4 ms·
Find the HIDDEN SECRETS that THEY DON'T WANT YOU TO KNOW! $ man ssh
by 0xbadcafebee 8mo ago
Find the HIDDEN SECRETS that THEY DON'T WANT YOU TO KNOW!
$ man ssh
- saguntum 8mo agoman ssh_config is even more interesting and hidden ProxyCommand is fun
- project2501a 8mo agoHonest question, why is ProxyCommand `fun`? What do I get out of ProxyCommand that i do not get out of setting the correct order for ProxyJump and doing an ssh finalhost -- domy --bidding?
- pmontra 8mo agoProxyJump is a newer functionality. There used to be only ProxyCommand. ProxyJump is a shortcut for the usual way to use ProxyCommand to connect through a bastion host but ProxyCommand is more flexible. For example with ProxyCommand you can run any command to connect to the remote host. ProxyJump only connects over ssh. I think I replaced all my ProxyCommand with ProxyJump because I don't need much else than the normal use case.
- pritambaral 8mo agoProxyCommand allows you to use any command to setup a connection. Not necessarily an ssh command, like ProxyJump. It can be any command, as long as it receives on stdin and produces on stdout, it can act like a TCP connection. ProxyJump is a special case of `ProxyCommand ssh -p <port> <user>@<host>`. Can't replace the `ssh` in there when using ProxyJump.
- brigandish 8mo agoI use ProxyCommand to run spipe tunnels for SSH.
- m132 8mo agoYou can get a lot more out of ProxyCommand. For example, you can run SSH over non-IP protocols, such as serial, Bluetooth RFCOMM for embedded boards, or vsock for virtual machines without networking set up at all. The latter is built into and setup up automatically by systemd: https://www.freedesktop.org/software/systemd/man/257/systemd-ssh-proxy.html https://www.freedesktop.org/software/systemd/man/257/systemd...
- project2501a 8mo agoMuch appreciated!
- marcta 8mo agoI came across ProxyCommand earlier this week, funnily enough. I have Cloudflare Zero Trust set up with an SSH service[0], and have the server firewall drop all incoming traffic. That helps reduce my attack surface, since I don't have any incoming ports open. [0]: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-cloudflared-authentication/ https://developers.cloudflare.com/cloudflare-one/networks/co...
- JayGuerette 8mo agoI use ProxyCommand in edge-case devices where key auth is not an option and the password is not controlled by me. ProxyCommand points to a script the retrieves the password from the vault, puts it on the clipboard for pasting, reminds me via stderr it's done so, and then proxies the connection.
- project2501a 8mo agoInteresting. I might have such a use case. Do you have anything about best practices on how to automate grabbing passwords from vaults? Cuz it seems to me that the vault needs to be kept open or keep the vault password somewhere on disk.
- withinboredom 8mo agoYou can also run commands when a user authenticates, grab their keys from github.com/username.keys, validate they're a user in a specific github group, then let them connect by outputing the keys, otherwise nothing to deny them access. It's really great for ops teams where you want to give ssh access and manage it from github teams without needing a complex system.
- smoyer 8mo agoHN as a tabloid ... After all enquiring minds want to know!
- senectus1 8mo agohahaha made me laugh, thanks :-D
- deleted 8mo ago[deleted]
- imwally 8mo agoI blew a few minds a week ago when I told my younger coworkers about man pages. I hit ‘em with the `man man` and one dude was like “whoa!”
- deleted 8mo ago[deleted]
- bombcar 8mo agoReminds me of the old canard of 'man woman'
- AndrewDavis 8mo agoFurther blow their minds by showing them `apropos` https://manpages.debian.org/testing/man-db/apropos.1.en.html https://manpages.debian.org/testing/man-db/apropos.1.en.html
- riffraff 8mo agoI remember my first days with Linux/Unix and being taught about man and apropos and info. But somehow I could never find anything useful via apropos! With many years of insight, I think I probably never updated the database.
- SEJeff 8mo agoman -k, apropos, but less to type
- coldpie 8mo agoI'm 100% certain this is user error, but I have not once gotten apropos to give me any output other than "nothing appropriate."
- aa-jv 8mo ago$ man -k <whatever>
- Aardwolf 8mo agoman, cat, lynx... We're all just creatures in a vast universe
- paulddraper 8mo agoIt’s been a while since I’ve heard RTFM
- iso1631 8mo agoRTFM gave way to LMGTFY, and I next is something like ATLLM (ask the LLM)
- johnisgood 8mo agoBecause it is associated with "toxicity". Yeah, I know.
- longislandguido 8mo agoMany Linux man pages have the thoroughness of a fortune cookie, so I can understand the skepticism. Jackpot if they're just a pointer to an 'info' page.
- darkwater 8mo agoDo we still have those? I think it was common in late '90s, due to GNU trying to get `info` gain moment but nowadays?
- skywhopper 8mo agoMostly just the bash builtins have (had) this problem.
- aa-jv 8mo agoBut its also true that many, many man pages have extremely valuable information that no enterprising hacker should overlook, too ..
- halapro 8mo agoI was never able to properly parse large man pages, I'm so happy that llms can now prepare half a usable command without spending an hour reading a time without a single usage example.
- jeremyscanvic 8mo agoWhat I usually do when I have to read large man pages like bash(1) is I read them as PDFs: man -Tpdf bash | zathura - Replace zathura with any PDF viewer reading from stdin or just save the PDF. Hope that can be useful to someone!
- sourcegrift 8mo agomy manpager is `vim -`, can't beat that
- thaumasiotes 8mo agoHow's that supposed to help? The ssh man page is about as close as you can get to a Platonic example of "uninformative pretend-documentation".
- hrmtst93837 8mo ago[flagged]
- antonvs 8mo agoWho doesn’t want you to know? Well, obviously, the man. That’s why you type man ssh, you’re forcing the man to tell you what he knows.
- vlod 8mo agoI still struggle with the fact that I was (or delusional) an effective C programmer "back in the day" (before google etc) and all we had was "man" to look up std/x11 system calls. Now I am dismayed with juniors who can't even be bothered to use google (or llms) to look up stuff on their first hiccup. #include <old-man-shouting-at-clouds>
- lxgr 8mo ago`pgrep`/`pkill` HATE this trick! Learn how this renegade developer (relatively) easily exits their hanging SSH sessions without restarting their laptop.
- proactivesvcs 8mo agoNot as much as they hate Enter ~ . See "escape characters" under man ssh.
- lxgr 8mo agoShh, you're giving away the trick for free! Please think of my clickthrough rates and ad revenue.
- _joel 8mo agoThey're sticking it to the man
- smnplk 8mo agosssshhhh...don't just give out secrets like that .
- EGreg 8mo agoWorking for the man eh?