To get full access to our network from external locations we provide a VPN access based on openvpn. This is free software and part of every Linux distribution. The following guide has been tested with Ubuntu.

For Linux we recommend the graphical configuration with [[VPN with Networkmanager]].

It is available for Windows and MacOS too.

=== Install OpenVPN ===

It is not part of the default installation, but can easily installed using apt. Enter the following commands:

sudo apt install openvpn

This requires to enter your password to get super user privileges.

=== Command line configuration ===

We have setup a new VPN gateway. Please use this configuration and report problems.

This configuration routes all traffic trough ITP. This is useful if you want to download papers, which are restricted to the university network.
The second examples only routes the traffic going directly to the ITP trough the VPN and leaves your default gateway untouched. The only difference is the missing 'redirect-gateway' statement [http://th.physik.uni-frankfurt.de/~thw/vpn/all-via-itp.ovpn]

<pre>
client
dev tun
proto udp
nobind
remote vgw.itp.uni-frankfurt.de
verify-x509-name vgw.itp.uni-frankfurt.de name
remote-cert-tls server
resolv-retry infinite
auth-user-pass
ca private-ca-itp.crt
# Comment this, if you don't want to redirect the default gateway
redirect-gateway def1
</pre>

Download our CA (Certificate of Authority) [http://th.physik.uni-frankfurt.de/~thw/vpn/private-ca-itp.crt] and store it in the same place. This file is needed for the verification of the authenticity of the server.

For only accessing internal services and routing your the normal traffic to your normal uplink use the following configuration: [http://th.physik.uni-frankfurt.de/~thw/vpn/itp.ovpn]

<pre>
client
dev tun
proto udp
nobind
remote vgw.itp.uni-frankfurt.de
verify-x509-name vgw.itp.uni-frankfurt.de name
remote-cert-tls server
resolv-retry infinite
auth-user-pass
ca private-ca-itp.crt
</pre>

=== Start the VPN connection ===

Open a terminal and change to the path where the vpn config file is stored. Start the connection with

sudo openvpn itp.ovpn

where itp.ovpn is the name of the config file. openvpn needs root access, therefore you must enter your local password for sudo. After this you have to enter your ITP credentials (Username and Password).

If everything went fine the output will look like:

<pre>
Fri Dec 7 15:03:00 2012 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
Fri Dec 7 15:03:00 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Dec 7 15:03:00 2012 UDPv4 link local: [undef]
Fri Dec 7 15:03:00 2012 UDPv4 link remote: [AF_INET]141.2.246.2:1194
Fri Dec 7 15:03:00 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Dec 7 15:03:00 2012 [FIAS-ITP_Generic_VPN_Service] Peer Connection Initiated with [AF_INET]141.2.246.2:1194
Fri Dec 7 15:03:02 2012 TUN/TAP device tap0 opened
Fri Dec 7 15:03:02 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Dec 7 15:03:02 2012 /sbin/ifconfig tap0 10.63.131.1 netmask 255.255.0.0 mtu 1500 broadcast 10.63.255.255
Fri Dec 7 15:03:02 2012 Initialization Sequence Completed
</pre>

Termiate the session by pressing Ctrl-C in this terminal.

==OpenVPN for Windows 10==

At the time of writing, you can download OpenVPN on 'https://openvpn.net/community-downloads/'.
Download the exe-file for Windows 10 and install OpenVPN.
Start 'OpenVPN GUI'. You will get a message that no config file was found. But starting 'OpenVPN GUI' creates a directory to put the config files into.

Next you need to download our CA (Certificate of Authority) [http://th.physik.uni-frankfurt.de/~thw/vpn/private-ca-itp.crt] and the config file [http://th.physik.uni-frankfurt.de/~thw/vpn/all-via-itp.ovpn].

Some Browsers, depending on the download method, save some of these files as standard text files '.txt'. If this happens, you need to rename them to 'private-ca-itp.crt' and 'all-via-itp.ovpn'. With standard configuration Windows 10 does not show the endings of the file names. The endings are correct if for 'all-via-itp.ovpn' the file type is shown as 'OpenVPN Config' and for 'private-ca-itp.crt' as 'Sicherheitszertifikat' or 'security certificate'.

You need to copy/save both files to C:/Users/'yourusername'/OpenVPN/config/, where 'yourusername' is your local username. In the picture below, the directory with the two needed files in it for a german Windows 10 is shown (for the username 'user'). (For both is assumed that 'C' is, as for most Windows systems, your main hard drive.)

[[File:Openvpn-win10-1.png|center]]

If 'OpenVPN GUI' is started, you can find it in the lower right corner where the minisymbols are. Most likely you need to click on the small arrow first. It is the symbol with the computer screen and the lock symbol. Right click on the symbol and you get a menu where the first option is to connect. Click this option. This menu has less entries if the settings are not found. Then control the previous step.

[[File:Openvpn-win10-2.png|center]]

After a few seconds you should get a login screen where you use the credentials of your itp account.

[[File:Openvpn-win10-3.png|center]]

The login takes a few seconds. Your connection was successful if no error window occurs and now the symbol in the lower right is green.

[[File:Openvpn-win10-4.png|center]]

==MacOS (tunnelblick)==

First download the itp certificate [http://th.physik.uni-frankfurt.de/~thw/vpn/private-ca-itp.crt] and configuration file [http://th.physik.uni-frankfurt.de/~thw/vpn/all-via-itp.ovpn]. If a '.txt' was added to the configuration file name, remove the ending '.txt'. At the end the two files should normally be namend 'private-ca-itp.crt' and 'all-via-itp.ovpn'.

Download the last stable release of the software tunnelblick [https://tunnelblick.net/downloads.html] and execute the dowloaded file.

[[File:Tunnelblick1.png|center|750px]]

After completion of the installation, a new icon appears in the top bar. Drag and drop the downloaded configuration file to this new icon to add the configuration to tunnelblick. Most likely you do not need to add the certificate manually (it was enough to download it and is handled automatically). Alternatively double-clicking the .ovpn file will also start the import. Both files are copied to system. The original files are no longer referred.

[[File:Tunnelblick2.png|center|750px]]

Now you can connect to the itp vpn via the new tunnelblick icon.

Open the settings page, like shown in the screenshot below and make sure the Default Route Option is selected. This option is ignored from the ovpn configuration.

[[File:Ovpn_settings_default_route.jpg|center|750px]]

If something fails look into the log of the connection. It also includes multiple times the path to place where the configuration file (tunnelblick automatically renames it into 'config.ovpn') and the certificate are stored. The exact path varies depending on your previous choice to use the configuration just for the current user or for all users.

[[File:Tunnelblick3.png|center|750px]]

In this case the configuration file and the certificate are located in '/Library/Application Support/Tunnelblick/Shared/all-via-itp.tblk/Contents/Resources'. If you need to edit or replace the configuration file or the certificate, this can be done in this directory. If there is just the configuration file in the directory, then copy the certificate to the in the log mentioned directory.

==Problems changing the vpn settings in tunnelblick (macOS)==

There were problems reported when switching in tunnelblick from the old vpn (vpn.th.physik.uni-frankfurt.de with tap) to the new one (vgw.itp.uni-frankfurt.de with tun). You also have this problem if, after applying the new configuration file itp.ovpn, the vpn does not work and the output contains a line containing 'vpn.th.physik.uni-frankfurt.de'. Search the output for a line beginning with '--config' and ending on '.ovpn'. This line specifies which configuration file (.ovpn) is used to establish the vpn connection and where it is located. Edit this file to have the same content as the itp.ovpn [http://th.physik.uni-frankfurt.de/~thw/vpn/itp.ovpn] (most likely the lines 2, 5 and 6 need to be edited).

==Warning in tunnelblick (macOS)==
If you get the following warning, you can check the box and click OK.
[[File:Tb-warn.png|center|500px]]

== Replacing the CA Certificate in macOS ==

When importing the configuration, the crt file is copied to somewhere in the system (see above). If you replace the crt file in your download or whatever folder it will not be used. The simpliest way to fix this is to delete the configuration from Tunnelblick and reimport it.

This is needed after the replacment of the CA certificate in Nov 2020. This lives for 5 years. Next replacment will be in 2025, if we are still using openVPN then.

File:Ovpn settings default route.jpg

2020-11-25T15:51:49Z

Thw:

VPN Access

2020-11-25T15:41:38Z

Thw: /* Replacing the CA Certificate in macOS */

To get full access to our network from external locations we provide a VPN access based on openvpn. This is free software and part of every Linux distribution. The following guide has been tested with Ubuntu.

For Linux we recommend the graphical configuration with [[VPN with Networkmanager]].

It is available for Windows and MacOS too.

=== Install OpenVPN ===

It is not part of the default installation, but can easily installed using apt. Enter the following commands:

sudo apt install openvpn

This requires to enter your password to get super user privileges.

=== Command line configuration ===

We have setup a new VPN gateway. Please use this configuration and report problems.

This configuration routes all traffic trough ITP. This is useful if you want to download papers, which are restricted to the university network.
The second examples only routes the traffic going directly to the ITP trough the VPN and leaves your default gateway untouched. The only difference is the missing 'redirect-gateway' statement [http://th.physik.uni-frankfurt.de/~thw/vpn/all-via-itp.ovpn]

<pre>
client
dev tun
proto udp
nobind
remote vgw.itp.uni-frankfurt.de
verify-x509-name vgw.itp.uni-frankfurt.de name
remote-cert-tls server
resolv-retry infinite
auth-user-pass
ca private-ca-itp.crt
# Comment this, if you don't want to redirect the default gateway
redirect-gateway def1
</pre>

Download our CA (Certificate of Authority) [http://th.physik.uni-frankfurt.de/~thw/vpn/private-ca-itp.crt] and store it in the same place. This file is needed for the verification of the authenticity of the server.

For only accessing internal services and routing your the normal traffic to your normal uplink use the following configuration: [http://th.physik.uni-frankfurt.de/~thw/vpn/itp.ovpn]

<pre>
client
dev tun
proto udp
nobind
remote vgw.itp.uni-frankfurt.de
verify-x509-name vgw.itp.uni-frankfurt.de name
remote-cert-tls server
resolv-retry infinite
auth-user-pass
ca private-ca-itp.crt
</pre>

=== Start the VPN connection ===

Open a terminal and change to the path where the vpn config file is stored. Start the connection with

sudo openvpn itp.ovpn

where itp.ovpn is the name of the config file. openvpn needs root access, therefore you must enter your local password for sudo. After this you have to enter your ITP credentials (Username and Password).

If everything went fine the output will look like:

<pre>
Fri Dec 7 15:03:00 2012 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
Fri Dec 7 15:03:00 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Dec 7 15:03:00 2012 UDPv4 link local: [undef]
Fri Dec 7 15:03:00 2012 UDPv4 link remote: [AF_INET]141.2.246.2:1194
Fri Dec 7 15:03:00 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Dec 7 15:03:00 2012 [FIAS-ITP_Generic_VPN_Service] Peer Connection Initiated with [AF_INET]141.2.246.2:1194
Fri Dec 7 15:03:02 2012 TUN/TAP device tap0 opened
Fri Dec 7 15:03:02 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Dec 7 15:03:02 2012 /sbin/ifconfig tap0 10.63.131.1 netmask 255.255.0.0 mtu 1500 broadcast 10.63.255.255
Fri Dec 7 15:03:02 2012 Initialization Sequence Completed
</pre>

Termiate the session by pressing Ctrl-C in this terminal.

==OpenVPN for Windows 10==

At the time of writing, you can download OpenVPN on 'https://openvpn.net/community-downloads/'.
Download the exe-file for Windows 10 and install OpenVPN.
Start 'OpenVPN GUI'. You will get a message that no config file was found. But starting 'OpenVPN GUI' creates a directory to put the config files into.

Next you need to download our CA (Certificate of Authority) [http://th.physik.uni-frankfurt.de/~thw/vpn/private-ca-itp.crt] and the config file [http://th.physik.uni-frankfurt.de/~thw/vpn/all-via-itp.ovpn].

Some Browsers, depending on the download method, save some of these files as standard text files '.txt'. If this happens, you need to rename them to 'private-ca-itp.crt' and 'all-via-itp.ovpn'. With standard configuration Windows 10 does not show the endings of the file names. The endings are correct if for 'all-via-itp.ovpn' the file type is shown as 'OpenVPN Config' and for 'private-ca-itp.crt' as 'Sicherheitszertifikat' or 'security certificate'.

You need to copy/save both files to C:/Users/'yourusername'/OpenVPN/config/, where 'yourusername' is your local username. In the picture below, the directory with the two needed files in it for a german Windows 10 is shown (for the username 'user'). (For both is assumed that 'C' is, as for most Windows systems, your main hard drive.)

[[File:Openvpn-win10-1.png|center]]

If 'OpenVPN GUI' is started, you can find it in the lower right corner where the minisymbols are. Most likely you need to click on the small arrow first. It is the symbol with the computer screen and the lock symbol. Right click on the symbol and you get a menu where the first option is to connect. Click this option. This menu has less entries if the settings are not found. Then control the previous step.

[[File:Openvpn-win10-2.png|center]]

After a few seconds you should get a login screen where you use the credentials of your itp account.

[[File:Openvpn-win10-3.png|center]]

The login takes a few seconds. Your connection was successful if no error window occurs and now the symbol in the lower right is green.

[[File:Openvpn-win10-4.png|center]]

==MacOS (tunnelblick)==

First download the itp certificate [http://th.physik.uni-frankfurt.de/~thw/vpn/private-ca-itp.crt] and configuration file [http://th.physik.uni-frankfurt.de/~thw/vpn/all-via-itp.ovpn]. If a '.txt' was added to the configuration file name, remove the ending '.txt'. At the end the two files should normally be namend 'private-ca-itp.crt' and 'all-via-itp.ovpn'.

Download the last stable release of the software tunnelblick [https://tunnelblick.net/downloads.html] and execute the dowloaded file.

[[File:Tunnelblick1.png|center|750px]]

After completion of the installation, a new icon appears in the top bar. Drag and drop the downloaded configuration file to this new icon to add the configuration to tunnelblick. Most likely you do not need to add the certificate manually (it was enough to download it and is handled automatically). Alternatively double-clicking the .ovpn file will also start the import. Both files are copied to system. The original files are no longer referred.

[[File:Tunnelblick2.png|center|750px]]

Now you can connect to the itp vpn via the new tunnelblick icon.

If something fails look into the log of the connection. It also includes multiple times the path to place where the configuration file (tunnelblick automatically renames it into 'config.ovpn') and the certificate are stored. The exact path varies depending on your previous choice to use the configuration just for the current user or for all users.

[[File:Tunnelblick3.png|center|750px]]

In this case the configuration file and the certificate are located in '/Library/Application Support/Tunnelblick/Shared/all-via-itp.tblk/Contents/Resources'. If you need to edit or replace the configuration file or the certificate, this can be done in this directory. If there is just the configuration file in the directory, then copy the certificate to the in the log mentioned directory.

==Problems changing the vpn settings in tunnelblick (macOS)==

There were problems reported when switching in tunnelblick from the old vpn (vpn.th.physik.uni-frankfurt.de with tap) to the new one (vgw.itp.uni-frankfurt.de with tun). You also have this problem if, after applying the new configuration file itp.ovpn, the vpn does not work and the output contains a line containing 'vpn.th.physik.uni-frankfurt.de'. Search the output for a line beginning with '--config' and ending on '.ovpn'. This line specifies which configuration file (.ovpn) is used to establish the vpn connection and where it is located. Edit this file to have the same content as the itp.ovpn [http://th.physik.uni-frankfurt.de/~thw/vpn/itp.ovpn] (most likely the lines 2, 5 and 6 need to be edited).

==Warning in tunnelblick (macOS)==
If you get the following warning, you can check the box and click OK.
[[File:Tb-warn.png|center|500px]]

== Replacing the CA Certificate in macOS ==

When importing the configuration, the crt file is copied to somewhere in the system (see above). If you replace the crt file in your download or whatever folder it will not be used. The simpliest way to fix this is to delete the configuration from Tunnelblick and reimport it.

This is needed after the replacment of the CA certificate in Nov 2020. This lives for 5 years. Next replacment will be in 2025, if we are still using openVPN then.

New Accounts

2020-11-25T15:32:14Z

Thw:

The following information is needed for an account creation for a new member/student/guest of the ITP:

* '''Name:''' Name of the new member.

* '''Room:''' The room number of the room the new member will work at. If the person will not have an office in the ITP/GSC, we use the office of the supervisor to have a connection to the group.

* '''Telephone:''' If there exists a telephone in the room, then the telephone number of this telephone.

* '''Expiration Date:''' Until which date is the account needed? (end of the contract; deadline of the bachelor/master thesis; or end of visit of a long term guest) (The expiration date can be extended if the contract/deadline/visit is extended.)

* '''Notice of the working group:''' A short notice from the head of the working group or the corresponding secretariat that this person will work in the corresponding group (a short email sent from the secretariat directly to us is enough).

* '''Name of the HRZ-account:''' Each member and long term guest of the ITP, who wants an ITP-account, additionally needs an account of the HRZ and needs to tell us the account name. Students of the Goethe University should already have a HRZ-account (beginning with the the letter s and followed by several digits). '''Important:''' As soon as the HRZ-account expires, the ITP-account expires to. Even if the account was created with a later expiration date.

After the account creation, the new member/student/guest can get their account information at room 01.128. No account information is given by email or telephone.

'''Attention:''' Due to the closed building in Covid-19 times, the accounts can not be picked up personally. For this, we can send the welcome sheet to the secretaries printer. We have also implemented a mail service which sends encrypted, one time links to the registered HRZ mail address.

2020-03-30T12:34:46Z

Thw:

Graphical Remote Login with xrdp

2020-03-26T12:26:51Z

Thw: /* Connect using remmina (Linux) */

If you are using a Linux desktop system or Windows 10, then you can remotely login into a Linux session on our main login server zeta. For macOS this should work similar to Linux, but is not tested.

To use this service you either need to connect to the ITP VPN or need to establish a ssh-tunnel.

How to use the ITP VPN with openvpn is described in [[VPN Access]] and with Networkmanager in [[VPN with Networkmanager]]. In most cases we recommend NetworkManager.

We first describe the settings needed if the ITP VPN is used. A description for ssh-tunnel is further below. If you use a Linux operating system or macOS and did not already configure the ITP VPN, the configuration with ssh-tunnel is shorter.

If you disconnect from a xrdp session (on purpose or by a network error), you can reconnect to the same session in the next 24 hours. To completely end a session you need to log out inside of your xrdp session instead of interrupting the connection. All session, which are not connected for over 24 hours, are automatically terminated.

==Set the window manager (Linux, macOS, Windows 10)==
You can skip this section if you want gnome as your window manager of your remote login session.

The window manager cannot be set by a menu. Instead it is set bin the content of the file '.xsession' in your home directory of your ITP account. Most likely this file does not exist in your account. If you connect to xrdp without this file in your home directory, then (before starting the window manager) this file is created such that gnome is started as window manager.

You can manually override your '.xsession' to choose another window manager. Here is a list of supported window managers and which needs to be the content of the '.xsession':

gnome: gnome-session

kde: startkde

xfce: xfce4-session

lxsession: lxsession -s LXDE -e LXDE

==Connect using remmina (Linux)==

If it is not already installed on your system, install the xrdp client remmina (sudo apt-get install remmina). Other clients like vinagre should work to.

Before you can connect with remmina, you need to establish a vpn connection to the ITP or establish an ssh-tunnel (see further below).

Open remmina.

In remmina do not directly connect, as the connection does not work with the standard settings. Instead click on the plus sign in the upper left corner to set up the configuration for a new connection.

[[File:Remmina1.png|center]]

In the new window choose a 'Name' for your connection and in the line 'Server' you need to enter 'zeta'.
Choose a custom resolution. You can also use the resolution of your client, but the performance decreases with very high resolutions.

[[File:Remmina2.png|center]]

In the section 'Colour depth' you need to choose another entry. The options 'GFX AVC444' and 'GFX AVC420' do not work. Choose one of the other options.

[[File:Remmina3.png|center]]

After saving your setting, you should have a new entry in your remmina main screen. Double click on this new entry to establish the xrdp connection.

[[File:Remmina4.png|center]]

After a few seconds you should get the following login screen.

[[File:Remmina5.png|center]]

Now you can log into a graphical session running on the login server zeta. This normally starts a gnome session. If you want another window manager please read the corresponding section on this page above.

'''Note:''' If you encounter connection problems with Remmina in recent Ubuntu Versions, specifying Username and Password in the configuration dialog skipps the login dialog. Do this only if you can trust your Linux installation.

==Connect with Windows 10 ==

For Windows 10 you eihter to establish a connection to the itp-vpn or establish a ssh-tunnel with Putty (for ssh-tunnel see further below).

The rest is very simple. In the window search menu search for 'remote'. In a german Window 10 you start the 'Remotedesktopverbindung' app. In english this should also begin with 'Remote desktop'.

[[File:Remote-win10-1.png|center]]

In the next window enter 'zeta' as server (use 'localhost' instead of 'zeta' if you are using a ssh-tunnel). Under options you can change various things as the wanted resolution. But the standard setting also work. If the performance is to slow, try reducing the resolution in the options.

[[File:Remote-win10-2.png|center]]

You can click yes in the next window.

[[File:Remote-win10-3.png|center]]

Now you should get a login screen where you can log in with your itp account (see the Linux section above for a picture of the login screen).

==SSH-Tunnel instead of VPN==

Instead of VPN you can also tunnel port 3398 to establish a connection to the xrpd server.

===Terminal based ssh-tunnel===

Just open a terminal and enter 'ssh -L 3389:localhost:3389 yourusername@itp.uni-frankfurt.de', where 'yourusername' needs to be replaced by your itp username. After a successful connection, do not close the terminal as else the ssh-tunnel is closed.
In your client software (e.g. remmina) use as server 'localhost' instead of 'zeta'.

===ssh-tunnel in remmina===
Instead of using the ITP VPN, you can add an ssh-tunnel directly in remmina. For this first change the server from 'zeta' to 'zeta.itp.uni-frankfurt.de'.

[[File:Remmina-ssh-1.png|center]]

Then in the connection menu switch to the tab 'SSH Tunnel'. Check the box 'Enable SSH tunnel', check 'Same server at port 22', enter your itp username at 'User name' and check 'Password'.
Now, before connecting to xrdp, a ssh-tunnel is established where you need to enter your itp password.
If you use ssh-keys to establish connection, you need to change the authentication method.

[[File:Remmina-ssh-2.png|center]]

===Putty===
If you use a ssh-tunnel with Putty, then change in your client software (e.g. remmina) the server 'zeta' to 'localhost'.

Install Putty through your software manager or for Windows go to https://www.putty.org/ follow the link and download and install Putty.

After opening Putty enter 'itp.uni-frankfurt.de' in the 'Host Name (or IP address)' field.

[[File:Putty-1.png|center]]

On the left side extend at the bottom the menu 'SSH' and go to the submenu 'Tunnels'. Add '3389' as 'Source port' and 'localhost:3389 as 'Destination'. Then click on 'Add'.

[[File:Putty-2.png|center]]

Go back back to the previous menu by clicking on 'Session' in the upper left corner. Under 'Saved Sessions' choose a session name of your liking and click on 'Save'. Later you can reload your settings by selecting the session name and clicking on 'Load'.

To establish your connection click on 'Open'.

[[File:Putty-3.png|center]]

You should get a login screen for your ssh-tunnel where you log in with your itp account. If you close this window, the ssh-tunnel is terminated.

[[File:Putty-4.png|center]]

Now start your client for the xrdp connection (remember to change 'zeta' to 'localhost' in your client settings).

Graphical Remote Login with xrdp

2020-03-26T12:22:18Z

Thw:

If you are using a Linux desktop system or Windows 10, then you can remotely login into a Linux session on our main login server zeta. For macOS this should work similar to Linux, but is not tested.

To use this service you either need to connect to the ITP VPN or need to establish a ssh-tunnel.

How to use the ITP VPN with openvpn is described in [[VPN Access]] and with Networkmanager in [[VPN with Networkmanager]]. In most cases we recommend NetworkManager.

We first describe the settings needed if the ITP VPN is used. A description for ssh-tunnel is further below. If you use a Linux operating system or macOS and did not already configure the ITP VPN, the configuration with ssh-tunnel is shorter.

If you disconnect from a xrdp session (on purpose or by a network error), you can reconnect to the same session in the next 24 hours. To completely end a session you need to log out inside of your xrdp session instead of interrupting the connection. All session, which are not connected for over 24 hours, are automatically terminated.

==Set the window manager (Linux, macOS, Windows 10)==
You can skip this section if you want gnome as your window manager of your remote login session.

The window manager cannot be set by a menu. Instead it is set bin the content of the file '.xsession' in your home directory of your ITP account. Most likely this file does not exist in your account. If you connect to xrdp without this file in your home directory, then (before starting the window manager) this file is created such that gnome is started as window manager.

You can manually override your '.xsession' to choose another window manager. Here is a list of supported window managers and which needs to be the content of the '.xsession':

gnome: gnome-session

kde: startkde

xfce: xfce4-session

lxsession: lxsession -s LXDE -e LXDE

==Connect using remmina (Linux)==

If it is not already installed on your system, install the xrdp client remmina (sudo apt-get install remmina). Other clients like vinagre should work to.

Before you can connect with remmina, you need to establish a vpn connection to the ITP or establish an ssh-tunnel (see further below).

Open remmina.

In remmina do not directly connect, as the connection does not work with the standard settings. Instead click on the plus sign in the upper left corner to set up the configuration for a new connection.

[[File:Remmina1.png|center]]

In the new window choose a 'Name' for your connection and in the line 'Server' you need to enter 'zeta'.
Choose a custom resolution. You can also use the resolution of your client, but the performance decreases with very high resolutions.

[[File:Remmina2.png|center]]

In the section 'Colour depth' you need to choose another entry. The options 'GFX AVC444' and 'GFX AVC420' do not work. Choose one of the other options.

[[File:Remmina3.png|center]]

After saving your setting, you should have a new entry in your remmina main screen. Double click on this new entry to establish the xrdp connection.

[[File:Remmina4.png|center]]

After a few seconds you should get the following login screen.

[[File:Remmina5.png|center]]

Now you can log into a graphical session running on the login server zeta. This normally starts a gnome session. If you want another window manager please read the corresponding section on this page above.

==Connect with Windows 10 ==

For Windows 10 you eihter to establish a connection to the itp-vpn or establish a ssh-tunnel with Putty (for ssh-tunnel see further below).

The rest is very simple. In the window search menu search for 'remote'. In a german Window 10 you start the 'Remotedesktopverbindung' app. In english this should also begin with 'Remote desktop'.

[[File:Remote-win10-1.png|center]]

In the next window enter 'zeta' as server (use 'localhost' instead of 'zeta' if you are using a ssh-tunnel). Under options you can change various things as the wanted resolution. But the standard setting also work. If the performance is to slow, try reducing the resolution in the options.

[[File:Remote-win10-2.png|center]]

You can click yes in the next window.

[[File:Remote-win10-3.png|center]]

Now you should get a login screen where you can log in with your itp account (see the Linux section above for a picture of the login screen).

==SSH-Tunnel instead of VPN==

Instead of VPN you can also tunnel port 3398 to establish a connection to the xrpd server.

===Terminal based ssh-tunnel===

Just open a terminal and enter 'ssh -L 3389:localhost:3389 yourusername@itp.uni-frankfurt.de', where 'yourusername' needs to be replaced by your itp username. After a successful connection, do not close the terminal as else the ssh-tunnel is closed.
In your client software (e.g. remmina) use as server 'localhost' instead of 'zeta'.

===ssh-tunnel in remmina===
Instead of using the ITP VPN, you can add an ssh-tunnel directly in remmina. For this first change the server from 'zeta' to 'zeta.itp.uni-frankfurt.de'.

[[File:Remmina-ssh-1.png|center]]

Then in the connection menu switch to the tab 'SSH Tunnel'. Check the box 'Enable SSH tunnel', check 'Same server at port 22', enter your itp username at 'User name' and check 'Password'.
Now, before connecting to xrdp, a ssh-tunnel is established where you need to enter your itp password.
If you use ssh-keys to establish connection, you need to change the authentication method.

[[File:Remmina-ssh-2.png|center]]

===Putty===
If you use a ssh-tunnel with Putty, then change in your client software (e.g. remmina) the server 'zeta' to 'localhost'.

Install Putty through your software manager or for Windows go to https://www.putty.org/ follow the link and download and install Putty.

After opening Putty enter 'itp.uni-frankfurt.de' in the 'Host Name (or IP address)' field.

[[File:Putty-1.png|center]]

On the left side extend at the bottom the menu 'SSH' and go to the submenu 'Tunnels'. Add '3389' as 'Source port' and 'localhost:3389 as 'Destination'. Then click on 'Add'.

[[File:Putty-2.png|center]]

Go back back to the previous menu by clicking on 'Session' in the upper left corner. Under 'Saved Sessions' choose a session name of your liking and click on 'Save'. Later you can reload your settings by selecting the session name and clicking on 'Load'.

To establish your connection click on 'Open'.

[[File:Putty-3.png|center]]

You should get a login screen for your ssh-tunnel where you log in with your itp account. If you close this window, the ssh-tunnel is terminated.

[[File:Putty-4.png|center]]

Now start your client for the xrdp connection (remember to change 'zeta' to 'localhost' in your client settings).

Graphical Remote Login with xrdp

2020-03-26T12:21:27Z

Thw:

If you are using a Linux desktop system or Windows 10, then you can remotely login into a Linux session on our main login server zeta. For macOS this should work similar to Linux, but is not tested.

To use this service you either need to connect to the ITP VPN or need to establish a ssh-tunnel.

How to use the ITP VPN with openvpn is described here [[VPN Access]] and with Networkmanager in [[VPN with Networkmanager]].

We first describe the settings needed if the ITP VPN is used. A description for ssh-tunnel is further below. If you use a Linux operating system or macOS and did not already configure the ITP VPN, the configuration with ssh-tunnel is shorter.

If you disconnect from a xrdp session (on purpose or by a network error), you can reconnect to the same session in the next 24 hours. To completely end a session you need to log out inside of your xrdp session instead of interrupting the connection. All session, which are not connected for over 24 hours, are automatically terminated.

==Set the window manager (Linux, macOS, Windows 10)==
You can skip this section if you want gnome as your window manager of your remote login session.

The window manager cannot be set by a menu. Instead it is set bin the content of the file '.xsession' in your home directory of your ITP account. Most likely this file does not exist in your account. If you connect to xrdp without this file in your home directory, then (before starting the window manager) this file is created such that gnome is started as window manager.

You can manually override your '.xsession' to choose another window manager. Here is a list of supported window managers and which needs to be the content of the '.xsession':

gnome: gnome-session

kde: startkde

xfce: xfce4-session

lxsession: lxsession -s LXDE -e LXDE

==Connect using remmina (Linux)==

If it is not already installed on your system, install the xrdp client remmina (sudo apt-get install remmina). Other clients like vinagre should work to.

Before you can connect with remmina, you need to establish a vpn connection to the ITP or establish an ssh-tunnel (see further below).

Open remmina.

In remmina do not directly connect, as the connection does not work with the standard settings. Instead click on the plus sign in the upper left corner to set up the configuration for a new connection.

[[File:Remmina1.png|center]]

In the new window choose a 'Name' for your connection and in the line 'Server' you need to enter 'zeta'.
Choose a custom resolution. You can also use the resolution of your client, but the performance decreases with very high resolutions.

[[File:Remmina2.png|center]]

In the section 'Colour depth' you need to choose another entry. The options 'GFX AVC444' and 'GFX AVC420' do not work. Choose one of the other options.

[[File:Remmina3.png|center]]

After saving your setting, you should have a new entry in your remmina main screen. Double click on this new entry to establish the xrdp connection.

[[File:Remmina4.png|center]]

After a few seconds you should get the following login screen.

[[File:Remmina5.png|center]]

Now you can log into a graphical session running on the login server zeta. This normally starts a gnome session. If you want another window manager please read the corresponding section on this page above.

==Connect with Windows 10 ==

For Windows 10 you eihter to establish a connection to the itp-vpn or establish a ssh-tunnel with Putty (for ssh-tunnel see further below).

The rest is very simple. In the window search menu search for 'remote'. In a german Window 10 you start the 'Remotedesktopverbindung' app. In english this should also begin with 'Remote desktop'.

[[File:Remote-win10-1.png|center]]

In the next window enter 'zeta' as server (use 'localhost' instead of 'zeta' if you are using a ssh-tunnel). Under options you can change various things as the wanted resolution. But the standard setting also work. If the performance is to slow, try reducing the resolution in the options.

[[File:Remote-win10-2.png|center]]

You can click yes in the next window.

[[File:Remote-win10-3.png|center]]

Now you should get a login screen where you can log in with your itp account (see the Linux section above for a picture of the login screen).

==SSH-Tunnel instead of VPN==

Instead of VPN you can also tunnel port 3398 to establish a connection to the xrpd server.

===Terminal based ssh-tunnel===

Just open a terminal and enter 'ssh -L 3389:localhost:3389 yourusername@itp.uni-frankfurt.de', where 'yourusername' needs to be replaced by your itp username. After a successful connection, do not close the terminal as else the ssh-tunnel is closed.
In your client software (e.g. remmina) use as server 'localhost' instead of 'zeta'.

===ssh-tunnel in remmina===
Instead of using the ITP VPN, you can add an ssh-tunnel directly in remmina. For this first change the server from 'zeta' to 'zeta.itp.uni-frankfurt.de'.

[[File:Remmina-ssh-1.png|center]]

Then in the connection menu switch to the tab 'SSH Tunnel'. Check the box 'Enable SSH tunnel', check 'Same server at port 22', enter your itp username at 'User name' and check 'Password'.
Now, before connecting to xrdp, a ssh-tunnel is established where you need to enter your itp password.
If you use ssh-keys to establish connection, you need to change the authentication method.

[[File:Remmina-ssh-2.png|center]]

===Putty===
If you use a ssh-tunnel with Putty, then change in your client software (e.g. remmina) the server 'zeta' to 'localhost'.

Install Putty through your software manager or for Windows go to https://www.putty.org/ follow the link and download and install Putty.

After opening Putty enter 'itp.uni-frankfurt.de' in the 'Host Name (or IP address)' field.

[[File:Putty-1.png|center]]

On the left side extend at the bottom the menu 'SSH' and go to the submenu 'Tunnels'. Add '3389' as 'Source port' and 'localhost:3389 as 'Destination'. Then click on 'Add'.

[[File:Putty-2.png|center]]

Go back back to the previous menu by clicking on 'Session' in the upper left corner. Under 'Saved Sessions' choose a session name of your liking and click on 'Save'. Later you can reload your settings by selecting the session name and clicking on 'Load'.

To establish your connection click on 'Open'.

[[File:Putty-3.png|center]]

You should get a login screen for your ssh-tunnel where you log in with your itp account. If you close this window, the ssh-tunnel is terminated.

[[File:Putty-4.png|center]]

Now start your client for the xrdp connection (remember to change 'zeta' to 'localhost' in your client settings).

Graphical Remote Login with xrdp

2020-03-26T12:20:08Z

2020-02-17T10:26:11Z

Thw: /* Getting Started */

This article shows you how to log into our VPN network without using the terminal. This method is by far more convenient and you also may find this helpful if you are not very familiar with command lines.
We will use a VPN Plugin called network-manager.

==Installation==

Open up a terminal of your choice (Ctrl + T) and install OpenVPN Network Manager by typing the following line:

sudo apt-get install network-manager-openvpn-gnome

Please enter your password to confirm the installation.

After the successful installation NetworkManager must be restartet:

sudo service network-manager restart

Again, confirm with your password if necessary.

== Getting Started ==

 [[File:step_01.png|thumb|x50|Menu in the top right corner in Ubuntu 14.04]]
[[File:Settings-network.png|thumb|x50|Settings menu in Ubuntu 18.04]]
[[File:Settings-network-vpn.png|thumb|x50|VPN Settings in Ubuntu 18.04]]
[[File:Settings-network-vpn-ex.png|thumb|x50|Advanced VPN Settings in Ubuntu 18.04]]

To get VPN access you must set up a new VPN connection first. Click on the two arrow symbol (or the WiFi symbol - depending on which connection you are currently using) in the top right corner.
: Now choose <code>VPN Connections -> Configure VPN...</code>. 
A new window will open up.
: Click on <code>Add</code> to add a new connection. 
You will be asked for the connection type.
: Choose <code>OpenVPN</code> and click on <code>Create...</code>.
If in the top right corner the option <code>VPN Connections</code> does not exist, the open the normal settings and add a new openvpn connection in <code>Network</code>.

Next you need to edit and configure your connection. Choose any connection name (e.g. itp_openvpn). 

For the '''Gateway''' type:
vgw.itp.uni-frankfurt.de

(old gateway: vpn.itp.uni-frankfurt.de)

Under '''Authentication''' select <code>Password</code> as authentication type. Enter your user name and password and choose the CA Certificate 'private-ca-itp.crt'. It can be downloaded [http://th.physik.uni-frankfurt.de/~thw/vpn/private-ca-itp.crt here].

Your new VPN connection will be listet in '''Network Connections'''.

==Using a VPN Connection==
To access a VPN network just click on the arrow or WiFi symbol on the top right corner. Your configured connection should be found under '''VPN Connections'''.