Hot answers tagged

7

The shell's $! variable only knows the pid of the process started by the shell. As you suspected, the ssh call using -f forks its own process so it can go to background, so the overall process tree looks like [1]: shell | +--ssh<1> (pid is $!) | +--ssh<2> (pid is different) ssh<1> exits very shortly after invocation; therefore, the ...


6

The feature is called ControlMaster which does multiplexing over one existing channel. It will cause you will do all key exchange and logging in only once and the later commands will go through much faster. You activate it using these three lines in you .ssh/config: Host host.com ControlMaster auto ControlPath ~/.ssh/master-%C # for openssh < 6.7 ...


6

You have 2 options here. Option 1: Put ssh to listen on a different port, by editing the file /etc/ssh/sshd_config and changing the Port parameter to another number of port. Port 2222 as an example. Option 2: Redirect the traffic incoming from another port to tcp/22(ssh) iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT iptables -A INPUT -i eth0 -p ...


5

I like to use sslh for this. It exploits the fact that different protocols start a connection differently. If it detects SSH, it forwards the connection to sshd and if it detects HTTPS it forwards the connection to httpd. This allows you to have e.g. nginx/apache and ssh listening on the same port (usually 443).


4

You must contact whoever is in charge of the network, and convince them that your access request is legitimate. Regardless of the sanity of the access restrictions, circumventing them will at the very least land you in hot water with your boss, and could even be taken as "hacking" and get you prosecuted.


4

You shouldn't believe everything you read on the Internet. :) There is no security problem with enabling TCPKeepAlive. There never was any such problem. The meaning of the warning in the sshd_config(5) manual is that you shouldn't rely on TCPKeepAlive alone, since an attacker can spoof it to fool the server into thinking a connection is still alive when it ...


4

There were such examples if you were using X11 forwarding, for example as described in this report: https://thejh.net/written-stuff/openssh-6.8-xsecurity Similar issue was published many years ago: http://www.giac.org/paper/gcih/571/x11-forwarding-ssh-considered-harmful/104780 All these should be fixed now, but using -X forwarding to untrusted machines ...


4

Why doesn't that solution with ProxyCommand work for X11 forwarding? I think you can directly reach mum's computer with X11 forwarding using the following configuration. Host mum ProxyCommand ssh -q -W localhost:1993 login@vps0 ForwardX11 yes


3

You need to use the OUTPUT chain to redirect an outbound connection to a local port. This rule will work as you need: iptables -t nat -A OUTPUT -p tcp -d 40.40.40.40 --dport 3306 -j REDIRECT --to-port 3306


3

This error means that the server sent an unrequested forwarded port that the client didn't expect. In short, the dropbear SSH client doesn't know how to handle the dynamically allocated port forward which the remote server has allocated for it. It is unsupported by dropbear. The relevant code: Where the dropbear client parses the remote forward request and ...


3

not yet possible. there is a pull-request for oob data which seems to work for some people, though: mosh/pull/583 all credits goes to guy named tribut from #mosh channel on freenode


3

With ssh -D 8080 yourserver you can start a SOCKS proxy to your home server. Configure your client to use localhost:8080 as SOCKS proxy. This method requires that port forwarding is enabled, see the AllowTcpForwarding directive in /etc/ssh/sshd_config. If you can not enable the TCP forwarding you might have a look at sshuttle. See ...


3

Your approach is not taking in account that contrary to other common protocolos, FTP uses both port 20 and port 21 over TCP. The term passive refers that the protocol is a little more well behaved than the initial implementations. Here is a link: http://www.slacksite.com/other/ftp.html Port 20/TCP is used for data, and port 21/TCP for commands. In ...


3

Well, this "I have no root" acces on Server A can be a problem to create a good vpn solution since: ip-ip tunneling requires interface manipulation; pptp also requires root privileges to create interfaces; OpenVPN can even run as unprivileged user, but some tricks need to be done like allowing sudo to the ip command to allow the creation of tun interface; ...


2

The -s flag tells ssh that instead of allocating a tty on the remote computer to use the subsystem specified as the remote command. What you're doing is establishing an ssh session using app as the subsystem similar to how things would work if the remote subsystem were sftp, for example.


2

Quoting Comcast Business Internet: Static IP is not supported on retail devices due to technical limitations. Static IP is only supported via Comcast Business CCR & BWG leased devices: CCR (Comcast Commercial Routers: SMC D3G-CCR or Netgear CG3000DCR) / BWG (Business Wireless Gateways: Cisco DPC3939B or Cisco DPC3941B). For more information ...


2

Performing SSH tunneling can get a bit confusing with all the terminology, but there is a complementary feature to -L, which provides you the ability to "dynamically" assign ports by allocating a socket locally, instead of a single port. From the man page: -D [bind_address:]port Specifies a local ``dynamic'' application-level port forwarding. This ...


2

The ProxyCommand is what you need. At my company, all the DevOps techs have to use a "jumpstation" in order to access the rest of the VPC's. The jumpstation is VPN access-controlled. We've got our SSH config setup to automatically go through the jumpstation automatically. Here is an edited version of my .ssh/config file: Host *.internal.company.com User ...


2

VNC does not support sound. You can use PulseAudio to move sound over SSH, though, which may be better than nothing for you. Check out this post: https://razor.occams.info/blog/2009/02/11/pulseaudio-sound-forwarding-across-a-network/


2

You're on the right track with tty, and the -t option gives you just that. However, unless you are actually aiming to get a tty session for interacting, leave this option off of the last ssh command in your chain. In your case you just need it on the first connection: ssh -L 5901:localhost:6000 host1 -t ssh -L 6000:localhost:5901 -N host2 Now when you use ...


2

This looks like the linux host is configured to be some sort of RDP gateway. The command will initiate a SSH session to itself (root@localhost), start a local listener on port 3300 (L 3300:) to forward all traffic to a Windows machine on port 3389 (remote_WIN_machine1:3389), typical for RDP. I suspect that the GatewayPorts directive is set to yes in ...


2

Second case is very useful in situation when example.com can connect to [google.com] host while your box can't. For example, you have VPN connection which is restricted to a number of boxes, while you want to access host not in list. ssh -L 123:target.host.com:456 user@vpn.host.com. So, basic usage is to jump INSIDE the network or jump OUTSIDE the network ...


2

Can someone crawl back down your SSH connection and infect your computer? No. Can they see there's a connection from your external IP address then scan/enumerate/potentially exploit your gateway (e.g. router)? Yes. What you should really be concerned with is if the proxy provider is worth trusting with your web traffic. By proxying your traffic through ...


2

If you understand what is going on in X11 forwarding, you will know that it is not so simple as described in the answer from @yaegashi. X11 forwarding is creating another layer under the ssh and it can't be chained as normal terminal data streams. But you are able to do it using port forwarding: Based on this blog post, which does it as hardcoding in shell ...


2

You don't need netcat on your bridge. As DanSut proposed in the comments you can use the ssh -W command line option instead, this configuration should work for you: Host axp User remote_userid HostName remoteserver.com IdentityFile ~/.ssh/id_rsa.eric ProxyCommand ssh -AW %h:%p bridge_userid@bridge_userid.com


2

You can add a user without a valid login shell: # useradd -s /sbin/nologin dbuser Set their password: # passwd dbuser Or leave it unset and make SSH keys: (on local machine) $ ssh-keygen (on remote machine) # su -s /bin/bash - dbuser $ cat local_id_rsa.pub >>~/.ssh/authorized_keys At this point, you can use SSH to create the tunnel: ssh ...


2

In general, an address binding is an association between a service (e.g., SSH) and an IP address. A host may have multiple IP addresses (e.g., 127.0.0.1, 192.168.1.2). Address binding allows you to run a service on some or all of these addresses. Suppose your host is configured with two network interfaces, one connected to a trusted network (e.g., ...


1

All interfaces means... all interfaces, though perhaps with the exceptions for special interfaces such as pflog0 (the packet filter log interface). Local use means the loopback interface, typically lo0 or such, which should have the ::1 address assigned to it. The main distinction here is whether or not remote systems can access the port; using localhost, ...


1

You do not have a listener on 127.0.0.1:7000 (or 0.0.0.0:7000) on the guest. Check for a listener on the guest using: netstat -an|grep 7000 See if a line like x.x.x.x:7000 0.0.0.0:* LISTEN exists and on which interface it is bound. The GatewayPorts directive does not make sense in this configuration since it applies only for remote portforwarding.


1

Have a look at autossh. It has support to reconnect lost tunnels. I will leave a link. The article suggests placing it in /etc/rc.local which is what I would do in Debian. http://linuxaria.com/howto/permanent-ssh-tunnels-with-autossh



Only top voted, non community-wiki answers of a minimum length are eligible