Tag Info

Hot answers tagged

11

An especially good solution for scripting is to use "master" mode, with a socket for control commands: ssh -f -N -M -S <path-to-socket> -L <post>:<host>:<port> <server> To close it again: ssh -S <path-to-socket> -O exit <server> This avoids both grepping for process ids and any timing issues that might be ...


7

-f -N is what you are looking for: ssh -f -N -L MY_LOCAL_PORT:FOREIGN_ADDRESS:FOREIGN_PORT MYUSER@SSH_SERVER


6

The feature is called ControlMaster which does multiplexing over one existing channel. It will cause you will do all key exchange and logging in only once and the later commands will go through much faster. You activate it using these three lines in you .ssh/config: Host host.com ControlMaster auto ControlPath ~/.ssh/master-%C # for openssh < 6.7 ...


5

My solution was similar to @slm's but I used SOCKS instead because it is simpler and required no proxy installation on the server or client. Run all commands on the computer with restricted acccess. in yum.conf set the proxy as follows proxy=socks5h://localhost:1080 from a terminal type ssh -D 1080 YOUR_USER@YOUR_SERVER_WITH_FULL_WEB_ACCESS press ...


4

From your workstation set up tunneling via: ssh -L8080:192.168.1.20:80 server10 Where "server10" is the public name you use to reach 192.168.1.10. This will listen locally on port 8080 and forward any data to 192.168.1.20:80 from the target host. An alternative is using the -D option for ssh for setting up a socks proxy. This will allow you to reach ...


4

You shouldn't believe everything you read on the Internet. :) There is no security problem with enabling TCPKeepAlive. There never was any such problem. The meaning of the warning in the sshd_config(5) manual is that you shouldn't rely on TCPKeepAlive alone, since an attacker can spoof it to fool the server into thinking a connection is still alive when it ...


4

There were such examples if you were using X11 forwarding, for example as described in this report: https://thejh.net/written-stuff/openssh-6.8-xsecurity Similar issue was published many years ago: http://www.giac.org/paper/gcih/571/x11-forwarding-ssh-considered-harmful/104780 All these should be fixed now, but using -X forwarding to untrusted machines ...


3

Sounds like autossh (Automatically restart SSH sessions and tunnels) could be something for you: http://www.harding.motd.ca/autossh/ To keep tunnels alive, and to administrate them in general. Should be on most distros base repos, so just use one of the following: apt-get install autossh # deb pacman -S autossh # arch yum install autossh # rhel


3

After discussing this in a chat and debugged the issue, it turned out that the required directive PermitTunnel yes was not in place and active. After adding the directive to /etc/ssh/sshd_config and reloading sshd by service sshd reload this was resolved. We added -v to the ssh command to get some debugging information and from that we found: debug1: ...


3

With ssh -D 8080 yourserver you can start a SOCKS proxy to your home server. Configure your client to use localhost:8080 as SOCKS proxy. This method requires that port forwarding is enabled, see the AllowTcpForwarding directive in /etc/ssh/sshd_config. If you can not enable the TCP forwarding you might have a look at sshuttle. See ...


3

Why doesn't that solution with ProxyCommand work for X11 forwarding? I think you can directly reach mum's computer with X11 forwarding using the following configuration. Host mum ProxyCommand ssh -q -W localhost:1993 login@vps0 ForwardX11 yes


3

You need to use the OUTPUT chain to redirect an outbound connection to a local port. This rule will work as you need: iptables -t nat -A OUTPUT -p tcp -d 40.40.40.40 --dport 3306 -j REDIRECT --to-port 3306


2

You should be able to proxy YUM's traffic over the SSH connection like so: add to the /etc/yum.conf on the protected server: proxy=http://127.0.0.1:8080 from the server with normal inbound/outbound ssh access: $ ssh -R 8080:ssh.server:8080 user@protected.server On the server where you want to run YUM commands: $ yum update References Port Forward ...


2

You need a desktop manager like xdm, gdm or kdm, configure it for remote access via XDMCP. Once the desktop manager on the desktop PC is set up to accept remote connections you do Xorg :1 vt8 -query <put desktop PC address here> on your netbook. KDM setup Depending on your distribution and version, the name and location of the config files may ...


2

Cisco routers has Telnet open by default. You have to explicitly make the configuration for SSH (set a domain, generase RSA, enable SSH 2.0 etc). Read the Cisco's documentation about how to configure Cisco and SSH.


2

Quite an interesting problem you've got. The real solution would be to ask your sysadmin for help first. If that's not an option, the next best thing is to have pyCharm's libssh or whatever it uses (I did some googling and couldn't figure it out) parse your `~/.ssh/config'. If that's not possible, you might be able to run your own ssh daemon on the remote ...


2

That's about it, but you've inverted home and office. The point is that the office firewall rejects outgoing connections other than web traffic. But since HTTPS traffic and SSH traffic are both encrypted, it can't easily distinguish between them, so the firewall just blocks outgoing connections to ports other than 443 (the standard HTTPS port) and probably ...


2

This looks like the linux host is configured to be some sort of RDP gateway. The command will initiate a SSH session to itself (root@localhost), start a local listener on port 3300 (L 3300:) to forward all traffic to a Windows machine on port 3389 (remote_WIN_machine1:3389), typical for RDP. I suspect that the GatewayPorts directive is set to yes in ...


2

not yet possible. there is a pull-request for oob data which seems to work for some people, though: mosh/pull/583 all credits goes to guy named tribut from #mosh channel on freenode


2

Performing SSH tunneling can get a bit confusing with all the terminology, but there is a complementary feature to -L, which provides you the ability to "dynamically" assign ports by allocating a socket locally, instead of a single port. From the man page: -D [bind_address:]port Specifies a local ``dynamic'' application-level port forwarding. This ...


2

Quoting Comcast Business Internet: Static IP is not supported on retail devices due to technical limitations. Static IP is only supported via Comcast Business CCR & BWG leased devices: CCR (Comcast Commercial Routers: SMC D3G-CCR or Netgear CG3000DCR) / BWG (Business Wireless Gateways: Cisco DPC3939B or Cisco DPC3941B). For more information ...


2

Can someone crawl back down your SSH connection and infect your computer? No. Can they see there's a connection from your external IP address then scan/enumerate/potentially exploit your gateway (e.g. router)? Yes. What you should really be concerned with is if the proxy provider is worth trusting with your web traffic. By proxying your traffic through ...


2

Second case is very useful in situation when example.com can connect to [google.com] host while your box can't. For example, you have VPN connection which is restricted to a number of boxes, while you want to access host not in list. ssh -L 123:target.host.com:456 user@vpn.host.com. So, basic usage is to jump INSIDE the network or jump OUTSIDE the network ...


2

If you understand what is going on in X11 forwarding, you will know that it is not so simple as described in the answer from @yaegashi. X11 forwarding is creating another layer under the ssh and it can't be chained as normal terminal data streams. But you are able to do it using port forwarding: Based on this blog post, which does it as hardcoding in shell ...


1

From an IT standpoint, your VPN provider will have to push routes to your system to access the SAN or application servers the network is running. If RDP is pushed through another firewall or NAT, then you'll have to ask your system admin. If your IT team is smart, their firewall may block traffic from the VPN network to the server network. Which is why ...


1

The shell will read commands from your terminal (i.e. the shell's standard input) until it's told to stop (by entering the exit command) or when an end-of-file (EOF) is encountered (just like when the shell is executing a script). If you enter the exit command, this will first be saved into the history, and then the shell will quit. Entering ctrl-D ...


1

If @St├ęphaneChazelas's suggestion of increasing ServerAliveInterval doesn't work (maybe try a value of 300), then you might want to consider something like GNU screen or tmux so you can resume your dropped connections. I have this near the top of my ~/.bashrc on all of my remote systems: screen -r >/dev/null 2>&1 This will do nothing if you ...


1

Try use sshtunnel lib. Example: from sshtunnel import SSHTunnelForwarder from time import sleep with SSHTunnelForwarder( ('localhost', 2222), ssh_username="vagrant", ssh_password="vagrant", remote_bind_address=('127.0.0.1', 3306)) as server: print(server.local_bind_port) while True: # press Ctrl-C for stopping ...


1

It's ssh client that's working on your side (local), not sshd. pgrep -l ssh should list pids and names. If no clue, try netstat -tnp|grep -F '127.0.0.1:8888'. Or run lsof -itcp@127.0.0.1:8888 and find the pid and kill. Or ssh into the remote machine, and press ~C and enter on it's own line. You'll get ssh> prompt, type -h for help. ~# lists forwarded ...


1

Does the command below work? % ssh -o ProxyCommand='ssh -p 2222 userS@SERVER /usr/bin/nc %h %p' userD@DESKTOP If so, you can bake the proxycommand into your ~/.ssh/config to make scp and sshfs calls easier.



Only top voted, non community-wiki answers of a minimum length are eligible