Hot answers tagged

7

The shell's $! variable only knows the pid of the process started by the shell. As you suspected, the ssh call using -f forks its own process so it can go to background, so the overall process tree looks like [1]: shell | +--ssh<1> (pid is $!) | +--ssh<2> (pid is different) ssh<1> exits very shortly after invocation; therefore, the ...


6

The feature is called ControlMaster which does multiplexing over one existing channel. It will cause you will do all key exchange and logging in only once and the later commands will go through much faster. You activate it using these three lines in you .ssh/config: Host host.com ControlMaster auto ControlPath ~/.ssh/master-%C # for openssh < 6.7 ...


6

You have 2 options here. Option 1: Put ssh to listen on a different port, by editing the file /etc/ssh/sshd_config and changing the Port parameter to another number of port. Port 2222 as an example. Option 2: Redirect the traffic incoming from another port to tcp/22(ssh) iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT iptables -A INPUT -i eth0 -p ...


5

I like to use sslh for this. It exploits the fact that different protocols start a connection differently. If it detects SSH, it forwards the connection to sshd and if it detects HTTPS it forwards the connection to httpd. This allows you to have e.g. nginx/apache and ssh listening on the same port (usually 443).


4

There were such examples if you were using X11 forwarding, for example as described in this report: https://thejh.net/written-stuff/openssh-6.8-xsecurity Similar issue was published many years ago: http://www.giac.org/paper/gcih/571/x11-forwarding-ssh-considered-harmful/104780 All these should be fixed now, but using -X forwarding to untrusted machines ...


4

Why doesn't that solution with ProxyCommand work for X11 forwarding? I think you can directly reach mum's computer with X11 forwarding using the following configuration. Host mum ProxyCommand ssh -q -W localhost:1993 login@vps0 ForwardX11 yes


4

You need to use the OUTPUT chain to redirect an outbound connection to a local port. This rule will work as you need: iptables -t nat -A OUTPUT -p tcp -d 40.40.40.40 --dport 3306 -j REDIRECT --to-port 3306


4

You must contact whoever is in charge of the network, and convince them that your access request is legitimate. Regardless of the sanity of the access restrictions, circumventing them will at the very least land you in hot water with your boss, and could even be taken as "hacking" and get you prosecuted.


4

First possibility is obvious (note the -t switch): ssh -t -i cloudkey -L 6000:localhost:6001 admin@54.152.188.55 -p 9000 \ "ssh -D 6001 -p 6666 localhost -l dancloud" With ProxyCommand it is more complicated on the first sight, but conceptually you need only one forwarding (netcat version is not advised anymore, using -W switch is more elegant): Host ...


3

Your approach is not taking in account that contrary to other common protocolos, FTP uses both port 20 and port 21 over TCP. The term passive refers that the protocol is a little more well behaved than the initial implementations. Here is a link: http://www.slacksite.com/other/ftp.html Port 20/TCP is used for data, and port 21/TCP for commands. In ...


3

This error means that the server sent an unrequested forwarded port that the client didn't expect. In short, the dropbear SSH client doesn't know how to handle the dynamically allocated port forward which the remote server has allocated for it. It is unsupported by dropbear. The relevant code: Where the dropbear client parses the remote forward request and ...


3

This can also happen if the (correctly configured) server has recently updated their kernel, but not yet rebooted.


3

VNC does not support sound. You can use PulseAudio to move sound over SSH, though, which may be better than nothing for you. Check out this post: https://razor.occams.info/blog/2009/02/11/pulseaudio-sound-forwarding-across-a-network/


3

Well, this "I have no root" acces on Server A can be a problem to create a good vpn solution since: ip-ip tunneling requires interface manipulation; pptp also requires root privileges to create interfaces; OpenVPN can even run as unprivileged user, but some tricks need to be done like allowing sudo to the ip command to allow the creation of tun interface; ...


3

Use the -N option -N Do not execute a remote command. This is useful for just for- warding ports (protocol version 2 only). Example ssh -fN -L 8999:localhost:6006 host


3

It is possible to add multiple lines of LocalForward: Host myhost Hostname 123.123.123.123 IdentityFile ~/.ssh/id_myhost LocalForward 8811 localhost:8811 LocalForward 6006 localhost:6006 IdentitiesOnly yes Is this what you want?


2

Can someone crawl back down your SSH connection and infect your computer? No. Can they see there's a connection from your external IP address then scan/enumerate/potentially exploit your gateway (e.g. router)? Yes. What you should really be concerned with is if the proxy provider is worth trusting with your web traffic. By proxying your traffic through ...


2

You're on the right track with tty, and the -t option gives you just that. However, unless you are actually aiming to get a tty session for interacting, leave this option off of the last ssh command in your chain. In your case you just need it on the first connection: ssh -L 5901:localhost:6000 host1 -t ssh -L 6000:localhost:5901 -N host2 Now when you use ...


2

Quoting Comcast Business Internet: Static IP is not supported on retail devices due to technical limitations. Static IP is only supported via Comcast Business CCR & BWG leased devices: CCR (Comcast Commercial Routers: SMC D3G-CCR or Netgear CG3000DCR) / BWG (Business Wireless Gateways: Cisco DPC3939B or Cisco DPC3941B). For more information ...


2

@Lawrence 's answer was good enough for me to get it all down. But here are the more detailed steps I used. I used this for using my laptops 4g dongle to route internet to a raspberry pi with a fixed line connection to a wifi router. If your host is a mac: install squidman http://squidman.net/squidman/ (not just generic squid, I had too much trouble ...


2

You can add a user without a valid login shell: # useradd -s /sbin/nologin dbuser Set their password: # passwd dbuser Or leave it unset and make SSH keys: (on local machine) $ ssh-keygen (on remote machine) # su -s /bin/bash - dbuser $ cat local_id_rsa.pub >>~/.ssh/authorized_keys At this point, you can use SSH to create the tunnel: ssh -...


2

You don't need netcat on your bridge. As DanSut proposed in the comments you can use the ssh -W command line option instead, this configuration should work for you: Host axp User remote_userid HostName remoteserver.com IdentityFile ~/.ssh/id_rsa.eric ProxyCommand ssh -AW %h:%p bridge_userid@bridge_userid.com


2

If you understand what is going on in X11 forwarding, you will know that it is not so simple as described in the answer from @yaegashi. X11 forwarding is creating another layer under the ssh and it can't be chained as normal terminal data streams. But you are able to do it using port forwarding: Based on this blog post, which does it as hardcoding in shell ...


2

Second case is very useful in situation when example.com can connect to [google.com] host while your box can't. For example, you have VPN connection which is restricted to a number of boxes, while you want to access host not in list. ssh -L 123:target.host.com:456 user@vpn.host.com. So, basic usage is to jump INSIDE the network or jump OUTSIDE the network (...


2

The -s flag tells ssh that instead of allocating a tty on the remote computer to use the subsystem specified as the remote command. What you're doing is establishing an ssh session using app as the subsystem similar to how things would work if the remote subsystem were sftp, for example.


2

The option you are looking for is not AllowTunnel (it is for VPN and level 3 forwarding using tun devices). You are looking for AllowTcpForwarding, which handles local and remote port forwarding of TCP traffic in ssh. Have a look what values is in your server and change it to yes: AllowTcpForwarding yes


2

In general, an address binding is an association between a service (e.g., SSH) and an IP address. A host may have multiple IP addresses (e.g., 127.0.0.1, 192.168.1.2). Address binding allows you to run a service on some or all of these addresses. Suppose your host is configured with two network interfaces, one connected to a trusted network (e.g., 192.168....


2

I found the answer https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts SOCKS proxy via an Intermediate Host If you want to open a SOCKS proxy via an intermediate host, it is possible: $ ssh -L 8001:localhost:8002 user1@machine1.example.org -t ssh -D 8002 user2@machine2.example.org The client will see a SOCKS proxy on ...


2

You can start gpg-agent remotely and create remote UNIX socket port forwarding to your host and then use the gpg-agent locally. In short Connect to the server and start gpg-agent (if it is not running yet) and ensure it stays running. It is listening on socket defined in environment variable $GPG_AGENT_INFO. Store the path: eval `gpg-agent --daemon` &&...


2

Firefox is using some specialities of X so it does not work over X11 forwarding out-of-the box. You need to play a bit with switches to firefox binary. Basically specifying X11 display. This works for me: firefox --no-remote --no-xshm or similar.



Only top voted, non community-wiki answers of a minimum length are eligible