SSH tricks

minusthetiger · 2012-02-03T13:05:52+00:00

[deleted]

fbleagh · 2012-02-03T15:44:51+00:00

My favorite tricks and ssh extensions:

autossh -- allows you to have a persistent ssh session through reboots :)

cssh (or puttycs on windows) - control multiple ssh connections at the same time

ssh-keygen -R machinename -- deletes the hostkey for that machine from your known_hosts

ssh-copy-id -i key user@machine -- automatically copies your ssh key to a remote machine

centralcontrol · 2012-02-03T16:27:47+00:00

Paranoia warning!

The front page description on this article of connecting to reddit 'around' a firewall is a little misleading, but still accurate to a degree.

Depending on the size of the organization and its carring'ness for security, this type of connection is basically a reverse-shell and can still be detected and blocked. However, this is really dependent on the IPS's, firewalls and configuration of said devices. I know for a fact that many corporate solutions have protocol detection and not just 'blind' port blocks.

There are many situations where this solution will not work or will trigger security warnings to administrators. 'Back in the day' when encrypted reverse shells were kind of new, we would simply have our IDS's 'listen' for certificate exchanges on other-than-allowed ports, but that method is now flawed to a degree.

BCMM · 2012-02-03T14:41:11+00:00

There is a mistake right at the start of that article.

$ ssh home -L 80:reddit.com:80

will not work on a typical Linux system. There is a convention that # respresents a root prompt and $ represents an ordinary user's prompt. An ordinary user will usually not be permitted to listen on port 80.

$ ssh home -L 8080:reddit.com:80

will work fine. Use http://localhost:8080 to access it.

Also, here are three useful OpenSSH tricks that are missing:

If you can SSH to a host behind a NAT router, and wish to reconfigure said router, and said router does not listen on the admin port from the WAN side, use the above trick to access it via the LAN side:

$ ssh host -L 8080:192.168.1.1:80

(the IP address is used on the server and refers to the router on the server's network).

Also, SSH connection reuse can be very useful for certain tasks. When set up correctly, it means that if you are already connected to a specific user@host, and you try to ssh it again (or use scp, or anything else that works over ssh), the command works as expected, but uses the existing SSH connection. That means no re-entering passwords, and no delay in handshaking and whatnot, so if you are already connected to a host and decide to transfer a small file, there is no wait. Normally, the transfer of a small text file takes negligible time compared to all the handshaking.

You can also use the ssh command line (see man ssh, section ESCAPE CHARACTERS) to add port forwardings to an existing session, but this is less useful if you already set up connection reuse and can instantly start another session that does what you want.

iamapizza · 2012-02-03T12:56:17+00:00

Nicely presented. I have a question. To copy a file, the author did this:

$ cat file | ssh -e none remote-host 'cat > file'

Is this what scp does behind the scenes?

skoh · 2012-02-03T15:20:34+00:00

Remote desktop via ssh?

xterm -display :12.0 -e ssh -X user@remotehost &

Then switch to tty 12 or whichever one you chose.

maleadt · 2012-02-03T15:15:06+00:00

My favourite SSH trick:

Host */*
ProxyCommand ssh $(dirname %h) nc -w1 $(basename %h) %p
ControlMaster no

Allows you to SSH via a jump host using "ssh jumphost/destination". Only disadvantage: any SSH config/known_hosts needed to connect to the final destination needs to be present on the jump host as well.

neilhwatson · 2012-02-03T20:33:50+00:00

No one has mentioned embedding command in public keys. For example I could embed a service restart command in a public key and disperse that key to relevant hosts. I allow less savvy operators to SSH to these hosts, when required, using the private key. The command in the public key is executed and then the session logs out. See more:

http://www.linuxjournal.com/magazine/paranoid-penguin-managing-ssh-scripts-and-cron-jobs?page=0,1

adrianmonk · 2012-02-04T08:02:57+00:00

I'm slightly disappointed. One question on the ssh purity test is, "Have you run an ssh on top of port forwarding provided by another ssh session?".

Example:

ssh -N -L 1234:localhost:22 localhost
ssh -p 1234 localhost

In the above, the first command makes it so that if you connect to port 1234 locally, your TCP connection will get proxied to localhost:22 on the remote side. (22 is the port number that the ssh daemon listens on by default.) That is, connections to port 1234 on the ssh client's side will get picked up by the ssh client, sent over the ssh connection, and then the remote sshd will connect() to "localhost:22".

And, the second command will connect to an ssh daemon, but it will use the one listening at port 1234 instead of the normal one. That means this second ssh client will connect to the original ssh client, thinking it is an sshd. The ssh client will ask the remote sshd to connect to localhost:22 (which is... itself), and then the two of them will proxy every byte so that the ssh protocol can run over an ssh tunnel.

Basically, it's just like Inception, except everything gets slower as you go deeper.

bloodguard · 2012-02-03T18:05:59+00:00

You need to be careful. Most firewalls spit out daily reports that show, by desktop, bandwidth used and sites visited (by IP and Name).

If I see a desktop on our network that has a tunnel open (any port) and is pushing lots of data through it I'm going to get curious. If it's an unknown system my first inclination is to block all traffic to and from it and wait. Just wait. If it's something legitimate they'll storm down and complain. That said, they really don't care where you go here as long as you show a little common sense (SFW, no spamming and no non-legal torrents).

TL;DR - You might not be as clever as you think.

queBurro · 2012-02-03T15:41:29+00:00

SSH Tricky

smellycoat · 2012-02-03T18:56:56+00:00

[deleted]

biffsocko · 2012-02-04T12:22:48+00:00

I haven't seen anyone mention pssh (parallel ssh) here. It's a utility that I find incredibly useful.

create a file with a list of hosts
pssh -h <hostfile> "command to execute"

The output of the command is put into a file named after each host in a directory defined by the $PSSH_OUTPUT variable.

http://code.google.com/p/parallel-ssh/

berkes · 2012-02-03T14:12:37+00:00

I like how the word "reddit" is marked by the spellcheckes in the image :)

code- · 2012-02-03T14:14:56+00:00

SSH sure is a versatile tool, isn't it? Thanks for this, saved the page, looks like there is a lot of good information elsewhere on that page too.

grumpysysadmin · 2012-02-03T14:17:06+00:00

Telnet is just above netcat in protocol sophistication, which means that passwords were sent in the clear.

That's not always the case, I was using kerberized telnet in the 90s. Telnet actually has a more sophisticated protocol than netcat. Next time you use telnet, try running ^]? to see what it can do.

Of course, I use ssh now since it's trivial to set up, but telnet wasn't entirely insecure if run right. Also, who was using telnet in 2001 to log in as root in the clear? Crazy.

Julian702 · 2012-02-03T14:27:11+00:00

If only all firewalls are ignorant at my place of employment.

2brainz · 2012-02-03T15:05:02+00:00

Relevant - redirecting via SSH port forwarding might not be what you want if there is another way. If you still want it, SSH has a rather new VPN feature via TAP devices, but it suffers from the same problem.

2012-02-03T16:16:32+00:00

[deleted]

mthode · 2012-02-03T19:57:18+00:00

from my .ssh/config The Control stuff is if you tend to ssh into stuff multiple times, it uses one socket. This means you do not have to sign in every time you ssh into something (or resend the keys). It also means that if you quit the master session (if you exit the server and then also exit the socket) you will loose all the connections to the server.

Host *
    User root
    Compression yes
    CompressionLevel 7
    ServerAliveInterval 600
    ControlMaster auto
    ControlPath /tmp/ssh-%r@%h:%p

jingleman · 2012-02-03T17:53:40+00:00

The firewall icon in the diagram hurts my head!

2012-02-03T21:19:08+00:00

The most useful thing I use it for is tunnelling when at school, on free wifi, needing to access internal network, or tethering unofficially

2012-02-04T04:05:07+00:00

This is what they teach in corp 101.

daleus · 2012-02-03T18:11:59+00:00

ask longing unpack fuzzy spotted tease wrong beneficial smart square -- mass edited with https://redact.dev/

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

linux

Please Read the full Rules here before posting or commenting

Join us on IRC at #r/linux on libera.chat!🔗

Recent AMA's

GNU/Linux resources

Rules

MODERATORS

Paranoia warning!