREAM CONNECTED 2503 /tmp/.ICE-unix/1101
unix 3 [ ] STREAM CONNECTED 2502
unix 3 [ ] STREAM CONNECTED 2495 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 2494
unix 3 [ ] STREAM CONNECTED 2488 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 2487
unix 3 [ ] STREAM CONNECTED 2484 /tmp/.ICE-unix/dcop1072-1042570692
unix 3 [ ] STREAM CONNECTED 2483
unix 3 [ ] STREAM CONNECTED 2467 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 2466
unix 3 [ ] STREAM CONNECTED 2462 /tmp/.ICE-unix/1101
unix 3 [ ] STREAM CONNECTED 2461
unix 3 [ ] STREAM CONNECTED 2457 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 2456
unix 3 [ ] STREAM CONNECTED 2454 /tmp/.ICE-unix/dcop1072-1042570692
unix 3 [ ] STREAM CONNECTED 2453
unix 3 [ ] STREAM CONNECTED 2444 /tmp/.ICE-unix/1101
unix 3 [ ] STREAM CONNECTED 2443
unix 3 [ ] STREAM CONNECTED 2439 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 2438
unix 3 [ ] STREAM CONNECTED 2437 /tmp/.ICE-unix/dcop1072-1042570692
unix 3 [ ] STREAM CONNECTED 2436
unix 3 [ ] STREAM CONNECTED 2425 /tmp/.ICE-unix/dcop1072-1042570692
unix 3 [ ] STREAM CONNECTED 2424
unix 3 [ ] STREAM CONNECTED 2419 /tmp/.ICE-unix/1101
unix 3 [ ] STREAM CONNECTED 2418
unix 3 [ ] STREAM CONNECTED 2416 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 2415
unix 3 [ ] STREAM CONNECTED 2410 /tmp/.ICE-unix/dcop1072-1042570692
unix 3 [ ] STREAM CONNECTED 2409
unix 3 [ ] STREAM CONNECTED 2406 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 2405
unix 3 [ ] STREAM CONNECTED 2399 /tmp/ksocket-Mark/kdeinit-:0
unix 3 [ ] STREAM CONNECTED 2398
unix 3 [ ] STREAM CONNECTED 2388 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 2387
unix 3 [ ] STREAM CONNECTED 2385 /tmp/.ICE-unix/dcop1072-1042570692
unix 3 [ ] STREAM CONNECTED 2384
unix 3 [ ] STREAM CONNECTED 2344 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 2343
unix 3 [ ] STREAM CONNECTED 2339 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 2338
unix 3 [ ] STREAM CONNECTED 2323 /tmp/.ICE-unix/dcop1072-1042570692
unix 3 [ ] STREAM CONNECTED 2322
unix 3 [ ] STREAM CONNECTED 2310 /tmp/.ICE-unix/dcop1072-1042570692
unix 3 [ ] STREAM CONNECTED 2309
unix 3 [ ] STREAM CONNECTED 2304
unix 3 [ ] STREAM CONNECTED 2303
unix 3 [ ] STREAM CONNECTED 1796 /tmp/.font-unix/fs7100
unix 3 [ ] STREAM CONNECTED 1795
unix 3 [ ] STREAM CONNECTED 1798 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 1787
unix 2 [ ] DGRAM 1713
unix 2 [ ] DGRAM 1662
unix 2 [ ] DGRAM 1619
unix 2 [ ] DGRAM 1542
unix 2 [ ] DGRAM 1301
unix 2 [ ] DGRAM 1147
unix 2 [ ] DGRAM 1095
unix 2 [ ] STREAM CONNECTED 1018

******************************8

3) cat /etc/ssh/sshd_config

*******************************

# $OpenBSD: sshd_config,v 1.56 2002/06/20 23:37:12 markus Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.

#Port 22
#Protocol 2,1
#ListenAddress 0.0.0.0
#ListenAddress ::

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 3600
#ServerKeyBits 768

# Logging
#obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

# Authentication:

#LoginGraceTime 600
#PermitRootLogin yes
#StrictModes yes

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys

# rhosts authentication should not be used
#RhostsAuthentication no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

#AFSTokenPassing no

# Kerberos TGT Passing only works with the AFS kaserver
#KerberosTgtPassing no

# Set this to 'yes' to enable PAM keyboard-interactive authentication
# Warning: enabling this may bypass the setting of 'PasswordAuthentication'
#PAMAuthenticationViaKbdInt yes

#X11Forwarding no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#KeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#Compression yes

#MaxStartups 10
# no default banner path
#Banner /some/path
#VerifyReverseMapping no

# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server

****************************

4) /sbin/ifconfig eth0

******************************
eth0 Link encap:Ethernet HWaddr 00:C1:26:11:28:78
inet addr:<myip> Bcast:255.255.255.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6241 errors:0 dropped:0 overruns:0 frame:0
TX packets:625 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:620501 (605.9 Kb) TX bytes:66035 (64.4 Kb)
Interrupt:5 Base address:0x1f00

*****************************

looks good. The ssh configuration needs to be tuned to make it more secure, or people will start banging your box and eventually succeed. We'll get to that.

If your box doesnt stay on all the time, make sure that httpd is running before you do this. Try to pull up http://<yourlinuxip> from your win box. And then do ssh <yourlinuxip>. What do you get?

If you are unable to connect in either case..
Do you use a local ISP? Do you know if they automatically firewall their broadband subscribers?

Ohh, I'm assuming that you have an ssh client installed. If not, telnet <yourlinuxip> 22 should suffice ( from a windows command prompt)

hi :)

>If your box doesnt stay on all the time, make sure that httpd is running before you do this. Try to pull up http://<yourlinuxip> from your win box. And then do ssh <yourlinuxip>. What do you get?

ok i enabled httpd, tried to access it from my windows box and i immediately got 'page cannot be displayed' error. i also tried accessing ssh thru telnet and after a while it said it couldnt connect to my linux box.

>Do you use a local ISP? Do you know if they automatically firewall their broadband subscribers?

i do use a local ISP. im certain that they dont automatically firewall their broadband subscribers because when i signed up they mentioned i should get a firewall. i cannot find anything indicating that they do it automatically.

once again thanks for the help thus far :) i really do appreciate it :)

Keep your linux box runing, make sure that the services you're trying to run are accessible from the console. And try to reach those services from somewhere else ( work/school maybe )
OR
Send me an email with your ip if that's okay with you. You may send me an email so it wont get displayed publicly.

And I'm assuming from our conversation that both boxes can actively use the internet ( ping google.com from both try to pull up google.com in both with the browser cache disabled ) but just cant see each other.

i have already tried accessing my linux box from school and it did not work, i dont know if this is because of the school network restrictions though.

both are connected to the internet :) i can ping my linux box from my windows box and get a result aswell.

i will PM u my ip. i think i can trust you ;) my ip gets changed pretty often aswell :)

**

i will email, urs pm's are off.

thanks for going 'above and beyond', you dont have to help me :)

I can ping your box. But cant access TCP ports 80 or 22. That could only mean your iptables filter is swallowing the packets destined to either port and possibly, most of the others.

post
/sbin/lsmod
/sbin/iptables -L INPUT

as root:
/sbin/iptables -A INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT

List rules again and post:
/sbin/iptables -L INPUT

Try to pull up http://<yourip> from work/school/homewinbox and see if that does it.

If not,
/etc/rc.d/init.d/iptables stop

Try again. Dont forget to start it back up after you're done.

See Netfilter howto or iptables howto. And man iptables.

>post
/sbin/lsmod
/sbin/iptables -L INPUT

****************
/sbin/lsmod
=========

Module Size Used by Tainted: P
nls_iso8859-1 3516 1 (autoclean)
sr_mod 18136 2 (autoclean)
emu10k1 68840 0 (autoclean)
ac97_codec 13384 0 (autoclean) [emu10k1]
sound 74228 0 (autoclean) [emu10k1]
soundcore 6500 7 (autoclean) [emu10k1 sound]
agpgart 42912 3 (autoclean)
nvidia 1592128 10 (autoclean)
parport_pc 19108 1 (autoclean)
lp 8996 0 (autoclean)
parport 37152 1 (autoclean) [parport_pc lp]
8139too 17704 1
mii 2156 0 [8139too]
ipt_REJECT 3736 2 (autoclean)
iptable_filter 2412 1 (autoclean)
ip_tables 14840 2 [ipt_REJECT iptable_filter]
ide-scsi 10512 1
scsi_mod 107176 2 [sr_mod ide-scsi]
ide-cd 33608 1
cdrom 33696 0 [sr_mod ide-cd]
usbnet 10842 0 (unused)
mousedev 5524 1
keybdev 2976 0 (unused)
hid 22244 0 (unused)
input 5888 0 [mousedev keybdev hid]
usb-uhci 26188 0 (unused)
usbcore 77056 1 [usbnet hid usb-uhci]
ext3 70400 2
jbd 52212 2 [ext3]

***********************
/sbin/iptables -L INPUT said i had to be root.
as root, i got:

************************
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Lokkit-0-50-INPUT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:http flags:SYN,RST,ACK/SYN
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh flags:SYN,RST,ACK/SYN

*********************

>as root:
/sbin/iptables -A INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT

neither gave any results.

>If not,
/etc/rc.d/init.d/iptables stop

bingo! it worked, i successfully connected to my sshd from my windows box. i assume that i have to edit the /etc/hosts.allow to allow connections to port 22? how do i make it so that port 22 isnt blocked? im about to go looking for instructions and check the man iptables too see if i can figure this out. i restarted iptables btw.

>The ssh configuration needs to be tuned to make it more secure, or people will start banging your box and eventually succeed. We'll get to that.

could you point me in the direction of some instructions on how to make my ssh configuration more secure?

i will post when i succeed with this iptables thing :)

thanks for your help :)

Originally posted by charlie123
>/sbin/iptables -L INPUT said i had to be root.
Indeed, they write into the kernel packet filtering table.
>neither gave any results.
they shouldn't.

>could you point me in the direction of some instructions on how to make my ssh configuration more secure?
See man pages for ssh_config and sshd_config. Turn off version 1 compatibility, password autentication, kerberos, PAMAuthenticationViaKBDInt etc. Basically everything but the public key, the idea being.. one more way to get to your system = one more way to hack your system. So keep only the bare essentials.

Generate a key pair from your ssh-client side ( PuTTY or cygwin on windows) and save the publickey as ~/.ssh/authorized_keys on your linuxbox. More keys may be appended to this file later on. Now all you need is your passphrase to connect to your box. Personally, I carry my key-pair in a floppy diskette along with putty tools, so I can access my home box from somewhere else if I needed to. Secure your private key using a passphrase. Use only the latest SSH server and client and be sure to upgrade your your SSL libraries. The old versions are rather perforated. Visit www.openssh.org and www.openssl.org resp for package downloads.

man iptables will drive you crazy if you dont know what you're doing. Be sure to go thru the following tutorials before you attempt reading the man page so it would make more sense.

http://www.netfilter.org/unreliable-...ltering-HOWTO/
http://www.netfilter.org/unreliable-...hacking-HOWTO/