Editing the Rules with Webmin 237

•Figure 34-11: The Edit Rule window.

3.To change the action, click the radio button next to the desired action in the Action to Take field.

4.The condition details are a bit more involved, but not hard to change. Under the Condition Details portion of the window, use the dropdown list to enable the filter you want to enforce and then enter the condition parameter in the field to the right of the condition.

For example, to filter packets based on the ICMP network protocol, find the Network Protocol line, change the first list box on that line from Ignored to Equals, and change the second list box to ICMP. (Don’t actually do this, it’s just an example.)

5.After making any changes to rules in the Edit Rules window, be sure to click the Save button to save the changes.

You go back to the table (refer to Figure 34-10).

6.Click the Apply Configuration button when you return to the chain of rules.

Your new rule is now in effect.

Adding a new rule with Webmin

The rightmost column in the rules table is labeled

To add a new rule above an existing rule, click the up arrow. To add a rule below it, click the down arrow. Remember, packets travel through the chain from top to bottom, so the order is important.

Use the up and down arrows in the Move column to rearrange the order of the rules within the chain.

You have a really secure firewall in place, but you may need to open up the system for use by others. If you open up a port for a tool like Telnet, you’ll be exposing cleartext passwords to anyone who may be spying on your network. Be sure to use secure network programs like SSH — SSH encrypts everything that it sends over your network.

To open up your system for SSH use, follow these steps:

1. Click the down arrow in the Add column of the first rule in the chain of rules table.

The Add Rule window appears, as shown in Figure 34-12.

•Figure 34-12: The Add Rule window.

2.In the Rule Comment field, enter a comment like this:

Accept incoming SSH packets

Add, and it contains a pair of up and down arrows.

238 Technique 34: Protecting Yourself with a Firewall

The Rule Comment is there to remind you why you created the rule. Be sure to include good comments in your firewall, and you’ll save yourself a lot of time later when you need to make another change.

3. Click the Accept radio button.

4. In the Condition Details area, find the Network

Protocol line and change the list boxes to Equals and TCP.

5. Find the Destination TCP or UDP Port line and change the list boxes to Equals and 22.

6. Click the Create button at the bottom of the page.

You’re returned to the first page where you can see that your new rule has been added to the list.

7. Click Apply Configuration to apply the rule.

You still need to start the sshd daemons, but the firewall will now let an SSH session through. See Technique 33 for useful information about using SSH to share your data without exposing yourself to intruders.

In some cases, you may want a computer that’s already behind a firewall to accept incoming packets only from machines within your network. That way, your corporate firewall can let Internet-originated traffic through, but you can secure individual machines more thoroughly. To do this, create a firewall on that machine with a rule that limits inbound packets to addresses from within your own network.

You can limit access to the Internet to protect your system from unfortunate downloads that might bring in viruses or other trouble. You’ll save network

bandwidth, disk space, and time when you don’t have to worry about restoring your system because of someone else’s careless download.

Follow these steps to disable Internet access from within your system (you’ll have to enable the firewall on your computer first; see the section titled “Finding Your Firewall” at the start of this technique for details):

1. Click the down arrow in the Add column of the first rule in the chain.

The Add Rule window appears.

2. Enter a comment in the Rule Comment field:

Close off Internet Access

3. Click the Reject radio button.

4. Use the drop-down list boxes to change the

Network Protocol condition to Equals and TCP.

5. Change the Source TCP or UDP Port condition to Equals Port 80.

6. Click the Create button at the bottom of the window.

You’re returned to the first page where you can see your new rule has been added to the list.

7. Click Apply Configuration to apply the rule.

If you’re using a proxy server, you need to disable that port as well. Just add another rule like this one to reject the packets from that port.

Now your system is insulated from incoming packets from the Internet, and disk space and network bandwidth are preserved for in-house use.

35 Using VNC to Connect to Remote

Technique Desktops

Save Time By

Sharing your desktop with VNC

Extending personal invitations to your desktop

Exposing your desktop for others

Using tsclient for remote viewing

Turbo charging cut and paste

Creating desktops on demand with gdm

VNC (an acronym for virtual network computing) is a client/server utility that lets you share graphical desktops across a local network or across the Internet. Before VNC server came along, you

could use the KDE or GNOME desktop environments only if you were actually sitting in front of the computer. With VNC server, you can create a separate desktop (KDE, GNOME, or whatever environment you prefer) for use from a different computer — located in the next room or in another country.

In this technique, we show you how to set up and use remote viewers and servers. VNC makes it easy. VNC is friendly, intuitive, fast, and free (all in all, some of our favorite software features). You can

Combine the best of different platforms on one monitor.

Share a desktop with another user to get help or collaborate on a project.

Share Linux machines without sharing desktops — each user has his own work environment, complete with privacy. You can even streamline the setup of private remote desktops by creating new VNC desktops on demand.

The time you can save by using other desktops without taking a step is amazing.

Sharing Desktops with VNC

When you run a VNC (virtual network computing) server on your Linux computer, you create a new graphical desktop that you can use from a VNC viewer. Linux is a multi-user operating system: Many users can log into your computer at the same time.

240 Technique 35: Using VNC to Connect to Remote Desktops

When you run a VNC viewer, you see a remote desktop within a window on your local desktop. If you click the Full Screen option, it feels like you’re sitting in front of the VNC server. When you move your mouse, the cursor follows. When you type at the keyboard, the characters are sent to the remote desktop. Open Konqueror on the remote desktop and you can drag files around your remote desktop.

VNC is portable:

You can run the VNC server on a Linux computer, a Windows computer, a Macintosh, or on a number of different UNIX distributions.

You can run the VNC viewer on a Linux computer, a Windows computer, a variety of UNIX workstations, a Macintosh, or even within a Web browser.

You can run a VNC server on one platform and the VNC viewer on a different platform. For example, if you have a nice big screen on a Windows computer, run a VNC viewer on Windows connected to your Linux VNC server. You may like to keep your e-mail on a Windows-based computer, while using your favorite graphics program on a Mac, but use your Linux desktop for everything else.

With just a few mouse clicks, you can have a window open for each desktop, with each desktop running the programs you like to use on that system. For example, in Figure 35-1, you can see three desktops: in the background you see our workstation (Fedora Core running KDE), in the upper-left you see a Windows desktop, and in the foreground is a remote session waiting for us to log into another Fedora host.

Because each remote desktop appears within its own window on your local desktop, you can work with multiple desktops at the same time.

Desktop sharing makes it easy to get a second opinion about a problem on your desktop — just let your most technically adept friend log in and help.

• Figure 35-1: Multiple remote desktops.

Inviting Your Friends to Use Your Desktop

If you’ve installed the KDE Networking package, you can share your desktop with another user (if you haven’t installed the kdenetwork package, flip back to Technique 17 for a quick refresher). Sharing your desktop is a great way to get help from another user, or to collaborate on a project. When you share your desktop, the other user connects to your desktop using a VNC viewer (such as vncviewer or rdesktop).

To invite another user to share your desktop, follow these steps:

1. Open the KDE menu.

2. If you’re running Fedora Linux, choose System Tools More System Tools Desktop Sharing.

If you’re running SuSE Linux, choose System Remote Access Desktop Sharing.

Mandrake users choose Internet Remote

Access Desktop Sharing.

The KDE Desktop Sharing window appears.