Connecting to FBaPS services remotely

Tags: Faq

Introduction
Resyncing your password
Connecting to the Aber VPN
Connecting to the remote teaching service
Connecting to central filestore

Introduction

I have been asked to write this document to act as a basic HowTo for connecting to University-wide and FBaPS-supplied teaching services.

Much of the information in this document is also available via the IS FAQ pages. However, the information in the FAQs is a bit fragmented and can be quite difficult to put together. Where relevant, I will put links to the IS-supplied documentation.

This document also covers computing services provided directly by FBaPS which are therefore not covered at all by the IS FAQs.

– Alun Jones, auj@aber.ac.uk, September 2020.

Resyncing your password

When IS first send us your account details, they are only able to send Windows password data immediately after you’ve changed/set your password. If, for some reason, you become eligible for an account on our systems after you have activated your account with IS, the data they send us will not contain your Windows password and you will be unable to log in to any of our Windows desktop machines, either locally or via the remote service.

It’s therefore a very good idea to visit the IS Resync your Password page before you first try to access any of our desktop machines.

You will only need to do this once - subsequent password changes will work fine.
It’s safe for anyone to use, whether or not their password is already in sync, so I’d recommend that all new students do it.
It takes around 15 minutes before IS sends us the data, so I’d recommend you do it well before your first practical in any of our rooms.

Connecting to the Aber VPN

Aberystwyth University has a firewall protecting much of the internal network from external hacking. To access many internal services from outside campus, you need first to connect to the Aber Virtual Private Network (VPN) service. Once you are connected to the VPN, your computer acts as though it is directly connected to the Aber network, and all traffic from your computer will be tunnelled into Aber. It is worth noting, at this point, that you should only use the VPN when you need access to the Aber internal network - otherwise you will be tunnelling everything you do into and out of Aber, which is likely to impact on your Netflix viewing experience!

N.B. You only need to use the VPN when connecting from outside the Aber network. If you’re connecting from halls or over eduroam WiFi, you do not need to connect using the VPN.

Setting up multi-factor authentication (MFA)

The relevant IS FAQ page for this step is here.

The Aber VPN requires multi-factor authentication (MFA). When connecting, you are required to enter your Aber username and password, along with a six digit “One Time Pad” (OTP) access code. Your OTP code changes every 30 seconds and you need an application installed somewhere to tell you what your current code is.

While you might have already done this for Office365 at some point, the VPN uses a different OTP code. The numbers generated for one are incompatible with the other.

Setting up MFA has to be done from a machine on the campus network. It cannot be done from home. However, you need to be able to run the application at home to generate OTP codes when connecting to the VPN. For this reason, if you have an Android or Apple phone/tablet, I would strongly recommend using a Mobile app rather than desktop software. Here are the details:

Recommended OTP apps

On phone/tablet
Use either Google Authenticator (Android) (iPhone) or Microsoft Authenticator (Android) (iPhone).
Windows
IS recommend using WinAuth. Download the Zip file, double click to open it and drag the program onto your desktop.
Linux
IS recommend using OTPClient. This is available in the standard software repositories on the most common Linux distro’s and I would suggest you use your normal package manager to find and install it rather than installing from source.
macOS
While IS recommend using Authy on macOS, installing it requires that you disclose your mobile phone number and email address. It is also quite complicated to import tokens into this application. If you wish to use Authy, please use the IS FAQ.

A preferable alternative is “Step Two” in the App store. It doesn’t require any personal details and can scan the IS QR code directly. I would recommend that you use this instead.

Generating and Installing Your OTP Token

Once you have installed one of the above applications, you need to set up MFA on your Aber account and import your “Token” into your chosen OTP app. This has to be done from on the Aber network (eduroam or a wired connection on campus)

Visit https://mfa.aber.ac.uk/
Log in using your Aber username/password
Click “Enroll Token”
On the next page, enter “VPN” (or whatever you like) into the “Description” box and click the “Enroll Token” button below it. The next page will display a QR code.

What you do next will depend on the app you installed above.

Google Authenticator (Mobile devices)
Open the app on your phone. If you have never run it before, you might be presented with some introductory questions. You can skip all of those. When you get to the “Add an account” page, click on “Scan a barcode”. You may then be asked to allow the app to take pictures. Click “Allow”. Point your phone camera at the QR code on the screen until the app has managed to read it. Google Authenticator will then start showing you six digit OTP codes.

Microsoft Authenticator (Mobile devices)
Open the app on your phone. If you have never run it before, you might be presented with some introductory questions. You can skip all of those. When you get to the “Accounts” page, click on Add Account. Then click on “Other account”. You may then be asked to allow the app to take pictures. Click “Allow”. Point your phone camera at the QR code on the screen until the app has managed to read it. Microsoft Authenticator will then start showing you six digit OTP codes.

WinAuth (Windows)
Right click on the QR code and select “Copy Image Location” or “Copy image address”.

Open the WinAuth application (you previously saved it to your desktop) and click “Add”, then select “Authenticator” from the dropdown.

Right click on the text box next to the “Decode” button and select “paste”.

Enter a descriptive name (e.g. Aber VPN) into the “Name” box. Then click “Verify Authenticator”. The app should then show you a six digit code. Press “OK”. If you get an error about WinAuth failing to decode the URL, go back to the web page, click “Regenerate QR Code” and try copying/pasting the new image.

After a short pause, WinAuth will then give you the option of protecting the code. It is up to you whether you password protect it. If you don’t feel the need, untick the “Protect with my own password” box and click “OK”. WinAuth will then show you your current OTP code in a small window.

OTPClient (Linux)
Open OTPClient. If you have never used it before, it will ask you to create a password-protected database to hold your data. Follow the instructions until you get to the main OTPClient screen.

Right click on the QR code in your web browser and select “Copy Image”.

Now switch back to OTPClient and click the “+” button to add a code. Select “Using a QR Code”, then “From Clipboard”.

All being well, a “TOTP” item should appear in the main window and, when you click on it, it should show a six digit code.

It will also put that code onto the clipboard and show you a countdown timer for how long the code will remain valid.

“Step Two” (macOS)
Open Step Two and click the “+” icon to add an account. Select “Scan Two-Step QR Code” from the menu.

A window named “QR Code Scanner” will open.

Go back to your web browser and drag the QR code from it into the “QR Code Scanner” window.

Hit “Continue” and your MFA token (named “PAU”) should be added to the main “Step Two” window, along with the current six digit code.

Whenever you open Step Two in future, it will show you your current OTP code.

Connecting to the VPN from Windows

The relevant IS FAQ page for this step is here.

While you can install the software while your home computer is on campus, you cannot use the VPN from within the Aber network (eduroam wireless or the wired network) and, if you try, you will get connection errors. If you have a phone with “hotspot” capabilities, you could connect your computer to that to test via the mobile network, but I will leave it to you to figure that one out!

The software is very easy to install. Download and run it from here. Click “Yes” or “Next” at every prompt and “Close” once it says it has installed.

You should now have a small, grey circular icon in your system tray area:

Click on it. The first time you do this, you will be asked for your “portal address”. Enter pa-vpn.aber.ac.uk and click “Connect”. If you get an error at this stage, check that you are connected to a working WiFi/wired/4G network. Note again that this will not work from Aber’s eduroam network.

You should then be prompted for your username and password. These should be your Aber username and password. The username should not contain the “@aber.ac.uk” part (e.g. use auj rather than auj@aber.ac.uk).

The next prompt will ask you for your OTP code. This is the six digit number from the Authenticator app software that you installed earlier. Start whichever app you chose and enter the number it shows. The number is nominally valid for 30 seconds, but you are given a bit of leeway, so don’t worry if you overrun the time a bit.

Once you have entered the code, the VPN should connect and the grey icon in the system tray should turn blue & green, at which point you will realise it’s supposed to be an icon of the Earth!

Connecting to the VPN from Linux

The relevant IS FAQ page for this step is here.

Lots of people have had trouble with the “official” GlobalProtect VPN package for Linux. It makes edits to your system’s global bash “profile” files and, in at least one case I have seen, these changes have completely prevented someone from logging into their laptop. I have tried installing it so I could document the process, but was unable to establish a working connection. For me, it just sat in a loop, constantly requesting my username and password.

If you wish to use it, please visit the IS page above. But I don’t recommend it at present on Linux.

There is an open source project, OpenConnect which works well when connecting to the Aber VPN service. I have been using it for 6 months with no problems and, when I have pointed other people at it, they have not tended to come back with problem reports.

OpenConnect is present in the default repositories of various distro’s, but be aware you will need version 8.0 or above for GlobalProtect compatibility. Ubuntu and Mint 20.x have this in their default software repositories. For older versions of Mint and Ubuntu, I have compiled the version that comes with recent Debian builds, and that seems to work. So…

If your repository contains OpenConnect 8.0.0 or above, you can just install and use it.

If you are on Mint 19.x, install OpenConnect from the standard repository (to get its dependencies) then download my packages of libopenconnect5 and openconnect. Next, open a terminal and install them. Assuming you have downloaded them to your Downloads folder, you can do:

cd ~/Downloads
sudo dpkg --install libopenconnect5_8.02-1+deb10u1_amd64.deb openconnect_8.02-1+deb10u1_amd64.deb

NetworkManager plugin

Versions of Mint/Ubuntu prior to 19.x don’t have the GlobalProtect support built into the NetworkManager plugin.

On Mint/Ubuntu 20.x, the plugin exists (networkmanager-openconnect-gnome) but, due to a long-standing bug it doesn’t set up the default route through the VPN properly. So, while you can connect to the VPN using the friendly GUI, it doesn’t actually work!

While there are various workarounds that can fix this, I recommend just using the command line tool below.

Command line usage

At home, I just open a terminal and use the following command line to connect to the Aber VPN:

sudo openconnect --user=auj --protocol=gp pa-vpn.aber.ac.uk

Of course, you should change the --user=auj part to use your Aber username, rather than mine!

Connecting to the VPN from macOS

The relevant IS FAQ is here.

First, download and run the GlobalProtect agent installer. Accept the default values for all prompts. A greyed out globe should appear on the right hand side of the menu bar. Click on it to open the “Welcome to GlobalProtect” window and enter “pa-vpn.aber.ac.uk” as the portal address. Click “Connect”. It should then ask for your username and password. Enter your Aber username (without the @aber.ac.uk) and pasword and click “Sign In”. It should then ask for your OTP code. Enter it and click “Sign In”. You should then be connected to the VPN.

Connecting to the remote teaching service

SSH services

Information Services offer ssh access to central.aber.ac.uk. Just use your favourite ssh client to connect, and you shouldn’t need to have the VPN running to do so.

Under Windows, our recommended SSH client is Putty. Under Linux or macOS, you would normally use the default “ssh” command line client.

In-browser access to desktops and SSH servers

IS are offering clientless remote access to their desktop via a web page. Just browse to https://rd.aber.ac.uk/. You will be presented with a login page. Log in with your Aber username (without @aber.ac.uk) and password.

You will be presented with a list of connections.

central is the central.aber.ac.uk SSH service.
Public Service is the IS Windows desktop.

Click on either and you should be logged in, with the appropriate desktop being presented via your web browser.

It’s not made obvious in the user interface, but if you hit Ctrl-Alt-Shift within the browser window, a side bar will open with options to create an on-screen keyboard and configure how your mouse should behave. This is helpful if you need to send keyboard combinations which conflict with your local machine’s keyboard mappings (e.g. Ctrl-Alt-Del).

FBaPS desktop

We have installed our own copy of the in-browser access service, for connecting to our own teaching desktops. This is available at https://remote-desktops.dcs.aber.ac.uk and works in exactly the same manner as the IS one. This service requires that you have a VPN connection up and running.

It is possible that IS will also add connectivity to our teaching desktops via their service. We are waiting on their input on this.

Native clients

Due to the wide variety of client software, we will not be providing detailed documentation for this, but you can connect directly to the service using standard remote access tools.

On Windows, you can use the standard terminal services client to connect to our Windows desktop, and any VNC client (e.g TightVNC) to connect to Linux and macOS.

On Linux, Remmina has plugins providing access to both Windows RDP and Linux/macOS VNC.

macOS has a built in VNC client (Finder -> Go -> Connect to Server) and the app store has a free Windows Remote Desktop client.

Windows desktop

This is available via RDP (Microsoft Terminal Services) as windows-desktop.dcs.aber.ac.uk. You will have to accept a warning about an SSL certificate the first time you connect.

Linux & macOS desktops

These are available via VNC as linux-desktop.dcs.aber.ac.uk:0 and mac-desktop.dcs.aber.ac.uk:0 respectively. Depending on the capabilities of your client software, you may end up with an unencrypted connection and receive a popup warning about it. If you’re using the VPN, the traffic will be encrypted for most of its journey in any case, only passing unencrypted over the last hop within the Aber network.

Connecting to central filestore

Information Services provides personal filestore which is mapped as M: on their desktop machines. We provide a larger area which is P: on our Windows machines. Both areas of filestore provide backup, so if you store your data on one of these, it should be possible to restore it in case of disaster. M: is backed up regularly by Information Services. P: is backed up twice daily by us.

Both P: and M: are connected automatically when you log into the FBaPS Windows and Linux desktops.

In the case of Windows, several default locations (e.g. Documents, Pictures, Downloads) are redirected into your P: drive and much of your home folder on the C: drive is synchronised across to P: when you log out.

On Linux, P: appears as /impacs/{your username} and is mapped as your home folder. So almost everything you do on Linux will be saved safely onto the network filestore. M: appears as /aber/{your username} so you can access IS content via that location.

On macOS, due to performance issues, we do not connect any network filestore automatically. If you need to access your IS or FBaPS filestore from a Mac in B57, please follow the instructions below to connect to it.

You may find it convenient to connect to this filestore from home. If accessing from off campus, you will first need to establish a VPN connection for almost all the options below.

Connecting to your filestore from Windows

Open the file manager and click on “This PC”
In the menu bar, select “Computer”, then “Map network drive”
Choose a drive name from the dropdown. We tend to use M: for your IS filestore and P: for your FBaPS filestore.
For IS filestore, enter \\smb1.aber.ac.uk\your-username (e.g. \\smb1.aber.ac.uk\auj)
For FBaPS filestore, enter \\homefs.imaps.aber.ac.uk\your-username (e.g. \\homefs.imaps.aber.ac.uk\auj)
Click “Finish”
An “Enter network credentials” window will appear.
For IS filestore, enter your username as PAU\your-username (e.g. PAU\auj)
For FBaPS filestore, enter your username as IMAPS\your-username (e.g. IMAPS\auj)
Enter your normal Aber password. You might also wish to click “Remember my credentials” so that you don’t have to re-enter your password every time you connect.
Click OK and the drive should connect.

Connecting to your filestore from Linux

Connecting to network filestore on Linux is a problem. Not in terms of whether it can be done, but in terms of describing how to do it. In the GUI, the method will depend on the distro, desktop and file manager you are using and, to an extent, even the versions of those.

Personally, I would recommend using the sshfs method where possible. This probably has the least pitfalls and also avoids needing a working VPN connection.

Connecting via sshfs

sshfs is present in the standard repositories on most distros. You will need to install it before you can use this method.

sshfs uses the sftp protocol (part of ssh) to mount filestore from a remote server. Since it only relies on ssh, you can use it without needing to bring up the VPN.

You can use sshfs (to shellsrv.dcs.aber.ac.uk) to connect to any filestore that is mounted on that machine. This includes your personal space provided by IS (M: drive) and FBaPS (P: drive).

Obviously the location you choose to mount the filestore is entirely up to you. As an example, I will assume that you have created a folder called “aber” and, inside it, folders named “IS” and “FBaPS”.

Just to show the directory structure I have set up at home:

$ pwd
/home/auj/aber
$ ls
FBaPS   IS

Mounting the filestores - you might not have a “dcs” filestore - just mount the ones you want. Note also the trailing slashes on the paths. This is certainly needed for /aber/auj/, and can do no harm for the others:

$ sshfs auj@shellsrv.dcs.aber.ac.uk:/aber/auj/ IS
$ sshfs auj@shellsrv.dcs.aber.ac.uk:/impacs/auj/ FBaPS

Demonstrating it works - I can now see my (somewhat minimal) IS filestore:

$ ls -l IS
total 456
drwxr-xr-x 1 6001 6001   4096 Nov  6  2018 cgi-bin
drwxr-xr-x 1 6001 6001   4096 Jun 12  2019 public_html
-rw------- 1 6001 6001 456448 Mar 24 09:11 redirect.log

To unmount the filestore, you should use the “fusermount” command:

$ fusermount -u IS
$ fusermount -u FBaPS

Connecting via a “cifs” mount

This would be my second-place recommendation. It is slightly more flexible because you can use it to connect to any network share to which you have access in Aber.

However, it is a bit more complicated because…

…you need to have a working VPN before you can use this method. See above.
… you need to know the connection details for each share, and these can differ quite widely across shares. Getting the details wrong will give you hard-to-diagnose error messages.
… ‘'’chmod’’’ commands will almost certainly not do what you expect.

CIFS is present in the standard repositories on most distro’s. You will need to install it before you can use this method.

As with sshfs, I will assume you have created a directory named “aber”, into which you will create subdirectories for your various mounts, and have changed directory into “aber”.

IS Central filestore (M:)

$ mkdir IS # if it doesn't already exist
$ sudo mount -t cifs -o username=auj,domain=PAU,uid=$USER //smb1.aber.ac.uk/auj IS

FBaPS personal filestore (P:)

$ mkdir FBaPS # if it doesn't already exist
$ sudo mount -t cifs -o username=auj,domain=IMAPS,uid=$USER //homefs.imaps.aber.ac.uk/auj FBaPS

Disconnecting

To disconnect from a share, you should use e.g.:

$ sudo umount FBaPS

Through a GUI

You need to find the dialogue, in your file manager software, which allows you to connect to Windows (or SMB or Samba) network filestore. Depending on your software, you may be asked to enter connection details in various ways. As above, I will use “auj” as the username for these examples. Please change as appropriate!

IS personal filestore (M:)

Server name: smb1.aber.ac.uk
Share name: auj
Username: auj
Domain: PAU
Windows-style connection string: \\smb1.aber.ac.uk\auj
Unix-style connection string: //smb1.aber.ac.uk/auj
URI-style connection string: smb://PAU;auj@smb1.aber.ac.uk/auj

FBaPS personal filestore (P:)

Server name: homefs.imaps.aber.ac.uk
Share name: auj
Username: auj
Domain: IMAPS
Windows-style connection string: \\homefs.imaps.aber.ac.uk\auj
Unix-style connection string: //homefs.imaps.aber.ac.uk/auj
URL-style connection string: smb://IMAPS;auj@homefs.imaps.aber.ac.uk/auj

Connecting to your filestore from Mac OS

Open Finder and select the “Connect to Server” item in the “Go” menu.

In the “Connect to Server” window, enter the appropriate share name (details in the next section) and click on “Connect”.

All being well, you should then receive a prompt to click “Connect” to continue, followed by a popup requesting your username and password (and whether to save them in your keyring). Enter the appropriate username and password (again, details in the next section) and click “Connect”. The drive should then appear in the “Locations” section of your Finder windows.