5 ms·

Pretty cool, but some of its aims can be achieved in other safer ways: * Use tmux, a multi-plexer, so you never lose the state of a program * Use KiTTY as an

Pretty cool, but some of its aims can be achieved in other safer ways: * Use tmux, a multi-plexer, so you never lose the state of a program * Use KiTTY as an SSH client- http://kitty.9bis.com/ http://kitty.9bis.com/ - enable 'Reconnect' options * Configure http tunnelling if you want, it's trivially easy to set up with either Chrome or Firefox The end result: an SSH connection that's always alive when I need it to be. When I open up my laptop's lid, it reconnects automatically, and because I've set up keys (without a passphrase) I do not have to do _anything_ and I'm all good to go. You can have a tmux attach command coded and you really do not have to do a thing. Some other notes: KiTTY is a PuTTY fork, with many new extremely delicious features (hyper links, better clipboard support, etc.) To tunnel your http traffic (for when you're in a public spot and would opt for basic security): Connection > SSH > Tunnels. Add a dynamic port... and concordantly configure proxy settings on your browser's end. For Firefox you don't need any extensions... for Chrome this extension, in my experiences, is fairly decent: http://switchy.samabox.com/ http://switchy.samabox.com/ -- these directions will work for both PuTTY and KiTTY. >> SSH waits for the server's reply before showing you your own typing. That can make for a lousy user interface. Mosh is different: it gives an instant response to typing, deleting, and line editing. It does this adaptively and works even in full-screen programs like emacs and vim. If real-time text rendering is a must for you, consider TRAMP: http://www.gnu.org/software/tramp/ http://www.gnu.org/software/tramp/ Also consider using EmacsClient: http://www.emacswiki.org/emacs/EmacsClient http://www.emacswiki.org/emacs/EmacsClient And for vim, apparently there's netrw: http://www.vim.org/scripts/script.php?script_id=1075 http://www.vim.org/scripts/script.php?script_id=1075

aaronblohowiak 15y ago
keys without passphrase? i hope they do not connect to a publicly available server with other people's data on it.
- ghshephard 15y ago
  If it's on OS X, keychains does a pretty good job of unlocking your (password secured) private key transparently. That's preferable to leaving your private key sitting around without a passphrase.
- jimmyjim 15y ago
  I knew someone would raise an issue there. If you're that concerned about security, there are a handful of additional things you can do: * Use a non-standard ssh port * Disable root ssh login * Configure 'Single Packet Authorization and Port Knocking' -- http://www.cipherdyne.org/fwknop/ http://www.cipherdyne.org/fwknop/ * Have decent iptables rules. Use either fail2ban or denyhosts with stringent rules, if you must, that ban on 3+ failed logins. * Have a whitelist of acceptable IP's for ssh access * Use any system of 2-factor authentication. I'm partial to Google's Authenticator. Here're some directions to get that set up, if anyone is interested: http://guides.webbynode.com/articles/security/ubuntu-google-authenticator.html http://guides.webbynode.com/articles/security/ubuntu-google-... But seriously, if you have keys set up and someone manages to steal them... you've really got bigger things you should be focusing on.
  - zobzu 15y ago
    No. Just No. * Use a non-standard ssh port <= not security. plus i bet you're on 2222. * Fail2ban: useless for key auth, you don't remote brute keys like that * 2 factor: that is ok If your comp can log directly without any authentication that is terrible practice. Your comp will eventually get compromised, stolen, etc and then its game over. The passphrase is no silver bullet but it helps a lot. 2 factor or tiny cryptokeys are best.
    - jimmyjim 15y ago
      I definitely agree with much of what you've pointed out. > * Use a non-standard ssh port <= not security. plus i bet you're on 2222. Right, marginally better than using port 22, but it's still something (better than non-action, if you will). I do hope one takes the vigilance to set a port number sufficiently high up, and sufficiently random looking. I recall something about nmap, that it scans only up to 1023 by default or something. > * Fail2ban: useless for key auth, you don't remote brute keys like that Still set it up -- for http and other services. > If your comp can log directly without any authentication that is terrible practice. Your comp will eventually get compromised, stolen, etc and then its game over. The passphrase is no silver bullet but it helps a lot. I agree... I emphasized seamless logging in because that seems to be a big point that Mosh is apparently selling itself on. I do have stronger authentication methods set up for the production machine. :)
keithwinstein 15y ago
That's definitely pretty workable. One big problem with these TCP-level approaches is you have to KNOW the connection is dead for roaming to work. So if you just walk and roam from one 802.11 ESSID to another, it won't necessarily just work until the TCP connection actually dies. Mosh roams right away (and warns you when it hasn't heard in a while) -- even if the client doesn't know it's roamed (e.g. because it's tethered to a NAT and it's the NAT that has roamed).
pmorici 15y ago
"* Use KiTTY as an SSH client- http://kitty.9bis.com/ http://kitty.9bis.com/ - enable 'Reconnect' options" Am I missing something, because the mosh site seems to indicate it works on most things except Windows and the KiTTY site seems to say it works only on Windows so they don't even serve the same set of potential users.
- jimmyjim 15y ago
  Try out autossh if you're not on Windows, and desire a persistent connection -- http://www.harding.motd.ca/autossh/ http://www.harding.motd.ca/autossh/ autossh is a program to start a copy of ssh and monitor it, restarting it as necessary should it die or stop passing traffic. The idea is from rstunnel (Reliable SSH Tunnel), but implemented in C.
  - mahkra 15y ago
    Or just install cygwin and autossh. Works fine in windows. This plus Tmux works great.
Raphael_Amiard 15y ago
Or you could, you know, just use Mosh.
- jimmyjim 15y ago
  I feel a bit guilty that my negative post is the top post, instead of a post discussing Mosh itself, most especially considering that Keith's responses throughout this thread have been quite elucidative and creditable. However I still think we should approach something as fundamental and important as remote access to our machines with great caution -- I'll be sticking with the tools tried and tested for years (and recommended by those I trust) for the foreseeable future. That said, Mosh does seem pretty interesting, -- and by golly, considering the terrible 3G speeds I get on my Android phone and how often the 'connectbot' app acts up, I will surely be giving this a try when I get time later this week.
  - drivebyacct2 15y ago
    ~~It all tunnels over SSH, what is the security risk compared to other protocols that also go over SSH?~~ (is it possible to strike text?) Thanks for the correction, I misunderstood how the protocol Mosh uses works. SSH is apparently used for initiation. Caution seems wise.
    - inklesspen 15y ago
      It's not all over SSH. It uses SSH to authenticate and start a server daemon, which it then connects to over UDP. The UDP connection is not tunneled through the SSH connection.
      - drivebyacct2 15y ago
        Thank you for this answer. I apparently missed this important distinction on my first pass through.
    - deleted 15y ago
      [deleted]
johno215 15y ago
Except the nicest feature of Mosh is it makes the remote session feel more responsive. Is there anything out there (not just local echo) that does this?
giddas 15y ago
What TRAMP, which is good, gives you is quite different to this.

aaronblohowiak 15y ago

keys without passphrase? i hope they do not connect to a publicly available server with other people's data on it.

ghshephard 15y ago
If it's on OS X, keychains does a pretty good job of unlocking your (password secured) private key transparently. That's preferable to leaving your private key sitting around without a passphrase.
jimmyjim 15y ago
I knew someone would raise an issue there. If you're that concerned about security, there are a handful of additional things you can do: * Use a non-standard ssh port * Disable root ssh login * Configure 'Single Packet Authorization and Port Knocking' -- http://www.cipherdyne.org/fwknop/ http://www.cipherdyne.org/fwknop/ * Have decent iptables rules. Use either fail2ban or denyhosts with stringent rules, if you must, that ban on 3+ failed logins. * Have a whitelist of acceptable IP's for ssh access * Use any system of 2-factor authentication. I'm partial to Google's Authenticator. Here're some directions to get that set up, if anyone is interested: http://guides.webbynode.com/articles/security/ubuntu-google-authenticator.html http://guides.webbynode.com/articles/security/ubuntu-google-... But seriously, if you have keys set up and someone manages to steal them... you've really got bigger things you should be focusing on.
- zobzu 15y ago
  No. Just No. * Use a non-standard ssh port <= not security. plus i bet you're on 2222. * Fail2ban: useless for key auth, you don't remote brute keys like that * 2 factor: that is ok If your comp can log directly without any authentication that is terrible practice. Your comp will eventually get compromised, stolen, etc and then its game over. The passphrase is no silver bullet but it helps a lot. 2 factor or tiny cryptokeys are best.
  - jimmyjim 15y ago
    I definitely agree with much of what you've pointed out. > * Use a non-standard ssh port <= not security. plus i bet you're on 2222. Right, marginally better than using port 22, but it's still something (better than non-action, if you will). I do hope one takes the vigilance to set a port number sufficiently high up, and sufficiently random looking. I recall something about nmap, that it scans only up to 1023 by default or something. > * Fail2ban: useless for key auth, you don't remote brute keys like that Still set it up -- for http and other services. > If your comp can log directly without any authentication that is terrible practice. Your comp will eventually get compromised, stolen, etc and then its game over. The passphrase is no silver bullet but it helps a lot. I agree... I emphasized seamless logging in because that seems to be a big point that Mosh is apparently selling itself on. I do have stronger authentication methods set up for the production machine. :)

keithwinstein 15y ago

That's definitely pretty workable. One big problem with these TCP-level approaches is you have to KNOW the connection is dead for roaming to work. So if you just walk and roam from one 802.11 ESSID to another, it won't necessarily just work until the TCP connection actually dies. Mosh roams right away (and warns you when it hasn't heard in a while) -- even if the client doesn't know it's roamed (e.g. because it's tethered to a NAT and it's the NAT that has roamed).

pmorici 15y ago

"* Use KiTTY as an SSH client- http://kitty.9bis.com/ http://kitty.9bis.com/ - enable 'Reconnect' options" Am I missing something, because the mosh site seems to indicate it works on most things except Windows and the KiTTY site seems to say it works only on Windows so they don't even serve the same set of potential users.

jimmyjim 15y ago
Try out autossh if you're not on Windows, and desire a persistent connection -- http://www.harding.motd.ca/autossh/ http://www.harding.motd.ca/autossh/ autossh is a program to start a copy of ssh and monitor it, restarting it as necessary should it die or stop passing traffic. The idea is from rstunnel (Reliable SSH Tunnel), but implemented in C.
- mahkra 15y ago
  Or just install cygwin and autossh. Works fine in windows. This plus Tmux works great.

Raphael_Amiard 15y ago

Or you could, you know, just use Mosh.

jimmyjim 15y ago
I feel a bit guilty that my negative post is the top post, instead of a post discussing Mosh itself, most especially considering that Keith's responses throughout this thread have been quite elucidative and creditable. However I still think we should approach something as fundamental and important as remote access to our machines with great caution -- I'll be sticking with the tools tried and tested for years (and recommended by those I trust) for the foreseeable future. That said, Mosh does seem pretty interesting, -- and by golly, considering the terrible 3G speeds I get on my Android phone and how often the 'connectbot' app acts up, I will surely be giving this a try when I get time later this week.
- drivebyacct2 15y ago
  ~~It all tunnels over SSH, what is the security risk compared to other protocols that also go over SSH?~~ (is it possible to strike text?) Thanks for the correction, I misunderstood how the protocol Mosh uses works. SSH is apparently used for initiation. Caution seems wise.
  - inklesspen 15y ago
    It's not all over SSH. It uses SSH to authenticate and start a server daemon, which it then connects to over UDP. The UDP connection is not tunneled through the SSH connection.
    - drivebyacct2 15y ago
      Thank you for this answer. I apparently missed this important distinction on my first pass through.
  - deleted 15y ago
    [deleted]

johno215 15y ago

Except the nicest feature of Mosh is it makes the remote session feel more responsive. Is there anything out there (not just local echo) that does this?

giddas 15y ago

What TRAMP, which is good, gives you is quite different to this.