Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH Secret Menu

twitter.com

Post reply on HN
Print view View original

141–150 of 184 posts

Re: SSH Secret Menu

#141

Post by coob »

lxgr wrote: post #111
tomxor wrote: post #22

Earlier quoted context omitted.

If hung SSH connections are common it's likely due to CGNAT which use aggressively low TCP timeouts. e.g. I've found all UK mobile carriers set their TCP timeout as low as 5 minutes. The "default" is supposed to be 2 hours, you could literally sleep your computer, zero packets, and an SSH connection would continue to work an hour later, and generally speaking this is still true unless CGNAT is in the way. If you are…

> you could literally sleep your computer, Depends on whether your sockets survive that, though. Especially on Wi-Fi, many implementations will reset your interface when sleeping, and sockets usually don't survive that. Even if they do, if the remote side has heartbeats/keepalive enabled (at the TCP or SSH level), your connection might be torn down from the server side.

Not on a Mac

Re: SSH Secret Menu

#142

Post by billfor »

This is not specific to ssh. Telnet and rlogin have similar things with ~ as the escape character. Back in the day it was common to send BREAK and other escape sequences when you were hardwired.

Re: SSH Secret Menu

#143

Post by lxgr »

rnhmjoj wrote: post #134
lxgr wrote: post #113

Earlier quoted context omitted.

It would also seem to break address privacy (usually not much of a concern if you authenticate yourself via SSH anyway, but still, it leaks your Ethernet or Wi-Fi interface's MAC address in many older setups).

Well, yss, but SSH is hardly ever anonymous and this could simply be a cli option.

Not anonymous, but it's pretty unexpected for different servers with potentially different identities for each to learn your MAC address (if you're using the default EUI-64 method for SLAAC).

Re: SSH Secret Menu

#144

Post by lxgr »

withinboredom wrote: post #129
lxgr wrote: post #120

Earlier quoted context omitted.

Yes, but they're not randomly distributed across the entire number space. For example, receiving traffic from a given address is a pretty good indicator that there's somebody there possibly worth port scanning. And where there has once been somebody, there or in the same neighborhood (subnet) might be somebody else, now or in the future.

Then it isn't random noise. It is determined by your own actions.

Or my predecessor/address space neighbor, or that of somebody using my wireless hotspot once, or that of me clicking a random link once and connecting to 671 affiliated advertisers's analytics servers...

I think a default policy of "no inbound connections" does makes sense for most mobile users. It should obviously be configurable.

Re: SSH Secret Menu

#145

Post by syncsynchalt »

lathiat wrote: post #11
piccirello wrote: post #6

I've been using SSH for ~15 years and never knew about these escape sequences. I'm eagerly awaiting my next hung session so that I can test `~.`. It's much nicer than my current approach of having to close that terminal window.

Have been using that weekly since probably 20 years. Will change your life :) My other favourite is I very often SSH with -v to figure out why the connection is hanging, you rapidly figure out if DNS is failing, the TCP connection doesn't open, it does open but no traffic flows at all or it opens and SSH negotiation starts but never finishes. You can learn a lot just from this about what is wrong.

And of course, you can use the ~v / ~V commands (as listed in the ~? menu) to increase/decrease verbosity after the connection is established.

That lets you `ssh -vvvv` to a host then once you've figured out the issue use ~V to decrease verbosity so that debug messages don't clutter your shell.

Re: SSH Secret Menu

#146

Post by lxgr »

vbezhenar wrote: post #61
tomxor wrote: post #22

Earlier quoted context omitted.

If hung SSH connections are common it's likely due to CGNAT which use aggressively low TCP timeouts. e.g. I've found all UK mobile carriers set their TCP timeout as low as 5 minutes. The "default" is supposed to be 2 hours, you could literally sleep your computer, zero packets, and an SSH connection would continue to work an hour later, and generally speaking this is still true unless CGNAT is in the way. If you are…

Host * ServerAliveInterval 25

Yes, this makes your connection more likely not survive client suspends. (ClientAliveInterval, which makes the server ping the client, will make it fail almost certainly, since the server will be active while the client is sleeping.)

Re: SSH Secret Menu

#147

Post by fcloud »

I intended to post in defense of manpages. I love manpages. I think most open-source manpages are high-quality, and a few are really outstanding.

"It's easier to ask an AI" can be true without implying that manpages are bad.

However, "man" the tool does have issues, and one of them bit me just now.

So, I didn't know about openssh client escapes like ~?. I thought, "surely that's in the manpage?" I opened the manpage (in less) and searched for "\~\?". No hits.

Of course, escape characters are documented in the manpage, and the string "~?" does appear. Why didn't search find it? Because man, in its infinite wisdom, decided to render every instance of "~" as some bizarre unicode not-tilde, which is visually similar but totally impossible to grep for.

This has also bitten me in the past with dash. DASH. A character that is critically important when documenting invocation options. man loves to convert it into something that looks like dash, prints like dash, but doesn't come up in search.

I'm sure there is a way to turn this "feature" off, and I'm about to spend a bunch of time figuring out what it is. But this is documentation for command-line tools. Silently destroying our ability to grep it should NOT be the default.

Re: SSH Secret Menu

#148

Post by wrs »

jervant wrote: post #128
wrs wrote: post #35

Those aren’t “secret”, they’re obviously borrowed from rsh — oh that’s right, I’m old.

I'm pretty sure the ~ command style came from cu(1) which had it in at least 4.1BSD. I don't think rsh (which came in 4.2BSD) ever had such commands.

Whoops -- I meant rlogin. That had ~. and ~^Z. But you're right, rlogin got them from cu! (I'm not that old. :) )

Re: SSH Secret Menu

#149

Post by jeffrallen »

You think that one is cool, go check out "~?" in IPMI "sol activate". From there you can deliver a serial break to the kernel, which then gets you to a third rarely seen menu from the kernel's console, which allows you to do kernel debugging of various sorts.

I use it when I need to crash a kernel on purpose to test kdump over the network.

You can also send commands to the simulated console of a VM under libvirt with "virsh connect". But I don't think you can send a break to the kernel with that.

Re: SSH Secret Menu

#150

Post by cestith »

alwillis wrote: post #40
Lasang wrote: post #20

Hidden or undocumented features like this always have a strange appeal. Part of it is nostalgia for older software where small Easter eggs or experimental features would sometimes ship in production builds.

It's not hidden or undocumented; it's in the man page. Here's 15-year old HN link about it: http://grack.com/blog/2011/02/23/ssh-escape-sequences-or-don...

Here’s a link to the man page for people who want to read man pages in a browser. https://linux.die.net/man/1/ssh

https://die.net and https://ss64.com are sites I’ve been recommending for years.

Post reply on HN