Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH Kung Fu

blog.tjll.net

Post reply on HN
Print view View original

41–50 of 133 posts

Re: SSH Kung Fu

#41

Post by icebraining »

luxpir wrote: post #33

One problem I have with SSH is DPI. Deep Packet Inspection seems to be behind the SSH block in place at a local library I work at. SSH out in any form just isn't possible there, even via a browser-based console (such as that used by Digital Ocean, for example). There doesn't seem to be a suitable solution to get around it offered anywhere. My own fix was to use 3G to do the SSH work via a tethered phone and to use th…

If the browser-based console is also blocked, there's something fishy going around, since that doesn't use SSH.

In any case, you can try proxying SSH over SSL using stunnel: http://askubuntu.com/questions/423727/ssh-tunneling-over-ssl

Or you could try setting up OpenVPN, it's easy enough.

Re: SSH Kung Fu

#42

Post by Piskvorrr »

Morgawr wrote: post #22
Piskvorrr wrote: post #11

Earlier quoted context omitted.

Moving ssh port is, IMNSHO, a stopgap measure; you should have exhausted all the other options (e.g. no passwords, no root login, denyhosts/fail2ban etc.) before this even crosses your mind. In other words, the inconvenience this brings is not adequate to the infinitesimal increase in security.

True, but still, moving the port away from the default is always a good and effortless thing to do. Or at least making people aware of it.

Good...perhaps, iff you're aware that this is a cosmetic issue (less spam in the logs), rather than actual security (and that ports 222, 2222 and 22222 get just as much spam as 22).

Effortless...except you need to configure every client to use the non-default port. How much effort is that? IDK, depends on your use case.

That said, I consider it harmless; which is to say, the benefits and drawbacks are just about equal, IMNSHO.

Re: SSH Kung Fu

#43

Post by Erwin »

hf wrote: post #20
patio11 wrote: post #13

A trick I learned recently: create .ssh/config File format: as many of the following blocks as you like Host $ALIAS You can now ssh to that server as that user by doing "ssh $ALIAS" on the command line, without needing to specify the port or user with the usual command line arguments, or necessarily spell out the entire host name.

What is more, you can specify an abstraction for the tedious double-ssh where you first connect to some internet-facing host in order to gain access to an internal machine: Host $ALIAS User $USER HostName $INTERNAL ProxyCommand ssh $USER2@$PUBLIC -W %h:%p Now laptop> ssh jim@public.example.com public> ssh dev@myworkstation becomes laptop> ssh work (I just realized that this slightly confused article seems to accompli…

The ssh -W option -- which replaces netcat -- is relatively new. E.g. Redhat 5.x did not have it, nor did Ubuntu 10.04 LTS. Until OpenSSH 5.4 netcat was the way to do this sort of proxying.

Re: SSH Kung Fu

#44

Post by sampo »

yen223 wrote: post #35
patio11 wrote: post #13

A trick I learned recently: create .ssh/config File format: as many of the following blocks as you like Host $ALIAS You can now ssh to that server as that user by doing "ssh $ALIAS" on the command line, without needing to specify the port or user with the usual command line arguments, or necessarily spell out the entire host name.

This is excellent advice. The best part is that you can use the same $ALIAS for tools built on SSH, including scp and rsync, like this: scp $ALIAS:/var/log/mylogs/logfile ~/backups/logs/

The aliases also work when mounting filesystems over the network in the File Browser.

Nautilus / Connect to Server / Server Address: work/home/user

(here 'work' is the alias for the work computer)

Re: SSH Kung Fu

#45

Post by sampo »

hf wrote: post #20
patio11 wrote: post #13

A trick I learned recently: create .ssh/config File format: as many of the following blocks as you like Host $ALIAS You can now ssh to that server as that user by doing "ssh $ALIAS" on the command line, without needing to specify the port or user with the usual command line arguments, or necessarily spell out the entire host name.

What is more, you can specify an abstraction for the tedious double-ssh where you first connect to some internet-facing host in order to gain access to an internal machine: Host $ALIAS User $USER HostName $INTERNAL ProxyCommand ssh $USER2@$PUBLIC -W %h:%p Now laptop> ssh jim@public.example.com public> ssh dev@myworkstation becomes laptop> ssh work (I just realized that this slightly confused article seems to accompli…

And if your router keeps dropping idle connections, add something like:

    ServerAliveInterval 240
    ServerAliveCountMax 5

Re: SSH Kung Fu

#46

Post by stock_toaster »

Erwin wrote: post #43
hf wrote: post #20

Earlier quoted context omitted.

What is more, you can specify an abstraction for the tedious double-ssh where you first connect to some internet-facing host in order to gain access to an internal machine: Host $ALIAS User $USER HostName $INTERNAL ProxyCommand ssh $USER2@$PUBLIC -W %h:%p Now laptop> ssh jim@public.example.com public> ssh dev@myworkstation becomes laptop> ssh work (I just realized that this slightly confused article seems to accompli…

The ssh -W option -- which replaces netcat -- is relatively new. E.g. Redhat 5.x did not have it, nor did Ubuntu 10.04 LTS. Until OpenSSH 5.4 netcat was the way to do this sort of proxying.

I ran into an issue[1] with the combination of -W and control persist -- using openssh versions netcat worked fine.

  [1]: https://news.ycombinator.com/item?id=4678117

Re: SSH Kung Fu

#47

Post by sampo »

hf wrote: post #20
patio11 wrote: post #13

A trick I learned recently: create .ssh/config File format: as many of the following blocks as you like Host $ALIAS You can now ssh to that server as that user by doing "ssh $ALIAS" on the command line, without needing to specify the port or user with the usual command line arguments, or necessarily spell out the entire host name.

What is more, you can specify an abstraction for the tedious double-ssh where you first connect to some internet-facing host in order to gain access to an internal machine: Host $ALIAS User $USER HostName $INTERNAL ProxyCommand ssh $USER2@$PUBLIC -W %h:%p Now laptop> ssh jim@public.example.com public> ssh dev@myworkstation becomes laptop> ssh work (I just realized that this slightly confused article seems to accompli…

> (I just realized that this slightly confused article seems to accomplish the same by using a convoluted setup of port-forwardings and netcat.)

Yeah, the article sets separately first

    Host bar
      ...
and then

    Host behind.bar
      ...
But it can also be done by just one step:

    host behindbar
      User         
      Hostname     behindbar.domain
      ProxyCommand ssh @bar.domain nc %h %p 2> /dev/null

Re: SSH Kung Fu

#48

Post by phaemon »

luxpir wrote: post #33

One problem I have with SSH is DPI. Deep Packet Inspection seems to be behind the SSH block in place at a local library I work at. SSH out in any form just isn't possible there, even via a browser-based console (such as that used by Digital Ocean, for example). There doesn't seem to be a suitable solution to get around it offered anywhere. My own fix was to use 3G to do the SSH work via a tethered phone and to use th…

SSH over SSL seems to be what you need. Try:

http://blog.chmd.fr/ssh-over-ssl-a-quick-and-minimal-config....

Re: SSH Kung Fu

#49

Post by stock_toaster »

luxpir wrote: post #33

One problem I have with SSH is DPI. Deep Packet Inspection seems to be behind the SSH block in place at a local library I work at. SSH out in any form just isn't possible there, even via a browser-based console (such as that used by Digital Ocean, for example). There doesn't seem to be a suitable solution to get around it offered anywhere. My own fix was to use 3G to do the SSH work via a tethered phone and to use th…

Maybe try wrapping in spipe[1]?

[1]: http://www.daemonology.net/blog/2012-08-30-protecting-sshd-u...

Re: SSH Kung Fu

#50

Post by nnnnni »

patio11 wrote: post #13

A trick I learned recently: create .ssh/config File format: as many of the following blocks as you like Host $ALIAS You can now ssh to that server as that user by doing "ssh $ALIAS" on the command line, without needing to specify the port or user with the usual command line arguments, or necessarily spell out the entire host name.

Well, that sure beats my .bashrc that's full of alias "servername"="ssh user@servername -p portnum"...
Post reply on HN