SSH hacks – a little sanity for remote workers

Post by mfontani » Thu, Apr 30, 2020, 9:55 AM UTC

snowwrestler wrote: post #84

m463 wrote: post #67

I always create and heavily use ~/.ssh/config Host x Hostname full.host.name.com (or 1.2.3.4) User IdentitiesOnly yes IdentityFile ~/.ssh/id_x_ed25519 I give hosts short names so you can `ssh x` to do automatic login, I generate identities for some machines ssh-keygen -t ed25519 -f ~/.ssh/id_x_ed25519 use ssh-copy-id to copy the identity to the target machine so it lets you in: ssh-copy-id -i ~/.ssh/id_x_ed25519.pub…

I use a config file for all my regular SSH connections as well. But I stopped using more than one key when I could not think of a threat model that it addressed. If the bad guys get a copy of my public key off one remote server, they can't use it to access any other remote server. They would need the private key, which is on my laptop. And if the bad guys get my laptop, then they get all my keys; having separate priv…

Post by MawKKe » Thu, Apr 30, 2020, 10:22 AM UTC

zengargoyle wrote: post #107

mrweasel wrote: post #87

Earlier quoted context omitted.

I love the multiplexing feature. We have a client who require password, ssh key and MFA. All services are behind a bastion host, which only accepts trafic from select IPs. SSH multiplexing and proxy configuration allows me to enter the password and TOTP just once instead of every time I need to access a service behind the bastion host.

Of course if the multiplex stalls or goes down so do all of the connections you have running through it. It's like screwing up Gnome Terminal or similar that uses a main server and multiple clients. Screw one pooch and you're whole session of things is similarly screwed.

Post by practical_lem » Thu, Apr 30, 2020, 10:39 AM UTC

anonymousDan wrote: post #103

InvaderFizz wrote: post #58

Earlier quoted context omitted.

Another lesser known tunneling trick is that SSH will happily act as a SOCKS5 Proxy. I've been using this trick for going on 20 years now. Just do: ssh -D9090 user@remote Then, in Firefox, set it to use a SOCK5 proxy of localhost:9090 and "Proxy DNS when using SOCKS v5". Now, when you use Firefox it is as if you are using Firefox on the machine you are SSH'd into(including DNS resolution!). This is really handy for t…

Can I use this to potentially view a pdf on a remote server locally (as an alternative to an X server)? Would it be more efficient?

Post by riedel » Thu, Apr 30, 2020, 10:49 AM UTC

mfontani wrote: post #111

snowwrestler wrote: post #84

Earlier quoted context omitted.

I use a config file for all my regular SSH connections as well. But I stopped using more than one key when I could not think of a threat model that it addressed. If the bad guys get a copy of my public key off one remote server, they can't use it to access any other remote server. They would need the private key, which is on my laptop. And if the bad guys get my laptop, then they get all my keys; having separate priv…

If a bad guy gets root on one server you're currently connected via ssh with, and forwarding said key via, they can also access (unless otherwise firewalled) all systems that ssh key grants them access to. See also: https://github.com/FiloSottile/whoami.filippo.io Using a private key per system or set of systems means that such an attacker would only gain access to what that key grants them access to. My "github" key…

Post by davb » Thu, Apr 30, 2020, 10:59 AM UTC

itsjloh wrote: post #62

segfaultbuserr wrote: post #4

> What are your favorite SSH tips & tricks? $ ssh -J user1@host1 user_final@host_final or $ ssh -J user1@host1,user2@host2 user_final@host_final Not many people know it, you don't need to launch a SSH within a SSH session - SSH has built-in support of using one SSH server as a proxy to another SSH server. Useful for hacking servers accessing servers behind a firewall, or using your own server as a proxy to bypass a b…

Jump hosts are fantastic! With a little bit of sed magic you can also setup wildcard jump hosts, eg: Host *-via-dc1 ProxyCommand ssh you@jump-01.example.com nc $(echo %h | sed 's/-via-dc1$//') %p I wrote about it ages ago here https://jloh.co/posts/dynamic-ssh-jump-hosts/

  Host my-jump-host
      Hostname my-jump-host.mydomain.example
      User myuser

  Host my-jump-host-*
      User myuser
      ProxyCommand ssh my-jump-host nc $(echo %h | sed 's/^my-jump-host-//') %p