Hot answers tagged

7

The shell's $! variable only knows the pid of the process started by the shell. As you suspected, the ssh call using -f forks its own process so it can go to background, so the overall process tree looks like [1]: shell | +--ssh<1> (pid is $!) | +--ssh<2> (pid is different) ssh<1> exits very shortly after invocation; therefore, the ...


6

The feature is called ControlMaster which does multiplexing over one existing channel. It will cause you will do all key exchange and logging in only once and the later commands will go through much faster. You activate it using these three lines in you .ssh/config: Host host.com ControlMaster auto ControlPath ~/.ssh/master-%C # for openssh < 6.7 ...


6

You have 2 options here. Option 1: Put ssh to listen on a different port, by editing the file /etc/ssh/sshd_config and changing the Port parameter to another number of port. Port 2222 as an example. Option 2: Redirect the traffic incoming from another port to tcp/22(ssh) iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT iptables -A INPUT -i eth0 -p ...


5

After discussing this in a chat and debugged the issue, it turned out that the required directive PermitTunnel yes was not in place and active. After adding the directive to /etc/ssh/sshd_config and reloading sshd by service sshd reload this was resolved. We added -v to the ssh command to get some debugging information and from that we found: debug1: ...


5

I like to use sslh for this. It exploits the fact that different protocols start a connection differently. If it detects SSH, it forwards the connection to sshd and if it detects HTTPS it forwards the connection to httpd. This allows you to have e.g. nginx/apache and ssh listening on the same port (usually 443).


4

Why doesn't that solution with ProxyCommand work for X11 forwarding? I think you can directly reach mum's computer with X11 forwarding using the following configuration. Host mum ProxyCommand ssh -q -W localhost:1993 login@vps0 ForwardX11 yes


4

There were such examples if you were using X11 forwarding, for example as described in this report: https://thejh.net/written-stuff/openssh-6.8-xsecurity Similar issue was published many years ago: http://www.giac.org/paper/gcih/571/x11-forwarding-ssh-considered-harmful/104780 All these should be fixed now, but using -X forwarding to untrusted machines ...


4

You shouldn't believe everything you read on the Internet. :) There is no security problem with enabling TCPKeepAlive. There never was any such problem. The meaning of the warning in the sshd_config(5) manual is that you shouldn't rely on TCPKeepAlive alone, since an attacker can spoof it to fool the server into thinking a connection is still alive when it ...


4

You must contact whoever is in charge of the network, and convince them that your access request is legitimate. Regardless of the sanity of the access restrictions, circumventing them will at the very least land you in hot water with your boss, and could even be taken as "hacking" and get you prosecuted.


3

With ssh -D 8080 yourserver you can start a SOCKS proxy to your home server. Configure your client to use localhost:8080 as SOCKS proxy. This method requires that port forwarding is enabled, see the AllowTcpForwarding directive in /etc/ssh/sshd_config. If you can not enable the TCP forwarding you might have a look at sshuttle. See ...


3

not yet possible. there is a pull-request for oob data which seems to work for some people, though: mosh/pull/583 all credits goes to guy named tribut from #mosh channel on freenode


3

Sounds like autossh (Automatically restart SSH sessions and tunnels) could be something for you: http://www.harding.motd.ca/autossh/ To keep tunnels alive, and to administrate them in general. Should be on most distros base repos, so just use one of the following: apt-get install autossh # deb pacman -S autossh # arch yum install autossh # rhel


3

You need to use the OUTPUT chain to redirect an outbound connection to a local port. This rule will work as you need: iptables -t nat -A OUTPUT -p tcp -d 40.40.40.40 --dport 3306 -j REDIRECT --to-port 3306


3

This error means that the server sent an unrequested forwarded port that the client didn't expect. In short, the dropbear SSH client doesn't know how to handle the dynamically allocated port forward which the remote server has allocated for it. It is unsupported by dropbear. The relevant code: Where the dropbear client parses the remote forward request and ...


3

Well, this "I have no root" acces on Server A can be a problem to create a good vpn solution since: ip-ip tunneling requires interface manipulation; pptp also requires root privileges to create interfaces; OpenVPN can even run as unprivileged user, but some tricks need to be done like allowing sudo to the ip command to allow the creation of tun interface; ...


2

VNC does not support sound. You can use PulseAudio to move sound over SSH, though, which may be better than nothing for you. Check out this post: https://razor.occams.info/blog/2009/02/11/pulseaudio-sound-forwarding-across-a-network/


2

This looks like the linux host is configured to be some sort of RDP gateway. The command will initiate a SSH session to itself (root@localhost), start a local listener on port 3300 (L 3300:) to forward all traffic to a Windows machine on port 3389 (remote_WIN_machine1:3389), typical for RDP. I suspect that the GatewayPorts directive is set to yes in ...


2

If you understand what is going on in X11 forwarding, you will know that it is not so simple as described in the answer from @yaegashi. X11 forwarding is creating another layer under the ssh and it can't be chained as normal terminal data streams. But you are able to do it using port forwarding: Based on this blog post, which does it as hardcoding in shell ...


2

Can someone crawl back down your SSH connection and infect your computer? No. Can they see there's a connection from your external IP address then scan/enumerate/potentially exploit your gateway (e.g. router)? Yes. What you should really be concerned with is if the proxy provider is worth trusting with your web traffic. By proxying your traffic through ...


2

Performing SSH tunneling can get a bit confusing with all the terminology, but there is a complementary feature to -L, which provides you the ability to "dynamically" assign ports by allocating a socket locally, instead of a single port. From the man page: -D [bind_address:]port Specifies a local ``dynamic'' application-level port forwarding. This ...


2

Quoting Comcast Business Internet: Static IP is not supported on retail devices due to technical limitations. Static IP is only supported via Comcast Business CCR & BWG leased devices: CCR (Comcast Commercial Routers: SMC D3G-CCR or Netgear CG3000DCR) / BWG (Business Wireless Gateways: Cisco DPC3939B or Cisco DPC3941B). For more information ...


2

Second case is very useful in situation when example.com can connect to [google.com] host while your box can't. For example, you have VPN connection which is restricted to a number of boxes, while you want to access host not in list. ssh -L 123:target.host.com:456 user@vpn.host.com. So, basic usage is to jump INSIDE the network or jump OUTSIDE the network ...


2

You don't need netcat on your bridge. As DanSut proposed in the comments you can use the ssh -W command line option instead, this configuration should work for you: Host axp User remote_userid HostName remoteserver.com IdentityFile ~/.ssh/id_rsa.eric ProxyCommand ssh -AW %h:%p bridge_userid@bridge_userid.com


2

You can add a user without a valid login shell: # useradd -s /sbin/nologin dbuser Set their password: # passwd dbuser Or leave it unset and make SSH keys: (on local machine) $ ssh-keygen (on remote machine) # su -s /bin/bash - dbuser $ cat local_id_rsa.pub >>~/.ssh/authorized_keys At this point, you can use SSH to create the tunnel: ssh ...


2

In general, an address binding is an association between a service (e.g., SSH) and an IP address. A host may have multiple IP addresses (e.g., 127.0.0.1, 192.168.1.2). Address binding allows you to run a service on some or all of these addresses. Suppose your host is configured with two network interfaces, one connected to a trusted network (e.g., ...


2

The -s flag tells ssh that instead of allocating a tty on the remote computer to use the subsystem specified as the remote command. What you're doing is establishing an ssh session using app as the subsystem similar to how things would work if the remote subsystem were sftp, for example.


1

This is not answering you question, but this answer on SU is solving your problem, I guess: Using ProxyCommand in your ~/.ssh/config should do everything for you: Host server HostName server.tld User {server user} Host proxy ProxyCommand ssh server -W %h:%p User {proxy user} Then you can access your server simply by using ssh server


1

If you have control of the machine to the point that you are automating tasks on it, then why is adding your key to authorized_keys not an option? ssh-copy-id -i ~/.ssh/foo somehost@example.com Then you don't have to enter a password every time you connect. If the biggest problem is that connections take a long time to connect, you could reuse a single ...


1

The ProxyCommand is what you need. At my company, all the DevOps techs have to use a "jumpstation" in order to access the rest of the VPC's. The jumpstation is VPN access-controlled. We've got our SSH config setup to automatically go through the jumpstation automatically. Here is an edited version of my .ssh/config file: Host *.internal.company.com User ...



Only top voted, non community-wiki answers of a minimum length are eligible