Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH hacks – a little sanity for remote workers

smallstep.com

Post reply on HN
Print view View original

51–60 of 230 posts

Re: SSH hacks – a little sanity for remote workers

#51

Post by Polylactic_acid »

segfaultbuserr wrote: post #30
_wldu wrote: post #9

Earlier quoted context omitted.

Use teredo at home. apt install miredo (on most debian based systems) https://en.wikipedia.org/wiki/Teredo_tunneling

You can also use Tor as IPv6 proxy in a pure IPv4 network (or as IPv4 proxy in a pure IPv6 network), recent versions of Tor can work under pure IPv6, gaining privacy and connectivity simultaneously. The speed is not actually too bad for web browsing, although not ideal for SSH. But still comes handy sometimes, I'm used it before to clone packages from GitHub on IPv6-only servers.

How does github not have an AAAA record in 2020?? The faster people move to gitlab the better. ipv6 servers are not at all rare. Useful for individual use since you can save $1/month by dropping a useless for personal use feature.

Re: SSH hacks – a little sanity for remote workers

#52

Post by xelxebar »

mmalone wrote: post #13
davb wrote: post #10

Earlier quoted context omitted.

And in your ~/.ssh/config that's the ProxyJump directive. Adding a proper configuration for the bastion/jump host and for the target host means you can just to "ssh target". In my case, I usually do "ssh target -t tmux -2 att" to attach to my tmux session, then when I detach it will close the SSH connection (and all of my tunnels).

That `tmux` bit is clever. Wonder if you could do that in a `ForceCommand` or something like that so you don’t need to type that part either?

A combination of `RemoteCommand` and `RequestTTY` should do the trick:

    Host 
        ...
        RequestTTY yes
        RemoteCommand tty
The problem is that this will mess up your one-off command invocations of ssh, git ssh connections, etc:

    $ ssh  ls
    Cannot execute command-line and remote command.
However, we can use `Match` blocks to get around that! There are a thousand ways to skin this cat, but one way is to use an environment variable, here `t` for "tmux". Put this at the end of your config:

    Match exec "test ${t:-0} = 1"
        RequestTTY yes
        RemoteCommand tmux has-session && tmux attach-session || tmux
and the following Just Work, reattaching tmux sessions as necessary:

    $ t=1 ssh 
    $ ssh  ls

Re: SSH hacks – a little sanity for remote workers

#53

Post by jerf »

davb wrote: post #10
segfaultbuserr wrote: post #4

> What are your favorite SSH tips & tricks? $ ssh -J user1@host1 user_final@host_final or $ ssh -J user1@host1,user2@host2 user_final@host_final Not many people know it, you don't need to launch a SSH within a SSH session - SSH has built-in support of using one SSH server as a proxy to another SSH server. Useful for hacking servers accessing servers behind a firewall, or using your own server as a proxy to bypass a b…

And in your ~/.ssh/config that's the ProxyJump directive. Adding a proper configuration for the bastion/jump host and for the target host means you can just to "ssh target". In my case, I usually do "ssh target -t tmux -2 att" to attach to my tmux session, then when I detach it will close the SSH connection (and all of my tunnels).

Just in general, look up .ssh/config and configure it.

A lot of software uses ssh to do various things. You can pull a lot of neat tricks with SSH config coming in through a bastion on a non-standard port to a host machine into a shell executed in a docker container with the right .ssh/config, aliased to "machine", and the you can use anything that can run on SSH to "machine" with all that fancy configuration. Check your favorite editor; good odds it can edit files through that mess, or give you a remote directory explorer, or whatever.

Re: SSH hacks – a little sanity for remote workers

#54

Post by mmalone »

xelxebar wrote: post #52
mmalone wrote: post #13

Earlier quoted context omitted.

That `tmux` bit is clever. Wonder if you could do that in a `ForceCommand` or something like that so you don’t need to type that part either?

A combination of `RemoteCommand` and `RequestTTY` should do the trick: Host ... RequestTTY yes RemoteCommand tty The problem is that this will mess up your one-off command invocations of ssh, git ssh connections, etc : $ ssh ls Cannot execute command-line and remote command. However, we can use `Match` blocks to get around that! There are a thousand ways to skin this cat, but one way is to use an environment variable…

Nice. `Match exec` is one of my favorite things. It's too bad the command being passed to `ssh` (if there is one) isn't available as a `TOKEN` (as far as I can tell). That would put a bow on everything.

Re: SSH hacks – a little sanity for remote workers

#55

Post by segfaultbuserr »

Polylactic_acid wrote: post #51
segfaultbuserr wrote: post #30

Earlier quoted context omitted.

You can also use Tor as IPv6 proxy in a pure IPv4 network (or as IPv4 proxy in a pure IPv6 network), recent versions of Tor can work under pure IPv6, gaining privacy and connectivity simultaneously. The speed is not actually too bad for web browsing, although not ideal for SSH. But still comes handy sometimes, I'm used it before to clone packages from GitHub on IPv6-only servers.

How does github not have an AAAA record in 2020?? The faster people move to gitlab the better. ipv6 servers are not at all rare. Useful for individual use since you can save $1/month by dropping a useless for personal use feature.

> How does github not have an AAAA record in 2020?

Yeah, it's hopeless, and it goes as if [0] they explicitly decided not to support it, incredibly frustrating!

> The faster people move to gitlab the better.

A lot projects will always host their master repository on GitHub for better or worse...

[0] Not meant to be an accusation, I don't have any evidence.

Re: SSH hacks – a little sanity for remote workers

#56

Post by mmalone »

segfaultbuserr wrote: post #55
Polylactic_acid wrote: post #51

Earlier quoted context omitted.

How does github not have an AAAA record in 2020?? The faster people move to gitlab the better. ipv6 servers are not at all rare. Useful for individual use since you can save $1/month by dropping a useless for personal use feature.

> How does github not have an AAAA record in 2020? Yeah, it's hopeless, and it goes as if [0] they explicitly decided not to support it, incredibly frustrating! > The faster people move to gitlab the better. A lot projects will always host their master repository on GitHub for better or worse... [0] Not meant to be an accusation, I don't have any evidence.

Last time I launched a new website it took less than a month for someone to let us know that we'd forgotten to configure a AAAA and our site was inaccessible for them. And that was at new website traffic volume.

So yea, GitHub definitely knows about AAAA records and has intentionally decided not to have one. The question is: why? They must have a reason. Maybe even a good one. I'm curious.

Re: SSH hacks – a little sanity for remote workers

#57

Post by segfaultbuserr »

mmalone wrote: post #56
segfaultbuserr wrote: post #55

Earlier quoted context omitted.

> How does github not have an AAAA record in 2020? Yeah, it's hopeless, and it goes as if [0] they explicitly decided not to support it, incredibly frustrating! > The faster people move to gitlab the better. A lot projects will always host their master repository on GitHub for better or worse... [0] Not meant to be an accusation, I don't have any evidence.

Last time I launched a new website it took less than a month for someone to let us know that we'd forgotten to configure a AAAA and our site was inaccessible for them. And that was at new website traffic volume. So yea, GitHub definitely knows about AAAA records and has intentionally decided not to have one. The question is: why? They must have a reason. Maybe even a good one. I'm curious.

I do find some rumors on Reddit [0], which says IPv6 is a low priority project that gives its way to other projects.

[0] https://old.reddit.com/r/ipv6/comments/ec8i7y/github_still_d...

Re: SSH hacks – a little sanity for remote workers

#58

Post by InvaderFizz »

segfaultbuserr wrote: post #4

> What are your favorite SSH tips & tricks? $ ssh -J user1@host1 user_final@host_final or $ ssh -J user1@host1,user2@host2 user_final@host_final Not many people know it, you don't need to launch a SSH within a SSH session - SSH has built-in support of using one SSH server as a proxy to another SSH server. Useful for hacking servers accessing servers behind a firewall, or using your own server as a proxy to bypass a b…

Another lesser known tunneling trick is that SSH will happily act as a SOCKS5 Proxy. I've been using this trick for going on 20 years now.

Just do: ssh -D9090 user@remote

Then, in Firefox, set it to use a SOCK5 proxy of localhost:9090 and "Proxy DNS when using SOCKS v5".

Now, when you use Firefox it is as if you are using Firefox on the machine you are SSH'd into(including DNS resolution!). This is really handy for things like accessing otherwise unreachable resources or other internal resources externally. I use it for accessing iDRAC/IPMI/ESXi (you can also tell Java to use the proxy so VMRC works as well). It is also handy to be able to put all your web traffic as originating from a remote VPS with no advanced setup required.

Post reply on HN