SSH

SSH

Friday, September 2, 11

An Overview


SSH was created in 1995 by Finland University
Researcher

Was initially open source, went closed source in
1999

OpenSSH was created in 1999 as a fork of the
last open source SSH code


What SSH Does

SSH handles the set up and generation of an
encrypted TCP connection


...which means....

SSH can handle secure remote logins (ssh)
SSH can handle secure ﬁle copy (scp)
SSH can even drive secure FTP (sftp)


Core SSH programs

ssh is the client
sshd is the server
if sshd is not running you will not be able to
connect to it with ssh


SSH Authentication Methods

Password
Public/private keypair
Host-based authentication


Password Authentication


Example Without SSH Keys

your-box box-1
ssh sshd


Prompts for Password

your-box box-1
ssh sshd

your-box> ssh box-1
password:

box-1>


Keypair Authentication


Example With SSH Keys

your-box box-1
ssh sshd


Step 1: Generate Keys

your-box> ssh-keygen


Public / Private Keypair

your-box

~/.ssh/id_rsa
~/.ssh/id_rsa.pub


Private Key: id_rsa

your-box

~/.ssh/id_rsa
~/.ssh/id_rsa.pub

Private keys should be kept secret,
do not share them with anyone


Public Key: id_rsa.pub

your-box

~/.ssh/id_rsa
~/.ssh/id_rsa.pub

Public keys are meant to be shared.


Copy Public Key to box-1

your-box box-1

~/.ssh/id_rsa
~/.ssh/id_rsa.pub ~/.ssh/authorized_keys


~/.ssh/authorized_keys

houses all public keys for people who can
authenticate as a user on a machine
when copying public keys, append to the ﬁle, do
not overwrite the ﬁle


No password required!

your-box box-1
ssh sshd

your-box> ssh box-1

box-1>


Host-based
Authentication


Host-based Authentication

Doesn’t require user credentials (password or
key)
Provides trust based on hostname and userid
Userid on both system has to be the same
Disabled by default -- not that useful


SSH Basics


Conﬁguration Files


Server Configuration Files
This is automatically by sshd when started.

sshd config: /etc/sshd_config

Based on installation method system config locations may vary.
ie: macports installs in /opt/local/etc/ssh/


Client Configuration Files
These are automatically by ssh when executed.

system-side ssh config: /etc/ssh_config
user-specific ssh config: ~/.ssh/config

Based on installation method system config locations may vary.
ie: macports installs in /opt/local/etc/ssh/


Custom Client Configuration Files
ssh will not read these on its own, use -F option

You can put custom config files anywhere you
want.
ssh -F /foo/bar/custom_ssh.cfg


Secure Logins


Login Example #1

ssh user@example.com


Login Example #2

ssh example.com

What’s the difference between example #1 ?


Login Example #3
Logging in on a non-default port.

ssh -p 45000 example.com

What’s the default SSH port anyway?


Login Example #4
Log in, run a command, and exit.

ssh example.com <command here>
ssh example.com ls -l
ssh example.com hostname

Anything with special characters such as
quotes, backticks, etc. need to be escaped.


Agent / Key Forwarding
Without them, With Them


Example Without SSH Keys

box-1

your-box

box-2


your-box> ssh box-1

box-1 your-box> ssh box-1
password:

Password required

your-box

box-2


your-box> ssh box-2

password:

Password required

your-box

box-2


your-box to box-1 to box-2

password:

box-1> ssh box-2
your-box password:

Passwords required each
step of the way!

box-2


Updated Example with SSH Keys

box-1 your-box> ssh-keygen

copy public key to
on each remote host
your-box
authorized_keys

id_rsa.pub box-2
id_rsa

authorized_keys


your-box> ssh box-1

box-1>
success

your-box

box-2


your-box> ssh box-2

box-2>
success

your-box

box-2



box-1>
success

box-1> ssh box-2
your-box password:
authorized_keys

Password required at
the second step!

id_rsa.pub box-2
id_rsa

authorized_keys


Enter Agent/Key
Forwarding



box-1 your-box> ssh -A box-1
box-1>
success

box-1> ssh -A box-2
your-box box-2>
authorized_keys
success

id_rsa.pub box-2
id_rsa

authorized_keys


Your SSH Key Gets Forwarded

box-1

your-box

id_rsa.pub box-2
id_rsa


Command Line Agent Forwarding

ssh -A example.com

Use -a to explicitly turn off forwarding for
a ssh session.


Host Configured

Host inspire.staging
ForwardAgent yes

Per-User ~/.ssh/config
System-wide /etc/ssh_config


Capistrano Conﬁgured (Ruby)

ssh_options[:forward_agent] = true

Capistrano’s deploy.rb
Provided by net/ssh library.


SSH Server has ﬁnal say!

AllowAgentForwarding no

System-wide /etc/sshd_conﬁg
Defaults to “yes” -- so pretty much ignore.


When/Why #1 - Everyday Usage

When SSH’ing from box to box to box. (ie:
multiple servers)
Greatly reduces the need to copy over public/
private key ﬁles
It (usually) just works!


When/Why #2 - Deploys

No need to manage additional SSH key pairs for
machines that you want to deploy to
If you have access to it and you do the
deploying, the remote machine will just SSH in
as you!
It (usually) just works!


...remember...

You still need to copy public key ﬁle contents to
Agent forwarding doesn’t work for automated
workﬂows where a user is taken out of the
equation, ie: our automated deploy from
TeamCity for Inspire


Port Forwarding
Local, Remote, Magic


Local Port Forwarding


Local Port Forwarding Example

your-box box-1 box-2
sshd www

Private Network


your-box to www on box-2

sshd www

public IP local IP
local IP

Private Network


Can’t access box-2 directly

X
sshd www

public IP local IP
local IP

Private Network


With Local Port Forwarding

sshd www

public IP local IP
local IP

your-box> ssh -L 8000:box-2:80 box-1
box-1>
success


A Tunnel is Made!

sshd www

public IP local IP
local IP

your-box> ssh -L 8000:box-2:80 box-1
box-1>
success


box-2 doesn’t have to run sshd

sshd www

public IP local IP
local IP


Command Line Local Port Forwarding

ssh -L localport:host:hostport example.com

localport is the port on your machine,
host is the remote box to tunnel to,
hostport is the port on the remote box to tunnel to


Sharing Your Tunnel

sshd www

public IP local IP
local IP

bobs-box your-box> ssh -L 8000:box-2:80 -g box-1
box-1>
success


Command Line Local Port Forwarding

ssh -L localport:host:hostport -g example.com

-g allows others to connect to your forwarded port


Host Conﬁgured

LocalForward 8000:box-2:80



SSH Server has ﬁnal say!

AllowTcpForwarding no

System-wide /etc/sshd_conﬁg
Defaults to “yes” -- so pretty much ignore.


When/Why

Access normally unreachable resources on an
internal network from anywhere on the internet


Remote Port Forwarding


Remote Port Forwarding Example

sshd

Private Network


box-2 to your-box

sshd

local IP public IP
local IP

Private Network


box-2 can’t talk to your-box

X
sshd

local IP public IP
local IP

Private Network


With Remote Port Forwarding

sshd

local IP public IP
local IP

your-box> ssh -R 8000:localhost:80 box-1
box-1>

success


A Reverse Tunnel Is Made!

sshd
http://box-1:8000
80 8000

local IP public IP
local IP

your-box> ssh -R 8000:localhost:80 box-1
box-1>

success


Command Line Remote Port Forwarding

ssh -R remoteport:host:hostport example.com

remoteport is the port on the machine you ssh into,
host is the local box to tunnel to,
hostport is the port on the local box to tunnel to


-g is not supported for
remote forwarding


Host Conﬁgured

RemoteForward 8000:localhost:80



When/Why

Allow outside resources to connect to your box,
or another machine on a private network
Example: testing web callbacks


~/.ssh/config
User-specified SSH configuration


Host Configuration
Host is the section identifier
Any time Host shows up a new section is started
Host is whatever you want to refer to the connection as

Host inspire
HostName staging.inspirehq.com
User inspire
your-box> ssh example.com
Host inspire.production
HostName inspirehq.com
User inspire
~/.ssh/config

HostName Conﬁguration

HostName is the real host name to log into
Can be IP address or domain name

Host inspire
User inspire
User inspire
~/.ssh/conﬁg

User Conﬁguration

User is the user to log in as
Can be overridden on the command line

Host inspire
User inspire
User foobar
~/.ssh/conﬁg

Port Configuration

Port defines what port for SSH connect on
Can be overridden on the command line

Host inspire
User inspire
Port 45000

~/.ssh/config

Local/Remote Port Forwarding

LocalForward
RemoteForward

Host inspire
User inspire
LocalForward 8080:example.com:80
RemoteForward 8080:example.com:80

~/.ssh/conﬁg

GatewayPorts
GatewayPorts speciﬁes whether or not remote hosts
can connect to local forwarded ports
Works in conjunction with LocalPortForward
Defaults to no
Host inspire
User inspire
GatewayPorts yes

~/.ssh/conﬁg

ServerAliveInterval
ServerAliveInterval sets a time interval in seconds after
which if no data has been received from the server ssh will
send a message to the server
Defaults to 0, meaning this will never be sent
This can be used to keep SSH connections alive
Host inspire
User inspire
GatewayPorts yes
ServerAliveInterval 5

~/.ssh/conﬁg

> ssh inspire


man ssh_conﬁg


Overuse ~/.ssh/conﬁg

SSHing into an IP more than once?
SSHing into crazy domains? (ie: Amazon)
Looking up IP or hostname routinely?
save it in ~/.ssh/conﬁg


...skipping server
conﬁguration...


SSH and Other apps


scp: secure ﬁle copy


copy single ﬁle

scp ﬁle1 example.com:


copy multiple files

scp file1 file2 example.com:


copy to other locations

scp ﬁle1example.com:foo/bar

scp ﬁle1example.com:/foo/bar


scp doesn’t copy directories

scp dir/ example.com:foo/bar

dir/: not a regular ﬁle


rsync: remote ﬁle copying


copy single ﬁle

rsync -avz ﬁle1 example.com:


copy directory

rsync -avz dir/ example.com:


rsync does so much more

incremental file transfers (only transfers what’s
different)
include/exclude files and directories
include/exclude file name patterns
can copy files from a remote box to a local box
can copy files from a local box to a remote box


git


git/ssh info

Can run over SSH
Supports SSH client configuration files
Can set to specific SSH binary using GIT_SSH
environment variable


The End


SSH

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

More from Zach Dennis

More from Zach Dennis (6)

Recently uploaded

Recently uploaded (20)

SSH