Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH Kung Fu

blog.tjll.net

Post reply on HN
Print view View original

111–120 of 133 posts

Re: SSH Kung Fu

#111

Post by voltagex_ »

hf wrote: post #19

The situation with beginner-friendly SSH tutorials is, in a much lesser degree perhaps, comparable to the crypto texts: Good will alone does more harm than good. This treatment ssh does not mention ssh-agent and, more importantly perhaps, implies that there is a certain virtue in having private keys unprotected by sturdy passphrases lying around. There is not; most emphatically not.

Hypothetically, if one was reading this article and had a large number of unprotected private keys around, one could change the password on these keys by issuing

   ssh-keygen -f id_rsa -p

Re: SSH Kung Fu

#112

Post by voltagex_ »

turrini wrote: post #109
vinceguidry wrote: post #78

Is sshfs a serious replacement for nfs? I've got a Buffalo Nas at home that I use Samba for, but Samba is too slow to watch hi-def videos over. NFS seems to be a pain in the neck to get working on that particular device, and I hate using it on a laptop. I guess I should probably just try it, but I can't see SSHFS as being any faster than Samba.

Try: # sshfs -o direct_io,nonempty,allow_other,cache=no,compression=no,workaround=rename,workaround=nodelaysrv user@remote:/place/ /mnt/somewhere For even more performance: * On server, start socat: # socat TCP4-LISTEN:7001 EXEC:/usr/lib/sftp-server * On client, do: # sshfs -o directport=7001,direct_io,nonempty,allow_other,cache=no,compression=no,workaround=rename,workaround=nodelaysrv user@remote:/place/ /mnt/somewh…

Whoa, what do all those options do?

Re: SSH Kung Fu

#113

Post by mpapi »

voltagex_ wrote: post #110
mpapi wrote: post #74

Earlier quoted context omitted.

A favorite .ssh/config feature of mine is pattern matching on hostnames with "?" and "*". So you can say something like: Host bos-?? HostName %h.mydomain.com IdentityFile ~/.ssh/my-boston-key Host nyc-?? HostName %h.mydomain2.com IdentityFile ~/.ssh/my-nyc-key and log in with e.g. "ssh bos-14".

This seems to be relatively new. It doesn't work on a couple of boxes I tried. Thanks though, I didn't know about the ?? syntax.

I found references to it going back to 2008, and the git repo that has my dotfiles says I've been using it (in Linux) for 3 or so years. Maybe it depends on the OS/distro.

The patterns are similar to shell globs: * matches zero or more characters, ? matches exactly one.

Re: SSH Kung Fu

#114

Post by MichaelMoser123 »

Very interesting article;

I have a shell script that helps with setting up trusted keys: trusted keys help if you need to run automated tests, that involve several machines, or simply if you would like to skip typing in a password on each connection.

http://mosermichael.github.io/cstuff/all/projects/2011/07/14...

Re: SSH Kung Fu

#115

Post by marianov »

ambrop7 wrote: post #94

About the "Lightweight Proxy" (ssh -D), if you want it to be transparent to the application (not require SOCKS support), you can use my tun2socks[1] program. This is useful if you can't or don't want to set up an SSH tunnel (which requires root permissions on the server). The linked page actually explains exactly this use case. It even works on Windows ;) [1] https://code.google.com/p/badvpn/wiki/tun2socks

Or use tsocks. Proxies everything that uses tcp through a socks proxy (ssh -D) http://manpages.ubuntu.com/manpages/hardy/man1/tsocks.1.html

Re: SSH Kung Fu

#116

Post by lexandstuff »

deanclatworthy wrote: post #17
patio11 wrote: post #13

A trick I learned recently: create .ssh/config File format: as many of the following blocks as you like Host $ALIAS You can now ssh to that server as that user by doing "ssh $ALIAS" on the command line, without needing to specify the port or user with the usual command line arguments, or necessarily spell out the entire host name.

I've been doing this for a while now, but my file is now huge and it's cumbersome to edit. Is there no utility to mange that file?

Aside from the ones already mentioned, there's a library called dot-ssh-config[1] that is useful for generating SSH configs.

[1] https://github.com/aelse/dot-ssh-config

Re: SSH Kung Fu

#117

Post by ambrop7 »

marianov wrote: post #115
ambrop7 wrote: post #94

About the "Lightweight Proxy" (ssh -D), if you want it to be transparent to the application (not require SOCKS support), you can use my tun2socks[1] program. This is useful if you can't or don't want to set up an SSH tunnel (which requires root permissions on the server). The linked page actually explains exactly this use case. It even works on Windows ;) [1] https://code.google.com/p/badvpn/wiki/tun2socks

Or use tsocks. Proxies everything that uses tcp through a socks proxy (ssh -D) http://manpages.ubuntu.com/manpages/hardy/man1/tsocks.1.html

Not system-wide though, and possibly incompletely and with bugs. The entire socket API is far from being simple to wrap like this, especially when you consider that it includes all the various IO functions (read/write, send/recv, recvmsg/sendmsg), nonblocking operation with select, poll, epoll, the p* versions of these with special behavior with respect to signals, the integration of these polling functions with non-wrapped fds, various socket options, splice functions, thread safety, shutdown semantics...

It shouldn't be hard to find a program which runs fine with tun2socks but breaks completely or subtly with tsocks.

Re: SSH Kung Fu

#118

Post by beagle3 »

While the socks proxy does not require any root (local or remote), it is only useful for programs that support it - which are not many.

However, apenwarr's sshuttle https://github.com/apenwarr/sshuttle is a briliant semi-proxy-semi-vpn solution that, in return for local root and remote python (but not remote root), gives you transparent VPN-style forwarding of TCP connections (and DNS requests if you want). It works ridiculously well. Try it, if you haven't yet.

Re: SSH Kung Fu

#119

Post by luxpir »

phaemon wrote: post #48
luxpir wrote: post #33

One problem I have with SSH is DPI. Deep Packet Inspection seems to be behind the SSH block in place at a local library I work at. SSH out in any form just isn't possible there, even via a browser-based console (such as that used by Digital Ocean, for example). There doesn't seem to be a suitable solution to get around it offered anywhere. My own fix was to use 3G to do the SSH work via a tethered phone and to use th…

SSH over SSL seems to be what you need. Try: http://blog.chmd.fr/ssh-over-ssl-a-quick-and-minimal-config....

Does seem to do the trick, and I have half of that already set up - just need to work out the config for Nginx. It's a smart workaround indeed. Thanks for that.

Re: SSH Kung Fu

#120

Post by luxpir »

icebraining wrote: post #41
luxpir wrote: post #33

One problem I have with SSH is DPI. Deep Packet Inspection seems to be behind the SSH block in place at a local library I work at. SSH out in any form just isn't possible there, even via a browser-based console (such as that used by Digital Ocean, for example). There doesn't seem to be a suitable solution to get around it offered anywhere. My own fix was to use 3G to do the SSH work via a tethered phone and to use th…

If the browser-based console is also blocked, there's something fishy going around, since that doesn't use SSH. In any case, you can try proxying SSH over SSL using stunnel: http://askubuntu.com/questions/423727/ssh-tunneling-over-ssl Or you could try setting up OpenVPN, it's easy enough.

I didn't want to spend too much time poking around, but it seemed odd to me too (wrt the browser-console). Cheers for the stunnel/OpenVPN thoughts, they ought to get through. It would be great if SSH could itself emulate SSL, in the modern context of increased security requirements and censorship.
Post reply on HN