Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mosh: the mobile shell

mosh.mit.edu

Post reply on HN
Print view View original

81–90 of 153 posts

Re: Mosh: the mobile shell

#81

Post by aerovistae »

geofft wrote: post #60
aerovistae wrote: post #38

I'm not a security researcher, but somehow I suspect the "maintaining connection while switching networks" holds potential for a flaw.

Can you describe what you're worried about? The connection is set up over SSH, and mosh-client generates a random AES-OCB key and sends it to mosh-server. Packets are sent over UDP, protected using authenticated encryption, and discarded if they fail integrity protection (which is fine, since packets could just be dropped and perhaps corrupted anyway because of bad network connections). Replayed packets are invalid.…

I guess I was thinking about something involving a principle similar to session fixation, but it was just a passing thought. Your methodologies seem sound.

Re: Mosh: the mobile shell

#82

Post by TimWolla »

geofft wrote: post #64
drewr wrote: post #34

autossh + tmux still. How are people getting around the lack of SSH agent forwarding?

I think "Not wanting to use SSH agent forwarding" is the answer. I don't want every single machine I use to be able to authenticate as me to anyone else. If I actually want to be able to connect to a third machine, I'll have an SSH key on the second machine. For instance, my phone has an SSH key to SSH/mosh to my VPS, and my VPS has a different SSH key that can authenticate to GitHub. If I suspect my VPS got compromi…

> I don't want every single machine I use to be able to authenticate as me to anyone else.

There is the `-c` option to `ssh-add` for that reason:

     -c      Indicates that added identities should be subject to confirmation
             before being used for authentication.  Confirmation is performed
             by ssh-askpass(1).  Successful confirmation is signaled by a zero
             exit status from ssh-askpass(1), rather than text entered into
             the requester.

Re: Mosh: the mobile shell

#83

Post by andy_ppp »

neves wrote: post #72
mholt wrote: post #24

> Mosh (and its tolerance for high packet loss) helps Iain Learmonth escape from an elevator. Um, wow! https://mosh.mit.edu/elevator.txt

Hey, never, but never, go out of an elevator that isn't leveled in the floor. By the description, I understand that he jumped from the elevator. If the elevator started to move, he could have been cut in half. This happened other day in my city. If you are stuck in a elevator, wait for professional help to take you out.

I once dreamt I was cut in half by a lift. It was not at all fun, so I'd definitely follow this advice :-D

The other piece of lift related advice (that I really enjoy saying in more crowded, rickety lifts): I once read if in a lift that is falling you should attempt to lie flat on the bottom of the lift to limit the impact - preferably on top of another human. Some hacker news physicist will prove me apocryphal here I'm sure...

Re: Mosh: the mobile shell

#84

Post by ChrisArgyle »

raesene9 wrote: post #51
ChrisArgyle wrote: post #46

Earlier quoted context omitted.

That sounds like a scenario for long-form work over a mobile network (eg. on a laptop through a mobile hotspot). Mosh from a laptop is a no-go for me because there's no Windows-based, full-featured terminal emulator (saved sessions, auth agents, etc) that supports mosh.

have you tried Mobaxterm for this? I've not used its mosh support but like it as a general SSH client...

I'm embarassed to say I haven't even heard of MobaXterm. This is going on my remote-work rig tonight.

Re: Mosh: the mobile shell

#85

Post by zobzu »

somebehemoth wrote: post #79
therealmarv wrote: post #68

Don't use it. It's a bigger security risk than e.g. SSH because there is no audit and so well tested regarding security.

I think caution is good, but I am not sure "Don't use it" is a fair assessment for all use cases given Mosh's technology and track record over the years. Of course SSH is more battle tested but, Mosh has a FAQ entry just for this concern: "In one concrete respect, the Mosh protocol is more secure than SSH's: SSH relies on unauthenticated TCP to carry the contents of the secure stream. That means that an attacker can…

Mosh requires OpenSSH to run so no matter what, using Mosh is ALWAYS less safe than OpenSSH alone since all it does is add functionality on top.

Now, I wrote a 3DES-telnet tool back in 1996 and it has zero security vulnerability. That's 20 years. Safe as hell! Yeah exactly. Everyone uses OpenSSH. Very few use Mosh. Invalid comparison.

Re: Mosh: the mobile shell

#86

Post by dfc »

mholt wrote: post #24

> Mosh (and its tolerance for high packet loss) helps Iain Learmonth escape from an elevator. Um, wow! https://mosh.mit.edu/elevator.txt

I dont get the plot. He got text messages to his flatmate, but the one asking his flatmate to call the council never made it. So his flatmate is dumb enough to need explicit instructions to call for help when a friend says they are trapped? Or were the first few texts he sent "hey whats up?" and "doing anything later?"? Why have your flatmate call "the council" when the obvious ask, and the one requested via email, was to call the fire brigade?

Re: Mosh: the mobile shell

#87

Post by shirro »

0xADADA wrote: post #26
shirro wrote: post #21

I have mostly gone back to plain ssh. mosh was fantastic for keeping a connection running across network changes and when accessing a plain command line it does feel a bit snappier on slow connections. But screen or tmux give me persistence and re-establishing an ssh connection isn't very time consuming. A terminal multiplexer has a lot of advantages that mosh does not provide. mosh adds another layer of terminal emu…

Why not just use mosh to establish & maintain the connection then then use tmux/screen to manage the terminal sessions?

It is practically necessary with mosh to run tmux/screen anyway because mosh removes scrollback. I find mosh adds little benefit for me most days and it makes a few things worse.

mosh is a great idea and sometimes useful when you are changing connections or opening and closing a laptop all day but most days I think I am better off without it.

Also I rarely have a remote connection open without forwarding some ports about so mosh often doesn't do what I need anyway.

Unfortunately every layer of terminal emulation tends to filter out some terminal capabilities. It is a small thing but I like to be able to yank a selection out of a remote vim and paste it locally and last I saw mosh's terminal emulation eats the necessary control codes.

Re: Mosh: the mobile shell

#88

Post by nyolfen »

neves wrote: post #72
mholt wrote: post #24

> Mosh (and its tolerance for high packet loss) helps Iain Learmonth escape from an elevator. Um, wow! https://mosh.mit.edu/elevator.txt

Hey, never, but never, go out of an elevator that isn't leveled in the floor. By the description, I understand that he jumped from the elevator. If the elevator started to move, he could have been cut in half. This happened other day in my city. If you are stuck in a elevator, wait for professional help to take you out.

Do you live in China by any chance?

Re: Mosh: the mobile shell

#89

Post by chitta »

spdustin wrote: post #25
chitta wrote: post #16

Earlier quoted context omitted.

Curious on what advantages you see vs. using IPv6 Edit: IPv4

I'll chime in and say: Support for IPv6. It's ... self evident? I think we've reached a point that it's okay to call out a network client that doesn't support it.

I am not sure I understand. How is it self-evident? Is there a benefit over using mosh over IPv4? Performance, stability,anything else? Does it add anything to what mosh can do over IPv4. Is the benefit from the client end or the server end or in-between.

Re: Mosh: the mobile shell

#90

Post by stouset »

andy_ppp wrote: post #83
neves wrote: post #72

Earlier quoted context omitted.

Hey, never, but never, go out of an elevator that isn't leveled in the floor. By the description, I understand that he jumped from the elevator. If the elevator started to move, he could have been cut in half. This happened other day in my city. If you are stuck in a elevator, wait for professional help to take you out.

I once dreamt I was cut in half by a lift. It was not at all fun, so I'd definitely follow this advice :-D The other piece of lift related advice (that I really enjoy saying in more crowded, rickety lifts): I once read if in a lift that is falling you should attempt to lie flat on the bottom of the lift to limit the impact - preferably on top of another human. Some hacker news physicist will prove me apocryphal here…

If an elevator is falling for long enough to give you time to recognize the situation, recall this strategy, and actually lie prone upon the floor (in ~0G, somehow)… it's not going to matter.
Post reply on HN