6 ms·

Mosh – a robust, responsive replacement for SSH

91 points by antonios 12y ago

smhenderson 12y ago
This looks cool on the surface but I'm not sure how to feel about it; do I really want to add another layer on top of SSH without worrying about security leaks? While I'm sure it can be done right I will probably reserve judgment until I have time to thouroughly check this out. The pros aren't many but I do like the thought of roaming connections. That and the local edit, echo, delete looks like it would help with editing (vim/gvim) over some lagging connections I sometimes get. Definitely something to keep an eye on though, nice write up too.
akent 12y ago
Previous discussions: https://news.ycombinator.com/item?id=8252093 https://news.ycombinator.com/item?id=8252093 https://news.ycombinator.com/item?id=5016745 https://news.ycombinator.com/item?id=5016745 https://news.ycombinator.com/item?id=3819382 https://news.ycombinator.com/item?id=3819382
PindakaasMan 12y ago
I've being using Mosh for some time now. I really like it that apps like JuicySSH also support is so when my server goes down I can fix it on the go.
- lepht 12y ago
  Unfortunately the one iOS app that supports mosh (iSSH) was removed from the app store late last year. I've heard that the mosh license isn't compatible with the App Store(?)
  - keithwinstein 12y ago
    The Mosh license has been compatible with the App Store since October 2012. Nobody has done the port yet (which will probably require grafting on a GUI terminal emulator), but I'm hoping somebody will do it if the demand is really there.
    - lepht 12y ago
      That's not entirely true: https://github.com/keithw/mosh/issues/198#issuecomment-7417927 https://github.com/keithw/mosh/issues/198#issuecomment-74179... Panic has explicitly stated in the past that they won't add mosh support to Prompt due to license issues, for instance.
visarga 12y ago
I like mosh but you can't scroll back in it. That's not nice.
- navaati 12y ago
  Use tmux.
  - moe 12y ago
    That still doesn't give you native scrolling.
    - anom9999 12y ago
      It can do if you configure it to
      - zobzu 12y ago
        its not really "native" scrolling. (technically, it is, but obviously the commenter meant to have regular scrollback maintained client-side) Then again the situation is no better with ssh, and tmux/screen work okay for that.
        lepht 12y ago
        You can get native tmux scrolling on a mac with iTerm or Terminal.app: https://filippo.io/native-scrolling-and-iterm2/ https://filippo.io/native-scrolling-and-iterm2/
        moe 12y ago
        This is NOT native scrolling. You still have to manually toggle "scroll-mode", get janky lag because of the screen redraws, and a redundant "selection cursor" that messes with inversions of the scroll direction.
kefka 12y ago
Doesn't support the following: Forwarding of X11, SSH agent, etc. IPv6, with roaming between v4 and v6 Android client The x-forwarding is what kills me. Still waiting for it though.
- razzmataz 12y ago
  Does it support any sort of port forwarding, not just X11?
  - m8rl 12y ago
    Mosh is a client/server setup allowing kind of asynchronous interactive session on a ssh server over a ssh connection. It doesn't replace ssh but complements it, making ssh interactive sessions more usable for low-latency and failing connections. It somehow works like a proxy, with the added feature that it tries to add some sort of advanced local echo.
  - db48x 12y ago
    No, MOSH is purely for interactive terminals.
- aroch 12y ago
  JuiceSSH (probably the most popular Android SSH client) supports mosh fully.
Maakuth 12y ago
I wouldn't call it a replacement, as it uses ssh for authentication and strives to not reinvent the wheel there. That is actually what makes mosh so nice - if you have your hosts in .ssh/config and your public key installed to your hosts, you can use mosh instead of ssh in interactive sessions and It Just Works. You still have ssh for file transfer, TCP and X11 forwarding, etc. For telecommuting, it's really nice to have mosh handle handovers between wifi and 3g/4g networks so gracefully. And for high latency links, it makes the user experience a bit less annoying. edit: missing word added
khanan 12y ago
Biggest drawback is that none of the commercial clients will implement support for it, that's what killed it for me (SecureCRT developer VanDyk told my company NOPE!) due to license issues :(
- mkesper 12y ago
  Using proprietary software for security is a no-go.
- jeffcox 12y ago
  Yeah, what's the point of creating a great, mobile focused alternative (or enhancement, however you'd like to describe it) to SSH if no one will implement it on iOS because it's GPLv3?
- belorn 12y ago
  If a company want to create a proprietary client, they can always do that. They simply has to pay programmers to do the work, rather then freeload on the work of a research university. Alternative they could collaborate with the research community, adding to the common knowledge in computer science and security on a deal where everyone share in access. For security and encryption software, I find this deal to be quite necessary for everyone involved and are thus glad with projects license choice.
eatonphil 12y ago
"Mosh is a replacement for SSH". "The mosh client logs in to the server via SSH..." Huh? I'm confused. So is it a replacement or is it an abstraction?
- blueskin_ 12y ago
  Abstraction. It's its own transport, but needs SSH to establish the session.
blueskin_ 12y ago
Mosh is nice, but I always feel wary about opening a big port range for it. Had it on my todo list for ages to work out a way of temporarily opening the port range for an IP that makes a successful SSH login.
- falcolas 12y ago
  FWIW, it works well with a fairly typical "allow all out, deny all in" firewall configuration. That is what I have set up on my server, and it works fine. If you go the deny all out, yeah, you'll probably have to set up more specific outgoing exceptions for Mosh.
  - blueskin_ 12y ago
    That's surprising, as IIRC it needs inbound UDP on high ports which aren't directly associated with the inbound TCP for the SSH session.
    - falcolas 12y ago
      It does; they are likely opened up via hole punching, coordinated via the SSH connection.
      - blueskin_ 12y ago
        Gets stuck at "Connecting..." when I try it on any of my servers with the default firewall config (allow all out, allow related/established in, allow new to 22).
- jamies888888 12y ago
  You can open a single UDP port and specify the port number using the -p option when connecting.
- ryanlol 12y ago
  If you're worried about opening ports, you're doing security wrong.
zobzu 12y ago
Is this auto submitted every 6mo? Because that's what it's looking like. There is no changes from the past 3 submissions...
- tobz 12y ago
  If I had to guess, I'd say this got posted because of the relevance next to the other posts about multiplexing SSH/HTTP over a single connection.
mholt 12y ago
Did anyone else see this file about how a guy used mosh to escape from an elevator? http://gopher.floodgap.com/gopher/gw.lite?gopher://sdf.org:70/0/users/irl/blog/2012-08-22-mosh-in-a-lift.md http://gopher.floodgap.com/gopher/gw.lite?gopher://sdf.org:7...
dalanmiller 12y ago
Anyone know when Mosh will support IPv6?
- sliken 12y ago
  looks like it does. Check out the github mosh issues on ipv6.
jamies888888 12y ago
Just been using this for the last week or so. It's great, especially for trains (intermittent connections) and geographically far-away servers (high-latency connections).
jkot 12y ago
Screen (terminal program) already offers most of those features.
- bergie 12y ago
  It does offer persistent sessions. However, the other nice part of Mosh is how it handles low-quality connections. I can use vim over SSH pretty nicely over 3G or crappy conference WiFi thanks to it.
  - deleted 12y ago
    [deleted]
- warnhardcode 12y ago
  Mosh and screen/tmux serve different roles. Mosh keeps your connection and reconnects across all sorts of events that would break your ssh connection. (laptop sleeps, different networks). Then screen/tmux manages the sessions on the other side of that connection. Maybe I don't understand everything screen can do, which is very possible.
frankzander 12y ago
Luckily Mosh isn't a real replacement. The first what comes in my mind wars "All the crypto rewritten?" and then I read "Uses SSH for Auth" ... SSH is robust and wide used ... I want no replacement for ssh because it seems like solid crypto. But mosh seems interesting.
the_duck 12y ago
What amazes me about mosh is how it handles transitions in and out of the private wifi network at my school. When I want to ssh to school machines from off campus, I generally need to use a VPN. Without the VPN the machines are unreachable: if I ping them, no packets are returned; ssh attempts fail. Using mosh, though, I've found that I can start a session at school and resume it off campus, no VPN necessary. This seems like magic to me. Can anyone explain how mosh does this?
- bisho 12y ago
  Uses udp and probably udp is not filtered in the firewall

91 points by antonios 12y ago

This looks cool on the surface but I'm not sure how to feel about it; do I really want to add another layer on top of SSH without worrying about security leaks? While I'm sure it can be done right I will probably reserve judgment until I have time to thouroughly check this out. The pros aren't many but I do like the thought of roaming connections. That and the local edit, echo, delete looks like it would help with editing (vim/gvim) over some lagging connections I sometimes get. Definitely something to keep an eye on though, nice write up too.

akent 12y ago

Previous discussions: https://news.ycombinator.com/item?id=8252093 https://news.ycombinator.com/item?id=8252093 https://news.ycombinator.com/item?id=5016745 https://news.ycombinator.com/item?id=5016745 https://news.ycombinator.com/item?id=3819382 https://news.ycombinator.com/item?id=3819382

PindakaasMan 12y ago

I've being using Mosh for some time now. I really like it that apps like JuicySSH also support is so when my server goes down I can fix it on the go.

lepht 12y ago
Unfortunately the one iOS app that supports mosh (iSSH) was removed from the app store late last year. I've heard that the mosh license isn't compatible with the App Store(?)
- keithwinstein 12y ago
  The Mosh license has been compatible with the App Store since October 2012. Nobody has done the port yet (which will probably require grafting on a GUI terminal emulator), but I'm hoping somebody will do it if the demand is really there.
  - lepht 12y ago
    That's not entirely true: https://github.com/keithw/mosh/issues/198#issuecomment-7417927 https://github.com/keithw/mosh/issues/198#issuecomment-74179... Panic has explicitly stated in the past that they won't add mosh support to Prompt due to license issues, for instance.

visarga 12y ago

I like mosh but you can't scroll back in it. That's not nice.

navaati 12y ago
Use tmux.
- moe 12y ago
  That still doesn't give you native scrolling.
  - anom9999 12y ago
    It can do if you configure it to
    - zobzu 12y ago
      its not really "native" scrolling. (technically, it is, but obviously the commenter meant to have regular scrollback maintained client-side) Then again the situation is no better with ssh, and tmux/screen work okay for that.
      - lepht 12y ago
        You can get native tmux scrolling on a mac with iTerm or Terminal.app: https://filippo.io/native-scrolling-and-iterm2/ https://filippo.io/native-scrolling-and-iterm2/
        moe 12y ago
        This is NOT native scrolling. You still have to manually toggle "scroll-mode", get janky lag because of the screen redraws, and a redundant "selection cursor" that messes with inversions of the scroll direction.

kefka 12y ago

Doesn't support the following: Forwarding of X11, SSH agent, etc. IPv6, with roaming between v4 and v6 Android client The x-forwarding is what kills me. Still waiting for it though.

razzmataz 12y ago
Does it support any sort of port forwarding, not just X11?
- m8rl 12y ago
  Mosh is a client/server setup allowing kind of asynchronous interactive session on a ssh server over a ssh connection. It doesn't replace ssh but complements it, making ssh interactive sessions more usable for low-latency and failing connections. It somehow works like a proxy, with the added feature that it tries to add some sort of advanced local echo.
- db48x 12y ago
  No, MOSH is purely for interactive terminals.
aroch 12y ago
JuiceSSH (probably the most popular Android SSH client) supports mosh fully.

Maakuth 12y ago

I wouldn't call it a replacement, as it uses ssh for authentication and strives to not reinvent the wheel there. That is actually what makes mosh so nice - if you have your hosts in .ssh/config and your public key installed to your hosts, you can use mosh instead of ssh in interactive sessions and It Just Works. You still have ssh for file transfer, TCP and X11 forwarding, etc. For telecommuting, it's really nice to have mosh handle handovers between wifi and 3g/4g networks so gracefully. And for high latency links, it makes the user experience a bit less annoying. edit: missing word added

khanan 12y ago

Biggest drawback is that none of the commercial clients will implement support for it, that's what killed it for me (SecureCRT developer VanDyk told my company NOPE!) due to license issues :(

mkesper 12y ago
Using proprietary software for security is a no-go.
jeffcox 12y ago
Yeah, what's the point of creating a great, mobile focused alternative (or enhancement, however you'd like to describe it) to SSH if no one will implement it on iOS because it's GPLv3?
belorn 12y ago
If a company want to create a proprietary client, they can always do that. They simply has to pay programmers to do the work, rather then freeload on the work of a research university. Alternative they could collaborate with the research community, adding to the common knowledge in computer science and security on a deal where everyone share in access. For security and encryption software, I find this deal to be quite necessary for everyone involved and are thus glad with projects license choice.

eatonphil 12y ago

"Mosh is a replacement for SSH". "The mosh client logs in to the server via SSH..." Huh? I'm confused. So is it a replacement or is it an abstraction?

blueskin_ 12y ago
Abstraction. It's its own transport, but needs SSH to establish the session.

blueskin_ 12y ago

Mosh is nice, but I always feel wary about opening a big port range for it. Had it on my todo list for ages to work out a way of temporarily opening the port range for an IP that makes a successful SSH login.

falcolas 12y ago
FWIW, it works well with a fairly typical "allow all out, deny all in" firewall configuration. That is what I have set up on my server, and it works fine. If you go the deny all out, yeah, you'll probably have to set up more specific outgoing exceptions for Mosh.
- blueskin_ 12y ago
  That's surprising, as IIRC it needs inbound UDP on high ports which aren't directly associated with the inbound TCP for the SSH session.
  - falcolas 12y ago
    It does; they are likely opened up via hole punching, coordinated via the SSH connection.
    - blueskin_ 12y ago
      Gets stuck at "Connecting..." when I try it on any of my servers with the default firewall config (allow all out, allow related/established in, allow new to 22).
jamies888888 12y ago
You can open a single UDP port and specify the port number using the -p option when connecting.
ryanlol 12y ago
If you're worried about opening ports, you're doing security wrong.

zobzu 12y ago

Is this auto submitted every 6mo? Because that's what it's looking like. There is no changes from the past 3 submissions...

tobz 12y ago
If I had to guess, I'd say this got posted because of the relevance next to the other posts about multiplexing SSH/HTTP over a single connection.

mholt 12y ago

Did anyone else see this file about how a guy used mosh to escape from an elevator? http://gopher.floodgap.com/gopher/gw.lite?gopher://sdf.org:70/0/users/irl/blog/2012-08-22-mosh-in-a-lift.md http://gopher.floodgap.com/gopher/gw.lite?gopher://sdf.org:7...

dalanmiller 12y ago

Anyone know when Mosh will support IPv6?

sliken 12y ago
looks like it does. Check out the github mosh issues on ipv6.

jamies888888 12y ago

Just been using this for the last week or so. It's great, especially for trains (intermittent connections) and geographically far-away servers (high-latency connections).

jkot 12y ago

Screen (terminal program) already offers most of those features.

bergie 12y ago
It does offer persistent sessions. However, the other nice part of Mosh is how it handles low-quality connections. I can use vim over SSH pretty nicely over 3G or crappy conference WiFi thanks to it.
- deleted 12y ago
  [deleted]
warnhardcode 12y ago
Mosh and screen/tmux serve different roles. Mosh keeps your connection and reconnects across all sorts of events that would break your ssh connection. (laptop sleeps, different networks). Then screen/tmux manages the sessions on the other side of that connection. Maybe I don't understand everything screen can do, which is very possible.

frankzander 12y ago

Luckily Mosh isn't a real replacement. The first what comes in my mind wars "All the crypto rewritten?" and then I read "Uses SSH for Auth" ... SSH is robust and wide used ... I want no replacement for ssh because it seems like solid crypto. But mosh seems interesting.

the_duck 12y ago

What amazes me about mosh is how it handles transitions in and out of the private wifi network at my school. When I want to ssh to school machines from off campus, I generally need to use a VPN. Without the VPN the machines are unreachable: if I ping them, no packets are returned; ssh attempts fail. Using mosh, though, I've found that I can start a session at school and resume it off campus, no VPN necessary. This seems like magic to me. Can anyone explain how mosh does this?

bisho 12y ago
Uses udp and probably udp is not filtered in the firewall