Ssh on Michael’s Domain

ProxyJump

Thu, 01 May 2025 00:00:00 +0000

Since OpenSSH 7.3, it has been much easier to connect from the outside to Linux computers inside the UH network. With older ssh versions, you needed to use a complicated “ProxyCommand”, but now it is straightforward:

Ways how to keep a process running after logging out

Sat, 26 Jun 2021 00:00:00 +0000

There are many ways how to keep a process running after logging out. Each if them has its own advantages and disadvantages: nohup, disown, screen, tmux, ssh2go, etc. Screen is certainly not the most feature-rich and modern solution, but it is available by default on all Linux installations. That’s why I use it. Here’s how it works:

How to enable passwordless logins to a server

Wed, 24 Jul 2019 00:00:00 +0000

Enable root login with password on the server. To do so, you need to edit the file /etc/ssh/sshd_config.Modify the lines starting with “PermitRootLogin” like this:#PermitRootLogin prohibit-passwordPermitRootLogin yes
Restart the sshd server:sudo systemctl restart sshd
On the client, copy the public key files to the server with the ssh-copy-id command:ssh-copy-id root@server
On the server, disable root login with password and enable root login with public key authentication:PermitRootLogin prohibit-password#PermitRootLogin yes

Passwordless login via the GUI and ssh defaults

Mon, 25 Mar 2019 00:00:00 +0000

I use cloud services at CSC (e.g. pouta.csc.fi), and they do not allow SSH login with a traditional username/password combo. When I want to make a bookmark in my file manager (Nemo oder Nautilus/Files), pointing to this location. I need to specify an RSA key file that is used for the login. On the command line, it looks as follows:

BackupPC and Macs

Wed, 13 Apr 2016 00:00:00 +0000

I myself have been using the backup software BackupPC for almost a decade, and I started to backup our lab computers to a central backup server about two years ago. BackupPC supports deduplication and therefore much data can be stored on a couple of 2 TB drives.BackupPC supports many protocols (smb, ftp, tar/rsync via ssh), but we mostly use rsync via ssh. The data is not encrypted before the backup. Strangely not even the upcoming version 4 will support pre-egression encryption. However, we store the backup on an encrypted volume. That way it is at least protected if the backup server is stolen. And during transit, the data is protected by ssh. However, the system is not TNO (“trust no-one”), since I (as the backupc administrator) can access the files. When using Linux, one feasible method would be to encrypt the user’s home directory using eCryptFS (which is an inbuilt option when creating users on Ubuntu ) and then backup the /home/.ecryptfs directory instead of the users home directory. However, recovery would be much more of a problem. You would be able to browse the diectory structure and files of the backup, but the filenames would be meaningless since they are also encrypted in the process.There is one peculiarity in backing up Mac OSX machines: BackupPC normally connects as root via ssh into the client computer and executes the rsync backup command. In order to make this possible on university-managed Mac OSX computers, we had to create a dedicated user (“backuppc”) on the client machines and allow for this user the execution of rsync with root privileges, which is done by adding this line in the /etc/sudoers file:backuppc ALL=NOPASSWD: /usr/bin/rsync. Then we have to change the ssh/rsync command for the Mac client on the backuppc server changing “root” into “backuppc”.

x11vnc as a nxserver replacement

Thu, 29 Nov 2012 00:00:00 +0000

Now that nomachine ’s great nxclient is defunct on MacOS X and its new nxplayer is still in beta (and completely nonfunctional on my setup), I needed another solution to connect to my work desktop from home. I tried many things, but then settled for x11vnc . My work desktop is running Ubuntu Precise Pangolin (12.04) and I connect from a MacOS X 10.8 (Mountain Lion). I only had to install x11vnc and openssh-server on my work desktop and add an x11vnc.conf file to /etc/init with the following content:x11vnc -forever -rfbauth /etc/x11vnc.pass -bg -o /var/log/x11vnc.log -scale 1280x800 -display :0 -auth /var/run/lightdm/root/:0I have to create the password file:x11vnc -storepasswd password /etc/x11vnc.passThen I just have to get into my work desktop by some means or another. At the moment I jump there via the UNIX computers of the university, because direct ssh access is not possible because of a firewall. So I ssh into the UNIX mainframe and from there I ssh into my work computer. Once I am in, I establish a reverse ssh tunnel to my Macbook Pro at home:ssh -R 19999:localhost:5900 IP_address_of_homecomputerOn my Macbook at home I had to enable Sharing - Remote login first. Then I just use the inbuilt Screen sharing of the OS “Connect to server” and then I type “vnc://localhost:19999” and voila I can see my work desktop’s login screen.Alternatively I could use my openvpn server that I have installed on my Macbook and use an openvpn client on my work desktop to establish a connection to my Macbook. Then I could directly log in and avoid the hops via the university UNIX machines to set up the reverse ssh tunnel.Another, although very slow method to access the GUI of my work desktop is X11 forwarding via ssh. All I need is a working ssh connection to the server, X11 forwarding enabled in the ssh server configuration file and an X11 server on the local machine (e.g. XQuarz on MacOSX):ssh -X username@remote-server.comxclock &

tar copying via ssh

Fri, 26 Sep 2008 00:00:00 +0000

tar czv sourcepath | ssh -l username 192.168.0.5 tar xz -C targetpath

VNC (Virtual Network Computing) via ssh

Sat, 26 May 2007 00:00:00 +0000

I am sitting at home and want to use the GUI of my Linux at work. But my work computer which is running the VNC server (mcblpc2.hi.helsinki.fi) is behind the University firewall. The only connection I can get into the firewall is via one of the university mainframes, e.g. vesuri.helsinki.fi. In order to connect using VNC, I need just two commands:ssh -L 5901:mcblpc2.hi.helsinki.fi:5901 mjeltsch@vesuri.helsinki.fivncviewer localhost:1To make the connection faster, you can use compression (helps only if you have a slow connection, e.g. a modem). When using VNC with ssh, the vncviewer really thinks you make a connection to the local machine and therefore chooses a wrong encoding. So the second command actually should be: vncviewer localhost:1 -compresslevel 0 -encodings "copyrect hextile"When you run the vncserver on a computer that has its own firewall, you need to have sshd running and to open the ssh port (22). Then you establish a tunnel from that ssh server on that computer to a port on your local computer:ssh -L 5901:remotemachine:5901 username@remotemachine vncviewer localhost:1When you run KDE desktop sharing on Suse 9.0, you share the physical screen (:0). Thus, if you are logged out, you cannot connect using desktop sharing. You have to start up additionally a vnvserver instance:vncserverThis server will use by default the :1 session and that’s why the forwarded port must be 5901 and not 5900 (like for the first session).

ssh host keys

Wed, 23 May 2007 00:00:00 +0000

When reinstalling an ssh server, one should keep the ssh key files from the old system. Otherwise ssh clients will receive messages of like “IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!”. If you didn’t keep the files, the clients can of course delete the entries from the host key file (usually /home/user/.ssh/known_hosts). When the user connects after that again to the server, the new, changed host key files are added to the host key file.

Execution of dd command via ssh and output redirection to local file

Wed, 04 Apr 2007 00:00:00 +0000

I wanted to copy a whole encrypted partition over the network into a file. You can execute many commands via ssh, but occasionally there are problems to direct the output where you want it. E.g. the “more” command doesn’t output to standard out when used via ssh. You need to use “less” to get the file content displayed locally (at least using a RedHat 8 remote machine). With dd you cannot use the “dd if=input of=output” syntax but you need the “dd output” syntax. The command I finally managed with is ssh -l root remote-machine 'dd hda1.bin

Tunneling of remote X11 output to a local machine behind a firewall (ssh, X11, ForwardX11)

Wed, 04 Apr 2007 00:00:00 +0000

If X11 forwarding is globally disallowed in your local machine, you need to override this by editing ~/.ssh/config: Host hostname.domain.org ForwardX11 yes Then you just ssh into the remote machine hostname.domain.org: ssh -X username@hostname.domain.org And execute some program that outputs to X11, e.g.: xclock &

Using ssh in scripts (one-click secure VNC connection using krdc)

Thu, 29 Mar 2007 00:00:00 +0000

Using ssh in scripts (one-click secure VNC connection using krdc) I wanted to establish a VNC connection that is tunneled via ssh and just by one click. I created a shell script with the following content: !/bin/sh ssh -L 5902:192.168.0.7:5902 -f -N jeltsch@192.168.0.7 krdc localhost:2 The ssh connection remains open in the background until the krdc application has finished.