Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An excruciatingly detailed guide to SSH (but only the things I find useful)

grahamhelton.com

Post reply on HN
Print view View original

91–100 of 120 posts

Re: An excruciatingly detailed guide to SSH (but only the things I find useful)

#91

Post by raffraffraff »

progbits wrote: post #17
zamadatix wrote: post #9

For forwarding I almost never do -f. It can be a footgun in making it hard to tell which forwards are still open or operational. -t is a cool trick, didn't know about that one. An important note that's easy to overlook in the ~ escape command list is you can nest the escape when in nested sessions (i.e. if you're not using -J for whatever reason). Cool list, it definitely lines up with what I've found useful and had…

-t is great, I use $ ssh -t my-dev-vps 'tmux new-session -A -s main' So each time I run it I'm right back where I left off.

Sometimes you have to use it twice if you're doing some (can't remember) bonkers stuff. I used to run commands on thousands of machines using a silly script I wrote.

Re: An excruciatingly detailed guide to SSH (but only the things I find useful)

#92

Post by raffraffraff »

lmz wrote: post #70
lost_tourist wrote: post #68

Earlier quoted context omitted.

I thought it was CR, tilde, . ? have i been doing it wrong?

Tilde dot is the disconnect sequence for SSH. Other characters after tilde have other uses as seen in the post.

And if you're N connections, use multiple tildes, depending on how many levels you want to disconnect. I think.

It's amazing how switching jobs to one where you just write terraform and yaml all day gets your terminal skills all rusty.

Re: An excruciatingly detailed guide to SSH (but only the things I find useful)

#93

Post by pastage »

sureglymop wrote: post #53

One thing I would find interesting would be how to read someones private key or agent from ram. For example, when ssh agent forwarding to a machine, the root could extract that agent probably.

Hard to do with secure enclaves. You should protect your agent on your local machine to not allow requests willy nilly if the machine you ssh through is part of the threat model. You may need to rethink wether to use agent forward at all if that is something you need to worry about.

There are alot if details in this that can go wrong. I seldom use agent forward in unknown/undesigned environments because of this.

Re: An excruciatingly detailed guide to SSH (but only the things I find useful)

#95

Post by frays »

withinboredom wrote: post #33

There is an amazingly simple directive missing here: # in sshd_config: AuthorizedKeysCommand /usr/bin/php /etc/ssh/auth.php %u # in /etc/ssh/auth.php $user = $argv[1] ?? ''; $user = rawurlencode($user); echo file_get_contents("https://gihub.com/{$user}.keys"); This is obviously not production quality code, but just demonstrates the gist of the configuration. Basically, you can do a number of things, like verify the u…

TIL about https://github.com/{$user}.keys - thanks!

Re: An excruciatingly detailed guide to SSH (but only the things I find useful)

#97

Post by e12e »

detuur wrote: post #58

Some years ago, I read a post on HN where someone made a text-mode game(? or something similar?) available through SSH. People could play the game by opening an SSH session and play from their terminals. This was non-trivial, and they explained all the ways they configured sshd to prevent players from running binaries other than the game. I didn't bookmark that post, and I haven't been able to find it again to my gre…

Sshbbs?

https://news.ycombinator.com/item?id=35412416

Ssh chat? https://news.ycombinator.com/item?id=8743374

Ssh tron? https://news.ycombinator.com/item?id=11234702

Devzat? https://news.ycombinator.com/item?id=30688691

Sshtalk? https://news.ycombinator.com/item?id=15829206

Re: An excruciatingly detailed guide to SSH (but only the things I find useful)

#98

Post by e12e »

sophacles wrote: post #44

A lesser known but quite useful bit of ssh is connection multiplexing. Rather than establish a new tcp connection, doing the auth dance, etc, you can tell ssh to reuse an existing connection. (The protocol itself has a notion of channels, a bit of metadata with every data frame to distinguish different streams, and this functionality uses that). The big thing with it is that you don't have to do a full auth for subse…

This can make Ansible much more usable when going through (ProxyJump) bastion host.

Re: An excruciatingly detailed guide to SSH (but only the things I find useful)

#99

Post by n8henrie »

bomewish wrote: post #81
withinboredom wrote: post #33

There is an amazingly simple directive missing here: # in sshd_config: AuthorizedKeysCommand /usr/bin/php /etc/ssh/auth.php %u # in /etc/ssh/auth.php $user = $argv[1] ?? ''; $user = rawurlencode($user); echo file_get_contents("https://gihub.com/{$user}.keys"); This is obviously not production quality code, but just demonstrates the gist of the configuration. Basically, you can do a number of things, like verify the u…

why php?

Can curl do the url encoding? Isn't there some new "variables" thing in the newest release?

Can valid Unix usernames have special characters that need escaping? I should know that by now.

Re: An excruciatingly detailed guide to SSH (but only the things I find useful)

#100

Post by n8henrie »

frays wrote: post #95
withinboredom wrote: post #33

There is an amazingly simple directive missing here: # in sshd_config: AuthorizedKeysCommand /usr/bin/php /etc/ssh/auth.php %u # in /etc/ssh/auth.php $user = $argv[1] ?? ''; $user = rawurlencode($user); echo file_get_contents("https://gihub.com/{$user}.keys"); This is obviously not production quality code, but just demonstrates the gist of the configuration. Basically, you can do a number of things, like verify the u…

TIL about https://github.com/{$user}.keys - thanks!

Really handy for NixOS users!
Post reply on HN