Remote Access

VPN

Not all network resources available at the university are not available when you are outside the university.

However when connected to a VPN one can have access to all network resources as like you are working on a computer located at the university locally.

Ssh terminal

You can always log in to one of the linux login servers with ssh. (eg. lilo.science.ru.nl).

You can also log in to a ssh server behind the university firewall, by using lilo as a jumping server:

    ssh -J [USER1@]lilo.science.ru.nl   [USER2@]SSH_SERVER

The USER between brackets is optional.

= Protocol

There are multiple protocols to share your machine's desktop over the internet. The best protocol is RDP (Remote Desktop Protocol) from Microsoft. For both Windows and Linux there is a RDP server available. So for these platforms we advise to use RDP.

However on Macos there is currently no a RDP server available. Therefore we have to fallback to the VNC protocol on MacOS.

The RDP protocol is encrypted via SSL, however the VNC protocol is not encrypted. So for the VNC protocol we can setup an end-to-end ssh tunnel to provide a safe encrypted channel for the VNC protocol.

The RDP protocol by default uses port 3389. The VNC protocol by default uses port 5900. Although the RDP protocol is already encrypt, we still need a ssh tunnel to cross the firewall.

Remote desktop using RDP protocol

On Windows you can enable a RDP server builtin windows.

On Linux you can install xrdp to enable a RDP server on linux. Below are 2 manuals found in the internet describing the installation:

• https://ultahost.com/knowledge-base/install-and-connect-to-linux-server-with-xrdp/
• https://www.turbogeek.co.uk/how-to-install-xrdp-server-on-ubuntu-22-04/
• https://www.howtogeek.com/devops/how-to-install-a-desktop-environment-on-your-headless-linux-server/

Remote desktop via VPN

Although it is possible to set up a Remote Desktop connection via an SSH-tunnel, the preferred way (according to C&CZ) is to do it over VPN.

This basically means that if you have setup a VPN connection with the faculty's VPN-server, you only need to make sure that your targetmachine is reachable from the VPN-server and that you are in the Local Remote Desktop users group. This typically needs to be configured by C&CZ.

Remote desktop via SSH tunnel

Assuming that you want to run a remote desktop via a login server such as lilo.science.ru.nl you can do that via an SSH tunnel.

Note: these instructions assume that the port 3389 is open on the targetmachine and that you have an account that is part of the Local Remote Desktop user group. If you are trying to connect to a Windows Managed PC you should ask C&CZ to set these settings.

linux/mac

On  linux/mac you can do something like:

  ssh -L 13389:targetmachine:3389 username@lilo.science.ru.nl 

It causes a ssh tunnel to be created from localhost:3389 to lilo.science.ru.nl, where from lilo all traffic is forward to port 3389 on the targetmachine. The latter forward is not protected anymore with an ssh encrypted tunnel. Latter is also not needed because RDP by itself is already encrypted usin SSL.

followed by the command:

  rdesktop -u username localhost:13389 

windows

If you are on Windows you can use the program Tunnelier.

In the Login tab you should set the following parameters:

Host: lilo.science.ru.nl 
Port: 22 Username: your username at the login server 

In the C2S Fwding tab you should Add a row and set the following parameters:

Status: enabled Listen 
Interface: 127.0.0.1 
List. Port: 13389 
Destination Host: targetmachine 
Dest. Port: 3389 

Now first connect to the login server using the Login button. Then you can start RemoteDesktop and connect to the address:

  127.0.0.1:13389.