« first day (1053 days earlier)      last day (3064 days later) » 

12:00 AM
this thing here that you wrote:
However, if I want to support SSH tunneling, my understanding is that my Android app would still post to my PHP API, but instruct to open an SSH tunnel, for example forwarding local port 3307 to remote host example.com on port 3306. Then PHP would connect to MySQL via 127.0.0.1 on port 3307.
...
This is fine, except if another user then decides to use port 3307 at the same time another user is doing a tunnel the second user would clash as the first user already has 3307 open so they would need to pick a new port.
...
Now, it is not as if a server listening on a port like 3306 is a one time use thing
that is the listening port. You can have hundreds of users on that port
 
Yea that's right, but if a user chooses to port forward from 3307 to 3306 my server would create a local port to 3306 and then port forward to the remote host on port 3306. If two users do the same thing, although different remote hosts, my server would attempt to create a new 3307 port locally which would get rejected.
e.g. user 1 > goes from my server on port 3307 to forward to example1.com on 3306.
User 2 > goes from my server on port 3307 to forward to example2.com on port 3306. User 1 will already have 3307 bound on my web server so user would get an error as it wouldn't be able to create a new port, or it would send the request to user1 server not the user 2 server
 
I honestly don't understand how the concept of port forwarding even factors into any of this
Let's start real simple
you have an android user, and we agree presumably there is no mysql native client for Android, right?
 
that's right
 
and for whatever reason, there is a need for direct access to a mysql server that has data and that data is on your side
 
no, the users data would be there own database server, my server is just acting a middle ground to talk between the users mysql database and my android app
 
12:09 AM
so they have the data. You wrote the Android app. You have the service. And the users go through you to get to some other party's mysql servers
Or said another way, only you talk to mysql servers
 
that's right. Maybe mysqlmanager.boardiesitsolutions.com/api_download.htm will give you a clue as to what the app does
 
Ok, so the stuff from boardiesitsolutions has gotta be you, due to your name
 
yea that's right
 
so the Android user gets to choose between trusting you guys for an outsourced simplicity or go it alone.
 
yep
 
12:14 AM
Their Android app can talk to you or to their own PHP (or some layer) and circumvent you
 
fyi, everything sent between the API and the app is encrypted and we do not store any information retrieved from the database. They have the option through the setting to use our server or install our API on there own server and point the app to post to their server and not ours
 
I wasn't questioning any trust part of it just trying to understand the arrow going from A to B
so are you trying to solve just your end of it, their end of it, both?
 
Na that's fine just so you knew. Not sure what you mean solve my end, their end or both.
 
I know that was vague.
Let's call going to you A. Them going direct B. Which or both
 
Both ideally, but if the API only supports B to avoid ports conflicts and accidental cross server connection, i.e. user 2 accidently trying to auth with user 1 server then that is fine
 
12:22 AM
when you say API, is it safe to say you are referring to a PHP api at the moment that works, or an extended next version
 
no when I say the API its the current PHP API
 
Ok, so Android user, going B, then the user goes direct to Acme Corp on PHP, and your concern is that the Acme mixes up clients and servers completely on their end?
unless it is taken care of
 
No. I'm assuming if they've chosen option B, they're technically minded and no what their doing and if they mix up clients and servers that's their kinda problem. My worry is if using option A then 2 completely unrelated users accessing 2 completely unrelated database servers accidently going to the others database
 
oh, I was reading above where you started with the words Both ideally
ok, so the focus is on them going A, to you, and on your end messing up directing traffic
 
Yea, when I said both I meant tunnelling working on both versions but the issue to solve is if going via option A. Sorry I confused things a tad I think
 
12:30 AM
np. So let's say there are Jim and Kate. Jim goes to Acme1, and Kate to Acme2, and both thru you.
They do this via PHP and you authenticate. Let's forget about security and SSL for now or at all
So you now you have their requests and let's just say they are authenticated and skip that part for now
So how in general do you currently direct traffic back to get stuff from Acme1 and Acme2? Thru PHP again, or thru mysqli or pdo or the like?
 
mysqli. So what happens is the app posts to the API the mysql host, user, password etc. We use this posted data to use mysqli to connect PHP to the database, run whatever query on the connected database and pass the result back to the app, as soon as the result is returned we close the database
 
and that all works. Now. With Jim and Kate and Acme1 and Acme2?
 
yea that's right
 
And what has come up is that an Acme(n) out that is queezy about security?
And wants SSH
 
yea
 
12:39 AM
So how is it that you securely authenticate Jim from Kate on your end (let's assume there isn't even a socket open to Acme yet)
 
At the moment they can't collide with each other, they're 2 completely different PHP sessions and PHP is directly connecting to their database so there is no way for them to accidentally hit the others server
 
like I said, we aren't even talking about their mysql servers yet. Just from your Android app, on its first handshake with you, have you nailed that down as to who that user is? Is that secure?
 
There is no authentication between the app and the API, there's no need, they just enter there mysql details and click submit it sends to the server and does its thing. Its only secure in the sense that the data sent between the app and the server is encrypted on the device/api side
 
Is it encrypted going over the air to you, or is it cleartext in a POST
because if that isn't buttoned down, I wouldn't concern yourself too much with SSH yet
I could masquerade as Jim or Kate
 
Its only posting over HTTP so the only encryption is relying solely on the device encrypting and the web server decrypting and vice versa
We are looking at getting an SSL cert so we can post via HTTPS in the future
 
12:47 AM
so make sure that is the case. Encrypted over the wire. So now Jim gets into you. You say you have no Jim authentication, but rather a connection string. Same for Kate
I see that needing to change perhaps.
Give me a bit. I need to get my head into the SSH side of it
btw what other programming languages do you program in just in case
 
Yea don't forget though the connection string itself isn't posted, only the various parts of the connection string, which are encrypted, then posted, decrypted by the server and then connects, so the connecting string isn't sent in plain text over the wire.
 
right. glad to hear that
 
We know PHP/C#/Java/ bit of bash
 
that string could be used as a sort of authentication
the thing you want to get to is an array of sorts of SSH keys.
and the ACME(n) guys need to have SSH servers obviously running on their end
Please read this link I wrote up: stackoverflow.com/a/31909044
generation of SSH keys happen off those links in that answer (links to things others wrote on other websites)
I share that not to talk about OpenShift, but a guy that writes in C# and needed to make direct connects to mysql
thru SSH
 
I did think about C# for this but I was a bit reluctant as I think it would be a bit odd to have a mix API of C# and PHP, either one or the other, but rather stick with PHP for ease of install for the user if they want to install the API themselves.
 
12:57 AM
so if I were to be you, I would first attempt to have my Boardy middleware resolve the Solution thru c# and
again, I am focusing on path A right now
 
PHP tunnel support does seem to be a bit naf, but I think I may be able to do what I want to achieve by using PHP terminal commands to create the tunnel instead, although would still have the issue with the port conflicts but if tunnel is only supported on there server may get a way with it
Although would still have the port conflict problem if it was C# doing it instead thinking about it
 
I still don't get the port confict and the 2nd user thing
give me a second to explain
 
With the tunnel, I don't know if you know much about SSH tunnels, admittidely I've only just learnt about it, but the tunneling works on port forwarding
So basically, the idea is you create an SSH tunnel from server a on port 3307 to server b on 3306. This will create a tunnel on the local server so all traffic that hits port 3307 locally will be sent to server b on 3306 so once the tunnel is set up you can then connect to mysql using 127.0.0.1 on port 3307.
Although you are connecting to mysql on 127.0.0.1 on port 3307 you are actually talking to the mysql server on server b on port 3306
 
right. I am trying to ponder the key management of multiple tunnels
one per ACME(n)
` which is typically stored in the ~/.ssh/ directory, ` from this link: wiki.archlinux.org/index.php/SSH_keys
 
potentially each user may need multiple keys for each SSH server (the app supports connecting to multiple database servers)
 
1:10 AM
so on the first link above you have key management, on the second link you have one ssh tunnel open per ACME
 
Yea that's right, so the user would need generate the SSH key on their server and this key would need to be stored into the app so it doesn't require a password when SSH'ing to the server
 
on the Boardy side, it needs to translate the Jim and Kate coming in to know which 3307 3308 ... 33nn to go to
 
Possibly, that is one way of doing it, in which case I guess the API would need to itself have a database to tie the user with their port
I was hoping to avoid the API needing its own database, but I don't think I am going to have an option
 
a database or a SESSION array
the Android side has a SESSION php.net/manual/en/book.session.php if you start it
Jim comes in first time without a SESSION. You give him one. You find that BillyBob is already talking to ACME7. You know you are on port 3314. Jim uses that one too and that info is jammed in his SESSION
 
whether you can craft a PHP global or singleton, or need a db, whatever solves this first time in for a user to setup their SESSION
 
1:18 AM
Are you saying that each users PHP session would contain a list of all ports that are currently in use by other users.
 
you then know the port #, and you are off to the races
no I am not saying that
I am saying that you are merely trying to determine which port # 3307 and up to assign a user to knowing what is the proper destination mysql server
 
There is the other issue of SSH connections dropping, but that is a whole other issue
 
I'm not sure I follow. Are you saying then that the user chooses the local server port, so they choose 3307 to forward to their 3306 port. I'm not worried about the tunnel closing, it won't be persistent, it will open the tunnel do the required query and then close again
 
You could almost just hardcode the thing as far as port numbers go, each new ACME gets a well known port of sorts
which, if you know ports, is a rather bizarre use of the phrase well known port :P
I am not saying that the user chooses the port. I am saying the Boardy logic determines it properly
I am assuming that would be easy
 
OK, still not following completely, so Jim connects the API says port 3307 is free use that local port forwarding to 3306. Store that in Jims session. What happens when Kate joins, the API won't be able to access Jims sessions so therefore won't know 3307 is in use
 
1:33 AM
Jim sends first request. It contains encrypted info. PHP uses the block cipher to decrypt. Determines target is data2.acme7.com ... and you have other stuff in that connection string that you say Android passes. PHP determines that there is or isn't an active tunnel. Rectifies that by opening if necessary. Let's say it is housed in Boardy db that acme7 is port 3312 (always), or let's say it is dynamic and assigns one. Either way, acme7 is port N.
 
Port N is crammed into Jim's SESSION, and uses that. After some time-out period, Jim's session is destroyed. Along comes Susie. She needs ACME7 also. Boardy determines that the same tunnel can be re-used, as it is still open due to Jim's actions. Susie's session gets Port N jammed in her SESSION too
 
Kyle comes along. He is using General Electric. His ends up being like port 3323 or something. But certainly not the same local port tunnel'd to acme7
 
OK, that sounds like though that once the tunnel is open its never closed it can just keep getting reused. This could become a problem if later on down the line, lots and lots of users start tunnelling, my server could get overloaded with SSH sessions. The thing I'm not sure on though is how does the API allocate the port how would it know that acme7 is 33212 and general electric is 3323.
 
that is why I said I would do it in c#. I am not into silly php shell_exec() calls.
and I would use
why would the acme7 is 3312 and General Electric is 3323 that hard?
 
Ah I see, what I was thinking is if doing via php, when I create the SSH tunnel through the terminal command, I end the command with a & so it puts in the background. When it puts it in the background it outputs the pid and then when its finished I can just call kill <pid>.
 
1:45 AM
You could have a Boardy mysql table just hard code the thing like I said above "You could almost just hardcode the thing as far as port numbers go"
 
It wouldn't be hard, I'm being a bit slow I think, its quite late here :)
 
I am sure you are smarter than me. If I could do it, anyone can. Get some rest :P
 
Hehe. Thanks for your help, I'll have a think over it tomorrow and come up with a plan hopefully, tunnel support is a bit more complicated than I expected, if PHP tunnel functions would a bit better it would have been a lot easier
 
I agree. Over and out
 
2:01 AM
3 messages moved from Random Musings - Drew
 
2:14 AM
21 messages moved from Random Musings - Drew
22 messages moved from Random Musings - Drew
18 messages moved from Random Musings - Drew
22 messages moved from Random Musings - Drew
44 messages moved from Random Musings - Drew
14 messages moved from Random Musings - Drew
88 messages moved from Random Musings - Drew
 
2:30 AM
got the invitation and here I'm, Where is the party ?
 
 
5 hours later…
7:40 AM
Hi Previn, I hope you are able to type here. I entered your user ID to be able to type. Hopefully you are able to
alright Previn, read under question you can't type
 
8:00 AM
nothing on ois, the OIS Library that you reference here: sourceforge.net/projects/wgois
I stopped xcode / objective-c work a few years ago. That is as far as I can help you
 
user5503464
8:28 AM
any one help me out . jsfiddle.net/rpbn6u23/33 @Loktar @AwalGarg
 
 
2 hours later…
10:43 AM
1 message moved from Room for Kevin Guan and Ms Yvette
 
 
9 hours later…
user4639281
2 messages moved from SO Close Vote Reviewers
 

« first day (1053 days earlier)      last day (3064 days later) »