Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH hacks – a little sanity for remote workers

smallstep.com

Post reply on HN
Print view View original

61–70 of 230 posts

Re: SSH hacks – a little sanity for remote workers

#61

Post by fulafel »

davb wrote: post #10
segfaultbuserr wrote: post #4

> What are your favorite SSH tips & tricks? $ ssh -J user1@host1 user_final@host_final or $ ssh -J user1@host1,user2@host2 user_final@host_final Not many people know it, you don't need to launch a SSH within a SSH session - SSH has built-in support of using one SSH server as a proxy to another SSH server. Useful for hacking servers accessing servers behind a firewall, or using your own server as a proxy to bypass a b…

And in your ~/.ssh/config that's the ProxyJump directive. Adding a proper configuration for the bastion/jump host and for the target host means you can just to "ssh target". In my case, I usually do "ssh target -t tmux -2 att" to attach to my tmux session, then when I detach it will close the SSH connection (and all of my tunnels).

Word of warning: using jump hosts shift your mindset towards building an internal network with lax security, the crunchy outside/soft tasty inside security antipattern.

(Yes you don't intend it at the start, but the realities of your later evaluations of where to invest effort security-wise will leave the internal network to rot since you won't think of the scenarios of how it would be compromised)

Re: SSH hacks – a little sanity for remote workers

#62

Post by itsjloh »

segfaultbuserr wrote: post #4

> What are your favorite SSH tips & tricks? $ ssh -J user1@host1 user_final@host_final or $ ssh -J user1@host1,user2@host2 user_final@host_final Not many people know it, you don't need to launch a SSH within a SSH session - SSH has built-in support of using one SSH server as a proxy to another SSH server. Useful for hacking servers accessing servers behind a firewall, or using your own server as a proxy to bypass a b…

Jump hosts are fantastic! With a little bit of sed magic you can also setup wildcard jump hosts, eg:

    Host *-via-dc1
        ProxyCommand ssh you@jump-01.example.com nc $(echo %h | sed 's/-via-dc1$//') %p
I wrote about it ages ago here https://jloh.co/posts/dynamic-ssh-jump-hosts/

Re: SSH hacks – a little sanity for remote workers

#65

Post by asdff »

My advice is to make heavy use of your .ssh/config

Here is an example of some of mine (double spaced to read clearly on HN):

Host *

        Ciphers aes128-ctr

        Compression yes

        ServerAliveInterval 120

        ForwardX11 yes
Host example

        HostName example.url.com

        User my_name

        ForwardX11Trusted yes
I keep global settings behind the glob, and more specific settings for all the hosts I use.

No need to use aliases in your .bashrc or wherever. With this setup, typing 'ssh example' is equivalent to 'ssh -XCY -c aes128-ctr my_name@example.url.com' which definitely saves some keystrokes.

Re: SSH hacks – a little sanity for remote workers

#66

Post by segfaultbuserr »

InvaderFizz wrote: post #58
segfaultbuserr wrote: post #4

> What are your favorite SSH tips & tricks? $ ssh -J user1@host1 user_final@host_final or $ ssh -J user1@host1,user2@host2 user_final@host_final Not many people know it, you don't need to launch a SSH within a SSH session - SSH has built-in support of using one SSH server as a proxy to another SSH server. Useful for hacking servers accessing servers behind a firewall, or using your own server as a proxy to bypass a b…

Another lesser known tunneling trick is that SSH will happily act as a SOCKS5 Proxy. I've been using this trick for going on 20 years now. Just do: ssh -D9090 user@remote Then, in Firefox, set it to use a SOCK5 proxy of localhost:9090 and "Proxy DNS when using SOCKS v5". Now, when you use Firefox it is as if you are using Firefox on the machine you are SSH'd into(including DNS resolution!). This is really handy for t…

> Now, when you use Firefox it is as if you are using Firefox on the machine you are SSH'd into(including DNS resolution!).

Don't forget to check the "Proxy DNS when using SOCKS v5" option in Firefox.

Re: SSH hacks – a little sanity for remote workers

#67

Post by m463 »

I always create and heavily use ~/.ssh/config

   Host x
       Hostname full.host.name.com  (or 1.2.3.4)
       User 
       IdentitiesOnly yes
       IdentityFile ~/.ssh/id_x_ed25519
I give hosts short names so you can `ssh x`

to do automatic login, I generate identities for some machines

  ssh-keygen -t ed25519 -f ~/.ssh/id_x_ed25519
use ssh-copy-id to copy the identity to the target machine so it lets you in:

  ssh-copy-id -i ~/.ssh/id_x_ed25519.pub x
or if your machine doesn't have ssh-copy-id (older macs);

  cat ~/.ssh/id_x_ed25519.pub | ssh x "cat >> .ssh/authorized_keys"
IdentitiesOnly means it will only send that one identity for that one machine (otherwise it will try all of them, like a janitor trying to open a locker with a big keychain of identical keys)

If you always want to use a password to log into a machine, but want to be able to log in in other windows to the same machine without a password:

  Host x
      ...
      ControlMaster auto
      ControlPath ~/.ssh/master-%r@%h:%p
this will multiplex all activity to that host through one tcp connection

you can also use Host * at the beginning of your config to do this for all hosts

to tunnel vnc over ssh to a remote mac(I do this with mac)

  Host foo
        ...
        LocalFoward 5900 localhost:5900


  ssh foo
then locally vnc to localhost:127.0.0.1

Re: SSH hacks – a little sanity for remote workers

#68

Post by 3r8riacz »

m463 wrote: post #67

I always create and heavily use ~/.ssh/config Host x Hostname full.host.name.com (or 1.2.3.4) User IdentitiesOnly yes IdentityFile ~/.ssh/id_x_ed25519 I give hosts short names so you can `ssh x` to do automatic login, I generate identities for some machines ssh-keygen -t ed25519 -f ~/.ssh/id_x_ed25519 use ssh-copy-id to copy the identity to the target machine so it lets you in: ssh-copy-id -i ~/.ssh/id_x_ed25519.pub…

Doesn't ed25519 keys are fixed to 256 in terms of the -b flag, so no need to specify there anything?

Re: SSH hacks – a little sanity for remote workers

#69

Post by rob-olmos »

mmalone wrote: post #56
segfaultbuserr wrote: post #55

Earlier quoted context omitted.

> How does github not have an AAAA record in 2020? Yeah, it's hopeless, and it goes as if [0] they explicitly decided not to support it, incredibly frustrating! > The faster people move to gitlab the better. A lot projects will always host their master repository on GitHub for better or worse... [0] Not meant to be an accusation, I don't have any evidence.

Last time I launched a new website it took less than a month for someone to let us know that we'd forgotten to configure a AAAA and our site was inaccessible for them. And that was at new website traffic volume. So yea, GitHub definitely knows about AAAA records and has intentionally decided not to have one. The question is: why? They must have a reason. Maybe even a good one. I'm curious.

Interesting. Any likely reasons why not having IPv6/AAAA make the site inaccessible to them?

Sounds like most of the internet would be inaccessible to them as well?

Re: SSH hacks – a little sanity for remote workers

#70

Post by kbenson »

geocrasher wrote: post #35
kbenson wrote: post #11

I was tired enough of losing connections to work systems I was working on when network topology changes, or my laptop was moved, or it went to sleep, or I moved to a new computer (e.g. I'm at home) that I wrote a simple script to jump all my ssh connections through a VM at work, but with the extra step that the connection from the jump VM happens in a tmux that's named based on the desired host, and with options to r…

Why not just use Mosh? It's stateless connections that are persistent even when internet connectivity isn't.

Because convincing my org to install mosh-server on a few hundred systems is a non-starter. What I have is a small shim that sits on top of SSH the provides the interesting bits I need at no additional requirement per server. It works for any server running SSH, because it is SSH, so it already works with our key distribution system and expected way of managing servers. Not only that, SSH is well known and extremely well vetted security wise. Mosh has some nice features, but it doesn't really fit the criteria in this situation.
Post reply on HN