Trick to create restricted linux user I can remotely control no matter where it connects

Question

Short version: I need to give my 4 yr old son a laptop so that he can skype with me from the other side of the globe. The only help I can expect from his legal guardian is turning the laptop on at the designated times and enter the wifi password. Thus, I need to be able to control the laptop remotely (specially to change the audio levels on the fly) but I cannot ask the other side to have a static IP or do anything fancy like opening port 22.

I am thinking of using Ubuntu Remote Control plus a small script that sends me the IP of the machine every X minutes. How to do it? Any better suggestion?

Long version: I live thousands miles away from my 4 yr old son. His mother starts the conferences at the designated times, but then she leaves the room and only very rarely comes back. Often my child hits some key accidentally and then he stops seeing me or I stop hearing him. Or the microphone gain is too low.

So I need to do the following in a laptop and send it to them, a laptop that would be used only for the telecoms: Creating a 4-yr-old-resistant user with no priviledges to do anything else than staring at the screen and speaking. I would need to have access to the computer remotely, to change mic and speaker levels on the fly, open and move skype windows, or even do more complex tasks as a software update.

My former wife will never do for me such a time-consuming thing as opening port 22 in her particular router model, so ssh is out of the menu. With Ubuntu it is allegedly easy to remotely control another desktop. The problem is, unless it had a static IP, it will not work

Answer 1

(Now I said this was too broad but here's one possible solution).

Have a server on the internet (eg a linode or similar) with a static IP address.

This server should be an openvpn server.

Your daughter's laptop should initiate an openvpn connection to this server. You can do this at boot time, even before she logs in.

You can configure openvpn so her VPN'd IP address is always 192.100.100.10

You can have your machine also VPN as 192.100.100.20

Now from your machine you can ssh 192.100.100.10 and have command line access to her machine and change settings (patch, change volume, microphone, etc).

Answer 2

Another solution would be to use SSH tunneling.

Just like Stephen Harris, I'm a great fan of linode so let's also assume that you have a server on the internet there with a public static IP. (although any server from any provider will do).

On the server you create a private-public key pair with ssh-keygen and append the public key to the authorized_hosts file, e.g.

ssh-keygen -f ~/.ssh/daughters-laptop -N ""
cat ~/.ssh/daughters-laptop.pub >> ~/.ssh/authorized_hosts

Copy the private (~/.ssh/daughters-laptop) to the laptop. And ensure that the laptop performs two things at boot:

• Starts sshd (systemctl enable sshd on most today's systems)

• Runs ssh -R localhost:6667:localhost:22 -i /path/to/private/key/daughters-laptop user@server (most systems allow that to be done in /etc/rc.local)

Now, to login to the laptop you just need to login to the server and then perform:

ssh -p 6667 user_at_laptop@localhost

Notes:

• You need to login to the laptop as the same user as your daughter (or be able to su to it), otherwise Xorg permission madness ensures.

• You may setup a second pair of keys (or reuse the same ones) to facilitate the login into the laptop.

• Protect the private keys! You just created a backdoor on a laptop used by your child, anyone with that key can login to it. A key produced with -N "" is in clear text.