Tips on MobaXterm Blog

SSH tunnels and port forwarding

Mon, 04 Jan 2016 00:00:00 +0100

Hi everyone,

Today, we will try to give you a simple explanation of a life-saver feature: SSH tunnels and port-forwarding!

There are many cases in which you will find SSH-tunnels very useful:

when your remote server is not directly accessible (behind a firewall or in a DMZ)
when your remote program only binds to 127.0.0.1 (if you are using a mysql instance only bound to localhost on your web server for instance)
when you want to secure a protocol (like VNC or X11) by transporting it through an encrypted SSH channel
when you connect to a home computer, NAS or Raspberry Pi from the Internet
when you need to get through a network equipment where only SSH protocol is allowed
when you open a connection to a remote server and need to easily open a reverse communication channel from the remote server to your local computer

In all these situations, you will be able to achieve your goal easily thanks to SSH-tunnels.

Simple explanation of SSH tunnels and port-forwarding

If you are not used with SSH tunnels, here is a simple graphical explanation on how a simple SSH-tunnel works:

This screenshot explains local port-forwarding mechanism: local clients need to connect to a remote server which cannot be reached directly through network. A SSH connection will be established from “My computer” to “SSH server” (used as a “jump host”) and the local clients will use this tunnel in order to directly connect to the remote server.

In the example above, the remote server is running a MySQL database on port 3306. In order to reach it directly, the client applications will have to connect to “localhost”, on port 12345. Their connection will be automatically forwarded through the encrypted SSH tunnel, go through the jump host and reach the remote server on port 3306.

This picture shows the mechanism called “Local port forwarding”, but there are 2 other kinds of port-forwarding:

Remote port-forwarding: this is the same principle, a tunnel is opened from local computer to jump host, but the aim is to connect from remote server to local computer.
Dynamic port-forwarding: same principle, but the dynamic tunnel allows connection to any remote hosts and any remote ports. Local applications should be compatible with this protocol and allow configuration of a "SOCKS proxy".

How to connect to remote computers using a jump host

MobaXterm makes it really easy to connect through a jump-host.

Let’s say we want to reach ServerC through SSH, telnet, RDP or VNC. Unfortunately, ServerC cannot be reached directly on the network, you have to connect to ServerB first, then from ServerB to ServerC. In MobaXterm, you just have to:

create a new SSH, telnet, RDP or VNC session
put "ServerC" in the "remote host" field
open the "Network settings" section
check "Connect through SSH gateway (jump host)
fill-in required information in order to connect to "ServerB"

This will silently create an encrypted SSH tunnel to ServerB and then use this tunnel in order to connect to ServerC.

How to connect to my Cisco router or switch behind a firewall?

It is sometimes hard to work with remote network equipments, especially when they only allow telnet connections and when telnet is disallowed in your company firewall.

There is a simple workaround if you can reach a server behind the firewall using SSH: let’s say the server you can reach using SSH is called “RemoteSshServer”.

In MobaXterm, just create a new telnet session.
Put your Cisco equipment address in the "remote host" field. This address should be the one which will be used by "RemoteSshServer".
Open the "Network settings" section and check "Connect through SSH gateway (jump host)
Fill-in required information in order to connect to "RemoteSshServer"

This will silently create an encrypted SSH tunnel to RemoteSshServer and then use this tunnel in order to connect to your network router.

How to reach my server behind multiple jump hosts?

Well in this case you will have to manually create your SSH tunnels. Do not worry, this will not be too hard.

Let’s say we want to reach “ServerD”, by using “ServerB” and “ServerC” as jump hosts.

Open "MobaSSHTunnel" from MobaXterm "Tools" menu
Click on "New SSH tunnel" and create a new local SSH tunnel to "ServerC" by using "ServerB" as jump host. Type "11111" in the "Forwarded port" field
Click on "New SSH tunnel" again and create a 2nd local SSH tunnel to "ServerD" by using "localhost" port "11111" as jump host. Type "22222" in the "Forwarded port" field
Verify that the 2 tunnels are properly started
Create a new MobaXterm session and connect to "localhost" port "22222" in order to directly reach "ServerD"

First SSH tunnel:

Second SSH tunnel:

How to reach my remote SQL server which only binds to localhost?

In this case you will also have to manually create your SSH tunnel.

Let’s say we want to reach a MySQL instance on “MyWebServer”:

Open "MobaSSHTunnel" from MobaXterm "Tools" menu
Click on "New SSH tunnel"
Create a new local SSH tunnel to remote server localhost, using remote port 3306, SSH server MysqlServer (port 22), and forwarded port 3306
Connect to your remote MySQL database using your favorite client tool by using remote address localhost, port 3306

How to securely reach my home computer, Raspberry Pi or NAS server through Internet?

If you have a Raspberry Pi, there is a specific procedure for the Raspberry Pi described in this article.

For any other equipment, here is the basic procedure:

Go to https://whatismyipaddress.com in order to know your public IP address (the address from which your house can be reached from the internet): let's say that the public IP address you obtained is 36.36.36.36 and the IP address of your equipment on your home network is 192.168.1.10.
Add a new "Port forwarding" entry in your internet router with the following configuration: port "22" from the internet is forwarded to "192.168.1.10" on port "22". It means that when someone from outside your house connects to your internet router on port 22 (SSH), its connection is redirected to your home equipment on port 22 (SSH).
From outside your home, launch MobaXterm on a Windows computer connected to the Internet
Create a new SSH session, fill the "remote host" field using your public IP address 36.36.36.36 and click on "OK"

How to set up a simple SOCKS proxy?

A SOCKS proxy is basically a service which performs “dynamic port forwarding”. In order to set up a simple socks proxy, you just have to

open "MobaSSHTunnel" from MobaXterm "Tools" menu
click on "New SSH tunnel"
check the "Dynamic SSH tunnel" setting

How to secure my VNC connection using SSH?

Basic VNC protocol is not secured, so in order to encrypt data, you can direct VNC traffic through a SSH tunnel. You will need a SSH server installed on the host where VNC server is.

On your remote server, configure the VNC-server program in order to listen only to localhost (127.0.0.1)
In MobaXterm, create a new VNC session
Set the "remote host" field to "localhost"
Open the "Network settings" section and check "Connect through SSH gateway (jump host)
Fill-in required information in order to connect to your remote SSH server

This will silently create an encrypted SSH tunnel to your remote server and then direct VNC traffic through this tunnel.

We hope that these explanations about SSH tunnels and port-forwarding will be useful for your daily work.

If you want to read more on the subject, you can read the Wikipedia articles about tunneling or port-forwarding.

Raspberry Pi without monitor or keyboard

Wed, 30 Dec 2015 00:00:00 +0100

Hi everyone!

So you have a new Raspberry Pi device and you just want to unleash its potential, but you do not have any monitor, keyboard and mouse to connect it?

In this article, we will show you in 3 simple steps how to set up and control your Raspberry Pi device without any monitor, keyboard or mouse! You will only need to download MobaXterm on your Windows desktop.

Step 1: Find my Raspberry Pi IP address

We assume you have a Raspberry Pi with a distribution already installed on SD card. If you just have a Raspberry Pi with a blank SD card, then you can follow this tutorial in order to install a new GNU/Linux OS to the SD card.

Now, this is where things are getting interesting: you should normally have a monitor and keyboard connected to your Raspberry Pi in order to set it up and to identify its IP address on your network. However, we will try to guess it without the need to use a keyboard or a monitor.

Connect your Raspberry Pi to your home network
On your Windows computer, download MobaXterm program and install it.
Start MobaXterm and open the "Tools" menu, then select "Network scanner"
Click on the "Start scan" button and wait until scan is finished (it should take ~10 seconds)

This will show you the computers connected to your home network. One of the connected computers corresponds to your Raspberry Pi: it should be the one which has a green tick in the “SSH” columns. In the example above, the Raspberry Pi device on this home network has IP address 192.168.1.16.

You should now have identified the IP address of your Raspberry Pi and you can go on to step 2.

Step 2: Connect to my Raspberry Pi from Windows

Using MobaXterm, just click on the “new session” button and choose “SSH”. Then enter the IP address of your Raspberry Pi, click on “select username” and type “pi” in the field.

Click on the “OK” button and MobaXterm will connect to your Raspberry Pi using a secure SSH connection. When prompted for a password, please type “raspberry”, which is the default password. You will then be able to change it.

Useful tips

There are many things you can do with MobaXterm in order to unleash the full Raspberry Pi potential:

you can show the entire Raspberry Pi desktop by editing your session settings, then go to the "Advanced SSH setting" section and choose "LXDE desktop" in the "Remote environment" field

you can also transfer files from/to your Raspberry Pi by checking the "SSH-browser" setting. You will then be able to transfer files using drag and drop on the "SSH-browser" (the sidebar on the left of the main MobaXterm window)

Step 3: Connect to my Raspberry Pi from Internet

If you want, you can connect to your Raspberry Pi when you are not at home. MobaXterm is great for performing this task, because it uses a secure encrypted SSH channel in order to provide full security while connecting to your Raspberry Pi.

Warning: we strongly recommend that you change the Raspberry Pi default login and password before connecting it to Internet!

In order to connect to your Raspberry Pi from the outside using MobaXterm, you can follow these steps:

Go to https://whatismyipaddress.com to know your public IP address (the address from which your house can be reached from the internet): we will assume the IP address you obtained is 36.36.36.36 and that your Raspberry Pi local address is 192.168.1.16.
Add a new "Port forwarding" entry in your internet router with the following configuration: port "22" from the internet is forwarded to "192.168.1.16" on port "22". It means that when someone from outside your house connects to your internet router on port 22 (SSH), its connection is redirected to your Pi on port 22 (SSH).
Go out of your home (this is the hardest part of the procedure, especially if it rains)
Launch MobaXterm on a Windows computer connected to the Internet
Create a new SSH session, fill the "remote host" field using your public IP address 36.36.36.36 and the username.
If you want to display the entire "LXDE desktop", then we recommend to check the "Compression" setting, in order not to use too much bandwidth.

After pressing OK and entering your password, you should be able to browse your Raspberry Pi!

We hope this tutorial will help you set up your Raspberry Pi and unleash its full potential thanks to MobaXterm!

How to keep X11 display after su or sudo

Sat, 28 Nov 2015 00:00:00 +0100

Hi everyone!

We receive a lot of emails asking how to keep X11-forwarding working after changing user to root inside a SSH session in MobaXterm. This is by default not allowed on Unix/Linux systems, because the X11 display connection belongs to the user you used to log with when connecting to your remote SSH server. X11-forwarding mechanism does not allow anyone to use the open display.

However, in some cases you may need to start a graphical application like nedit or firefox in a sudo or su context. In order to achieve this, you could manually retrieve X credentials in the su/sudo context by looking up the “xauth list” for the original username and then adding them using “xauth add” to the current context.

You can also use a single command in order to achieve this!
For instance, here are 2 simple use cases:

1. Using “sudo” command:

Let’s assume that you are connected to a remote server using SSH with username “john”
In this session, if you want to launch a graphical application using the “sudo” command (like “sudo firefox” for instance), the following error will occur:

MoTTY X11 proxy: Authorisation not recognised

In order to make it work, you just have to execute the following command before the “sudo firefox”: sudo xauth add $(xauth -f ~john/.Xauthority list|tail -1)

2. Using “su” command:

Let’s assume that you are connected to a remote server using SSH with username “john”
In this session, you want to perform a “su” command in order to become “root”
If you run a graphical application in the “su” context, like “firefox” or “xclock”, the following error will occur:

MoTTY X11 proxy: Authorisation not recognised

In order to make it work, you just have to execute the following command in order to retrieve your display and make “firefox” or “xclock” work: xauth add $(xauth -f ~john/.Xauthority list|tail -1)

We hope this will help you if you need to have a working X11 display through SSH after becoming root.

MobaXterm configuration settings

Fri, 26 Jun 2015 00:00:00 +0100

If you have to set some configuration options in MobaXterm, you would probably go to the MobaXterm configuration window.

However, in order to keep a clean and simple graphical interface, some advanced settings are not displayed in the main configuration window:

Some options can be set in MobaXterm Customizer program
Some settings can be specified using commandline parameters
Some advanced settings can be set manually, directly in MobaXterm configuration file MobaXterm.ini

We previously discussed about MobaXterm command-line parameters and MobaXterm Customization capabilities in another post, so we will now introduce some ways to modify MobaXterm settings directly into its “MobaXterm.ini” configuration file.

How to locate my MobaXterm configuration file?

Well, it depends… Your MobaXterm.ini configuration file should be located:

in the same folder as MobaXterm executable if you are using MobaXterm Portable Edition
in %MyDocuments%\MobaXterm folder if you are using MobaXterm Installer Edition
in %MyDocuments%\MobaXterm folder if you are using MobaXterm Portable Edition and if you only have read access to the folder where the executable is

Moreover, you can use the -i commandline setting in order to determine the configuration file path for MobaXterm. For instance, you can specify the configuration file path manually at MobaXterm startup using the following command: C:\Some\place\MobaXterm.exe -i “D:\Data\MobaXterm.ini”

or you can use a network shared folder: C:\Some\place\MobaXterm.exe -i “\MySharedFolder\MobaXterm.ini”

or you can even use a web (HTTP) address in order to retrieve the configuration file: C:\Some\place\MobaXterm.exe -i https://MyIntranetServer/MobaXterm.ini In this case, the configuration file will be read from your intranet and any modification made by the user will be saved in a new MobaXterm.ini file created under %MyDocuments%\MobaXterm folder.

Which settings can be put in this INI file?

There are many settings which could be put in this MobaXterm.ini configuration file. We will just list the settings which cannot be set using the graphical interface. All these settings should be put under the [Misc] section of the configuration file. These options should be used by advanced users only:

Setting	Default value	Comment
MobaTempDir	%TEMP%	Path to MobaXterm temp folder
XWinSwitches	-hostintitle +bs	Additional X11 commandline parameters
Scrollbar	1	Toggle scrollbar visibility in terminal
SeparationLine	1	Toggle separation line visibility in terminal
BoldAsFont	no	Render bold text using bold font
BoldAsColour	yes	Render bold text using different colour
BellSound	no	Play a "beep" sound when terminal bell is triggered
BellFlash	no	Flash terminal when terminal bell is triggered
AllowBlinking	no	Allow font blinking in terminal
CtrlAltIsAltGr	no	Use Ctrl+Alt keys to simulate AltGr key press
NbPenguins	4	Number of penguins for the "consolesaver"
TimerConst	600	Time (in seconds) before starting the "consolesaver"
TimerInt	100	Time (in ms) between each penguin move in the "consolesaver"
PgUpDnScroll	0	Use PageUp/PageDown without "Shift" modifier for terminal scrolling
ScrollMod	shift	Change scroll modifier to ctrl/alt/shift
ScrollbackLines	360000	Specify scrollback buffer size

Fine tuning of SFTP browser transfer settings

Concerning SFTP in MobaXterm, some settings can be tuned by editing them directly within MobaXterm configuration file (under the [SFTP] section):

Setting	Default value	Comment
AutoAdjustTransferBlock	0	Automatically adjust SFTP pipeline and packetsizes
PipelineLength	32	Number of download requests sent simultaneously
UploadPipelineLength	32	Number of upload requests sent simultaneously
DownloadBlockSize	32	Size of the single download request
UploadBlockSize	64	Size of the single upload request
SftpBufferSize	256	Size of the internal SFTP buffers
DefaultWindowSize	2048	Default SSH window size
MinWindowSize	2	Min SSH window size
MaxSSHPacketSize	256	Max SSH packet length

We hope that this post will be helpful for you. Of course, if you decide to tune these expert settings and if you report a bug to our support team, please do not forget to specify that you modified some advanced configuration settings!

Secure MobaXterm for your company

Mon, 16 Mar 2015 00:00:00 +0100

When you purchase MobaXterm Pro Edition, you get access to a registered copy of MobaXterm and another program called Customizer. Using MobaXterm Customizer, you will be able to generate customized copies of MobaXterm with your own logo and your default settings. Settings specified in the Customizer will be hard-coded within the generated executable itself.

We already discussed about MobaXterm customization in another article. We will now try to explain in details how to secure your MobaXterm installation for your company use.

MobaXterm is already a secure program: its SSH connections are based on the well-known OpenSSH program and encrypted using the OpenSSL library, its sources are available so that anyone can audit them, its passwords can be stored with strong encryption.

For home usage, MobaXterm default settings may be enough to ensure a decent security level. However, depending on your company security rules, you can disable some features which may be considered as unsafe in your professional environment.

In the Customizer program, go to the Settings tab, then to the Security tab.

Each setting can be leaved unchecked (less secure) or checked (more secure), you will have to make some choices between features and security.

For instance:

if users do not use any of the embedded servers, we recommend to check the Disable servers box: this will prevent your company users from starting one of the embedded MobaXterm daemons (SSH, telnet, VNC, HTTP, FTP, …)
if users do not need any network packet capture or network scanner / port scanner tools, we recommend to check the disable packet capture and disable network/ports scanner
you may also consider the possibility in your environment, to disable insecure protocols such as telnet, rlogin or ftp and use SSH / SFTP instead.

It is very important to be aware that MobaXterm is only a network client program and that restraining things on the client will not secure your network entirely: it is much more important to secure the server side of your network architecture. For instance, if you need to force your team members to use ssh instead of rlogin/telnet in order to access to a server: even if you restrain MobaXterm in order to prevent it from performing rlogin/telnet connections, if the server is still able to accept such protocols, your team members will still be able to download another network client and to perform insecure connections.

How to customize MobaXterm

Thu, 12 Mar 2015 00:00:00 +0100

In order to perform this operation, just launch MobaXterm_Professional_X.X.exe
After having entered your license key, you can select to customize your MobaXterm package. Then, you will have the following graphical interface:

MobaXterm customizer is based on a step-by-step process. You just have to select your parameters (or leave default settings) and select the Next button to proceed to the second step.

The different steps are described hereunder:

In this step you can configure the banner that will be displayed at MobaXterm startup. Of course, if you do not have special requirement about the banner, leave the default text, and select Next.

Step 2: Profile customization

In this step, you will have access to the default profile used at MobaXterm startup. This profile is the equivalent of the /etc/profile file on Linux operating system. If you are not familiar with profile principles, please keep the default profile and select Next.

Step 3: Settings customization

In this step, you will have a list of the different MobaXterm features. The customizer allows you to enable or disable these features. The settings allow you to remove games, screensaver or even disable insecure protocols such as RSH, Rlogin or Telnet. All these parameters will become the default settings of the generated MobaXterm application.

Step 4: Logo customization

In this step, you can choose to set your own logo for the MobaXterm startup and about windows. Just select Browse and pick a picture from your computer.

Step 5: Bookmarks customization

In this step, you will have the possibility to pre-define MobaXterm sessions. For example you can add SSH sessions and organize these sessions in different folders. After MobaXterm generation, users will have access to these pre-defined sessions. Please note that no password can be stored in the customizer.

Step 6: Plugins integration

In this step, you will have the possibility to add plugins to your MobaXterm customized package. In order to get plugins, please visit https://mobaxterm.mobatek.net/plugins.html and download the requested plugin. Then just add it thanks to the Browse button. Note that plugins have the file extension MXT3.

Step 7: Generate your customized copy / save settings

This step is the last step of the Customizer. The build function allows you to generate your own MobaXterm copy which includes all the settings chosen in previous steps.

From this step you can generate an installation package (MSI file) by clicking on Generate MSI button. You have also the possibility to create a customized portable version, by clicking on the Portable exe button

Finally you also have the possibility to save your customization settings and export them to a file, using the Save Customization button. This will allow you to open it later, or to keep it in order to apply the same settings on any further update of MobaXterm.

We will discuss about using the customizer in order to secure MobaXterm for your company in another article.

MobaXterm commandline parameters

Fri, 06 Mar 2015 00:00:00 +0100

If you use MobaXterm extensively, you may need to know some advanced commandline settings in order to specify how MobaXterm should be started and to specify if it has to perform some automatic actions just after startup. This can be useful in order to automate some repetitive tasks or in order to include MobaXterm in a script.

Here is an exhaustive list of commandline parameters you can use:

You can run a shell script directly at MobaXterm startup. You just have to launch MobaXterm with the following command line:
MobaXterm.exe <script_file>
Be careful, the shell script has to be in Unix and not Dos format!
This command can be used to start a new instance of MobaXterm and immediately execute a given MobaXterm command

MobaXterm.exe -exec "<Command>"
This command can be used to start a new tab inside a running instance of MobaXterm (or start a new instance of MobaXterm if no other instance is running) and immediately execute a given MobaXterm command

MobaXterm.exe -newtab ["<Command>"]
This command can be used to start a bookmark by specifying its name.

MobaXterm.exe -bookmark "<Bookmark_name>"
Note: this only work for 1st level bookmarks: bookmarks from subfolders can not be invoked by this command
This command can be used to start a macro by specifying its name.

MobaXterm.exe -runmacro "<Macro_name>"
This command can be used to start MobaXterm in the specified folder

MobaXterm.exe -openfolder "<Folder_name>"
This command can be used to start MobaXterm that is immediately minimized into the system tray

MobaXterm.exe -hideterm
This command can be used to exit MobaXterm when the given action is finished. This parameter should be combined with -bookmark or -exec

MobaXterm.exe -exitwhendone
This command can be used to specify a path for MobaXterm configuration file MobaXterm.ini

MobaXterm.exe -i "<Ini_file_path>"
This command can be used to write down some debug information in a log file MobaXterm.log

MobaXterm.exe -log
This command can be used to install the right-click context menu in Windows explorer

MobaXterm.exe -installshellext
This command can be used to install the URL protocol handler, in order for MobaXterm to be able to execute sessions from HTML pages

MobaXterm.exe -installprotohandler
This command can be used to start MobaXterm configuration window

MobaXterm.exe -config
This command can be used to start MobaXterm keyboard shortcuts configuration window

MobaXterm.exe -shortcuts
This command can be used to start MobaXterm documentation

MobaXterm.exe -doc
This command can be used to start MobaXterm embedded picture viewer program

MobaXterm.exe -picview
This command can be used to start MobaXterm embedded text editor MobaTextEditor

MobaXterm.exe -edit "<File1>"
This command can be used to start MobaXterm embedded diff tool

MobaXterm.exe -compfiles "<File1>" "<File2>"
This command can be used to start MobaXterm embedded folders-diff tool

MobaXterm.exe -compfolders
This command can be used to disable X server for the given MobaXterm instance

MobaXterm.exe -noX
This command can be used to scale MobaXterm interface if the fonts are too small. You can try the following values: 120 (x1.25), 144 (x1.50) or 192 (x2.00)

MobaXterm.exe -dpi 120