Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH has become our universal (Unix) external access protocol

utcc.utoronto.ca

Post reply on HN
Print view View original

61–70 of 99 posts

Re: SSH has become our universal (Unix) external access protocol

#61

Post by pizlonator »

juujian wrote: post #37
Sebb767 wrote: post #24

Earlier quoted context omitted.

You can also simply use `ssh -X`/`ssh -Y` and use your local X/Xwayland server for the remote app. This way you can start remote GUI apps like local ones from your shell.

How is the latency on that?

Surprisingly good.

I was running emacs on a machine in the cloud on the east coast, tunneling to my X server on my laptop on the west coast. No visible keystroke latency. Only noticeable latencies were copy/paste and initial startup but those were only bad enough to be noticeable, not bad enough to annoy me.

Re: SSH has become our universal (Unix) external access protocol

#62

Post by dspillett »

whalesalad wrote: post #5

Need to get a file from one box to another? Have SSH? `scp` is your friend: https://en.wikipedia.org/wiki/SSH_File_Transfer_Protocol scp remote.host:path.txt local scp local remote.host:path Need a fast proxy to browse the internet securely and bypass restrictions without a VPN? SSH SOCKS proxy! Supported by most operating systems, but I tend to use it directly via Firefox so that it is isolated to one browser. This…

> Need to get a file from one box to another? Have SSH? `scp` is your friend

For less trivial transfers (recursive structures, large collections that you want to sync with minimal time) rsync supports SSH as a transport medium out of the box so

    scp remote.host:path.txt local
    scp local remote.host:path
becomes

    rsync remote.host:path.txt local
    rsync local remote.host:path
for the basics, then start adding the other options that you need:

    rsync some/local/dir me@remote.host:/target/ --recursive --times
    rsync some/local/dir me@remote.host:/target/ --archive # archive does recursive and also preserves times, ownership, etc.
    rsync some/local/dir me@remote.host:/target/ --recursive --delete-before --dry-run
    … … …
In fact, I usually end up using rsync even for the basics, just out of habit typing that instead of scp.

Re: SSH has become our universal (Unix) external access protocol

#63

Post by rsync »

cm2187 wrote: post #6

What about an IP whitelist managed on some other website (say in AWS). If you need remote access while you are travelling, you login to that website, which will add your current IP to the whitelist. The server refreshes its firewall with the new whitelist every 5 minutes. So within 5 minutes you get access. That creates another layer of protection (authentication to the website). I would assume a linux firewall is ve…

There is no reason to bother with any of this when you can just hide behind port knocking.

Re: SSH has become our universal (Unix) external access protocol

#64

Post by whalesalad »

samtheprogram wrote: post #29
mdgrech23 wrote: post #23

Earlier quoted context omitted.

I don't see how this gets around a VPN? I still need a host in your example. That's what I'm paying a VPN for, a bunch of hosts around the world that are relatively fast.

I used a server running in AWS for this while in China. Sometimes you don’t have a VPN, or using certain VPN providers might be heavily monitored and/or blocked.

My roommate was visiting family in China a few years back and I did the same thing. Got him sorted with SSH access to one of our servers and he was able to SOCKS proxy to bypass all of their unhinged filtering.

Re: SSH has become our universal (Unix) external access protocol

#65

Post by whalesalad »

dspillett wrote: post #62
whalesalad wrote: post #5

Need to get a file from one box to another? Have SSH? `scp` is your friend: https://en.wikipedia.org/wiki/SSH_File_Transfer_Protocol scp remote.host:path.txt local scp local remote.host:path Need a fast proxy to browse the internet securely and bypass restrictions without a VPN? SSH SOCKS proxy! Supported by most operating systems, but I tend to use it directly via Firefox so that it is isolated to one browser. This…

> Need to get a file from one box to another? Have SSH? `scp` is your friend For less trivial transfers (recursive structures, large collections that you want to sync with minimal time) rsync supports SSH as a transport medium out of the box so scp remote.host:path.txt local scp local remote.host:path becomes rsync remote.host:path.txt local rsync local remote.host:path for the basics, then start adding the other opt…

I must admit my rsync experience is limited. I do not know the behaviors and flags very deeply. It's on my list though, as it's surely another one of those foundational linux tools. I know it is even faster than cp on the same host for some situations.

Re: SSH has become our universal (Unix) external access protocol

#66

Post by imiric »

pjs_ wrote: post #18

Drives me nuts that somewhere along the devops journey people decided that SSHing into a private server used for internal tools is an antiquated and outrageous thing to expect. People for some reason are actually excited about the prospect -- "we're gonna make it so you never have to SSH!". Little do they know that I like SSH. A lot more than I like clicking on the AWS console. And then somehow we're expected to debu…

Not wanting to use SSH has nothing to do with not liking it. It's about getting your infrastructure to a state where everything you need to manage and troubleshoot it can be done _without_ SSH. This doesn't mean replacing it with click-ops, but having robust deployment and automation in place, an external and centralized log/metrics store, and everything else that minimizes the need to manually manage it at all.

Additionally, removing SSH means removing a large security risk, the need to create and rotate keys, and all the associated mess that we take for granted. It's a huge operational and security burden.

Re: SSH has become our universal (Unix) external access protocol

#67

Post by dspillett »

clausecker wrote: post #31

SSH is great but rapidly becomes less so once companies decide to put their servers behind some times cascaded SSH gateways, so you need to know which magic invocation of jump hosts to put in to have your connection go through anyway.

You can simplify this for hosts you talk to regularly by configuring them in your .ssh/config file(s), as shown in https://wiki.gentoo.org/wiki/SSH_jump_host

A bit of faf for one-off or infrequent connections, but a great time saver for regular interactive use.

Re: SSH has become our universal (Unix) external access protocol

#68

Post by jacobgkau »

thrillgore wrote: post #3

You can do all sorts of things with SSH. My favorite is SSHFS, which is couplings for SFTP that treat it like a proper filesystem, and it works on everything that uses SSH. Quicker to setup than a VPN and SMB, and about as secure (you could also theoretically use PAM to authenticate with LDAP or newer MFA protocols)

I use SSHFS daily with my NAS on my home network. It's far faster and simpler to administer than SMB or NFS, with way less config overhead and AAA complications than the other two.

Unfortunately, it is currently semi-abandonware: https://github.com/libfuse/sshfs/blob/eadf7f104a479f0313ecd4... It works well enough for me, but there are certain issues to be aware of. For example, listening for file changes via inotify doesn't work-- and it's a double-whammy of neither SFTP nor FUSE supporting that, so it's unlikely to be fixed any time soon.

Re: SSH has become our universal (Unix) external access protocol

#69

Post by rad_gruchalski »

graemep wrote: post #28
bluejekyll wrote: post #21

Earlier quoted context omitted.

I think the use of IDEs really made this practice less simple. Terminal mode emacs and vi/m are simple with SSH, VSCode and other things start getting more complex. I think the extensions to VSCode and others to run remotely with a browser are starting to bring some of this back into fashion.

only if you are developing on a remote server which I never do. I do use GUI text editors, file browsers and other tools that work over SSH.

some of us have the misfortune of having to use wsl…

Re: SSH has become our universal (Unix) external access protocol

#70

Post by utensil4778 »

lucasoshiro wrote: post #45

Something that few people remember is that if you have access to a filesystem through SSH, then you can have a remote Git repository with no configuration! In the remote machine, you only need to create a bare repository: git init --bare And in your "client" machines you use it like any other remotes: git remote add my_remote my_user@my_host:path_to_repo It can be useful if for some reason you don't want to use GitHu…

For quite a while before I built my homelab, my git server was a flash drive plugged into my OpenWRT router.

Honestly I still kind of prefer that to gitlab et al. It's nice to not have to leave my terminal to setup a new repo. It takes so much more effort to log into a website and dismiss a bunch of notifications before I can click even more buttons to create a new repo.

I like having all my repos accessible through the website, but I really just want to create new projects through ssh like a civilized person.

Post reply on HN