[Music] Welcome to this session on network and SSH. In this session, we will look at how to access remote machines using a command line utility. So, here is how most of our daily life would be: that is, we are at home in a private network. Our computer is connected to the telephone as a hotspot, and then the telephone is then connected to the internet service provider, let us say, Jio or Airtel or whatever, and then it is able to access the internet. So, public network is basically the internet, and a lot of routing of packets happen within the internet. And from our home, we would like to access, let us say, a particular website. So, that website may be sitting in another network of a different campus or organization. So, for example, sitting at home in your hometown, you want to access the website of IIT Madras. So, the IIT Madras is this blue private network, let us say, and one of those computers running the web server of IIT Madras would then be making its content available through the campus LAN followed by a network switch.

which then passes on the content onto the public network, which will come through all these connections to the internet service provider for your home telephonic network, and then on to your computer device so that you can look at the home page. And all of this happens within a fraction of a millisecond, so that you are having a very live experience of browsing. Now, what is also important for us to realize is that we don't have direct access to the private networks in respect to organizations. So, we need to understand how that is made possible. So, the way it is made possible is because of the different types of IP addresses that are given. So, there are two types of IP addresses, the version 4 and version 6. So, here I am giving the examples of the IPv4 version 4, which are still being used. So, there are three types of addresses that you would have in a machine. One address that will be there for every mission is the so-called local host address, whereby the system can refer to itself if it wants to refer to itself.

through any network connection, there must be some address. So, the local host address is 127.0.0.0. And then, after the four-digit or four-part IP address, there is a slash and then a number is given. It tells you how many IP addresses are possible with that particular combination, okay? And so, you can see that most of the computers will have an IP address, which is 127.0.0.1, okay? And some may have more of those types of series depending upon the configuration. Now, any private network IP address would be falling into one of the three categories here listed as class A, class B, or class C. So, class A is the kind of network meant for large organizations, let us say, item address campus LAN or the DRDO LAN or the Infosys internal LAN. So, all of these have several thousands of computers, if not tens of thousands. So, the IP address range will be 10 dot. And after that, the three parts can be any number between 0 and 255. And that would give you a total of 16.

million IP addresses that are possible. So, a large organization can assign these IP addresses to the machines within its organization. The Class B addresses are starting with 172.16, and then the last two parts can be varied, and you have about 1 million IP addresses that are possible. Now, Class C would actually have 65,000 IP addresses that are possible. So now, these three addresses: 10 dot something, 172.16 or something, 192.168 or something. These three addresses are called the private addresses, which means there cannot be any publicly visible website or a service provider with these addresses because they will not be honored by the routing machines that take the packets from your mission to another mission. And every other address would then fall into the category of a public network, which I have shown you here as a globe. Okay, now when you have the three types of addresses, you can actually have a possibility that within a private network, you can have multiple private networks up to three levels of hierarchy because you have three address ranges that are possible, and you can actually prevent access from

anyone within the campus lan to access your private network, and let us say this private network 2 is the computer center, and private network 3 is, for example, an internal network within the computer center. So you can actually protect a storage box connected to a high-performance computer from the campus user by having two layers of routing that is required to reach it, and you can have rules for these switches in such a way that a storage box within the private network is not visible to a campus user, and definitely not to a user from outside the public internet. Now this is how basically we are able to protect our machines as far as the network access is concerned. Of course, there are ways by which a person can penetrate into the network campus network, take control of one of the machines, and thereby cause harm. So those safety nets also have to be thought of. Now the concept of port is also something that we must be familiar. So when a computer is connecting to another computer, we may see that as a physical connection where the network

card is connected with a wire, which goes into a network switch. And then some routing happens, and then those packets are going through a wire to the network card into the other machine. So that is the physical network, but the connection itself needs to talk to the IP address of the server on a specific port. It is like when you go to the bank, you have various counters. One counter is to get your passbook printed, updated, etc. And let us say another counter is for your service queries, and a third counter is to open accounts, new accounts, and a fourth counter may be to pick up cash from your savings bank. Now it's the same bank on the other side of the desk, but each window is meant for a particular action. Similarly, network connections are also like that. Each port number is meant for a particular service. So what are those services, and these port numbers are already standardized. So what are those mappings is something that we need to look at. So before that, I want to also tell you that if you want to get access to a

remote computer so you can actually get it in many ways. So, virtual private network is one way so all IIT Madras students have the ability to connect from their home as if they are coming from the campus by a VPN account if they have a good reason to have that particular facility. Another way of connecting to a remote computer is by using what is called SSH tunneling. That is, you can open in a secure shell connection by going through multiple hops and also perhaps changing the port number along the way so that for security reasons you can actually connect from your machine all the way to a machine in the campus through machines that allow for this kind of patterning to happen. And you can also have remote desktop access, that is GUI access also is possible using tools like X2Go or Remote Desktop Protocol, which is very popular among the Windows machine or PCoIP, which is also a possible option if you are using let us say VMware tools. And you can also have the ability to access a remote desktop as a part of the

browser window. And there, there's a free software called Apache Guacamole, which is useful for you to configure. That if somebody sets it up for you, it means that life is very simple because you just need to open the browser window. And then the browser itself shows you the desktop environment that you can work with. Sometimes it is needed because you may want to plot and look at the plots on a computer, which is remotely located. And there are also commercial tools which would help you see the remote desktop via internet, maybe not very safe, but they are available and very easy. Free versions are also available. So like TeamViewer, AnyDesk, and Zoho Assist, etc. So these actually help you access a remote computer, which is deeply located within a private network. And by learning one of these techniques, you can actually start using facilities that are available in a remote location and work for a good productivity right from home. Now some of the ports that I mentioned earlier and their mapping with respect to services are listed here. So these port numbers are standard port

numbers so most of the computers will have those services on those respective ports. An exception would be like ssh, which may open not only on port 22, but maybe also on port some other number meant for a public network so that there is a security by which you slow down essentially somebody who's trying to check which port number you are listening to, etc. 21 is the port number for ftp file transfer. 25 is a port number for unencrypted mail transfer. So when you are sending an email, what you are doing is you are opening a network connection with a remote computer over port 25 and then sending the data, and that's how the mail is actually sent between machines. Port 80 is the http unsecured web server access, basically website access without any security settings, and 443 is when you have the security certificate present. So most of the time, https connections are what we use today, so the port number over which this service is provided is 443. Now every linux mission allows for printing from any service via

the network connection over the port number 631. So, if you open localhost: 631 in a Linux computer, you can see what printers are connected, what jobs are being executed right now for printing purposes, and so on. So, you can do a lot of configurations for printing by simply accessing a website, which is localhost: 631. And if you have configured a database like MySQL for remote connectivity, the port number typically is 3306. So, like this, many software will have a standard port number over which the service is made available. Now, there is a concept of a firewall that we must be aware of because we must know that some software is not opening up ports on my machine without my knowledge, and they may actually open up some security issues for me. How do I prevent such things from happening? By setting up a firewall to prevent connections except on those ports on which I am actually explicitly giving permission. So, that is something that we can configure quite easily on a Linux machine. We also need to check the firewall settings when we are

trying to access a service on a remote mission because our service may not be able to go through if there is a firewall on the way, which doesn't allow connections over that particular port number. Usually, the network switches can be configured to either allow or deny communications over a specific port number. So, if things don't work, we have to also know up to what point we are able to communicate over the port number and beyond what point is a problem. Therefore, we can help the computer center to debug the problem for us. And at every hop between the computers, there is a way by which firewall controls can be set up in place. So, one has to be aware of these possibilities so that one can learn more about them to secure their own mission as well as to maintain a server if they are responsible for a server for a service that they are providing over the internet. Now, how do we protect a server when we are providing a service over the internet? So, there are anonymous users coming from all over the world, and if we are not careful, they may inject

viruses within the service request that they are making to the web browser through their web browser to our service, and thereby take control of our machine. So one way by which we can protect is by setting up a network firewall, which would ensure that the connections are coming from legitimate sources and on legitimate port numbers and so on, and also at a particular speed that we would like to control. And then we also have a possibility of what is called web application filter, which is another form of a network firewall but specifically for a particular service. So for example, for https, it would actually look at the http request and analyze various fields that are being sent to the web server and see if any of them contain malicious code such as sql injection attack, etc. So by having these two layers of protection, the server is slightly better placed in offering the services without too much of a problem from anonymous users who may be attempting to take control of the server. An extreme way of securing it is actually to enable what is called security-enhanced Linux mode earlier it

was only available for CentOS, Fedora, Red Hat Linux, or SUSE Linux, etc., which are the server-grade, and Ubuntu, being a desktop operating system and user-friendly, etc., did not have it in the past. But, offlet, we have it as part of the Ubuntu open system also. And what it does is just like a sentry at the entrance of a gate. It would provide an additional layer of access control on files to services. So, if there is any web server that is supposed to access files and provide them over the internet, so AppArmor (AA) Linux would provide one more layer of security by limiting what parts of the file system can be read by the web server and what files are visible to it or not. So, this is a layer beyond the file system permissions that we are familiar already, and AppArmor (AA) Linux offers what is called role-based access control. So, different services, different users can have different levels of access to different directories, and thereby we can actually protect the open system from being taken over by malicious intent from a remote location through the services.

that we are offering. SC Linux also provides what is called sandboxing for every process. That means every process will have restriction of reading information about the processes or memory locations or files that are belonging to other processes. And by default, it would operate in the least privileged access mode for all the subjects, which means that by default the doors are closed. So that is a mode in which SC Linux will work. So that is one of the reasons why people do not enable it, because slightly painful once you enable it to do some routine work, but it is going to be a little bit more secure way of going about it. Now how do you know whether SC Linux was enabled in your mission or not? So instead of ls -l, you can add one more option, Z, and see if there is something more that is actually appearing on the screen. And if it is, then that means that perhaps SC Linux was enabled. Same thing for the processes. If you add the Z option for ps command, then you can also see whether such a mode has been enabled.

there are four types of items that are coming under the purview of rbse role-based access control system so the users, the roles, the types, and the level of security can be controlled quite elaborately. So in the brackets, I have given some examples of such types of entities, and there are many modes in which secure Linux can be configured. So you can have it disabled more by default, but you can enforce it, or you can even keep it in a permissive mode where it would actually do all the checks but only log them, but let you actually proceed further. So that is useful when you want to configure it before going live. And there are tools like semanage and restorecon which help you in managing the permissions of directories and services once the SELinux has been enabled. So if you have any publicly visible server, it's a very good idea to enable SELinux. There are some tools that are useful in a network to understand how the communications happen so that you can debug any given problem situation. So things like ping

so if you want to know whether a machine is up, you can actually try to ping it using the IP address. If there is a response, it means that machine is up. If there is no response, it doesn't mean the machine is down. The reason is that one can configure a machine to not respond to ping requests for security purposes. So, only the positive thing has to be interpreted correctly, that is, if the ping is responded to, it means the machine is up. That's all. You can also look at what route is taken by the network packets to a remote machine by using the trace route. You can convert the names of the machines to IP addresses by using nslookup or dig utility. You can check what network activities are happening on your machine by using netstat. If you want to know if the machine that you are working on is having public access, then you need actually a different machine in the internet to look at your machine. For that, there is a website called mxtoolbox.com, which helps you to do some

debugging. And if you encounter a machine name and you want to know whether it's a genuine machine or not, you can actually find out who registered the name for that machine. And if the name and address of that particular person who has registered that machine appear to be reasonable, then maybe that name of the machine is perhaps a genuine. But there are a lot of fake DNS entries out there, so one has to be careful. Now, if you are in a campus and you want to look at what are all the ports that are open around your computer in the network, you can run the utility called nmap. But you should not do it without permission of the network administrator, because it can cause a lot of network traffic. And there is even more dangerous tool called Wireshark, where you can sniff packets through the network to do some diagnostics of the network protocol. It is again meant for usage by the network administrator. A regular user is not supposed to do nmap and Wireshark without permission. Now, we will actually go and look at the website.

top500.org to look at statistics. And it will be very interesting to note that every single machine in the top 500 HPC facilities in the world are actually Linux-based. Which means that if you are good at Linux, then you are able to access remotely located high-performance computing machines quite comfortably. Okay, and one cannot run the tasks on an HPC machine directly. You need to submit a job, which will be sent to a job scheduler, and it will be executed whenever its time comes in a sequential manner as per the policies. So, therefore, one has to learn how to run heavy tasks on a remote computer, and knowing Linux very well will help a lot. And very often, you cannot bring the whole data out to your laptop because the internet costs will be there for such transfers. And also, you may have too much data that the bandwidth may not be sufficient. So, it's very useful if you know Linux and a command-line environment. Then you can actually do SSH to a high-performance computing computer and process the data remotely and bring

only the processed data out so that you can save both the network charges, as well as bandwidth. So, being comfortable with a command line is almost a must if you are into high-performance computing. I hope that will be acting like a motivation for you, that whatever you have learned till now in the course will be quite useful in case you are going to high-performance computing, which enables machine learning and things like that. So, let us go to the demo now. So, if config is a utility that lets me know what are the addresses that I have, and here we have the LAN connection, which is giving me an IP address of 10 series, which means it's a class A network, which is in the campus, and loopback device, local loop device is also here, which is having an IP address of 127.0.0.1, which will be there for every machine. Okay, to contrast this, I will actually log into my desktop computer and show you. So, I am doing the remote connection through SSH, so you can see that the host name is now funny server.

the machine on which I was recording is icm. So you can see that from here, within the terminal environment, we are able to SSH into a different machine, and we are able to use that machine without shifting from the place. That is because the Secure Shell is allowing us to do this particular command line way of using the remote machines. And if you look at the ifconfig for the other machine that I am logged into, you see that it has way more number of devices. So it has an internet IP of a class B, and then it has also a class A address coming from the LAN. And then it has a loopback address of 127.0.0.1. And then it also has a class C type of an address, also two of them, and then class B, second one. So why does it have so many IP addresses? That is because in my server, I have got a bunch of virtual machines and containers that are running, and they will communicate with each other using a separate network. And I also have

a private network setup in my own office using a small d-link adapter that I bought from Amazon. So, I have this network also configured for communication within the room, which is totally cut off from the campus land. The campus LAN is communicating with the IP address range of 10 dot something. So, you can see that all these addresses will be different for different machines. So, there will be a 10 series address, a 172 series address, there is a 198 series address, and then there is one address which is common for every machine, that is 127.0.0.1, which is basically saying me. Okay, so everybody knows who is me then themselves. So, that kind of an address is available always. One way by which you can use network tools on the command line to convert names to IP addresses is to check nslookup or some machine name. So, iatm.ac dot in is one machine name that I want to check the web server of our institute. So, you see that it is connected to a web application filter.

and it has an IP address of 10.24.0.191, which means that it is an intranet IP. Now, because I am trying it from campus, it is an internet IP. However, if I try the same thing from the website MX Toolbox, the IP address will be different. So let us check that out. So, I am opening a browser, okay, and I go to mxtoolbox.com. Okay, here in this, I will go to the DNS lookup and type www.iitm.edu.10dns.lookup. So, this is coming from the public network. So, from the public network, as the rest of the world looks at our IP address, it happens to be 103.158.42.57. So, that's an IP address coming from outside. So now you see that this is a public IP address, okay. And from the IP address, you can also see that it is also basically transparently telling that we have a web application filter in place, okay. And this is a name that is translated into another name, which means there are some aliases that are possible.

so let us see for any other address. Let us say for mit.edu, and you would see that it is having a DNS record pointing to a hkey.net domain. And Akamai Technologies is maintaining that, okay? And what we can see here is the same kind of information will come out here also, okay? And you see that hkey.net, the domain name, and Akamai is maintaining that. And of course, some addresses are also being listed. So what this means is that mit.edu website is actually maintained by a service provider, which is actually having multiple machines all over the globe, very fast dissemination of information across the globe. And that kind of address is being resolved uniformly from outside the campus as well as from inside the campus. The reason is that this is not our machine, so it is not located on our lab. So therefore, we do not get to see what was the intranet IP for that particular machine, okay? So it is a global IP that we will know, okay? So what we would do now is we can

also look at a tool called dig, which does the same task. So, dig would actually go and get you the IP address of a particular machine, and the IP address happens to be here. This way, now what we do is that big minus x, then it would do a reverse lookup. Now you see that when it does a reverse lookup, the name for the particular IP address is different. So, what this means is that very often the names that we are actually typing in a browser window may not be the canonical names; they could be basically aliases. So now let us look at the IP address of this machine, and sure enough, that will be matching with what we originally had here. Okay, here you see 142.250.206.164. Okay, so it matches, which means that for this particular IP address, the machine name actually happens to be this one, but one of the aliases is basically google.com. Now, this address will not be matching with what we see from the browser, so let us look at that. Now you see the IP address here is different. The reason is that google.com

is served by many, many machines across the globe. And therefore, the machine IP that you would get when you look up is what is given by the nearest domain name server. So, MX Toolbox is located perhaps somewhere in California. And when we are running this particular command at the campus, then we are looking at our campus DNS server. So, therefore, these are very different geographical locations. So, therefore, the IP addresses that we get for those host names will be also different. So, let us see if there is a particular machine called Aqua. I know it's a machine from IIT Madras. Does it have an IP address visible from the internet? So, you see that it is not found. So, which means that our HPC cluster called Aqua is not visible from the globe, okay. But it will have an IP address visible from the campus. So, you can look at it now. So, it would have a local IP address. So, you can see that it says intranet IP address. So, it will not have a global IP. So, it's only available from within the campus, which means that if you

need to have access to our petaflop supercomputer on campus then you need to find ways of entering the campus because the machine is not available as a visible to outside the campus so which means that you must have a vpn access or you must use some other remote desktop options to come into the campus and then you can access the high performance computer now let us look at how we can connect with the remote machine like this so we have got this machine so i can ssh into that machine and then i need to give my password so once i give my password then i am entering the machine so you can see that within the terminal we are able to log into a remote machine so in our case we are logging into the supercomputer of our campus now if i put a w it tells me who are all the people who are logged on so you can see how many students are logged on and from various machines on the campus at what time they are logged on what are they doing and all that okay so this is a super cluster

hundreds of people can log in and submit jobs and get them executed. Because we have got more than 200 nodes of computer 200 computers connected in a big network. And jobs will be executing on those nodes as we submit to a job scheduler. Okay, so the job scheduler is called qstat to just tell the statistics of the queues that are available. And it has an alias. So, I do not want the ds. So, I will remove the nls. And I run the command without the alias so that it is meant for jobs of everybody. And now you can see that which student has submitted which kind of a job. And on which node it is running. What job id it is running. And what is the status. For example, this is in queue but this job is actually running. Okay, and it's a gpu queue. And this job is running. And it is occupying only eight cores. Okay, so like this you can actually see that a supercomputer is available to you within the secure shell by just a command and environment you can look at the jobs you.

can submit jobs, and you can actually make use of the supercomputer facilities quite nicely if you know the ssh very well. So, from this desktop, which is icme where we are doing the recording of the videos, we have connected to till now, ah, three different machines. We have connected to my desktop, the aqua supercluster, and we have connected also to my laptop. And you see that I have not moved from here. So, from the terminal, we are able to connect to multiple machines. Now, I will also connect with the Intel Developer Cloud via my desktop through ssh. Okay, I have configured it already. So, it actually already has the ssh keys shared, so it doesn't ask me for a password. So, you can also have an account on Intel Developer Cloud by registering on their website. Okay, so here is an opportunity for you to see that sitting in IIT Madras, by just using ssh, I am now logging on to a machine that is actually located in the Intel high-performance facility that they have made available for education sector for free. Okay, and what kind of a machine it is, it is a

ubuntu linux machine. Uh, thank god, because it means that we are in familiar territory, and therefore we can go on to use this particular machine as if it's our own linux laptop. Okay, so most of the commands that we know will work there. Okay, so you have got all kinds of stuff out there that you can work with. So, as you can see, we have connected using ssh from the terminal environment from this machine to a desktop machine in the room, a laptop in the room, a supercomputer within the campus, and intel developer cloud, which is actually sitting somewhere in California, perhaps. So, this is possible because the routing, etc., are taken care, and secure shell is providing us a way by which we can connect over a terminal. And just because a terminal is a very limited amount of communication needed for us to view what is there on the screen, it tends to be quite fast in terms of response. And therefore, learning the bash shell over ssh connection would be very useful because we will then be able to work on remote computers quite effectively, and your knowledge of

ubuntu will come of use in almost every such machine. Let us look at the top 500.org to look at what are those supercomputers the world and how fast are they. So let us look at the top 500.org website. You have the top computers in the world being listed every six months. So you could look at the November 2021 listing, which is the latest as of now. It shows that Fugaku is at half an exa flop capacity at the number one in the world, which means that we are in the ixa flop regime already. And Microsoft Azure system is at the number 10 position, which means the public cloud, which you can access by paying for it, is already available at number 10 in the world. And let us see what are the kind of statistics with respect to the operating system. So in terms of our persisting family, you can see that 100 of these supercomputers are Linux family. That's exciting for us because we are now familiar with the Linux operating system and which flavor of operating system is

also listed here. Ubuntu 20.04 is also listed here, along with Red Hat Enterprise Linux and CentOS, HP-UX, and all that. So all these are basically Linux, so they'll have the same file system with the same structure, and also the bash shell. So, therefore, we are at home in any of these top 500 supercomputers in the world. And where are we with respect to the countries? When it comes to India, we could look at that. So here we see that India is at position 17, which is not bad, but I am sure that it will climb up in the next couple of years because several national supercomputing mission facilities are being set up in the country. And we are at home in any of these missions because they are all going to use Linux. So I hope it was useful for you to find the application of learning supercomputer learning the operating system that powers the supercomputers in the world. So here is a brief demo on checking the AC Linux whether it was enabled or not. So on the

machine where i am recording so i will just put ls minus l z and you would see that there's a question mark which means that perhaps sc linux was not enabled on this nation. And also i would use the ps minus ez option and again there is a question mark here which means that the processors also do not have the s linux security pages enabled. So i would see if the web server for our department is up using the ping and it appears to be available. So i happen to have an account on that so i will log in there and in this web server what i would do is look at the files and with the capital z option you see that there's a lot of information that is coming here. So you see that all these options show that the file system has had a layer on top of it from the sa linux which is a protection mechanism. So on the web server of our department the sd linux has been enabled and also the process listing normal listing would actually show that there is a web service that is running httpd.

but if i use same listing with capital z, you would see that the web servers are running with some additional conditions where it has the fields that are available here in front of it, where the role, namely the httpd underscore t, is listed so that whatever the restrictions meant for that particular service will then be put in place. So you can see that there are certain other services which have different roles compared to http, and that is exactly what i was talking about where the role-based access can be given to specific services, keeping in mind what kind of users are expected to connect with the machine through those services. Netstat is a command to show you the network statistics, and here you can look at what all the various programs that are running, and you could see that the tcp connection right now to the web server is open from a particular foreign address, and the port number from the client side is also listed. There is also an ss connection coming from the ip address of the machine where we are recording, so you can actually see.

what are the active network connections that are actually taking place in the computer using netstat. So we will do the same netstat on the computer where we are recording. So you would see that you have got a bunch of ports that are open for various purposes, and there is no service which is basically for http. So I am not running any web server on this machine, but I am opening a connection outward which basically is to connect with the google account as well as the obs recording system that is running is also actually having an internet connectivity for the service. So you can see that though I have not explicitly opened that particular site, it has been opened by the obs software that is running in the background perhaps to check for any update or whatever. Okay, so this is some brief demo on ac the next netstat.

Networking Commands and SSH

Networking Commands and SSH