SSH hacks – a little sanity for remote workers • Hacker News Board

Re: SSH hacks – a little sanity for remote workers

#31

Post by madars » Thu, Apr 30, 2020, 1:46 AM UTC

> When debugging a complex issue on your servers, you might like to share an SSH session with someone who is not in the same room. tmux is perfect for this for terminal sharing! Here are the steps: > [..] > Both of you will need to SSH to the machine using the same account.

If you want, it is very easy to do view-only tmux sessions with no third-party tools required. That is, you start your tmux specifying a socket (tmux -S ...), and then have a dedicated ssh user which references it (tmux -S ... attach -r, where -r is for read-only) as sshd's ForceCommand (a 10-liner https://gist.github.com/madars/e6b957ea508be1dcd9044fd2c7096...)

Re: SSH hacks – a little sanity for remote workers

#32

Post by memco » Thu, Apr 30, 2020, 1:47 AM UTC

davb wrote: post #10

segfaultbuserr wrote: post #4

> What are your favorite SSH tips & tricks? $ ssh -J user1@host1 user_final@host_final or $ ssh -J user1@host1,user2@host2 user_final@host_final Not many people know it, you don't need to launch a SSH within a SSH session - SSH has built-in support of using one SSH server as a proxy to another SSH server. Useful for hacking servers accessing servers behind a firewall, or using your own server as a proxy to bypass a b…

And in your ~/.ssh/config that's the ProxyJump directive. Adding a proper configuration for the bastion/jump host and for the target host means you can just to "ssh target". In my case, I usually do "ssh target -t tmux -2 att" to attach to my tmux session, then when I detach it will close the SSH connection (and all of my tunnels).

Incidentally, I just filed a ticket because ProxyJump is not a known keyword in VScode’s SSH config autocomplete. It’s such a handy tool. Only landed in OpenSSH 7.3 in 2016 so it’s not that surprising it isn’t well known.

Re: SSH hacks – a little sanity for remote workers

#33

Post by varenc » Thu, Apr 30, 2020, 1:48 AM UTC

shawnz wrote: post #28

dallbee wrote: post #27

Earlier quoted context omitted.

Do be careful doing this, if your company cares, a competent network admin can tell what's going on.

You can defeat deep packet inspection by tunneling it over an HTTPS proxy, using the SSH ProxyCommand option and the proxytunnel utility

A corporate IT admin would probably detect this by pulling information directly from the company managed machines. i.e. osquery

https://www.metalliccode.com/detecting-ssh-tunnels

Re: SSH hacks – a little sanity for remote workers

#34

Post by Camillo » Thu, Apr 30, 2020, 1:52 AM UTC

If you have a Mac, the correct way to use SSH is:

1. Install iTerm.

2. ssh -t remote.workstation 'tmux -CC new-session -A -D -s main'

Re: SSH hacks – a little sanity for remote workers

#35

Post by geocrasher » Thu, Apr 30, 2020, 1:54 AM UTC

kbenson wrote: post #11

I was tired enough of losing connections to work systems I was working on when network topology changes, or my laptop was moved, or it went to sleep, or I moved to a new computer (e.g. I'm at home) that I wrote a simple script to jump all my ssh connections through a VM at work, but with the extra step that the connection from the jump VM happens in a tmux that's named based on the desired host, and with options to r…

Why not just use Mosh? It's stateless connections that are persistent even when internet connectivity isn't.

Re: SSH hacks – a little sanity for remote workers

#36

Post by downerending » Thu, Apr 30, 2020, 1:56 AM UTC

jonah-archive wrote: post #23

tashian wrote: post #7

Earlier quoted context omitted.

And on an international keyboard it’s ~~, because ~ defaults to being a character modifier. If you nest SSH sessions, then you add more ~s. So in your fifth nested SSH session on an international keyboard the escape sequence would be \n~~~~~~~~~~.

Does anyone know of a modification that will e.g. dump hostname on a ~? -- so many times I'm in a few layers deep and likely to miscount.

Sounds like maybe ~C could do it? Too lazy to try it out.

Re: SSH hacks – a little sanity for remote workers

#37

Post by gbrayut » Thu, Apr 30, 2020, 1:59 AM UTC

One of my most used commands is Ctrl+d for closing the input stream and causing a remote or local shell session to exit

https://unix.stackexchange.com/q/110240/8692

Re: SSH hacks – a little sanity for remote workers

#38

Post by yownie » Thu, Apr 30, 2020, 2:02 AM UTC

shawnz wrote: post #28

dallbee wrote: post #27

Earlier quoted context omitted.

Do be careful doing this, if your company cares, a competent network admin can tell what's going on.

You can defeat deep packet inspection by tunneling it over an HTTPS proxy, using the SSH ProxyCommand option and the proxytunnel utility

or just sshuttle

Re: SSH hacks – a little sanity for remote workers

#39

Post by shawnz » Thu, Apr 30, 2020, 2:12 AM UTC

yownie wrote: post #38

shawnz wrote: post #28

Earlier quoted context omitted.

You can defeat deep packet inspection by tunneling it over an HTTPS proxy, using the SSH ProxyCommand option and the proxytunnel utility

or just sshuttle

Sshuttle solves a different problem. It uses SSH as a transport so it could not bypass a firewall that blocks outgoing SSH.

Re: SSH hacks – a little sanity for remote workers

#40

Post by LilBytes » Thu, Apr 30, 2020, 2:29 AM UTC

shawnz wrote: post #28

dallbee wrote: post #27

Earlier quoted context omitted.

Do be careful doing this, if your company cares, a competent network admin can tell what's going on.

You can defeat deep packet inspection by tunneling it over an HTTPS proxy, using the SSH ProxyCommand option and the proxytunnel utility

We had a sys. admin who did exactly this to access his home computer to play World of Tanks. :)

He still works there in a Government Agency riddled with staff who are perfectly adapt at doing enough to stay hired and doing little enough to describe their job as a paid hobby.