ssh tricks

from http://news.ycombinator.com/item?id=3543334 My favorite trick is transparently bouncing via ProxyCommand+netcat: Host target.domain Hostname target.local ProxyCommand ssh -q bounce_host.domain nc -q0 %h 22 Also, authorizing by key but restricting the (passwordless) key to certain commands, allowing for remote action automation. [0]Ssh agent forwarding is also particularly awesome instead of naively scattering keys. Ssh ControlMaster allowing to reuse connections can really improve responsiveness. Tip: start the master connection as a daemon (-f), so as not to mistakenly close the terminal which handles it, else you will close the channel for all other currently opened slave sessions. I wish ssh would fork and start the master on demand then close it when the last channel closes.[0] http://www.cmdln.org/2008/02/11/restricting-ssh-commands/ -----

andrewaylett 58 days ago | link If you're connecting from a *nix-y box, you may also be interested in sshuttle: https://github.com/apenwarr/sshuttleIt gives you most of the benefits of VPN, without requiring tun/tap and without needing root on the remote box -- all you need is the ability to run python. Very useful if you're on an insecure network and you want to tunnel everything over a secure connection, or if you have SSH access to a box inside your firewall and want to access other resources without having to specify each port individually. -----

JoshTriplett 57 days ago | link > Ssh ControlMaster allowing to reuse connections can really improve responsiveness. Tip: start the master connection as a daemon (-f), so as not to mistakenly close the terminal which handles it, else you will close the channel for all other currently opened slave sessions. I wish ssh would fork and start the master on demand then close it when the last channel closes.Good news: as of OpenSSH 5.6p1, it can. Just set "ControlPersist 60" in ~/.ssh/config (in addition to setting ControlMaster auto and ControlPath), and ssh will automatically spawn an SSH master connection in the background, and close it 60 seconds after the last client exits. (You can obviously change the timeout to taste.) -----

gnaritas 58 days ago | link > Ssh ControlMaster allowing to reuse connections can really improve responsiveness.Yes it does, but I've noticed when I do this, it breaks my rsnapshot backups. Is this something you've heard of or know a fix for? -----

lloeki 58 days ago | link I don't use rsnapshot but you can set up arguments you pass to ssh, in which case you can selectively disable ControlMaster. If you can't, maybe rsnapshot respects .ssh/config so you can set up a Host entry with the relevant config. If you want to also use ControlMaster the host you connect to with rsnapshot, you can set up a Host with a dummy name and set its Hostname option to the real host.-----

gnaritas 57 days ago | link > I don't use rsnapshot but you can set up arguments you pass to ssh, in which case you can selectively disable ControlMasterJust FYI, that worked perfectly. -----

gnaritas 58 days ago | link Some good ideas, thanks, I'll give it a shot. I really like the speed of the persistent connections.-----

yycom 57 days ago | link host *%* proxycommand ssh $(echo %h | cut -d%% -f1) nc $(echo %h | cut -d%% -f2) %p usage: ssh gateway%target -----

a3_nm 57 days ago | link Awesome. Here is another version to support chaining multiple gateways: Host *%* Proxycommand ssh $(echo %h | rev | cut -d%% -f2- | rev) nc $(echo %h | rev | cut -d%% -f1 | rev) %p usage: ssh gateway1%gateway2%target (Not very clean, improvements welcome.)-----

a3_nm 57 days ago | link A shorter version of the same thing: Host *%* Proxycommand bash -c "h=%h; ssh \${h%%\\%%*} nc \${h##*%%} %p" It would be shorter and cleaner if I knew a way to apply string operators on a constant string rather than defining the intermediate variable $h.-----

vidarh 57 days ago | link That syntax gave me flashbacks to good old bang paths...-----

haridsv 50 days ago | link Very cool! Is there any security risk in running nc on the gateway this way?-----

ryan-c 55 days ago | link A more featureful version of that hack:https://github.com/ryancdotorg/ssh-chain -----

zobzu 57 days ago | link you don't mention whats awesome about the proxycommand to go through hosts:here's what! it uses the intermediate hosts as a tunnel, which means no ssh agent is listening on the hosts (the regular way to do this is ssh -A hostx ssh -A hosty ssh finalhost) This means no attacker can use your agent while connected.Additionally, its less cumbersome when its setup. -----

haridsv 50 days ago | link How do you use the -f option for the master? Do you run a command that just waits for ever? What command do you run?-----

mattdeboard 58 days ago | link Is there a "tech blogger of the year" category somewhere so we can nominate this guy? Every single one of his posts is epic. The peri-relational metaphor for shell command composition, this one, and every one before should be required reading.-----

mattmight 58 days ago | link Thanks for the kind words!These recent posts are part of the lecture notes for my "Scripting Language Design and Implementation" course. There are slides that go along with some of them: http://matt.might.net/teaching/scripting-languages/spring-20... I prefer spartan slides, so I'm not sure how useful they are without me presenting them. But, I'll throw them out there since there are a few nuggets in them that are not in the posts.There are also slides for non-existent posts (e.g. bash), because I don't always have time to transcribe my notes into a blog post. -----

beambot 57 days ago | link Hey Matt, to echo yycom's concern below... can you please add dates to your articles? We have context as they're posted today, but it gets muddled 10+ years out.-----

babarock 58 days ago | link I would also mention the following 2 articles that constitue an absolutely amazing TODO list:What every CS major should know (http://matt.might.net/articles/what-cs-majors-should-know/)12 resolutions for programmers (http://matt.might.net/articles/programmers-resolutions/) -----

mburns 58 days ago | link http://2012.bloggi.es/#technology-----

yycom 57 days ago | link Really? Where are they? Article index is empty.And article needs a date before any award is bestowed. -----

ColdAsIce 57 days ago | link Are you being sarcastic? How could one not know that ssh could do these things? Have you been using it instead of telnet?-----

mattdeboard 56 days ago | link Save your snark and go read the rest of his blog posts.-----

nlh 58 days ago | link One addition:Re: iOS -- Panic (makers of Coda, etc.) developed a _really_ nice little iOS app for SSH called 'Prompt'. It got some coverage here when it was released, and I immediately replaced iSSH with it and haven't looked back once.http://www.panic.com/blog/2011/04/introducing-prompt-ssh-for... -----

sciurus 58 days ago | link I wouldn't call these tricks, just using ssh properly.Here is an article with some less known features of ssh: http://www.jedi.be/blog/2010/08/27/ssh-tricks-the-usual-and-... -----

moe 58 days ago | link As a small addendum to "Copying files", you can also copy entire directories: $ tar czf - foo | ssh remote "cd /where/to/unpack && tar xzf -" This is often significantly faster than rsync, e.g. when copying a directory with many files for the first (or only) time.-----

msmith 58 days ago | link I'm not sure how it compares in performance, but I've always used scp -r for this: $ scp -r remote foo /where/to/unpack -----

loeg 58 days ago | link scp has some end-to-end latency for each file transferred. This means that for lots of small files, a single tar file stream is much quicker than 'scp -r'.-----

kahawe 57 days ago | link The most fun I ever had was doing exactly this, piping a stream through ssh, but on the one end was a CD image, on the other end was a cd burner. It is kinda obvious you could also do that because pipes and ssh are ubiquitous on UNIX but I still couldn't stop giggling.-----

dchest 58 days ago | link Is it possible to pipe something into already opened ssh connection?-----

__alexs 57 days ago | link Using named pipes (mkfifo) I suspect you could do that. I've not tried it in practice and there will be some warts to work around. e.g. the password prompt comes to mind.-----

timrod 58 days ago | link if you're piping the output of tar, instead of using "tar f -", you can leave off the f argument (since you don't want to specify a file anyway) and tar will default to stdin/stdout: $ tar cz foo | ssh remote "cd /where/to/unpack && tar xz" -----

ars 58 days ago | link You may not need the z either since it's common to configure ssh to do compression.Or use ssh -C -----

ralph 57 days ago | link For GNU tar these days that's true, unless you can be sure $TAPE is in its environment. Historically, tar defaulted to a tape device, e.g. /dev/mt0, and you still find vestiges of that, e.g. OpenBSD defaults to /dev/rst0.IOW, specify "f -". :-) -----

rbonvall 58 days ago | link > $ cat .ssh/id_dsa.pub | ssh host 'cat >> ~/.ssh/authorized_keys' Using ssh-copy-id is simpler: ssh-copy-id host (Works On My Machine™)-----

stretchwithme 58 days ago | link does not work on mac, but this guy has a script:http://phildawson.tumblr.com/post/484798267/ssh-copy-id-in-m... -----

pavel_lishin 58 days ago | link Homebrew also has a recipe for it. brew install ssh-copy-id -----

nzmsv 58 days ago | link I would add the use of the ControlMaster and ControlPath options for connection sharing, as well as keepalive settings for those cases where connections drop when idle.The remote port forwarding feature can be very handy. I've used a combination of ssh and daemontools to set up remote access to a machine behind a particularly nasty firewall. -----

paxswill 58 days ago | link And if your SSH client supports it ControlPersist. It keeps the shared connection around in case you're coming back. It's a fairly new feature though.-----

newman314 50 days ago | link I tried enabling this and it seems that support for this on MacOS is pretty iffy. It's not too stable and my issues went away as soon as I disabled it.-----

xxqs 58 days ago | link haha, I wrote an article exactly about this (see my other comment)-----

mike-cardwell 58 days ago | link Only yesterday, I wrote up how I use a smart card and reader with hardware pin pad for SSH authentication. Seems relevant:https://grepular.com/Smart_Cards_and_SSH_Authentication -----

zobzu 57 days ago | link yeah, been using that for a while, and its quite handy. I want to switch to the cryptostick tho, because having a pinpad/reader around sux.don't you have one of those? -----

mike-cardwell 57 days ago | link My laptop has a built in smart card reader, and my desktop has a USB one plugged in with a hardware pin-pad.The cryptostick does look cool. I've come across it before. I like the smart card because I can just pop it in my wallet like a credit card.You can also get keyboards with built in smart card readers, where the numeric keypad has a mode to operate as a hardware pin pad (rather than sending the keypresses to the computer) I'm thinking of getting one of these at some point. -----

beagle3 57 days ago | link Do you know of anyone who sells them in the US? (or OpenPGP cards or any other Linux usable tokens for that matter?) or do I have to order them from Germany?-----

Estragon 58 days ago | link My main problem with sshfs lately has been that on a flakey connection it sometimes hangs irretrievably, often taking out the process trying to use it (usually emacs.)-----

vectorpush 58 days ago | link I've had this problem too. Try appending "-o reconnect" flag, I haven't had a hang since.-----

xtacy 58 days ago | link Good list of useful configuration options. I'd also like to add the "Compression yes" option that you can add on a per-host basis, and this could save some bytes sent over the wire. To see how much it saved, invoke with verbose ("ssh -v"), and it outputs the number of bytes saved after the session ends.Another config option that has saved me a lot of time is the "ProxyCommand" option that lets you specify a command, whose stdin is used as a pipe to talk to a remote server. So, something like: Host inside ProxyCommand ssh gateway nc inside 22 Would allow you to just type "ssh inside" and ssh to a machine behind a gateway, without ssh-ing twice!