[Savannah-cvs] administration/content/gnu-content/faq CVS_-_Ho...

[Sylvain Beucler]

CVSROOT:        /cvsroot/administration
Module name:    administration
Branch:         
Changes by:     Sylvain Beucler <address@hidden>        05/12/17 11:00:07

Modified files:
        content/gnu-content/faq: 
                                 
CVS_-_How_can_I_access_a_repository_from_behind_a_firewall_or_proxy.txt 

Log message:
        Updated URLs, added a section about manual testing, insisted about 
contacting the local sysadmin, usd 'EOF' instead of EOF to prevent unwanted 
bash substitutions, and various clean-ups

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/administration/administration/content/gnu-content/faq/CVS_-_How_can_I_access_a_repository_from_behind_a_firewall_or_proxy.txt.diff?tr1=1.4&tr2=1.5&r1=text&r2=text

Patches:
Index: 
administration/content/gnu-content/faq/CVS_-_How_can_I_access_a_repository_from_behind_a_firewall_or_proxy.txt
diff -u 
administration/content/gnu-content/faq/CVS_-_How_can_I_access_a_repository_from_behind_a_firewall_or_proxy.txt:1.4
 
administration/content/gnu-content/faq/CVS_-_How_can_I_access_a_repository_from_behind_a_firewall_or_proxy.txt:1.5
--- 
administration/content/gnu-content/faq/CVS_-_How_can_I_access_a_repository_from_behind_a_firewall_or_proxy.txt:1.4
  Tue Dec 13 21:49:14 2005
+++ 
administration/content/gnu-content/faq/CVS_-_How_can_I_access_a_repository_from_behind_a_firewall_or_proxy.txt
      Sat Dec 17 11:00:07 2005
@@ -4,7 +4,7 @@
 <p>First, this documentation is <i>complainware</i>. It means that you
 can freely use it provided you complain to your local system
 administrator, or to your Internet Service Provider (ISP), if you are
-using a restrictive Internet environment as described below.
+using a restrictive Internet environment as described below.</p>
 
 <p>This FAQ is about a system we had to setup so that people behind
 restrictive firewalls, or proxies, or ISP that blocks some ports, can
@@ -14,10 +14,10 @@
 <p>There is no security issue in allowing people to access a remote
 CVS repository, or more generaly a remote SSH server. It is rather a
 matter of policy, when administrators decide what kind of action they
-allow their users to perform. For example, some ISPs decide to block
-outgoing traffic to port 25 (smtp) so as to prevent people to send
-mail from anything else than their SMTP smarthost and hopefully fight
-spam.</p>
+allow their users to perform. For example, some ISPs decided to block
+outgoing traffic to port 25 (smtp) so as to keep people from sending
+mail using any other service than their SMTP smarthost, and think they
+can fight spam (and control their users) that way.</p>
 
 <p>You should know, however, that it is possible to bypass such a
 setup by two ways:</p>
@@ -25,7 +25,7 @@
 <ul><li><p>First, systems like Tor (http://tor.eff.org) can be used,
 at the price of a decreased connection speed, to redirect your traffic
 to any public computer, and any port, provided you have outgoing
-access to port 80 (http) and 443 (https) - which I think anybody have
+access to port 80 (http) and 443 (https) - which anybody should have
 whatever their setup. As of 2005-03-27, it does not work from behind a
 proxy, but it is a matter of development, not a technology
 limitation.</p>
@@ -49,23 +49,52 @@
 over SSH on port 443 (https) in addition to port 22 (ssh) to allow
 people to access our CVS repositories.</p></li> </ul>
 
-<p>In conclusion, remote outgoing traffic is a burden for us, the
-Savannah hackers, and does not bring any real value.</p>
+<p>In conclusion, remote outgoing traffic is a burden for us (the
+Savannah hackers) and does not bring any real value.</p>
 
 <p>That's what it is important that you tell your local system
 administrator or your ISP about it. You can for example refer them to
-this page.</p>
+this page. I mean it: that's the only clean and reliable solution to
+access Savannah and other services on the Internet. You need to
+mention it to your local sysadmin so he realizes that opening outgoing
+traffic is needed, and that trying to control is ineffective and just
+a burden to his/her users.</p>
 
 <p>Now let's see how to access our CVS services using any of those
 methods.</p>
 
 <ul><li><p>Tor (check
-http://wiki.noreply.org/wiki/TheOnionRouter/TorifyHOWTO#head-617feae632f5e2f957b45f1b3701b3d1c0ce41b7
+http://wiki.noreply.org/noreply/TheOnionRouter/TorifyHOWTO#head-0ae888b56f2f45ecda014dfc163a0dc0502b664d
 for more information). This method can be used to access any remote
 CVS repository. Here are instructions for a Debian GNU/Linux-based
 distribution:</p>
 
 <pre>
+# Install Tor. Check http://tor.eff.org/download.html for more information
+aptitude install tor
+# Configure Tor
+cat &lt;&lt;'EOF' &gt;&gt; /etc/tor/torrc
+
+FascistFirewall 1
+FirewallPorts 80,443
+EOF
+# Restart Tor
+invoke-rc.d tor restart
+</pre>
+
+Now you should be able to use tor the easy way:
+<pre>
+export CVS_RSH=ssh
+torify cvs -d:ext:<i>username</i>@cvs.savannah.gnu.org/cvsroot/<i>emacs</i> co 
<i>emacs</i>
+</pre>
+
+<p>If you don't like typing 'torify', you may want to have a look at
+http://shellscripts.org/project/toraliases</p>
+
+<p>If for some reason that doesn't work (notify us!), you can try the
+difficult way:</p>
+
+<pre>
 # Get connect
 wget http://www.taiyo.co.jp/~gotoh/ssh/connect.c
 # Compile it
@@ -73,29 +102,28 @@
 # Install it somewhere in your path
 install -m 755 connect ~/bin/
 # Configure SSH
-cat &lt;&lt;EOF &gt;&gt; ~/.ssh/config
+cat &lt;&lt;'EOF' &gt;&gt; ~/.ssh/config
 
 Host cvs.savannah.gnu.org
        ProxyCommand connect -S localhost:9050 %h %p
 EOF
-# Install Tor. Check http://tor.eff.org/download.html for more information
-apt-get install tor
-# Configure Tor
-cat &lt;&lt;EOF &gt;&gt; /etc/tor/torrc
 
-FascistFirewall 1
-FirewallPorts 80,443
-EOF
-# Start Tor
-/etc/init.d/tor start
 # You now can use SSH normally
 export CVS_RSH=ssh
-cvs -d:ext:address@hidden/cvsroot/emacs co emacs
+cvs -d:ext:<i>username</i>@cvs.savannah.gnu.org/cvsroot/<i>project</i> co 
<i>module</i>
 ...
 </pre>
 
 <p>If you are not root on your machine, you will need to compile Tor
-by hand, but that should not be a problem.</p></li>
+by hand, but that should not be a problem.</p>
+
+<p>We heard that some ISPs block most of the Tor nodes. If that's the
+case, the fist move is to explain your system administrator that this
+is blocking your legitimate work, and ask him/her the reason of this
+filtering (we would be pleased to know that reason as well). Last time
+a Savannah user had this kind of issue, he didn't contact the sysadmin
+and didn't even know why Tor nodes were blocked - we don't think
+that's the way to go.</p></li>
 
 <li><p>Using cvs.savannah.gnu.org:443. Please note again that this is
 a burden for us to offer this method and is not garanteed in the long
@@ -113,7 +141,7 @@
 # Install it somewhere in your path
 install -m 755 connect ~/bin/
 # Configure SSH
-cat &lt;&lt;EOF &gt;&gt; ~/.ssh/config
+cat &lt;&lt;'EOF' &gt;&gt; ~/.ssh/config
 
 Host cvs.savannah.gnu.org
        ProxyCommand connect -H <i>proxyhost</i>:<i>proxyport</i> %h %p
@@ -127,17 +155,39 @@
 
 <pre>
 # Create a wrapper, in your path
-cat &lt;&lt;EOF &gt; ~/bin/sshwrapper
+cat &lt;&lt;'EOF' &gt; ~/bin/sshwrapper
 #!/bin/sh
 exec ssh -p 443 $*
 EOF
 # Give it executable permissions
 chmod 755 ~/bin/sshwrapper
+
 # You now can use SSH with sshwrapper
-export CVS_RSH=sshwrapper
-cvs -d:ext:address@hidden/cvsroot/emacs co emacs
+export CVS_RSH=~/bin/sshwrapper
+cvs -d:ext:<i>username</i>@cvs.savannah.gnu.org/cvsroot/<i>project</i> co 
<i>module</i>
 ...
 </pre>
 </li></ul>
 
-<p style="font-size: smaller">Update $Date: 2005/12/13 21:49:14 $</p>
+<p>If that doesn't work, try typing:</p>
+
+<pre>
+# Tor
+$ <b>~/bin/connect -S localhost:9050 cvs.savannah.gnu.org 443</b>
+SSH-2.0-OpenSSH_3.8.1p1 Debian-8.sarge.4
+<b><i>&lt;Ctrl+d to exit&gt;</i></b>
+</pre>
+
+<pre>
+# HTTPs Proxy
+$ <b>~/bin/connect -H <i>proxyhost</i>:<i>proxyport</i> cvs.savannah.gnu.org 
443</b>
+SSH-2.0-OpenSSH_3.8.1p1 Debian-8.sarge.4
+<b><i>&lt;Ctrl+d to exit&gt;</i></b>
+</pre>
+
+<p>If you don't see the the remote SSH version after a few seconds, then
+there's a problem; please note any error message and contact us if you
+can't fix your configuration.</p>
+
+
+<p style="font-size: smaller">Update $Date: 2005/12/17 11:00:07 $</p>