Slashdot Mirror
Getting the Most Out of SSH
jfruh writes "If you have to administer a *nix computer remotely, you hopefully ditched Telnet for SSH years ago. But you might not know that this tool does a lot more than offer you a secured command line. Here are some tips and tricks that'll help you do everything from detect man-in-the-middle attacks (how are you supposed to know if you should accept a new hosts public key, anyway?) to evading restrictions on Web surfing."
What are your own favorite tricks for using SSH?
If you're still using telnet to administer anything that offers SSH, you should probably choose another field to work in.
Well to be fair not everyone had SSH when they were 16 years old...
I was 16 once, and I would try to figure out how to do all the cool new trick that my new systems has... As we get older we get in a groove (mostly due to the fact that we are paid to do a particular job, and if we spend too much time finding something new and cool would prevent us from getting things done by are estimated time)
And after 8+ hour of work when we get home the last thing we want to do is more work.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Traffic pattern matching over SSL. A web session over an SSL connection looks very different than an ssh tunnel session over SSL, not to mention the length of life of the socket. It's trivial to have the firewall identify the ssh connection over port 443 and disconnect it in the first few seconds of the session based purely on the pattern of the traffic regardless of content.
The Master (Angelo Rossitto) in Mad Max Beyond Thunderdome, "Not shit, energy!"
To be fair, I'm sure there are sixteen year olds reading /.
I don't expect every article to be useful to me. Not sure why you would expect that.
I haven't read the article - I think I'm familar enough myself with ssh - but as long as the info is accurate, I'd image it's a useful tutorial for folk getting into Linux.
Get real SSH tips from people complaining (rightly or not) that it doesn't contain any actual advice.
I'd love to see stuff like that as well as:
OpenSSH signed certificates (Not X.509) and TrustedUserCAKeys options and their usage. This way, I can hand a new cow-orker signed ssh host keys and assuming he or she knows enough not to just blindly replace a key if it isn't right, will minimize the chance of a MITM attack.
Revoking SSH keys.
Using SSHGuard to lock out brute force attempts.
Proper configuration of the sshd_config file. Stuff like only allowing root in via RSA keys (or blocking root access entirely.)
Auditing logs to know that key "A" ssh-ing to root is from user Alice, and key "B" is from Bob, so that one can tell who just wiped out the wrong filesystem come an inquiry.
Running sshd as a user, not as root.
Getting a backup program like NetBackup to form a ssh tunnel, do the backup, then close down the connection cleanly.
I'd never used tmux. i've officially learned more from /. comments than the actual articles. Thanks!
Supplies!
OP should be -1 overrated. You jerks who keep saying things like "everyone is doing X because I am" or "this isn't knew" or "this isn't important" really need to STFU. There are people coming into the world all the time who haven't learned what you learned or had the same experiences that you do. Much of what you learned from is burried now under mountains of information and its very often not clear where people should start from. So sit down, shut up and let others learn, otherwise all you will do is scare them away so that they never will. Not everything is some conspiracy to generate ad revenue.