6 ms·
SSH Tricks
- dotBen 15y agoOk, not techically part of SSH itself but I think SShuttle[1] is one of the most awesome SSH tricks around. [1] https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle
- sunyc 15y agotoo hard , you should just use -D and tsocks
- nieve 15y agoI'm surprised that you'd say that if you actually understand what sshuttle does and you've read the tsocks (8) manpage. The ssh -D/tsocks combination is significantly more fragile due it how SOCKS proxying works & potential LD_PRELOAD problems, doesn't work at all with static binaries, works only for programs started with the preload (sshuttle is system-wide), doesn't handle async sockets, has issues with DNS, and fails with programs that do syscall() directly. The tsocks solution also fails miserably for anything but the use case of "have this program act (mostly, sorta) like it's running on this other machine's network" and can only do all or nothing for a program, no discrimination based on routes or ip. If it's too hard to alias "./sshuttle -r user@ssh 0/0 -vv" I'm not sure you should be playing with sharp objects like LD_PRELOAD...
- sunyc 15y agoWhat I say too hard, is saying this is way too much trouble for a problem that should be solved at another perspective. that is, fix the network or authorization problem.
- PHLAK 15y agoI put together a little script for just this purpose: https://github.com/PHLAK/Soxy https://github.com/PHLAK/Soxy
- sgentle 15y agoSShuttle is brilliant. For those who don't know/are skimming the comments, it's basically VPN built on SSH. You just sshuttle -r user@host 0/0 and all your outbound connections are now securely tunneled through that server. I mainly use it for watching Hulu and pretending I'm being oppressed by the government, but I suspect it's useful for other things too.
- ary 15y ago> /dev/null .known_hosts This is not a good idea (and far from "awesome"). I get why he's doing it, but suggesting that weakening the security of a tool that is meant to enhance it is bad advice.
- dlsspy 15y agoSecurity advice from someone making it easier to login as root on boxes... The first things I do with sshd on any machine are 1) disable remote root login and 2) disable password login.
- mkramlich 15y agosame here plus move it to a high non-standard port
- pestaa 15y agoBut security through obscurity... oh, wait, you actually secured the box!
- wglb 15y agoI move the port after doing the stuff he notes above, but it is for reducing the junk in the log about failed logins.
- bradleyland 15y agoSeconded! Our fail2ban processes were using a not-insignificant amount of resources while sshd was listening on port 22. Moving to a high port shifted it to somewhere in the "dead last" range in the CPU time column.
- peterwwillis 15y agoEh... bad advice in general, but awesome advice for the case he's using it in. Like he says in the post: Don't set these values for hosts that you actually care about.
- jerrya 15y agoI hadn't known about sshfs - that sounds great and I'll have to look it up. One of my favorite features is ssh forced commands, http://oreilly.com/catalog/sshtdg/chapter/ch08.html#22858 http://oreilly.com/catalog/sshtdg/chapter/ch08.html#22858 which I use on infrequently used remote servers to present menus of pre-defined commands to me or to others. And at other times, I can use it to kick off a daemon on a remote server just by ssh'ing to that remote server with the proper key. It's a simple way to create a "compile server" and then use one command line from my preferred machine to tell the compile server to check a certain directory and compile everything within it. Yeah, ssh is nice.
- beagle3 15y agoThe most magical command he didn't mention is 'ssh-copy-id'. If you can log-in to a host with password, you just 'ssh-copy-id myuser@thishost', supply the password once, and from that moment you can ssh with public key authentication. Extreme magic. Also, sshfs works great, but has some issues with memory mapped files that silently lose writes. Luckily (?) most programs don't use mmap to write files, so it's not very noticeable. All in all, ssh is one of the greatest tools.
- dotBen 15y agoI'm always sad that OS X doesn't support ssh-copy-id natively.
- deleted 15y ago[deleted]
- snprbob86 15y agoAgreed, but that's easy enough to deal with: `brew install ssh-copy-id`
- danishkhan 15y agoman this was an awesome find for me. thank you.
- vegardx 15y agoSince it's basically just a bash-script you can just copy it from any of the major Linux-distros. I've copied mine from Debian Lenny, and it works great.
- pilif 15y agoapparently it's in homebrew (see other comment), but for half an eternity, I've always been using this: ssh user@host "mkdir .ssh && cat >> .ssh/authorized_keys" < ~/.ssh/id_rsa.pub (remove the mkdir if .ssh already exists) This works as well and is using nothing but the power of the unix shell and the concept of pipes.
- xtacy 15y agoThe ssh escape sequence "~" (without quotes) comes in handy at times. "~ C" Gives you a ssh command prompt. Press ? for help. "~ ." Closes the ssh connection; useful for unresponsive ssh connections!
- LiveTheDream 15y agoWorth noting that you need a newline before the ~ for it to work. Another useful tip to know is how to set your own escape key. ssh -e ^ example.com This will set the escape key to ^ instead of ~. I had to use this recently to terminate an ssh connection that was initiated inside of a screen session on a machine I was sshed into from my laptop. Obviously, the generic ~. killed the first ssh session (on my machine), not the one in the screen. Connecting to the middle machine with ssh -e^ let me send ~. to the proper ssh session.
- fugue88 15y agoInstead of changing the escape, you can tap it one more time. So, to drop your 2nd (nested) connection: ~ ~ .
- JoshTriplett 15y agoAnother handy trick: put this script on your path somewhere, and name it "ssh-argv0": #!/bin/sh exec ssh "${0##*/}" "$@" Then create symlinks to ssh-argv0 for common hostnames you ssh to, shortened using host aliases as suggested in the article. You now have a command for each host, which you can use as a prefix like sudo to run a single command on that host. For instance, "myth sudo reboot". If you're used to using "ssh user@box foo", and not always for the same user (in which case you could use "User" in .ssh/config), you can do the same thing via "box -l user foo"
- robtoo 15y agoHuh. ssh used to offer this feature natively -- just symlink any hostname to the ssh binary -- but it turns out that they removed this about ten years ago. (I feel old...)
- mhw 15y agoA feature which was copied from rlogin and rsh, I seem to remember. Me too.
- davvid 15y ago${0##*/} ... are you looking for the basename(1) command? Posix requires support for this usage, but it does not work with many traditional shells, e.g., Solaris 10 /bin/sh. Here's how to work around it: #!/bin/sh exec ssh "$(basename "$0")" "$@" FWIW it's a little easier to read, too.
- apaprocki 15y agoSun was so into keeping backward compatibility intact they would not update the default /bin/sh because of some compatibility issues that could affect customers. So they included the newer XPG4 sh in a different location (it is a POSIX-compliant ksh88): /usr/xpg4/bin/sh. So you can write: #!/usr/bin/env sh So that users who have setup PATH=/usr/xpg4/bin:$PATH get the correct shell and everything works fine.
- JoshTriplett 15y ago
- jpdoctor 15y agoAnyone know how to ensure 8 bits worth of keyboard are passed? (Run emacs over ssh and you sometimes get stuck without the meta key working.)
- 0x12 15y agomy personal favorite, a one liner to set up an email tunnel on a non-privileged port: ssh -f username@mymailserver.com -L 2000:mymailserver.com:25 -N
- darrikmazey 15y agoAnother trick I especially like is to use the command="" syntax inside of an authorized_keys file to allow a user to execute certain commands via ssh, especially handy for git-shell.
- koenigdavidmj 15y agohttp://www.funtoo.org/wiki/Keychain http://www.funtoo.org/wiki/Keychain is also quite nice.
- primo44 15y agoIn case the article's author stops by: - loose rhymes with "goose". The word is "lose".
- gnu6 15y agoNice use of /tmp, I hope you're the only one on your machine.
- brown9-2 15y agoI believe ssh-agent has always written it's socket files to /tmp, in directories readable only by the user. If you disagree with this, criticize the program, not the user.
- sneak 15y agoI'm not sure how this could omit "ssh -D". Also, is it just me, or might his ssh-reagent bash function add keys to some other user's ssh agent process if they've sufficiently modified the permissions on their socket file in the temporary directory to allow you to write to it?
- zobzu 15y agogpg-agent. ;-)
- jvogt 15y agoI have a lot of machines I regularly connect to. Parsing the known_hosts file and adding to my shell's tab completion was a nice timesaver. Here's the line from my .bash_profile complete -W "$(echo `cat ~/.ssh/known_hosts | cut -f 1 -d ' ' | sed -e s/,.*//g | uniq | grep -v "\["`;)" ssh
- RyanMcGreal 15y ago+1 for sshfs, which comes in handy for backing up my hard drive to an external machine.
- there 15y agomany shells can be setup to autocomplete a list of hosts parsed from ~/.ssh/known_hosts. for tcsh, see http://www.opensource.apple.com/source/tcsh/tcsh-63.1/tcsh/complete.tcsh http://www.opensource.apple.com/source/tcsh/tcsh-63.1/tcsh/c...
- Spoutingshite 15y agoI use SuperPutty on my Windows PC to manage many putty sessions at a time...it is a little clunky, however it is better than having putty open 5 or 10 times.