1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
|
<!DOCTYPE html>
<html lang=en>
<head>
<title>SSH - Advanced Usage – LandChad.net</title>
<meta charset="utf-8" />
<link rel="shortcut icon" href="favicon.ico" type="image/x-icon" />
<link rel='stylesheet' type='text/css' href='style.css'>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel='alternate' type='application/rss+xml' title='Land Chad RSS' href='/rss.xml'>
</head>
<body>
<header>
<h1>SSH - Advanced Usage</h1>
</header>
<nav></nav>
<main>
<h2>Introduction</h2>
<p>
This page is dedicated to advanced SSH usage examples. We will discuss the following concepts:
<ul>
<li>config files (for client)</li>
<li>tunneling</li>
<li>jumping</li>
</ul>
</p>
<h2>Config files</h2>
<p>
Config files allow you to specify certain rules for all or chosen hosts. The file has a really simple structure.
It is divided into sections which begin with the <code>Host</code> keyword. Sections are read one by one and <b>the first
matching section takes precedence over the remaining sections</b> - you write more specific sections at the top and the more general
sections below.
</p>
<h3>Why even bother?</h3>
<p>
You might say that SSH client doesn't need any special configuration - you just type the user@host and that's it.
Well, what happens when you manage multiple servers? Maybe you want to use a different pair of keys for each servers?
Maybe the server uses a port other than the default 22 to avoid automated bots trying to log in?
</p>
<p>
That's where config files come in handy!
</p>
<h3>Example scenario</h3>
<p>
Let's assume that you manage 3 servers, with the following access info:
<ol>
<li>very.long.hostname.example1.com
<ul>
<li>user: admin</li>
<li>port: 22</li>
<li>key name: id_rsa</li>
</ul>
</li>
<li>example2.com
<ul>
<li>user: billthemaster</li>
<li>port: 2222</li>
<li>key name: example2_ecdsa</li>
</ul>
</li>
<li>192.168.133.7
<ul>
<li>user: management</li>
<li>port: 22</li>
<li>key name: id_rsa</li>
</ul>
</li>
</ol>
</p>
<p>
You got tired having to always specify the identity file location with the <code>-i</code> option and the port with <code>-p</code> option for example2.com.
Don't even mention <code>admin@very.long.hostname.example1.com</code>!
</p>
<p>In the given example, the config file could look like this:
<code><pre>Host server1
HostName very.long.hostname.example1.com
User admin
IdentityFile ~/.ssh/id_rsa
Host server2
HostName example2.com
Port 2222
User billthemaster
IdentityFile ~/.ssh/example2_ecdsa
Host server3
HostName 192.168.133.7
User management
IdentityFile ~/.ssh/id_rsa
Host *
IdentityFile /path/to/some/other/key
</pre></code>
</p>
<p>You can see here usage of <code>Host *</code>. Options specified in this section will affect all other hosts.</p>
<h3>But where do I put this file?</h3>
<p>
SSH looks for the options in the following order:
<ol>
<li>command line arguments</li>
<li><code>~/.ssh/config</code></li>
<li><code>/etc/ssh/ssh_config</code></li>
</ol>
</p>
<p>You can also specify a custom path with the <code>-F</code> argument, for example:
<code><pre>ssh -F ~/Documents/projects/someproject/config/ssh production</pre></code>
</p>
<p>
...or discard any config file:
<code><pre>ssh -F /dev/null username@hostname</pre></code>
</p>
<p>There's more to ssh config files, but I direct you to <code>man ssh_config</code> for more information</p>
<h2>SSH Tunneling ("port forwarding")</h2>
<p>
SSH tunneling gives you the ability to route TCP traffic from your location to the remote server or the other way around (if server allows for this).
Thanks to it, you can set up a secure connection with a service that doesn't provide any encryption by default. You can treat it like a lite VPN.
</p>
<p>
You can for example access your SQL server via SSH without opening the port for public - you just need SSH port opened on the server's firewall.
It's also a great way of creating a secure channel for connecting with other hosts on the server's network.
</p>
<h3>Local to remote</h3>
<p>
You can route traffic from your local network to the remote server's network by using the <code>-L</code> option.
Let's say you want to access a MySQL service on the remote server. You can tell SSH to route any
traffic that comes to your 3000 port to port 3306 on the remote server with the following example:
<code><pre>ssh -L 3000:localhost:3306 username@example.com</pre></code>
</p>
<p>
The above command states that anyone connecting to your port 3000 will be routed via the SSH connection to the localhost:3306 from the remote server's perspective
</p>
<p>
If you can't understand the above description, let's take a look at another example:
<code><pre>ssh -L localhost:8080:192.168.178.25:80 username@example.com</pre></code>
</p>
<p>
The above command states that any traffic comming from your device (and only yours, because of <code>localhost</code>) will be routed via the
SSH channel to <code>192.168.178.25:80</code> in the server's network.
</p>
<p>
In general, the argument's structure is as follows:
<code><pre>-L [local_address:][local_port]:[remote_address]:[remote_port]</pre></code>
</p>
<p>
The <code>local_address</code> can be your LAN IP, <code>localhost</code> or any other address that your device has. Depending on it, other devices in
the specified network will be able to connect to you or not.
</p>
<p>
The <code>remote_address</code> can be any address reachable from the server.
</p>
<p>You can, of course, route multiple ports. For example:
<code><pre>ssh -L 8000:localhost:8000 -L 8001:localhost:8001 username@example.com</pre></code>
</p>
</main>
<footer>
<a href="https://landchad.net">LandChad.net</a>
</br>Because Everyone should be an Internet LandChad.</br>
<a href="index.html">
<li><img src="pix/chad.gif" alt="chad"></li>
</a>
<a href="rss.xml">
<li><img src="pix/rss.svg" alt="RSS"></li>
</a>
<a href="pix/btc.png">
<li><img src="pix/btc.svg" alt="BTC"></li>
</a>
<a href="pix/xmr.png">
<li><img src="pix/xmr.svg" alt="XMR"></li>
</a>
<a href="https://github.com/lukesmithxyz/landchad">
<li><img src="pix/git.svg" alt="Github"></li>
</a></footer>
</body>
|
