7 ms·

Using SSH_config Match to connect to a host using multiple IP or Hostnames

125 points by srijan4 4y ago

blueflow 4y ago
The ssh config is quite versatile, its worth giving the manual a look: https://man7.org/linux/man-pages/man5/ssh_config.5.html https://man7.org/linux/man-pages/man5/ssh_config.5.html
srijan4 4y ago
I used ssh_config's `Match` recently to route only okta-managed servers via their auth proxy command. That was quite powerful.
0x0 4y ago
I had no idea .ssh/config could do arbitrary command exec. Neat (and scary!) :)
- ape4 4y ago
  Yeah seems like there should be an option to disable that
  - blueflow 4y ago
    Its not increasing any attack surface, or can you construct a situation where it could be exploited?
    - HvTfMhdTZ8Lths6 4y ago
      Well, setups using forced commands are relatively common with SSH (case in point: probably any Git server you've ever accessed over SSH); if one of those setups also allowed their user to specify ssh_config rules without realizing that Match can exec things there'd be a problem. I think that's a bit of a stretch though.
      - blueflow 4y ago
        The ForcedCommand is server-side, the Match exec from ssh_config is done client-side. The server has no way to enforce which commands the client can run locally.
bin_bash 4y ago
ICYMI make sure you check out the "ssh tips" thread from yesterday: https://news.ycombinator.com/item?id=32486031 https://news.ycombinator.com/item?id=32486031 (As someone that's a long-term SSH user most of the good stuff was in the thread) I also believe the day before yesterday someone showed an incredible rsync/dotfile/ssh trick in the comments but I have no idea what article it was on. I'm not sure if Big SSH is astroturfing HN lately or not but I'm here for it.
- InvaderFizz 4y ago
  The dotfile post: https://news.ycombinator.com/item?id=32468605 https://news.ycombinator.com/item?id=32468605 I bookmarked that for reference last night.
nwatson 4y ago
Could also set up DNS server to return different IP addresses for same hostnames depending on the which interface the DNS client is connecting from. There'd only be one hostname per server, two (or more) IP addresses each mapped to originating network. Edit: autocorrect
- TechBro8615 4y ago
  What if the client cached the DNS lookup from when it connected on a previous interface?
  - spicymellon 4y ago
  - HvTfMhdTZ8Lths6 4y ago
    I don't think it's reasonable for clients to cache responses across disconnect/reconnect, especially when the network has observably changed (new default gateway, for example), and even more so when the resolver has changed. Based on my own personal experience I'd also say that no (modern) clients do so although that could be wrong.
zokier 4y ago
Neat trick, but seems like something that should be solveable few layers lower. Does he mean VPN when he says "SDN"? Like why does the laptop have two different IPs and hostnames to begin with?
- AdamJacobMuller 4y ago
  Probably means something NG-vpn like tailscale
uberduper 4y ago
`Match exec` lets you do some convenient stuff. Like using env vars to determine which environment you're ssh'ing to when you re-use cidrs in multiple regions or w/e. `Match exec "test ${REGION}.${ENVIRONMENT} = us-east-1.staging" ProxyJump yourRegionEnvSpecificBastion`
egberts1 4y ago
While I draft an easy prompting for complex YubiKey SSH MatchHost (not yet git-pushed), I’ve got this OpenSSH configuration tool based on user-prompting of many other OpenSSH-related configuration settings into sshd.conf/ssh.conf file using /etc/ssh[d].conf.d directory holding many setting files. Each setting file has a full comment page on how to use its keyword, a commented-out default setting, and a CISecurity-recommended setting. Each setting files are named (via numeric prefix) to be in execution order, which enables for easier thinking of “how deep” it goes into the SSH protocol. As a default, the config files are written into a local build/etc/ssh subdirectories for perusal before being implemented manually into /etc Plus, I code-review OpenSSH regularly. https://github.com/egberts/easy-admin/tree/main/490-net-ssh https://github.com/egberts/easy-admin/tree/main/490-net-ssh
mmh0000 4y ago
I love Match. I use it to automatically select my bastion/jump host when not on my home network and not on my local VPN: $ cat ~/.ssh/config # Define external nodes here …SNIP… # If connecting to a *.xn0.org host and router.xn0.org = 10.0.0.1, must be home/vpn. Match host *.xn0.org exec "getent ahosts router.xn0.org | grep -q ^10.0.0.1" ProxyJump none # If connecting to a *.xn0.org host and the macaddr of 10.0.0.1 is NOT f0:9f:XX:XX:XX:XX, then use jump.xn0.org: Match host *.xn0.org exec "! arp -ne 10.0.0.1 | grep -Fq f0:9f:XX:XX:XX:XX" ProxyJump jump.xn0.org # Define internal nodes here …SNIP…
linsomniac 4y ago
I also used to do mosh+tmux for remote development from my Mac. A few months ago I switched to WezTerm, which has a built-in first class terminal multiplexer and remote protocol, including typeahead. The benefits are that I'm using the same terminal I (now) use on my Linux box, so I have the same keyboard shortcuts on Mac and Linux, and various things like cut/paste aren't weirded out by tmux. The one downside I've had so far is that often when I've suspended too long my wezterm client disconnects and I have to reconnect to the session (just up-arrow+enter in my terminal), where mosh+tmux would just stay always there.
Haegin 4y ago
Match is useful, but for anyone trying to solve the problem of accessing a given machine from different networks check out Tailscale. It's one of the closest things to magic that I've found in recent years and just works. I used to have a dynamic DNS thing set up, and all kinds of firewall rules to be able to ssh to my home machine when on the road from my laptop and now I just ssh [hostname] and it just works, wherever I am.
- xnyan 4y ago
  The only thing stopping tailscale solving all my problems the latency. It's 3-5x higher than straight wireguard without their cloud relay, 5-10x higher (or more) on their relay.
jarym 4y ago
I did not know we could do exec in ssh config so I learnt something new today! However, I also have a similar setup but for my SDN I use Twingate which lets me re-route DNS when its connected so all I need to do is the equivalent of defining *.lan as a resource in the UI and then I can reach it no matter when I'm connected via SDN or not.
HvTfMhdTZ8Lths6 4y ago
What is "SDN", how is it different from the thing that everyone else has called "VPN" for a few decades, and why not just have its resolver serve answers for the same TLD? Or better yet why not just route your home subnet over the VPN subnet (probably with a high metric, so that it doesn't override "real" routes) so you don't need a different IP? Match is extremely useful though. It's in use on a few systems I control to allow password authentication from certain subnets.
- HvTfMhdTZ8Lths6 4y ago
  PS: I decided to go write up how I just use the same IPs everywhere with OpenVPN. https://docs.google.com/document/d/1u9mGu7bv5JYL_Fvv0L7OX4_12G97HVTRjmCcgAuQW4M/edit?usp=sharing https://docs.google.com/document/d/1u9mGu7bv5JYL_Fvv0L7OX4_1... Worth noting that I actually just use split-horizon DNS for my personal VPN though. Telling Unbound this is a lot easier (and still works with stuff that isn't SSH): local-zone: "mydomain.com." transparent local-data: "foo.mydomain.com. A 10.0.0.4"

125 points by srijan4 4y ago

The ssh config is quite versatile, its worth giving the manual a look: https://man7.org/linux/man-pages/man5/ssh_config.5.html https://man7.org/linux/man-pages/man5/ssh_config.5.html

srijan4 4y ago

I used ssh_config's `Match` recently to route only okta-managed servers via their auth proxy command. That was quite powerful.

0x0 4y ago

I had no idea .ssh/config could do arbitrary command exec. Neat (and scary!) :)

ape4 4y ago
Yeah seems like there should be an option to disable that
- blueflow 4y ago
  Its not increasing any attack surface, or can you construct a situation where it could be exploited?
  - HvTfMhdTZ8Lths6 4y ago
    Well, setups using forced commands are relatively common with SSH (case in point: probably any Git server you've ever accessed over SSH); if one of those setups also allowed their user to specify ssh_config rules without realizing that Match can exec things there'd be a problem. I think that's a bit of a stretch though.
    - blueflow 4y ago
      The ForcedCommand is server-side, the Match exec from ssh_config is done client-side. The server has no way to enforce which commands the client can run locally.

bin_bash 4y ago

ICYMI make sure you check out the "ssh tips" thread from yesterday: https://news.ycombinator.com/item?id=32486031 https://news.ycombinator.com/item?id=32486031 (As someone that's a long-term SSH user most of the good stuff was in the thread) I also believe the day before yesterday someone showed an incredible rsync/dotfile/ssh trick in the comments but I have no idea what article it was on. I'm not sure if Big SSH is astroturfing HN lately or not but I'm here for it.

InvaderFizz 4y ago
The dotfile post: https://news.ycombinator.com/item?id=32468605 https://news.ycombinator.com/item?id=32468605 I bookmarked that for reference last night.

nwatson 4y ago

Could also set up DNS server to return different IP addresses for same hostnames depending on the which interface the DNS client is connecting from. There'd only be one hostname per server, two (or more) IP addresses each mapped to originating network. Edit: autocorrect

TechBro8615 4y ago
What if the client cached the DNS lookup from when it connected on a previous interface?
- spicymellon 4y ago
- HvTfMhdTZ8Lths6 4y ago
  I don't think it's reasonable for clients to cache responses across disconnect/reconnect, especially when the network has observably changed (new default gateway, for example), and even more so when the resolver has changed. Based on my own personal experience I'd also say that no (modern) clients do so although that could be wrong.

zokier 4y ago

Neat trick, but seems like something that should be solveable few layers lower. Does he mean VPN when he says "SDN"? Like why does the laptop have two different IPs and hostnames to begin with?

AdamJacobMuller 4y ago
Probably means something NG-vpn like tailscale

uberduper 4y ago

`Match exec` lets you do some convenient stuff. Like using env vars to determine which environment you're ssh'ing to when you re-use cidrs in multiple regions or w/e. `Match exec "test ${REGION}.${ENVIRONMENT} = us-east-1.staging" ProxyJump yourRegionEnvSpecificBastion`

egberts1 4y ago

While I draft an easy prompting for complex YubiKey SSH MatchHost (not yet git-pushed), I’ve got this OpenSSH configuration tool based on user-prompting of many other OpenSSH-related configuration settings into sshd.conf/ssh.conf file using /etc/ssh[d].conf.d directory holding many setting files. Each setting file has a full comment page on how to use its keyword, a commented-out default setting, and a CISecurity-recommended setting. Each setting files are named (via numeric prefix) to be in execution order, which enables for easier thinking of “how deep” it goes into the SSH protocol. As a default, the config files are written into a local build/etc/ssh subdirectories for perusal before being implemented manually into /etc Plus, I code-review OpenSSH regularly. https://github.com/egberts/easy-admin/tree/main/490-net-ssh https://github.com/egberts/easy-admin/tree/main/490-net-ssh

mmh0000 4y ago

I love Match. I use it to automatically select my bastion/jump host when not on my home network and not on my local VPN: $ cat ~/.ssh/config # Define external nodes here …SNIP… # If connecting to a *.xn0.org host and router.xn0.org = 10.0.0.1, must be home/vpn. Match host *.xn0.org exec "getent ahosts router.xn0.org | grep -q ^10.0.0.1" ProxyJump none # If connecting to a *.xn0.org host and the macaddr of 10.0.0.1 is NOT f0:9f:XX:XX:XX:XX, then use jump.xn0.org: Match host *.xn0.org exec "! arp -ne 10.0.0.1 | grep -Fq f0:9f:XX:XX:XX:XX" ProxyJump jump.xn0.org # Define internal nodes here …SNIP…

linsomniac 4y ago

I also used to do mosh+tmux for remote development from my Mac. A few months ago I switched to WezTerm, which has a built-in first class terminal multiplexer and remote protocol, including typeahead. The benefits are that I'm using the same terminal I (now) use on my Linux box, so I have the same keyboard shortcuts on Mac and Linux, and various things like cut/paste aren't weirded out by tmux. The one downside I've had so far is that often when I've suspended too long my wezterm client disconnects and I have to reconnect to the session (just up-arrow+enter in my terminal), where mosh+tmux would just stay always there.

Haegin 4y ago

Match is useful, but for anyone trying to solve the problem of accessing a given machine from different networks check out Tailscale. It's one of the closest things to magic that I've found in recent years and just works. I used to have a dynamic DNS thing set up, and all kinds of firewall rules to be able to ssh to my home machine when on the road from my laptop and now I just ssh [hostname] and it just works, wherever I am.

xnyan 4y ago
The only thing stopping tailscale solving all my problems the latency. It's 3-5x higher than straight wireguard without their cloud relay, 5-10x higher (or more) on their relay.

jarym 4y ago

I did not know we could do exec in ssh config so I learnt something new today! However, I also have a similar setup but for my SDN I use Twingate which lets me re-route DNS when its connected so all I need to do is the equivalent of defining *.lan as a resource in the UI and then I can reach it no matter when I'm connected via SDN or not.

HvTfMhdTZ8Lths6 4y ago

What is "SDN", how is it different from the thing that everyone else has called "VPN" for a few decades, and why not just have its resolver serve answers for the same TLD? Or better yet why not just route your home subnet over the VPN subnet (probably with a high metric, so that it doesn't override "real" routes) so you don't need a different IP? Match is extremely useful though. It's in use on a few systems I control to allow password authentication from certain subnets.

HvTfMhdTZ8Lths6 4y ago
PS: I decided to go write up how I just use the same IPs everywhere with OpenVPN. https://docs.google.com/document/d/1u9mGu7bv5JYL_Fvv0L7OX4_12G97HVTRjmCcgAuQW4M/edit?usp=sharing https://docs.google.com/document/d/1u9mGu7bv5JYL_Fvv0L7OX4_1... Worth noting that I actually just use split-horizon DNS for my personal VPN though. Telling Unbound this is a lot easier (and still works with stuff that isn't SSH): local-zone: "mydomain.com." transparent local-data: "foo.mydomain.com. A 10.0.0.4"