8 ms·
Useful things you can make SSH do
- dododo 16y agowant to log in without appearing in lastlog(8)/w(1)/who(1)? ssh -T host (of course syslog still sees you). if available, ssh-copy-id(1) is an easier way of setting up passwordless ssh(1). note also that openssh supports on-demand proxying via SOCKS4/5: check out ssh -D. this makes it easy to pipe all web traffic (for example) over ssh.
- sabat 16y agoEr, yeah, -T will work, but of course you don't get an interactive shell. Works for one-off cmds or for running a shell script or something.
- p3ll0n 16y agoTwo more that come to my mind ... 1. Comparing local and remote files $ ssh user@123.4.5.6 "cat /tmp/remotefile" | diff - /tmp/localfile 2. Outputting your microphone to a remote computer's speaker dd if=/dev/dsp | ssh -c arcfour -C username@host dd of=/dev/dsp
- dododo 16y agohah! the dsp trick actually works surprisingly well IF you combine it with lame (iirc).
- p3ll0n 16y agoyeah the quality is going to be terrible and your going to hear a lot hissing but it will work!
- jackolas 16y agomight want to try esd instead. When I was looking to try networking sound for a thin client thats the closest I got.
- gcr 16y agoPulseaudio is perfect for this nowadays. A bit more modern than esd, I'd say.
- pavel_lishin 16y agoBack in college we did something similar, but much less technologically advanced, to a roommate's linux box that he hooked up to speakers. We found a lot of fun sounds to blast at him while he slept. :)
- deleted 16y ago[deleted]
- koenigdavidmj 16y agodiff <(ssh user@host cat remote-filename) local-filename is a bit more intuitive too. You can put anything that writes to stdout in the <(), too. (Useful for decrypting or decompressing on the fly.)
- sabat 16y agoHe left off the use of proxytunnel, which lets you tunnel SSH through an HTTP/S proxy, even if it requires authentication: http://proxytunnel.sourceforge.net/usage.php http://proxytunnel.sourceforge.net/usage.php Also, as others have mentioned, -D is pretty useful (SOCKS proxy).
- deleted 16y ago[deleted]
- mjschultz 16y agoOne of the biggest 'ah-ha' moments I had with SSH was that I could create my own hosts with certain properties. For example, if I wanted a backup server with a special user and key I could add it to my ~/.ssh/config file Host backup-server HostName backup.example.com User backup IdentityFile ~/.ssh/backup_dsa Then just have a shell script run $ ssh backup-server It ended up working really well. Also, control sockets.
- mcantor 16y agoThat gives you tab completion, too!
- cypherdog 16y agoThis one is simple, but I like it. Use -X command to launch a local x11 session for a given remote application. Works for Linux and OSX machines with x11 installed. >ssh -X user@remoteserver.com will connect you. >gedit file.txt will launch a remote instance (viewable locally) of gedit with the remote file.txt loaded and ready for editing. Especially good for those who don't like command line editors (note: gedit must be installed on the remote machine for the example to work.)
- derwiki 16y agoThis is a neat trick, and I've used it a lot -- but worth pointing out that this should really only be done over a local network. X11 apps tend to be VERY chatty, and very slow when forwarded over the internet. I'd recommend VNC or FreeNX to do remote X11 apps over the internet.
- cypherdog 16y agoI absolutely agree. I work primarily on an local network at my work, so I don't often think about it.
- herrherr 16y agoMy personal favourite: - Get a cheap development box (Linode, Slicehost, etc.) - Set Firefox to use Socks Host 127.0.0.1:8080 - Open up your terminal and enter this: ssh -C2qTnN -D 8080 your-user@example.com Et voilà, you're tunneling all your browser traffic through the development box.
- timf 16y agoIf your intent is to hide what you're doing from your LAN/ISP, there is a snag with Firefox. It will leak DNS requests locally unless you go to about:config and set "network.proxy.socks_remote_dns" to "true"
- deleted 16y ago[deleted]
- vimalg2 16y agoYes, its a useful trick I often use. However, does anyone know if Chromium or Opera can do the same DNS request tunnelling? (Firefox+Linux is sluggish for me.)
- sesqu 16y agoI'm pretty sure Chrome, at least, doesn't support SOCKS yet at all. I was trying to make a shell script just the other day that would set up a SSH SOCKS proxy to a remote box and launch a browser using it, but couldn't do it from the command line in either Firefox or Chrome (didn't try a custom profile). Furthermore, I couldn't get it working in Chrome at all (shame; Firefox is more sluggish, and Opera won't even start on my box).
- nl 16y agoChrome (under both Windows & Linux - not sure about OS X) can use SOCKS - I use it regularly. I'm unsure how to make it do remote DNS look-ups though. Opera cannot do SOCKS.
- afhof 16y agoMaking a VPN over ssh using a 10.0.0.0 address: http://bodhizazen.net/Tutorials/VPN-Over-SSH/ http://bodhizazen.net/Tutorials/VPN-Over-SSH/
- Groxx 16y agoThis could really use an explanation of what the arguments are doing. It's just a list of ingredients, not a recipe; very little can be learned from this list (though it may inspire learning).
- enneff 16y agoIs "man ssh" really that hard? Is it necessary to reproduce the excellent documentation that already exists?
- Groxx 16y agoNot hard, no. And expectable, yes. But by the same token though, why document any code? It executes the same no matter what comments are around it, and all the underlying operations are well documented.
- spekode_ 16y agoThese aren't lists of ingredients, they are recipes. A typical problem with man pages is that they list the ingredients but don't give you any useful recipes. Some have an 'Examples' section but most don't. These are recipes: ingredients and parameters for them, and a short explanation of what you're going to get. Makes sense to me.
- novas0x2a 16y agoMy favorite trick (in .ssh/config): Host *.internal.workdomain.com ProxyCommand ssh gateway.workdomain.com nc %h 22 ForwardAgent yes User <username> Then you can type ssh bender.internal.workdomain.com and ssh will automatically connect through the gateway to the (normally inaccessible) internal node. ForwardAgent will pass the credentials through. (If you copy this blindly, note that this requires netcat). This configuration lets you pretend (to tools like scp, rsync-over-ssh, etc) that you have direct access to the machine in question, even when it goes through a gateway machine: scp config bender.internal.workdomain.com: scp bender.internal.workdomain.com:logfile .
- nuclear_eclipse 16y agoSimilarly, Corkscrew allows you to do the same thing, but with an HTTP proxy like Squid: Host foo ProxyCommand corkscrew proxy.domain 3128 %h %p
- jackolas 16y agoAnother config trick for multiplexing ssh connections into just one session: ControlMaster auto ControlPath ~/.ssh/master-%r@%h:%p
- ww520 16y agoMy favorite trick with SSH is running Tramp mode in Emacs to do editing on remote servers, invaluable when accessing isolated servers in data center via a jump-box server from my local machine. The fun part is the multi-host jump to editing files on a server that is couple hops away, like jumping through multiple data centers. I usually bookmarks the Tramp sessions of the frequently visited servers to avoid retyping the host url and logon setting.
- kaens 16y agoThe only gripe I have with tramp is that it seems to have an awful lot of network overhead.
- bacarter 16y agoIt's important to encrypt your private key with a passphrase. Use ssh-agent to store the un-encrypted key in memory on login. On OSX 10.5 or greater, this is really easy: http://bit.ly/alDMhp http://bit.ly/alDMhp. Make sure to add 'ForwardAgent Yes' to your ssh config, and then never have to type your ssh password again.
- deleted 16y ago[deleted]
- LiveTheDream 16y agoIt is almost as bad to have your passphrase-protected key permanently stored in ssh-agent, because anyone with access to your machine can use the key without the passphrase. A better solution is to use ssh-agent with the -t option to establish a lifetime (after which you will need to re-enter the passphrase). My setup is to keep ssh-agent running with a 2-hour lifespan, and connect to that automatically when I log in. Basically this: $ ssh-agent -t 7200 > ~/.ssh-agent $ echo "source ~/.ssh-agent" >> ~/.bash_profile $ [... log in ...] $ ssh-add I am not annoyed by re-entering my passphrase every two hours.
- evaryont 16y agoThis. The parent's idea is similar to storing the user's password forever in memory for sudo. As any ol' neckbeard could tell you, that's a Bad Thing.
- jerf 16y agoCheck 'man ssh' for escape characters, including for how to terminate an SSH session when the remote is not responding. Check 'man sshd' for the AUTHORIZED_KEYS FILE FORMAT section. I call particular attention to the "command='command'" option, which allows you to set up an SSH key in such a way that it can only be used to run a particular command. Of course the key is only as secure as the command, but that's a great start. I use it for when I want to cron a job where one server has to talk to another to do something as some privileged user, and of course can't enter a password then, but I don't want the key to grant full login privs as that user.
- surki 16y agoGot a computer behind a firewall whose configuration you don’t have access to? It’s pretty easy to get the computer behind the firewall to poke out to another server. (step 1, from the computer you wish to access) derwiki@firewalledcomputer:~$ ssh -R localhost:2002:localhost:22 mypublicserver.com (step 2, from any computer than can access mypublicserver.com) derwiki@mylaptopontheinternet:~$ ssh mypublicserver.com -p 2002 (authenticate) derwiki@firewalledcomputer:~$ If you want to keep it running always, you may want to consider "autossh" (restarts ssh connections if they ever exit/disconnect)
- _pi 16y agoI'm just gonna say this, NEVER have SSH keys without a password and say it's a secure way for a passwordless logon. It's unsecure and your keys can get used against you. Giving your key a strong password and using ssh-agent and ssh-add will give you passwordless logons and the benefit of security.