SSH Tools

From miki
Revision as of 16:13, 27 October 2009 by Mip (talk | contribs) (Extract from page SSH - GUI Front Ends, ssh-tunnel, ssh-agent)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

GUI Front-Ends

Gnome/Nautilus

  • Under GNOME, one can uses menu PlacesConnect to Server... to connect to a remote server in Nautilus. The connection can be bookmarked for future use.
  • The syntax for address bar in Nautilus is sftp://username@server/folder.

KDE/Konqueror

  • Use KIO fish or sftp to establish a SSH or SFTP connection in Konqueror.

gftp

  • gftp is a free multithreaded file transfer client for *NIX based machines. It supports the FTP, FTPS (control connection only), HTTP, HTTPS, SSH and FSP protocols.

SSH-Tunnel

  • SSH-Tunnel is a Perl script that can be used with SSH ProxyCommand to automatically detect the proxy settings to use.
  • See official page on Yobi.
  • To install
# Install ssh-tunnel
tar -xvzf ssh-tunnel-x.yy.tgz
make install

# Create empty ssh banner (will be updated at the first connection)
touch ~/.ssh/clbanner.txt

# Create ssh symlink ( need to have ~/bin in path !)
mkdir ~/bin
ln -s /usr/local/bin/ssh.pl ~/bin/ssh

# Edit ~/.ssh/config and ~/.ssh/proxy.conf
vi ~/.ssh/config
vi ~/.ssh/proxy.conf
  • Install required packages (openssl and dev libraries) and required PERL packages (see Perl:
$ sudo apt-get install openssl libssl-dev
$ sudo cpan
# 2 following lines only needed if first time cpan is run
cpan> o conf init urllist
cpan> o conf commit
cpan> install Getopt::Long MIME::Base64 Net::SSLeay IO::Socket::SSL Authen::NTLM
  • Here a [{{#filelink: ssh-tunnel-v2.26.patch}} patch] on ssh-tunnel-v2.26 to prevent double expansion in command arguments:
{{#fileanchor: ssh-tunnel-v2.26.patch}}
--- ssh-tunnel-2.26/ssh.pl      2007-04-15 20:15:36.000000000 +0200
+++ ssh-tunnel-2.26-patched/ssh.pl      2008-09-09 15:54:59.125000000 +0200
@@ -15,5 +15,5 @@
 # Parse ssh-options
 while ($#ARGV>=0 && $ARGV[0] ne '--') {
-       push @SSHARGV, shift @ARGV;
+       push @SSHARGV, "\'" . shift(@ARGV) . "\'";
 }
 shift @ARGV if $ARGV[0] eq '--';

SSH-Agent

ssh-agent is a program that holds private keys used for public key authentication (RSA, DSA). Using this program, users only have to enter once the passphrase of their ssh key, and not at each ssh invokation.

% eval `ssh-agent -s`
% ssh-add                      # Here ssh-add asks for user's passphrase
% ssh                          # Here no passphrase requested

ssh-agent defines the environment variable SSH_AUTH_SOCK, which points to a unix socket that is used by 'ssh to communicate with the agent.

Linux

On Linux, ssh-agent should be launched before starting the X session, so that all child processes have this variable defined. Also, be sure to kill all instances of ssh-agent when the session ends.

Cygwin

The situation is trickier on Cygwin / Windows because it is not possible to launch the ssh-agent before the Windows GUI.

I use [{{#filelink: ssh-agent-refresh.sh}} this script] to overcome this situation (to install in /usr/local/bin/). The script also works in multi-user environment, but only accept one ssh-agent instance per user.

Then add the following lines in your file ~/.bash_profile (not in the ~/.bashrc because we use variable USER which is only defined in a login shell):

eval `ssh-agent-refresh.sh` >/dev/null
if ( ! ( ssh-add -L | grep -q $USER ) ); then ssh-add -t 3600; fi

Some security tip:

  • Define a maximum life time using option -t time.
  • Lock the agent with a password using option ssh-add -x.

Note that to overcome the one instance per user limitation, one would need to save the environment generated by ssh-agent in some file in home directory, and then source the proper file at next invocation.

Other ideas found on internet:

  • win-ssh-askpass A GUI tool to do exactly the same as in Linux. Also provides win-ssh-askpass.exe that can be defined as executable for SSH_ASKPASS (see ssh-add man pages).
  • [1] Proposes to use a predefined SSH_AUTH_SOCK (defined in Windows environment), and saves the ssh-agent environment into a file, which can be sourced later on.
  • Some more ideas here