Hacker News Reader

If you're connecting from a *nix-y box, you may also be interested in sshuttle: https://github.com/apenwarr/sshuttle

It gives you most of the benefits of VPN, without requiring tun/tap and without needing root on the remote box -- all you need is the ability to run python. Very useful if you're on an insecure network and you want to tunnel everything over a secure connection, or if you have SSH access to a box inside your firewall and want to access other resources without having to specify each port individually.

> Ssh ControlMaster allowing to reuse connections can really improve responsiveness. Tip: start the master connection as a daemon (-f), so as not to mistakenly close the terminal which handles it, else you will close the channel for all other currently opened slave sessions. I wish ssh would fork and start the master on demand then close it when the last channel closes.

Good news: as of OpenSSH 5.6p1, it can. Just set "ControlPersist 60" in ~/.ssh/config (in addition to setting ControlMaster auto and ControlPath), and ssh will automatically spawn an SSH master connection in the background, and close it 60 seconds after the last client exits. (You can obviously change the timeout to taste.)

    host *%*
        proxycommand ssh $(echo %h | cut -d%% -f1) nc $(echo %h | cut -d%% -f2) %p

usage:

    ssh gateway%target

Awesome. Here is another version to support chaining multiple gateways:

  Host *%*
    Proxycommand ssh $(echo %h | rev | cut -d%% -f2- | rev) nc $(echo %h | rev | cut -d%% -f1 | rev) %p

usage:

    ssh gateway1%gateway2%target

(Not very clean, improvements welcome.)

That syntax gave me flashbacks to good old bang paths...

A shorter version of the same thing:

  Host *%*
    Proxycommand bash -c "h=%h; ssh \${h%%\\%%*} nc \${h##*%%} %p"

It would be shorter and cleaner if I knew a way to apply string operators on a constant string rather than defining the intermediate variable $h.

Very cool! Is there any security risk in running nc on the gateway this way?

A more featureful version of that hack:

https://github.com/ryancdotorg/ssh-chain

> Ssh ControlMaster allowing to reuse connections can really improve responsiveness.

Yes it does, but I've noticed when I do this, it breaks my rsnapshot backups. Is this something you've heard of or know a fix for?

I don't use rsnapshot but you can set up arguments you pass to ssh, in which case you can selectively disable ControlMaster. If you can't, maybe rsnapshot respects .ssh/config so you can set up a Host entry with the relevant config. If you want to also use ControlMaster the host you connect to with rsnapshot, you can set up a Host with a dummy name and set its Hostname option to the real host.

Some good ideas, thanks, I'll give it a shot. I really like the speed of the persistent connections.

> I don't use rsnapshot but you can set up arguments you pass to ssh, in which case you can selectively disable ControlMaster

Just FYI, that worked perfectly.

you don't mention whats awesome about the proxycommand to go through hosts:

here's what! it uses the intermediate hosts as a tunnel, which means no ssh agent is listening on the hosts (the regular way to do this is ssh -A hostx ssh -A hosty ssh finalhost)

This means no attacker can use your agent while connected.

Additionally, its less cumbersome when its setup.

How do you use the -f option for the master? Do you run a command that just waits for ever? What command do you run?