SSH - Revision history

imported>Lkoven: /* Connecting to machines via ProxyJump */ Tweaked formatting, added more information, fixed typos

2023-06-15T21:03:20Z

Connecting to machines via ProxyJump: Tweaked formatting, added more information, fixed typos

← Older revision		Revision as of 21:03, 15 June 2023
Line 429:		Line 429:

	=== Connecting to machines via ProxyJump ===		=== Connecting to machines via ProxyJump ===
	As part of the University's Secure Internet Border Initiative, most hosts can no longer be accessed via SSH from off campus. If you need to access one of these hosts, and you're using OpenSSH 7.3 or above (this covers most recent releases of Linux distros, MacOS, and Windows), you can use ProxyJump ~~or -J~~ to specify a bastion host to connect to first, before it jumps to your destination host. ~~For example~~:		As part of the University's Secure Internet Border Initiative, most hosts can no longer be accessed via SSH from off campus. If you need to access one of these hosts, and you're using OpenSSH 7.3 or above (this covers most recent releases of Linux distros, MacOS, and Windows), you can use ProxyJump to specify a bastion host to connect to first, before it jumps to your destination host. The easiest way to make this work for ssh and other clients which use ssh (such as scp, sftp, and rsync) is to specify it in your ~/.ssh/config file:

			<pre>
			Host *.astro.princeton.edu !coma.astro.princeton.edu
			User myuser
			ProxyJump coma.astro.princeton.edu
			</pre>

			This tells ssh to always use a ProxyJump to coma when connecting to any astro host, except coma itself.

			You can also do this on the command line:

	<pre>ssh -J coma.astro.princeton.edu myuser@mydesktop.astro.princeton.edu</pre>		<pre>ssh -J coma.astro.princeton.edu myuser@mydesktop.astro.princeton.edu</pre>

	This will connect to mydesktop by connecting to coma first, then jumping automatically to mydesktop. ~~You can also add this to your ~/.ssh/config:~~		This will connect to mydesktop by connecting to coma first, then jumping automatically to mydesktop.

	<~~pre~~>		The -J option only works for ssh itself. You will need to use one of a few different methods for other commands. scp and sftp need <code>-o ProxyJump coma.astro.princeton.edu</code> and rsync needs <code>-e "ssh -J coma.astro.princeton.edu"</code>. Again, I strongly suggest putting this in your ssh config file as noted above since then it should just work for anything which uses ssh.
	~~Host mydesktop~~.astro.princeton.edu
	~~Username myuser~~
	~~ProxyJump~~ coma.astro.princeton.edu
	</~~pre~~>

	If you are using Putty on Windows, make sure you're running at least version 0.77. You can then setup a proxy host (coma.astro.princeton.edu) as [https://the.earth.li/~sgtatham/putty/0.78/htmldoc/Chapter4.html#config-proxy documented here].		If you are using Putty on Windows, make sure you're running at least version 0.77. You can then setup a proxy host (coma.astro.princeton.edu) as [https://the.earth.li/~sgtatham/putty/0.78/htmldoc/Chapter4.html#config-proxy documented here].


	=== Multiplexing connections to avoid multi-factor authentication prompts ===		=== Multiplexing connections to avoid multi-factor authentication prompts ===

imported>Huston: /* Multiplexing connections to avoid multi-factor authentication prompts */

2023-06-15T18:34:41Z

Multiplexing connections to avoid multi-factor authentication prompts

← Older revision		Revision as of 18:34, 15 June 2023
Line 458:		Line 458:
	</pre>		</pre>

	Now your first connection to coma will use whatever normal authentication methods are required, but subsequent connections will simply reuse the already authenticated path. If you then add another stanza using the ProxyJump example above:		Now your first connection to coma will use whatever normal authentication methods are required, but subsequent connections will simply reuse the already authenticated path. Make sure to create the directory before you try to use this:
			mkdir ~/.ssh/sockets
			If you then add another stanza using the ProxyJump example above (put this below the coma entry, so coma is matched first and this matches anything else in astro after):

	<pre>		<pre>
	Host *.astro.princeton.edu		Host *.astro.princeton.edu

imported>Huston: Adding multiplexing information

2023-06-15T18:31:30Z

Adding multiplexing information

← Older revision		Revision as of 18:31, 15 June 2023
Line 442:		Line 442:

	If you are using Putty on Windows, make sure you're running at least version 0.77. You can then setup a proxy host (coma.astro.princeton.edu) as [https://the.earth.li/~sgtatham/putty/0.78/htmldoc/Chapter4.html#config-proxy documented here].		If you are using Putty on Windows, make sure you're running at least version 0.77. You can then setup a proxy host (coma.astro.princeton.edu) as [https://the.earth.li/~sgtatham/putty/0.78/htmldoc/Chapter4.html#config-proxy documented here].


			=== Multiplexing connections to avoid multi-factor authentication prompts ===
			Another trick that can be used to limit the number of times you have to utilize multi-factor authentication when authenticating SSH connections is multiplexing. When you use multiplexing you're combining many SSH connections into a single authenticated connection, and just reusing that path for subsequent connections. Here's an example of how it works:

			<pre>
			Host coma.astro.princeton.edu coma
			User myuser
			ControlMaster auto
			ControlPersist yes
			ControlPath ~/.ssh/sockets/%C
			ServerAliveInterval 30
			# This is the default, putting here to document
			ServerAliveCountMax 3
			</pre>

			Now your first connection to coma will use whatever normal authentication methods are required, but subsequent connections will simply reuse the already authenticated path. If you then add another stanza using the ProxyJump example above:
			<pre>
			Host *.astro.princeton.edu
			User myuser
			ProxyJump coma.astro.princeton.edu
			</pre>

			Now any connection to a host in the astro subdomain will be proxied through coma automatically, and will reuse the existing connection if it can.

	== Errors & Warnings ==		== Errors & Warnings ==

imported>Lkoven: Added instructions for using proxyjump to connect via a bastion host

2023-06-09T15:45:04Z

Added instructions for using proxyjump to connect via a bastion host

← Older revision		Revision as of 15:45, 9 June 2023
Line 427:		Line 427:

	Now whenever I want a proxied connection, I type 'proxy' at a terminal prompt. A SSH connection to coma is opened, and then a new Chrome window connects which is proxied via that connection and thus all traffic appears to come from coma.		Now whenever I want a proxied connection, I type 'proxy' at a terminal prompt. A SSH connection to coma is opened, and then a new Chrome window connects which is proxied via that connection and thus all traffic appears to come from coma.

			=== Connecting to machines via ProxyJump ===
			As part of the University's Secure Internet Border Initiative, most hosts can no longer be accessed via SSH from off campus. If you need to access one of these hosts, and you're using OpenSSH 7.3 or above (this covers most recent releases of Linux distros, MacOS, and Windows), you can use ProxyJump or -J to specify a bastion host to connect to first, before it jumps to your destination host. For example:

			<pre>ssh -J coma.astro.princeton.edu myuser@mydesktop.astro.princeton.edu</pre>

			This will connect to mydesktop by connecting to coma first, then jumping automatically to mydesktop. You can also add this to your ~/.ssh/config:

			<pre>
			Host mydesktop.astro.princeton.edu
			Username myuser
			ProxyJump coma.astro.princeton.edu
			</pre>

			If you are using Putty on Windows, make sure you're running at least version 0.77. You can then setup a proxy host (coma.astro.princeton.edu) as [https://the.earth.li/~sgtatham/putty/0.78/htmldoc/Chapter4.html#config-proxy documented here].

	== Errors & Warnings ==		== Errors & Warnings ==

imported>Huston: Using Chrome on Mac OS

2020-07-16T18:51:51Z

Using Chrome on Mac OS

@@ Line 409: / Line 409: @@
 From this point forward, Firefox will require that you have the ssh proxy up and running in order to browse the web (since it'll want to proxy everything over that). If you need to disable the proxy, you can go back into Network Settings and hit the No Proxy option. It will remember your settings so that they're available the next time you want to use it.
 If you want to make this easier, there's an extension available which lets you toggle the proxy right from the Firefox toolbar. [https://addons.mozilla.org/en-US/firefox/addon/proxy-toggle/ You may want to check it out].
 == Errors & Warnings ==

imported>Lkoven: /* Use SSH Socks Proxy instead of VPN */ Made a clickable link to the firefox instructions

2020-07-16T18:44:29Z

Use SSH Socks Proxy instead of VPN: Made a clickable link to the firefox instructions

← Older revision		Revision as of 18:44, 16 July 2020
Line 394:		Line 394:
	ssh -D 1080 user@host		ssh -D 1080 user@host

	This will setup a socks proxy listening on local port 1080 which will bounce off of 'host'. Next you'll want to setup your client to use a socks proxy for host localhost and port 1080. An example for firefox is further down on this page.		This will setup a socks proxy listening on local port 1080 which will bounce off of 'host'. Next you'll want to setup your client to use a socks proxy for host localhost and port 1080. An example for [[#Configuring_Firefox_to_use_the_socks_proxy\|firefox]] is further down on this page.


	==== Setting up the proxy for Windows ====		==== Setting up the proxy for Windows ====
	TODO: Write and test instructions for a couple of the newer ways to do this in Windows 10, including Putty and native openssh -- it may not work exactly the same as Macs and Linux. If you want to contribute instructions, feel free, otherwise I'll get this done the next time I boot into Windows -LHK		TODO: Write and test instructions for a couple of the newer ways to do this in Windows 10, including Putty and native openssh -- it may not work exactly the same as Macs and Linux. If you want to contribute instructions, feel free, otherwise I'll get this done the next time I boot into Windows -LHK


	==== Configuring Firefox to use the socks proxy ====		==== Configuring Firefox to use the socks proxy ====
Line 411:		Line 409:
	From this point forward, Firefox will require that you have the ssh proxy up and running in order to browse the web (since it'll want to proxy everything over that). If you need to disable the proxy, you can go back into Network Settings and hit the No Proxy option. It will remember your settings so that they're available the next time you want to use it.		From this point forward, Firefox will require that you have the ssh proxy up and running in order to browse the web (since it'll want to proxy everything over that). If you need to disable the proxy, you can go back into Network Settings and hit the No Proxy option. It will remember your settings so that they're available the next time you want to use it.
	If you want to make this easier, there's an extension available which lets you toggle the proxy right from the Firefox toolbar. [https://addons.mozilla.org/en-US/firefox/addon/proxy-toggle/ You may want to check it out].		If you want to make this easier, there's an extension available which lets you toggle the proxy right from the Firefox toolbar. [https://addons.mozilla.org/en-US/firefox/addon/proxy-toggle/ You may want to check it out].


	== Errors & Warnings ==		== Errors & Warnings ==

imported>Lkoven: Added initial writeup for using a socks proxy.. this will need some cleanup, reformatting, and I still need to write Windows instructions

2020-07-16T18:40:19Z

Added initial writeup for using a socks proxy.. this will need some cleanup, reformatting, and I still need to write Windows instructions

← Older revision		Revision as of 18:40, 16 July 2020
Line 385:		Line 385:

	You can add comments to a key with the '-C' option to ssh-keygen, either before or after the key is created. Note that the comment is attached to the public half, not the private key.		You can add comments to a key with the '-C' option to ssh-keygen, either before or after the key is created. Note that the comment is attached to the public half, not the private key.


			=== Use SSH Socks Proxy instead of VPN ===
			SSH has a neat feature which lets you setup a [https://en.wikipedia.org/wiki/SOCKS SOCKS] proxy over your ssh connection. This can be useful for applications which support the SOCKS protocol for proxies, generally web browsers. The net effect is that you can access websites as if you're connecting from the remote server instead of your local client. This is significantly more convenient for accessing websites for which you need to be on a specific network, like campus websites. There are two pieces to this puzzle. You need to establish the proxy and you need to tell the application you want to proxy how to use it.

			==== Setting up the proxy for Mac and Linux systems ====
			Just add the -D command line switch along with a port to your ssh connection to a host you want to bounce off of. Port can be anything you want (usually recommend something above 1024). 1080 is the standard port for SOCKS proxies. Example:
			ssh -D 1080 user@host

			This will setup a socks proxy listening on local port 1080 which will bounce off of 'host'. Next you'll want to setup your client to use a socks proxy for host localhost and port 1080. An example for firefox is further down on this page.


			==== Setting up the proxy for Windows ====
			TODO: Write and test instructions for a couple of the newer ways to do this in Windows 10, including Putty and native openssh -- it may not work exactly the same as Macs and Linux. If you want to contribute instructions, feel free, otherwise I'll get this done the next time I boot into Windows -LHK


			==== Configuring Firefox to use the socks proxy ====
			Click the overflow menu (aka 'hamburger' menu, 3-bars on the upper right side of the Firefox window), hit Preferences, scroll down to Network Settings and hit the Settings button.
			Select Manual Proxy Configuration
			Leave HTTP/HTTPS/FTP Proxy lines blank
			In SOCKS Proxy, enter the proxy host (usually localhost, but Windows may require you to use something different) and the port you selected for the proxy (usually 1080). Make sure SOCKS v5 is selected.
			You may also want to check the box for Proxy DNS when using SOCKS v5, since some campus sites won't resolve if you don't use a campus DNS server.
			Hit OK

			From this point forward, Firefox will require that you have the ssh proxy up and running in order to browse the web (since it'll want to proxy everything over that). If you need to disable the proxy, you can go back into Network Settings and hit the No Proxy option. It will remember your settings so that they're available the next time you want to use it.
			If you want to make this easier, there's an extension available which lets you toggle the proxy right from the Firefox toolbar. [https://addons.mozilla.org/en-US/firefox/addon/proxy-toggle/ You may want to check it out].

imported>Lkoven: Updated ssh on Mac instructions as ssh-agent is now standard. Added reference to downloading xquartz as X11 is no longer included with MacOS

2018-05-22T22:33:57Z

Updated ssh on Mac instructions as ssh-agent is now standard. Added reference to downloading xquartz as X11 is no longer included with MacOS

← Older revision		Revision as of 22:33, 22 May 2018
Line 328:		Line 328:
	ForwardX11 yes		ForwardX11 yes
	ForwardX11Trusted yes		ForwardX11Trusted yes
	If you want to forward X11 connections to your Mac (for example, you want to run Matlab or Mathematica on one of our systems and display it on your Mac laptop), you will need to download and install [~~[XQuartz\|~~https://www.xquartz.org]], as X11 is no longer included with MacOS.		If you want to forward X11 connections to your Mac (for example, you want to run Matlab or Mathematica on one of our systems and display it on your Mac laptop), you will need to download and install [https://www.xquartz.org XQuartz], as X11 is no longer included with MacOS.

	== Tips & Tricks ==		== Tips & Tricks ==

imported>Lkoven: /* ssh-agent for Mac OS X */

2018-05-22T22:31:37Z

ssh-agent for Mac OS X

← Older revision		Revision as of 22:31, 22 May 2018
Line 313:		Line 313:

	==== ssh-agent for Mac OS X ====		==== ssh-agent for Mac OS X ====
	~~'''Please note, the following instructions only apply to Mac OS X 10.4 and below.''' OS X 10.5 (Leopard) and above~~ include ~~a built~~-in agent. ~~To use~~ it, ~~just run ssh-add at a command line to add your key for that session~~.		Most recent versions of MacOS include an ssh-agent that starts up at login, so it should work pretty much the same as it does under Linux. If you are running an old enough version of OSX that it doesn't, you really should upgrade.

			'''NOTE:'''
			: You will still need to either copy your keys from your Peyton account, or create new keys. You can use the [[#RSA\|instructions above]] since OpenSSH on Mac will operate in the same way.

	While Mac OS X does contain OpenSSH, there is no easy way to hook the ssh-agent process to your session by default. However, there is a program you can install which will do this, called SSHKeychain. You can get SSHKeychain from the website http://www.sshkeychain.org. Download and install the program (copy to your /Applications folder, for example). Double click the program to execute it. When you first run SSHKeychain, load its preferences and make the following changes:
	* Under "Display", select "Status Bar" so only the icon in the status bar is visible
	* Under "Environment", check the box for "Manage (and modify) global environment variables. The default settings should be OK.
	~~Now close the preferences window and logout, then login again. This will start the ssh-agent process, and all the programs under your current login will be able to access it.~~

	~~'''NOTE:'''~~
	: You will still need to either copy your keys from your Peyton account, or create new keys. You can use SSHKeychain to create new keys, or you can use the [[#RSA\|instructions above]] since OpenSSH will operate in the same way.

			===== MacOS SSH 'gotcha's =====
			There's a couple of things to note when using SSH on a Mac:

	~~===== OS X SSH 'gotcha's =====~~		All forwarding is turned off by default
	~~There's a couple things to note when using SSH on a Mac:~~		: Apple ships the SSH software on OS X so that all forwarding is turned off. In the Peyton Hall machines, when you ssh from one box to another, your ssh-agent keys and your X11 forwarding information carries through, so you can display things on the local machine from the remote one, and you can login again from the remote machine to another. In order to make the SSH software on the Mac behave like that installed in Peyton, you'll need to either create a file called ~/.ssh/config (if you want to enable it just on your account) or edit the file /etc/ssh_config (if you want to enable it on all the accounts on your Mac you will need to become root first, if you've enabled the root account, or use 'sudo' to exec your favorite editor on the file).
	~~# SSHKeychain will only work properly if the account is an administrative account~~
	#: By default, the first user setup on a Mac is forced to be an admin, so this most likely won't be an issue for most users. If you want to be sure you're an admin user, go to Apple Menu -> System Preferences -> Accounts and make sure "Allow user to administer this computer" is checked (it might be grayed out, but that's OK).
	# All forwarding is turned off by default
	#: Apple ships the SSH software on OS X so that all forwarding is turned off. In the Peyton Hall machines, when you ssh from one box to another, your ssh-agent keys and your X11 forwarding information carries through, so you can display things on the local machine from the remote one, and you can login again from the remote machine to another. In order to make the SSH software on the Mac behave like that installed in Peyton, you'll need to either create a file called ~/.ssh/config (if you want to enable it just on your account) or edit the file /etc/ssh_config (if you want to enable it on all the accounts on your Mac you will need to become root first, if you've enabled the root account, or use 'sudo' to exec your favorite editor on the file).
	Host *		Host *
	ForwardAgent yes		ForwardAgent yes
	ForwardX11 yes		ForwardX11 yes
	ForwardX11Trusted yes		ForwardX11Trusted yes
			If you want to forward X11 connections to your Mac (for example, you want to run Matlab or Mathematica on one of our systems and display it on your Mac laptop), you will need to download and install [[XQuartz\|https://www.xquartz.org]], as X11 is no longer included with MacOS.

	== Tips & Tricks ==		== Tips & Tricks ==

imported>Huston: Don't use DSA keys anymore

2016-10-26T15:29:17Z

Don't use DSA keys anymore

Show changes