Aerospace Software Ltd.

The Hostile IT How-to Guide

For Mandriva Linux 2009

Scope

This guide describes how to get your work done despite having a large, unhelpful, corporate IT department. I was wondering whether to call this the Corporate IT Subversion Guide, but that word is already used for other purposes.

There are many silent and weary sufferers of locked down, encrypted hard disk Windows machines. This guide offers some help.

SSH Tunnels

If you have a server somewhere, but you cannot reach it because the corporate firewall blocks port 22 outgoing, then you can fix the problem by telling sshd to listen on an additional port and then tunnel to it over whatever port is open, for example HTTP port 80 or HTTPS port 443.

Edit file '/etc/ssh/sshd_config'. Look for the 'Port 22' line and add 'Port 80' immediately below it. Then restart SSHD with

# service sshd restart

and Bob's your Uncle. The SSH server will now listen on two ports, 22 and 80.

Now you can tunnel to your server using

# ssh -p 80 user@server.example.com

and run any program you want. If your local machine has an X server running (Linux or Windows with Xming and PuTTY) then you can do

# ssh -X -C -c blowfish user@server gnome-panel

and go click happy!

SSH Port Forwarding

You can forward a port with SSH over your newly discovered tunnel, for example Samba, with

# ssh -p 80 -L 445:localhost:445 user@server.example.com

then connect to that service with

# smbclient //localhost/sharename -Uusername%password

The possibilities are endless.

Encrypted Hard Disks

If your nice Windows based corporate desktop machine has an encrypted hard disk and you don't have administrator rights, then you cannot run Cygwin or Linux on it.

You could use 'dd' to copy the whole hard disk to a larger one, then make a second partition for Linux, but that would be cheating and your IT department may find out one day when the machine breaks down. Nothing lasts forever - so don't do that.

However, you can download a Knoppix CD http://www.kernel.org/pub/dist/knoppix/ and boot that by changing the BIOS or pressing a key to get to the boot menu. That will likely suffice for most nefarious or innocent purposes, but not having access to your email and calendar could make you miss meetings and other important events, like Free Doughnuts at someone's cubicle.

Exchange

If you are a patient Geek, then you may be able to get Evolution to work with Exchange, but you may run into a problem with Active Directory authentication, depending on how smart the corporate system is set up. Also, with an encrypted hard disk, you will have nowhere to store data.

You could get around that with a USB memory stick. The best solution is to make a USB memory stick bootable version of Linux. Then you can go gaga and configure Samba Winbind for Active Directory as explained here http://aeronetworks.ca/LinuxActiveDirectory.html

Linux on a Stick

You can buy a pre-installed USB memory stick from Mandriva, or you can roll your own using 'dd'. The new Mandriva download ISO files can simply be copied to a memory stick and will boot and run just same as from a CDROM drive. Assuming that your machine has only one disk drive, then you can copy it like this:

# dd if=mandrivafile.iso of=/dev/sdb

You should use 'dmesg' to ensure that you don't get the destination wrong!

Ubuntu and Puppy Linux have the ability to make a USB bootable stick right on the main menu, so that is even easier.

Once you can boot Linux off USB, then you have the world at your feet and your IT guy will be none the wiser if you copy the regular Windows XP desktop background picture.

Half Measures - Portable Programs

Those old enough to remember DOS, will know that Windows programs do not really have to store their data in the Registry mess. There are many projects that recompile Windows programs to make them 'portable'.

All that means is that they modify the program slightly so that it doesn't store anything in the registry but rather use a local file for configuration parameters. The result is a program that doesn't need to be 'installed'. You simply copy it to your Windows hard disk or a USB memory stick and run it the old fashioned way, without the need for administrator rights.

Many portable applications are available here http://portableapps.com/. Now you can run OpenOffice Portable instead of the infernal MS Office 2007, or Firefox instead of IE.

La Voila!

Herman