Archive for the ‘SSH’ Category
Posted by jpluimers on 2020/05/04
Often, hotspots only allow http/https traffic. Other traffic – like SSH – is blocked. Nowadays, fewer hotspots block that, but too many still do.
So it can be worth a while to route your SSH server through HTTPS (I don’t like Web-based SSH that much as terminal emulation in browsers isn’t that well yet, but that seems to change rapidly, more on that in the “Further reading” section below).
After some background reading at apache – Tunnel over HTTPS – Stack Overflow, here are a few links that help you do it:
You need:
- An internet connected Apache server (eg. with IP address 10.1.2.3)
- A FQDN that points to this IP address (eg. ssh.yourdomain.com)
- A virtual host configuration in Apache for this domain (eg. /etc/httpd/conf.d/ssh.yourdomain.com.conf)
- A configuration to adapt ssh to use the HTTP tunnel
Read more at DAG: Tunneling SSH over HTTP(S) and SSH over SSL, a quick and minimal config..
Steps:
- Test of it works at all
- Edit your local ~/.ssh/config file to redirect SSH to HTTPS
Read more at Using SSH over the HTTPS port · GitHub Help.
Using Putty and an HTTP proxy to ssh anywhere through firewalls | Me in IT.
the Digital me: SSH Tunneling Proxy using Putty on Windows and Linux (Unblock YouTube / Orkut / Facebook).
Tunneling SSH through HTTP proxies using HTTP Connect – ArchWiki.
HTTP Tunneling – ArchWiki.
Running SSHD on port 443.
Not all proxy configurations and hotspots support this. But it might be worth a look: SSH Over Proxy.
SSH plugins for browsers:
Web based SSH:
–jeroen
Posted in Communications Development, Development, Encryption, HTTP, https, HTTPS/TLS security, Internet protocol suite, Power User, Security, SSH, TCP | Leave a Comment »
Posted by jpluimers on 2020/03/10
In a lot of ssh-keygen related posts, you still see DSA being mentioned, though that has been deprecated and later removed from OpenSSH.
I wondered why, so I did some digging.
TL;DR: it’s complicated:
- different standards mandating eventually conflicting parameters,
- extending the parameters would require protocol extension,
- a logjam vulnerability for certain combinations of parameters and finally
- better algorithms having become available.
Some of the related topics cannot be archived in the WayBack machine or refuse being archived at Archive.is, so here is a list of partially archived relevant links:
–jeroen
Posted in Communications Development, Development, Internet protocol suite, Power User, Security, SSH, TCP | Leave a Comment »
Posted by jpluimers on 2019/03/15
For me, scp is like tar; somehow I Google this every time…
- On the remote machine, find out the full path of the remote file:
~ # ssh username@192.168.71.123
...
~ # ls -alh `find /vmfs/volumes/ | grep -w W81Entx64CI | grep '\.vmdk$'`
-rw------- 1 root root 200.0G Aug 26 22:48 /vmfs/volumes/552f5788-33e30274-8dba-001f29022aed/VM/PSO/W81Entx64CI/W81Entx64CI-flat.vmdk
-rw------- 1 root root 500 Aug 19 16:36 /vmfs/volumes/552f5788-33e30274-8dba-001f29022aed/VM/PSO/W81Entx64CI/W81Entx64CI.vmdk
- On the local machine, go to the right directory, then copy the file from the remote machine:
~ # cd /vmfs/volumes/Samsung512NVME/PSO/VM/W81Entx64CI/
~ # time scp -v username@192.168.71.123:/vmfs/volumes/552f5788-33e30274-8dba-001f29022aed/PSO/W81Entx64CI/W81Entx64CI-flat.vmdk W81Entx64CI-flat.vmdk
I don’t know what’s worse–the fact that after 15 years of using tar I still can’t keep the flags straight, or that after 15 years of technological advancement I’m still mucking with tar flags that were 15 years old when I started.
The last line will logon over ssh and shows the file transfer in a verbose way.
Requirements:
- both machines have ssh
- local machine has firewall entry to allow client ssh
- remote machine has sshd and firewall entry to allow sshd server connections
Via [WayBack] shell – How to scp a folder from remote to local? – Stack Overflow (thanks [WayBack] Gryphius)
Image source: [WayBack] xkcd: tar
–jeroen
Posted in Communications Development, Development, Internet protocol suite, SSH, TCP | Leave a Comment »
Posted by jpluimers on 2019/01/22
Note: if the system you SSH from is ever compromised, then assume the passwordless targets are also compromised!
–jeroen
Posted in *nix, *nix-tools, Communications Development, Development, Internet protocol suite, Linux, openSuSE, Power User, SSH, SuSE Linux, TCP, Tumbleweed | Leave a Comment »
Posted by jpluimers on 2018/12/24
If you want to setup an account on your system that will be used only to transfer files (and not to ssh to the system), you should setup SFTP Chroot Jail.
This explains how: [WayBack] How to Setup Chroot SFTP in Linux (Allow Only SFTP, not SSH)
Posted in *nix, *nix-tools, Communications Development, Development, Internet protocol suite, Power User, SFTP, SSH, TCP | Leave a Comment »
Posted by jpluimers on 2018/12/12
Having mainly used ssh as a means to connect to a shell on remote machines and occasionally a manual port forward.
I never noticed autossh where you can automate the ssh logon process to keep permanent port forwards up and running. Cool!
It’s on my research list now, as this will be useful probably sooner than later:
My initial impression is that autossh is a wrapper around the regular ssh client that allows reconnection upon communication failures.
–jeroen
Posted in *nix, *nix-tools, Communications Development, Development, Internet protocol suite, Power User, SSH, TCP | Leave a Comment »
Posted by jpluimers on 2018/11/07
Posted in *nix, Awk, bash, Communications Development, Development, Internet protocol suite, Power User, Scripting, Software Development, SSH, TCP | Leave a Comment »
In this article, we will explain you how to restrict a SSH user access to a specific directory using chrooted jail in Linux systems.