17 ms·
SSH tricks
- xtacy 15y agoGood list of useful configuration options. I'd also like to add the "Compression yes" option that you can add on a per-host basis, and this could save some bytes sent over the wire. To see how much it saved, invoke with verbose ("ssh -v"), and it outputs the number of bytes saved after the session ends. Another config option that has saved me a lot of time is the "ProxyCommand" option that lets you specify a command, whose stdin is used as a pipe to talk to a remote server. So, something like: Host inside ProxyCommand ssh gateway nc inside 22 Would allow you to just type "ssh inside" and ssh to a machine behind a gateway, without ssh-ing twice!
- loeg 15y agoCool trick -- thanks!
- mattdeboard 15y agoIs there a "tech blogger of the year" category somewhere so we can nominate this guy? Every single one of his posts is epic. The peri-relational metaphor for shell command composition, this one, and every one before should be required reading.
- babarock 15y agoI would also mention the following 2 articles that constitue an absolutely amazing TODO list: What every CS major should know (http://matt.might.net/articles/what-cs-majors-should-know/ http://matt.might.net/articles/what-cs-majors-should-know/) 12 resolutions for programmers (http://matt.might.net/articles/programmers-resolutions/ http://matt.might.net/articles/programmers-resolutions/)
- mattmight 15y agoThanks for the kind words! These recent posts are part of the lecture notes for my "Scripting Language Design and Implementation" course. There are slides that go along with some of them: http://matt.might.net/teaching/scripting-languages/spring-2012/lectures/ http://matt.might.net/teaching/scripting-languages/spring-20... I prefer spartan slides, so I'm not sure how useful they are without me presenting them. But, I'll throw them out there since there are a few nuggets in them that are not in the posts. There are also slides for non-existent posts (e.g. bash), because I don't always have time to transcribe my notes into a blog post.
- beambot 15y agoHey Matt, to echo yycom's concern below... can you please add dates to your articles? We have context as they're posted today, but it gets muddled 10+ years out.
- deleted 15y ago[deleted]
- mburns 15y agohttp://2012.bloggi.es/#technology http://2012.bloggi.es/#technology
- yycom 15y agoReally? Where are they? Article index is empty. And article needs a date before any award is bestowed.
- ColdAsIce 15y agoAre you being sarcastic? How could one not know that ssh could do these things? Have you been using it instead of telnet?
- mattdeboard 15y agoSave your snark and go read the rest of his blog posts.
- deleted 15y ago[deleted]
- lloeki 15y agoThis talks about port forwarding but does not mention using ssh as a socks proxy, with is extremely convenient. Also, although tricky to configure ssh can also be used as a VPN with tun/tap support (although a good /etc/network/interfaces on Debian can make it as easy as ifup/ifdown tunX) Unfortunately this guide does not mention ssh-agent to have usable passphrased keys. Tip: Mac OS X Keychain integrates fantastically with ssh-agent. My favorite trick is transparently bouncing via ProxyCommand+netcat: Host target.domain Hostname target.local ProxyCommand ssh -q bounce_host.domain nc -q0 %h 22 Also, authorizing by key but restricting the (passwordless) key to certain commands, allowing for remote action automation. [0] Ssh agent forwarding is also particularly awesome instead of naively scattering keys. Ssh ControlMaster allowing to reuse connections can really improve responsiveness. Tip: start the master connection as a daemon (-f), so as not to mistakenly close the terminal which handles it, else you will close the channel for all other currently opened slave sessions. I wish ssh would fork and start the master on demand then close it when the last channel closes. [0] http://www.cmdln.org/2008/02/11/restricting-ssh-commands/ http://www.cmdln.org/2008/02/11/restricting-ssh-commands/
- andrewaylett 15y agoIf you're connecting from a *nix-y box, you may also be interested in sshuttle: https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle It gives you most of the benefits of VPN, without requiring tun/tap and without needing root on the remote box -- all you need is the ability to run python. Very useful if you're on an insecure network and you want to tunnel everything over a secure connection, or if you have SSH access to a box inside your firewall and want to access other resources without having to specify each port individually.
- gnaritas 15y ago> Ssh ControlMaster allowing to reuse connections can really improve responsiveness. Yes it does, but I've noticed when I do this, it breaks my rsnapshot backups. Is this something you've heard of or know a fix for?
- lloeki 15y ago
- joejohnson 15y agoPort forwarding is a good trick to know.
- moe 15y agoAs a small addendum to "Copying files", you can also copy entire directories: $ tar czf - foo | ssh remote "cd /where/to/unpack && tar xzf -" This is often significantly faster than rsync, e.g. when copying a directory with many files for the first (or only) time.
- msmith 15y agoI'm not sure how it compares in performance, but I've always used scp -r for this: $ scp -r remote foo /where/to/unpack
- loeg 15y agoscp has some end-to-end latency for each file transferred. This means that for lots of small files, a single tar file stream is much quicker than 'scp -r'.
- timrod 15y agoif you're piping the output of tar, instead of using "tar f -", you can leave off the f argument (since you don't want to specify a file anyway) and tar will default to stdin/stdout: $ tar cz foo | ssh remote "cd /where/to/unpack && tar xz"
- ars 15y agoYou may not need the z either since it's common to configure ssh to do compression. Or use ssh -C
- ralph 15y agoFor GNU tar these days that's true, unless you can be sure $TAPE is in its environment. Historically, tar defaulted to a tape device, e.g. /dev/mt0, and you still find vestiges of that, e.g. OpenBSD defaults to /dev/rst0. IOW, specify "f -". :-)
- dchest 15y agoIs it possible to pipe something into already opened ssh connection?
- nzmsv 15y agoI would add the use of the ControlMaster and ControlPath options for connection sharing, as well as keepalive settings for those cases where connections drop when idle. The remote port forwarding feature can be very handy. I've used a combination of ssh and daemontools to set up remote access to a machine behind a particularly nasty firewall.
- xxqs 15y agohaha, I wrote an article exactly about this (see my other comment)
- paxswill 15y agoAnd if your SSH client supports it ControlPersist. It keeps the shared connection around in case you're coming back. It's a fairly new feature though.
- newman314 15y agoI tried enabling this and it seems that support for this on MacOS is pretty iffy. It's not too stable and my issues went away as soon as I disabled it.
- xxqs 15y agonice summary, and sshfs looks cool. here are my 2 cents: http://txlab.wordpress.com/2012/01/25/call-home-ssh-scripts/ http://txlab.wordpress.com/2012/01/25/call-home-ssh-scripts/
- keeperofdakeys 15y agoBe warned that sshfs uses sftp underneath, which doesn't like latency too much, so potential bandwidth is greatly reduced over the internet. If you want fast file transfers, try scp or rsync.
- xxqs 15y agoof course, I use scp and ssh tunneling quite regularly. I just like the concept of sshfs, will need to play with that and see how it could be useful
- symkat 15y agoSome more (Transferring whole directories, multiplexing etc) http://www.symkat.com/ssh-tips-and-tricks-you-need http://www.symkat.com/ssh-tips-and-tricks-you-need
- michaelcampbell 15y agossh as a cheap way around firewalls is nifty, but caveat ssh-or, for sure. A colleague of mine used this to connect to Yahoo IM (or somesuch; details not important) for some totally innocent IM'ing. Nothing against the company, no secrets leaked, nothing against any of his signed agreements. (Only that he couldn't use IM.) While corporate IT couldn't tell exactly what was going on, they did ask him why he was ssh'd to an ISP-provided IP for X hours using Y bytes. So don't try to outclever your company this way; they can still nab you on suspicion of whatever, even if what you did was non-harmful in any way.
- sravfeyn 15y agoI actually went on to implement an automated file sharing service over SSH using these tricks in our college when they blocked normal protocols. You can see the software on github tailored for my college https://github.com/sravfeyn/SparkDC https://github.com/sravfeyn/SparkDC
- elehack 15y agoOne more trick that I really like: using an SSH agent. On Gnome-based systems, Seahorse provides one (sometimes you have to install seahorse-plugins to get it); otherwise, gpg-agent can be an ssh agent. Pageant on Windows, and I'm not sure what's available on Mac. SSH agents let you keep your key encrypted while only needing to enter your passphrase on first use (with the default ssh-agent, you must load the key manually with ssh-add; gpg-agent and seahorse both prompt you the first time it's needed). Add that to SSH agent forwarding (where multi-hop SSH connections authenticate using the agent on the originating machine, and your key is (A) only on the local machine and (B) encrypted when not in use.
- pooriaazimi 15y agoThe best and most useful SSH trick (for me at least) is: ssh -[N]D 1080 [-p 33] user@server A SOCKS5 proxy on the go...
- mirkules 15y agoRemember also when you're using SSH socks proxy that all your DNS requests go through the un-proxied connection -- unless you're using Firefox, in which case you could set network.proxy.socks_remote_dns to 1 in about:config. Another point is that most firewalls block most ports, but usually not 443 (https). So set up your SSH server on port 443. Since all traffic to 443 is encrypted anyway, you're less likely to raise suspicion.
- sciurus 15y agoI wouldn't call these tricks, just using ssh properly. Here is an article with some less known features of ssh: http://www.jedi.be/blog/2010/08/27/ssh-tricks-the-usual-and-beyond/ http://www.jedi.be/blog/2010/08/27/ssh-tricks-the-usual-and-...
- rbonvall 15y ago> $ cat .ssh/id_dsa.pub | ssh host 'cat >> ~/.ssh/authorized_keys' Using ssh-copy-id is simpler: ssh-copy-id host (Works On My Machine™)
- stretchwithme 15y agodoes not work on mac, but this guy has a script: http://phildawson.tumblr.com/post/484798267/ssh-copy-id-in-mac-os-x http://phildawson.tumblr.com/post/484798267/ssh-copy-id-in-m...
- pavel_lishin 15y agoHomebrew also has a recipe for it. brew install ssh-copy-id
- nlh 15y agoOne addition: Re: iOS -- Panic (makers of Coda, etc.) developed a _really_ nice little iOS app for SSH called 'Prompt'. It got some coverage here when it was released, and I immediately replaced iSSH with it and haven't looked back once. http://www.panic.com/blog/2011/04/introducing-prompt-ssh-for-ios/ http://www.panic.com/blog/2011/04/introducing-prompt-ssh-for...
- Joeri 15y agoAnother cool trick is setting up a script that constantly tries to set up x2x between your laptop and desktop, tunneled over ssh. As soon as the laptop enters the local network, you can use the keyboard and mouse of the desktop on it, no cable connections necessary.
- ronreiter 15y agoThe most amazing thing about SSH tunneling is that it is always on, even if there is NO SHELL CONFIGURED for the user.
- delan 15y agoOne good trick that the article could add is getting around NTLM-authenticated HTTP proxies, which are frequently found in schools and workplaces. First, set up cntlm or ntlmaps to run a local HTTP proxy that strips the authentication from the real proxy. This is because almost all software that can handle authenticated proxies (including corkscrew) can only handle basic auth, but not NTLM. Then, configure ssh to use corkscrew: ProxyCommand /usr/bin/corkscrew localhost 3128 %h %p Finally, set up the socks proxy (most of these proxies only allow outgoing connections over ports 80 and 443): ssh -ND2345 -p443 host I use this technique constantly at school to browse the web unrestricted and with privacy.
- Estragon 15y agoMy main problem with sshfs lately has been that on a flakey connection it sometimes hangs irretrievably, often taking out the process trying to use it (usually emacs.)
- vectorpush 15y agoI've had this problem too. Try appending "-o reconnect" flag, I haven't had a hang since.
- jsilence 15y agoPlease don't use password less ssh keys. Use ssh-agent.
- mike-cardwell 15y agoOnly yesterday, I wrote up how I use a smart card and reader with hardware pin pad for SSH authentication. Seems relevant: https://grepular.com/Smart_Cards_and_SSH_Authentication https://grepular.com/Smart_Cards_and_SSH_Authentication
- zobzu 15y agoyeah, been using that for a while, and its quite handy. I want to switch to the cryptostick tho, because having a pinpad/reader around sux. don't you have one of those?
- mike-cardwell 15y agoMy laptop has a built in smart card reader, and my desktop has a USB one plugged in with a hardware pin-pad. The cryptostick does look cool. I've come across it before. I like the smart card because I can just pop it in my wallet like a credit card. You can also get keyboards with built in smart card readers, where the numeric keypad has a mode to operate as a hardware pin pad (rather than sending the keypresses to the computer) I'm thinking of getting one of these at some point.
- beagle3 15y agoDo you know of anyone who sells them in the US? (or OpenPGP cards or any other Linux usable tokens for that matter?) or do I have to order them from Germany?
- eridius 15y agoSSH is capable of running multiple channels over the same SSH connection. In theory this means you could ssh to a remote host, then establish a second channel to transfer a file over. Why the heck does the ssh tool not actually allow this sort of capability? Why do I have to establish a second scp or sftp connection to transfer a file when I'm already ssh'd into the machine? I don't get it.
- lmz 15y agoIf you use ControlMaster & ControlPath in ~/.ssh/config, sftp will use the existing connection.
- eridius 15y agoSure, but that's not really relevant to my point. That's just a minor optimization, but my workflow is still exactly the same: start up sftp, re-navigate back to the same directory, and do the transfer.
- blacksmith_tb 15y agoLots of good advice, but if you are using Windows Kitty is a bit nicer than Putty: http://kitty.9bis.com/ http://kitty.9bis.com/
- skeletonjelly 15y agoSeems like this pops up every few months. But I guess I can't complain about the spread of the knowledge surrounding ssh security and pro tips.