Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why aren’t we using SSH for everything?

medium.com

Post reply on HN
Print view View original

41–50 of 105 posts

Re: Why aren’t we using SSH for everything?

#41

Post by _JamesA_ »

josephg wrote: post #25

Because SSH requires several seconds to initiate a session, even on a local LAN. Does anyone know why this is the case? Its always baffled me.

You may be experiencing the GSSAPIAuthentication delay.

The -v flag will help identify where the connection is being delayed.

ssh -v [user@]hostname [command]

Try connecting with the option disabled.

ssh -o GSSAPIAuthentication=no [user@]hostname [command]

You can globally disable GSSAPIAuthentication in ssh config:

echo 'GSSAPIAuthentication=no' >> ~/.ssh/config

Re: Why aren’t we using SSH for everything?

#42

Post by SilasX »

ivansavz wrote: post #34

Isn't there a problem when you tunnel TCP over TCP with increasing window sizes (auto throttling mechanism meant to prevent packet fragmentation)? Every time I've tried to keep a long-running ssh tunnel for printing / http, the connection degrades after a while. I'm sure there are some flags that can be set, but I thought this was the major show stopper for the "everything over shh" (since ssh uses TCP protocol)

Have you tried the autossh utility? That's what I use to keep up long-term tunnels.

Re: Why aren’t we using SSH for everything?

#44

Post by shazow »

boracay wrote: post #39
shazow wrote: post #7

Earlier quoted context omitted.

Yea I was fairly confused about that announcement as I couldn't find anything damning in the released docs about SSH. Do you have a reference to a specific document/slide?

My guess is that, at least, some router ssh implementation is insecure, possibly not by accident. From the slides: Page 19: "SSH [...] Potentially recover user names and passwords" Page 36: "SSH - often have router configurations and user credentials [...]" http://www.spiegel.de/media/media-35515.pdf

Right, I saw that also. Is it referring to routers that happen to run SSH with default root/admin passwords or something? I couldn't find anything more concrete.

Re: Why aren’t we using SSH for everything?

#45

Post by blfr »

ezequiel-garzon wrote: post #43

What surprises me is the lack of total CLI control, potentially through SSH and ideally using keys, of your hosting provider's control panel. Whether it's CLI or some form of TUI, it's bound to be faster and more convenient for many developers.

Cloud providers nowadays usually have some sort of CLI clients. OpenStack comes with a full suite[1]. Google rolled out their own for Google Cloud[2]. And if there's nothing official, there are often tools built by users available for interacting with the API.

Authentication is based on some sort of shared secret rather than keys though, yes.

[1] http://docs.openstack.org/user-guide/content/ch_cli.html

[2] https://cloud.google.com/sdk/gcloud/

Re: Why aren’t we using SSH for everything?

#46

Post by sysk »

It's not clear to me how SSH differs from SSL/TLS conceptually. It seems to me both achieve similar goals (encrypted tunnel, client/server authentication). Perhaps we should take the best bits of both protocols and create a new one? But then, I am reminded of http://xkcd.com/927/.

Re: Why aren’t we using SSH for everything?

#48

Post by marcosdumay »

shazow wrote: post #16
forgottenpass wrote: post #12

Why aren’t we using SSH for everything? Because "Use X for everything" is a terrible design decision? SSH uses flexible transport with some desirable features and may be underutilized in practice. This question is starting to feel like people who want to staple every pie in the sky idea to the bitcoin blockchain because it too has a set of desirable properties.

You're right, we probably shouldn't use SSH to microwave our food. But a lot of things where we use HTTP today, we could be using SSH if we had better library support. Some more ideas towards the end of the post.

> we could be using SSH if we had better library support

It's the firewall rules, not library availability.

Re: Why aren’t we using SSH for everything?

#49

Post by otterley »

SilasX wrote: post #42
ivansavz wrote: post #34

Isn't there a problem when you tunnel TCP over TCP with increasing window sizes (auto throttling mechanism meant to prevent packet fragmentation)? Every time I've tried to keep a long-running ssh tunnel for printing / http, the connection degrades after a while. I'm sure there are some flags that can be set, but I thought this was the major show stopper for the "everything over shh" (since ssh uses TCP protocol)

Have you tried the autossh utility? That's what I use to keep up long-term tunnels.

The window size issue has to do with bandwidth, not session duration. See, e.g., http://www.psc.edu/index.php/hpn-ssh

Re: Why aren’t we using SSH for everything?

#50

Post by otterley »

monksy wrote: post #38
spydum wrote: post #36

Interesting idea, but isn't ssh very sluggish when it comes to throughput and latency? Doesn't it cost quite a bit more in CPU? I'd hate to make ssh the protocol replacement for http for a busy site.

It depends on the clipher you're using and the implementation/hardware.

It depends more on the TCP window size; OpenSSH uses a small one by default and it cannot be changed.

See also http://www.psc.edu/index.php/hpn-ssh

Post reply on HN