3

Short version: I need to give my 4 yr old son a laptop so that he can skype with me from the other side of the globe. The only help I can expect from his legal guardian is turning the laptop on at the designated times and enter the wifi password. Thus, I need to be able to control the laptop remotely (specially to change the audio levels on the fly) but I cannot ask the other side to have a static IP or do anything fancy like opening port 22.

I am thinking of using Ubuntu Remote Control plus a small script that sends me the IP of the machine every X minutes. How to do it? Any better suggestion?

Long version: I live thousands miles away from my 4 yr old son. His mother starts the conferences at the designated times, but then she leaves the room and only very rarely comes back. Often my child hits some key accidentally and then he stops seeing me or I stop hearing him. Or the microphone gain is too low.

So I need to do the following in a laptop and send it to them, a laptop that would be used only for the telecoms: Creating a 4-yr-old-resistant user with no priviledges to do anything else than staring at the screen and speaking. I would need to have access to the computer remotely, to change mic and speaker levels on the fly, open and move skype windows, or even do more complex tasks as a software update.

My former wife will never do for me such a time-consuming thing as opening port 22 in her particular router model, so ssh is out of the menu. With Ubuntu it is allegedly easy to remotely control another desktop. The problem is, unless it had a static IP, it will not work

  • I'm sorry to vote this "too broad" because there are a tonne of answers, but it depends on your setup. For example, you could have her machine setup on openvpn connection back to you (assuming you have a static IP, or pay for a virtual server). Now you know she's always on a VPN-based static IP regardless of the public one. But there are also remote control apps via middleware gateway providers... lots of solutions. – Stephen Harris Aug 27 '16 at 1:13
  • Your child's computer would need to either be connected to an online service (possibly a VPN like Stephen mentions) or a port would have to be opened on the router. – Julie Pelletier Aug 27 '16 at 1:40
  • 1
    i did something like this once. i configured the laptop to ssh to an instance i had running in AWS free tier with a reverse channel to local ssh listening only for 127.0.0.1 connections. when both hosts connected to the free (for one year) server, the path was complete. – Skaperen Aug 27 '16 at 4:22
  • @Skaperen That seems easy. Please could you expand it a little bit? – Mephisto Sep 3 '16 at 17:07
  • What about "my idea is to include a script that sends me an email every X minutes with the IP of the machine, so that I can use it to connect (hopefully) and speak with my daughter untill the next dynnamic IP is assigned." ? – Mephisto Sep 3 '16 at 17:08
4

(Now I said this was too broad but here's one possible solution).

Have a server on the internet (eg a linode or similar) with a static IP address.

This server should be an openvpn server.

Your daughter's laptop should initiate an openvpn connection to this server. You can do this at boot time, even before she logs in.

You can configure openvpn so her VPN'd IP address is always 192.100.100.10

You can have your machine also VPN as 192.100.100.20

Now from your machine you can ssh 192.100.100.10 and have command line access to her machine and change settings (patch, change volume, microphone, etc).

  • @grochmal Yes; ssh tunneling with also work for a limited number of ports (and pre-shared secrets and a very restricted shell on the central server). A VPN connection would allow additional controls such as VNC for correctly set up laptops and doesn't require specific ports to be known. Both solutions can be made to work. That's why I called it a solution and flagged it "too broad". – Stephen Harris Aug 27 '16 at 1:54
  • @grochmal I'd recommend you writing out an answer along these lines, so the OP has some more detailed options. It's a viable solution to his question. – Stephen Harris Aug 27 '16 at 2:07
  • Good point, comment removed and answer added. – grochmal Aug 27 '16 at 2:43
  • I need more explanations on "have a server on the internet" – Mephisto Sep 3 '16 at 17:09
3

Another solution would be to use SSH tunneling.

Just like Stephen Harris, I'm a great fan of linode so let's also assume that you have a server on the internet there with a public static IP. (although any server from any provider will do).

On the server you create a private-public key pair with ssh-keygen and append the public key to the authorized_hosts file, e.g.

ssh-keygen -f ~/.ssh/daughters-laptop -N ""
cat ~/.ssh/daughters-laptop.pub >> ~/.ssh/authorized_hosts

Copy the private (~/.ssh/daughters-laptop) to the laptop. And ensure that the laptop performs two things at boot:

  • Starts sshd (systemctl enable sshd on most today's systems)

  • Runs ssh -R localhost:6667:localhost:22 -i /path/to/private/key/daughters-laptop user@server (most systems allow that to be done in /etc/rc.local)

Now, to login to the laptop you just need to login to the server and then perform:

ssh -p 6667 user_at_laptop@localhost

Notes:

  • You need to login to the laptop as the same user as your daughter (or be able to su to it), otherwise Xorg permission madness ensures.

  • You may setup a second pair of keys (or reuse the same ones) to facilitate the login into the laptop.

  • Protect the private keys! You just created a backdoor on a laptop used by your child, anyone with that key can login to it. A key produced with -N "" is in clear text.

  • This is good, but there's a gotcha... the remote end is a 4 yr old, so it's probable that the private key should be generated without a passphrase (-N "") and the the remote end needs to automate the ssh connection. We can't expect a 4 yr old to initiate a connection :-) – Stephen Harris Aug 27 '16 at 3:10
  • @StephenHarris - Eyuup, updated the answer. I was thinking of a key without a passphrase, I do not know why I did not write it down. – grochmal Aug 27 '16 at 3:29
  • This is why we have multiple people reviewing answers :-) – Stephen Harris Aug 27 '16 at 3:32
  • 1
    @Mephisto - Really, the simplest cloud hosting providers will sell you one by default. Just as Stephen I really like linode but another simpler (and slightly cheaper) option is digital ocean. Big cloud providers like amazon EC-2 are more complicated, where you need to explicitly (buy and) assign a static IP. – grochmal Sep 3 '16 at 17:15
  • 1
    @Mephisto - And the following is the reason that I like linode so much: they have a lot of good tutorials. I'd start from the basics, go through the security tutorial to get an idea of the accounts and ssh and finally through the static ip setup to make sure. – grochmal Sep 3 '16 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.