One of my favorites, from: http://www.phrack.org/issues.html?issue=64&id=4&page...

See: An almost invisible ssh connection

     ssh -T user@host /bin/bash -i

This connects you to a box with no TTY allocation. If someone types 'w', they will not see your connection.

This is much better

ssh -t user@host screen -ln

since you get a full fledged shell with job control and everything

Okay, you've done the trick, now what's the reveal? How do you readily detect someone who has started their shell without TTY allocation?

if you are running sshd on port 22 this will show you all connections going into it

    sudo lsof -i :22

you can then reverse what people are doing based on the pids lsof gives you.

[edit: using ps ax | grep sshd also works but you can't see where they are connecting from. [+1 daten]]

The sshd process for your connection is still present on the server and looks like: "sshd: username@notty". You can find it easily with a grep of running processes.

ps aux | grep sshd.*notty

Seems to be down.

Text only cache: http://webcache.googleusercontent.com/search?q=cache:http://...

My cache got it also, and it's easier to read: http://viewtext.org/article?url=http://blog.urfix.com/25-ssh...

I know its a small difference, but I am happy this title doesn't imply I don't know these tricks yet, as some articles of this kind tend to do.

That's an excellent litmus test on whether there is likely to be anything actually valuable there. On the other hand, I wonder how much more traffic they might get from the people who visit just to affirm, "I do too know them..." :-)

Tech folks are sensitive to arrogance and jabs at pride in context of knowledge. It seems like every other top ten list poster seems to be standing on the shoulders of giants we never knew of.

This list is missing sshuttle: https://github.com/apenwarr/sshuttle

sshuttle is a transparent proxy server that works as a poor man's VPN. Forwards over ssh. Doesn't require admin access. Works with Linux and MacOS.

Avery Pennarun is a Hero :)

Wow, this is fantastic, thanks! I was looking for something like this a while ago and the closest I could find was transocks, which is Linux-only, not overly stable, not actively maintained, and TCP-only.

sshuttle is currently TCP-only i remember seeing some people discussing about UDP, and DNS forwarding on top of sshuttle but it hasn't gotten very far.

How can something like this work without admin access? Mucking around with network routing using requires root, doesn't it?

It require root access on the client, on the server it only needs ssh and python >= 2.3

Thanks - that's awesome. Pandora is back.

Nice piece of code - tons of interesting possibilities there.

I wish this would automatically omit locally attached networks -although easy enough to do from the command line.

What does this do that ssh -Dport user@host does not?

Forward transparently your traffic using iptables. So, if you use sshuttle on your gateway all the tcps connections to the specified subnets are forwarded using ssh for the gateway and all the machines using that gateway.

You can do this

# sshuttle -v -r user@host:443 10.0.0.0/8 # ssh user@10.0.0.138

Connections to 10.0.0.0/8 goes through ssh automatically.

The site is currently down. Why is it so hard for most blog software to do the most basic thing of the web: delivering static content?

Because the author made the same mistake so many Wordpress users do which is going absolutely crazy with add-ons. I managed to get the page to load after about 3 minutes and I can count at least 8-9 add-ons he is using that are sucking up tons of server resources. The owner of this blog would be extremely well served by removing unnecessary add-ons and installing something like WP Super Cache to serve content significantly faster and lower the server load.

For security he might want to relocate the admin login URL as well since he still has it set to /wp-admin/ .

Then again, for security he might want to use something else. Is it only me who is amused by the irony of someone using a system with such a poor security track record to talk about ssh which is intended to provide secure connections?

What additional security does relocating the admin login buy?

Like running sshd on another port (to stay on topic), it doesn't make the service more secure against someone who knows it's there, but it makes it less visible to automated scripts probing the standard location for known bugs.

Why does this submission continue getting voted up when the site has been down all day today?

Because everyone is reading cached versions.

They may want to change their DB username and password ASAP.

http://blog.urfix.com/wp-config.php

I can see their config in plain text.

Also, use

  ~.

to terminate a stalled session.

The tilde-escape offers significantly more than just termination, actually. Hit '~?' for the available escape sequences:

  Supported escape sequences:
    ~.  - terminate connection (and any multiplexed sessions)
    ~B  - send a BREAK to the remote system
    ~C  - open a command line
    ~R  - Request rekey (SSH protocol 2 only)
    ~^Z - suspend ssh
    ~#  - list forwarded connections
    ~&  - background ssh (when waiting for connections to terminate)
    ~?  - this message
    ~~  - send the escape character by typing it twice
  (Note that escapes are only recognized immediately after newline.)

If you open the command line (~C), another '?' shows its available commands:

  ssh> ?
  Commands:
        -L[bind_address:]port:host:hostport    Request local forward
        -R[bind_address:]port:host:hostport    Request remote forward
        -KR[bind_address:]port                 Cancel remote forward

cool list, thank you!

Previous ssh fu posts:

http://news.ycombinator.com/item?id=1536126

http://news.ycombinator.com/item?id=874666

http://news.ycombinator.com/item?id=1624010

When I first got my netbook, I sometimes set up an ssh media server to stream music from my main computer to my netbook like this:

ssh user@host cat /path/to/music-collection | mplayer

I have been looking for solutions to some of these things forever:

21) Have an ssh session open forever

autossh -M50000 -t server.example.com ‘screen -raAd mysession’

Open a ssh session opened forever, great on laptops losing Internet connectivity when switching WIFI spots.

24) Transfer SSH public key to another machine in one step

ssh-keygen; ssh-copy-id user@host; ssh user@host

This command sequence allows simple setup of (gasp!) password-less SSH logins. Be careful, as if you already have an SSH keypair in your ~/.ssh directory on the local machine, there is a possibility ssh-keygen may overwrite them. ssh-copy-id copies the public key to the remote host and appends it to the remote account’s ~/.ssh/authorized_keys file. When trying ssh, if you used no passphrase for your key, the remote shell appears soon after invoking ssh user@host.

25) Copy stdin to your X11 buffer

ssh user@host cat /path/to/some/file | xclip

25a) Copy stdin to clipboard on Mac

ssh user@host cat /path/to/some/file | pbcopy

To keep an ssh session forever, you could also add the following line to ssh_config.

  ServerAliveInterval 10

The client sends a keepalive packet every 10 seconds.

Very useful indeed, some of those I've been wondering about for ages.

> i think that is the fastest and best way to migrate a DB to a new server!

Except that your mysql password is now in your history?

Just put a space before you execute the command, then it doesn't get saved in history. Alternatively, delete it from your history file as the other commenter suggests.

I don't have a box to test this on right now, but you might have to set HISTCONTROL=ignorespace for that to work.

At least under ZSH (on Ubuntu), I don't appear to have the HISTCONTROL environment variable set and yet it still ignores anything prepended with a space.

Isn't this what history -d is for? I always delete passwords and important information from my bash history.

If you're on OS X, you can get ssh-copy-id through homebrew. (And if you're on OS X and not using homebrew, go install it now: https://github.com/mxcl/homebrew )

It's clunky. How is it better than compiling for yourself or using Apple-blessed MacPorts?

Compiling it yourself takes a lot more work than `brew install ssh-copy-id`.

Here's a pretty good expression of the main complaint I've heard about MacPorts:

> The system [homebrew] is much better than MacPorts, the idea is that for example, Mac OS X comes with python installed. Brew will try to use the default python installation instead of trying to make it's own in /usr/opt/whatever ... so, homebrew premise, is to respect the Mac OS X installed packages and use them to it's favor + respecting the Mac OS X structure ( don't re create a whole new structure like fink and mac ports )

- http://stackoverflow.com/questions/189912/what-package-manag...

An added bonus is that things tend to install way faster because it's not compiling all of this stuff that OS X came with.

Last time I tried to use it I was burned when it came to removing packages. Sure, I can remove them by hand, but then what good is my package management system? The hairier installation is, the more configuration files it creates and modifies all over the system, the more urgent is the need for reliable management system. And there are packages that can't not write all over the system. SSH is one. Sage's another.

One cool application of ssh port forwarding missing from the list is https://github.com/progrium/localtunnel

It lets you temporarily give a behind-the-firewall web server a public, port 80 URL.

I use

  ssh -D9999 user@remotehost.com

And now I have a local SOCKS proxy running. I just have to change the proxy configuration in my browser using SOCKS4a at localhost:9999 and I can surf as if I were on remotehost

This is really useful. And if you do

  ssh -ND 9999

it doesn't open a shell.

This may stop you from accidentally shutting down your tunnel thinking it's just another ssh session.

i use ssh -D plus FoxyProxy on a daily basis, it's made my life a whole lot easier!

tsocks might help also for apps which do not have native socks support.

Useful post!

Does anyone know: Is it recommended to mount a directory via sshfs? My idea: Mount whole server filesystems into /mnt/servers/<server_ip> ... and then conveniently work with it using desktop tools.

Can it be done? What are the downsides to that?

The biggest thing to remember is that any command you run will be in a local context. For example, if you want to do things like updating a SVN repo that's located on the server you've mounted, you should SSH directly into the server and perform it. Otherwise, your _local_ SVN software will try to read in tons of files FROM the server to establish changes in the checkout before it can even try to commit. This can be very slow!

^^Very good point.

On OSX with MacFuse and SSHFS, I've done plenty of remote work before on LAN servers and "internet" servers. It definitely works, but is slow. But for being able to open up a "local" file in Vim/text editor and then save it, the only time you are hitting the network is during the save and that can be slow.

Transmit 4 integrated this functionality into their FTP client, auto-mounting of SSH connections, but it definitely seems more crashy than MacFuse to me.

If remote editing vim is your only requirement, it should be noted that up-to-date versions of vim will handle scp://, as in "vim scp://hostname/file_to_edit". (Emacs users have Fish) (you should already have ssh keys setup)

Thanks for that. You've just removed 90% of my use cases for opening an actual shell on the remote server.

I've been using vim for a decade or more. I guess it's a salutary lesson for experienced users. I should read the Changelog more carefully when upgrading.

As already noted, commands that deal with a lot of data will copy that data to your machine to process, and copy it back. This is a drawback of both NFS and sshfs.

NFS, however, doesn't encrypt, while sshfs does, so if you don't care about encryption, NFS will be a lot faster.

The proper way to do what you want is to install those desktop tools on the remote machine, and then use ssh X forwarding (ForwardX11 and ForwardX11Trusted in the manual, also -X and -Y) to have those programs run on the remote machine, but display their GUIs on your local desktop. This way you get the nice graphical interfaces while still doing all the hard work on the remote machine, without copying tons of data back and forth.

I have never managed to make sshfs properly handle network problems (at least as well as NFS), especially after suspend & resume, I'd quite too often end with unusable machine where half of all desktop apps are hanging on some blocking syscall via that sshfs, that will _never_ timeout. Also, sshfs is quite inefficient. It's main advantage is being almost setupless, both client- and serverside. But you don't need that if you want to permanently mount your servers somewhere. I think that properly setting up NFS is worth it, in your case.

A dead NFS server can also stall a local desktop. This was a huge issue at Google, where homedirs are mounted on NFS. Turns out almost all window managers need frequent access to dotfiles or they will freeze. This is stupid.

Sure, but it can at least timeout, reutrn EIO, seamlessly reconnect when the connection is reestablished and few other remedies (you can't really do anything else, if this happens), something that I've never managed to make sshfs do properly.

A lot of window managers don't really deal with NFS timeouts/errors very well. One solution is something like AFS, but that comes with a whole host of issues.

There's a little typo in item 5:

"Will allow you to mount a folder security over a network."

I guess the author meant instead:

"Will allow you to mount a folder securely over a network."

github does some impressive backend work with SSH - I was amazed when I read about their architecture https://github.com/blog/530-how-we-made-github-fast

Interesting stuff, but can you clip the number from the title, please?

> When ssh is the foundation of your security architecture, you know things aren't working as they should.

Rob Pike

http://interviews.slashdot.org/article.pl?sid=04/10/18/11532...

If you read the context, this isn't really a specific criticism of ssh, but rather a general criticism of Unix's network model (or lack of it). Maybe we should all be using Plan 9, but as we're not ssh helps a lot.

I know, I'm a long time plan9 user, I know what it could be like.

26. $ ~<Ctrl-Z> # suspend current SSH session

Very useful.