{"authors":["utzer"],"canonical_url":"https://newblog.utzer.de/2019/04/14/ssh-config-ssh-via-jumphost-and-autossh-ssh-to-tor-hidden-service/","categories":["Linux"],"content":"This will be a short post about the above mentioned parts, lets start right away.\n\n### SSH config\n\nEvery user can have a SSH client configuration file, it is located in ~/.ssh/config (where **config** ist the filename).   \nMy SSH config file, I guess as many other users file, grew over time. Lets start with some things from my file.\n\nThere is the **Host** part, it usually contains the name you want to assign to the host to use it later on. Tipp, use some short and of course unique name.\n\n```\nHost myserver\n```\n\nThe **Host** part can be wildcard, then the following parameters are valid for any Host. It then looks like this:\n\n```\nHost *\n     ServerAliveInterval 15\n     ControlMaster auto\n     ControlPath /tmp/ssh-%r@%h:%p\n```\n\n\u003e **ServerAliveInterval**  \nSets a timeout interval in seconds after which if no data has been received from the server, ssh(1) will send a message through the encrypted channel to request a response from the server. The default is 0, indicating that these messages will not be sent to the server. This option applies to protocol version 2 only.\n\u003e\n\u003e This is copied from the man page of \"[ssh\\_config](https://linux.die.net/man/5/ssh_config)\".\n\nIn the case above it means the client will keep the connection alive by sending some packet every 15 seconds at least. The packet is send and the client will wait for a reply for 3 times the interval (2 packet can get lost) by default. I use this setting to be sure the connection is kept alive and it is still alive. I work on a mobile connection quite often.\n\n```\nControlMaster auto\nControlPath /tmp/ssh-%r@%h:%p\n```\n\nThese two options might be helpful in particular cases when you use multiple SSH connection to one host and want to save some time to build up the connection. The option is explained [here](https://linux.die.net/man/5/ssh_config) and the options \"/tmp/ssh-%r@%h:%p\" are explained very well [here](https://www.cyberciti.biz/faq/linux-unix-reuse-openssh-connection/). Basically it will use a socket to connect to the host and the socket will be in \"/tmp/ssh-%r@%h:%p\", where \"r\" is the remote user name, \"h\" is the host name and \"p\" is the port number. The use of all this ensures that the socket name is unique.\n\n```\nHost myserver\n\tHostName example.org\n\tUser username\n        Port 22\n#\tIdentityFile ~/.ssh/id_rsa\n\tForwardAgent yes\n\tCompression yes\n\t#CompressionLevel 9\n```\n\n**HostName** contains the remote IP or host name (domain name) you want to connect to, like in \"ssh username@example.org\" the example.org.\n\n**User** contains the remote username.\n\nThis two are the minimum configuration parameters you want to use. When you want to connect to example.org via SSH you now just have to type the command \"ssh myserver\" and it will connect you as you are used to, but with much less typing.\n\n**Port** is not needed if you want to use 22 (standard SSH port), so it is useless in the example above, but if you want to connect to some host that runs the SSH service on some non standard port, lets say 6022 you can use \"Port 6022\" to provide the port.\n\n**IdentityFile** contains the identity file specific to the host. I commented this out some time ago because I now use a SSH-Agent, which you can do as well, there is \"ssh-add\" on any standard Linux system. So when I start a session I just do \"ssh-add .ssh/id\\_rsa .ssh/id2\\_rsa\" and so on to add all my needed ssh keys to the SSH-Agent.\n\nWith **ForwardAgent** your available keys from you local ssh-agent can be used on the remote host too, this is helpful when from the remote host you want to ssh to another server. I would suggest to use this option on any host, so you could move it to the \"Host \\*\" section.   \nUsing this parameter will be handy if you want to [rsync](/2019/03/15/rsync/) from one server to another.\n\nYou can use **Compression** if you are using a slow connection of if you transfer big amounts of data via SSH, it can be a bottle neck if your CPUs (local and remote) are not that fast. So it may be better to use Compression only in special cases or on really slow connections.   \nWith **CompressionLevel** you can set the compression level, it is like with most other compressions and I came to the conclusion to comment it out with the #, so it is not used in my configuration anymore. Check the man page of gzip or similar to see the compression levels explanation from 1-9.\n\nSo if you want you can use the \"Host \\*\" section like this:\n\n```\nHost *\n\tServerAliveInterval 15\n\tControlMaster auto\n\tControlPath /tmp/ssh-%r@%h:%p\n    \tForwardAgent yes\n```\n\n### Jump hosts\n\nIn some cases I want to connect to some host that is not reachable from the outside world (aka. the Internet), in this cases I use a jump host that is connected to that internal network.   \nI had to work some years the _usual_ way, the usual way being to connect to the jump host by \"ssh jumphost\" and then open another ssh connection from its local command line interface. Instead you can add the following to your ssh configuration for the host in the internal network.\n\n```\nssh -q -W %h:%p myserver\n```\n\nExplanation from [explainshell.com](https://explainshell.com/explain?cmd=ssh+-q+-W+%25h%3A%25p+myserver):\n\n[ssh(1)](https://explainshell.com/explain/1/ssh) -q -W %h:%p **myserver**\n\nOpenSSH SSH client (remote login program)**-q** Quiet mode. Causes most warning and diagnostic messages to be suppressed.**-W** host:port\n Requests that standard input and output on the client be forwarded to host on port over the secure\n channel. Implies **-N**, **-T**, **ExitOnForwardFailure** and **ClearAllForwardings** and works with Protocol\n version 2 only.**ssh** connects and logs into the specified hostname (with optional user name). The user must prove his/her\nidentity to the remote machine using one of several methods depending on the protocol version used (see\nbelow).\n\nIf command is specified, it is executed on the remote host instead of a login shell.\n\nSo when you add that to another Host configuration like this:\n\n```\nHost machine2\n        HostName 192.168.0.42\n        User username\n        ssh -q -W %h:%p myserver\n```\n\nThis would mean that your ssh connection to **192.168.0.42** as user **username** would be made via **myserver** and all data would be forwarded via myserver. This can also be used to connect via a particular server all the time if it is added to the \"Host \\*\" section of you ssh config.\n\n### SSH config for hidden Tor service SSH server\n\nSomething else I like to use ssh config for, is to connect to SSH via a tor Onion service, which I like to use for headless small computers (portable computer without a screen) like a Raspberry Pi that I connect to some network and want to SSH into them without knowing their IP address in the LAN. The setup of a Tor hidden service can be found online, the basic way it works is that your raspberry pi will tunnel to the Internet and be reachable via a hidden service.\n\n```\nHost raspberrypi\n\tHostName ap37csfkkmkksmkktllhjkcqd.onion\n        User Pi\n        Port 22\n        VerifyHostKeyDNS no\n        ProxyCommand /bin/nc -xlocalhost:9050 -X5 %h %p\n```\n\n**HostName** now contains the .Onion domain of the hidden service.\n\nI use **VerifyHostKeyDNS** to avoid warning about changed DNS for that host. I am not sure if it is actually needed, but at some point I added it.\n\nThe **ProxyCommand** parameter now is the important thing. I requires you to have Tor running as a client, this should be possible by \" _sudo apt-get install tor \u0026\u0026 sudo systemctl enable tor.service --now_\" Probably have to run it in two commands.   \nThis uses netcat (nc) to forward all packets from ssh to nc to the local port 9050 (standard Tor Socks port).   \n_I never noted what exactly the parameters for nc do. :-) if anyone know please let me know. I tried a quick search but it did not bring up any helpful results._\n\nPort must contain the port the hidden service ssh is available at, this can be different from the clients ssh daemon/server but is defined by the hidden service configuration in the torrc config file.\n\nHave a look in the manpage of ssh by typing \"man ssh\" in your command line or open the [manpage online](https://linux.die.net/man/1/ssh). The [ssh\\_config manpage](https://linux.die.net/man/5/ssh_config) is also very helpful.\n\n### autossh\n\nI lately started to use **autossh** in combination with remote _screen_ sessions, _screen_ is the tool to use if you work remotely and do something that you want to continue after a possible connection interruption. There is _tmux_ as well, but I prefer screen. Please have a look at both and choose which you prefer and use it.\n\nQuote from the [manpage of autossh](https://linux.die.net/man/1/autossh):\n\n\u003e autossh is a program to start a copy of ssh and monitor it, restarting it as necessary should it die or stop passing traffic.  \n\nIt basically improves the interruption resistivity of ssh by wrapping some other things around the connection and by using some special parameters. As I said I work remotely often and also I use mobile connections often on trains as well, I uses mosh (MObile SHell) before, but it is not working with screen that well, also it had some other downsides and to I ended up with autossh.\n\nLet me know if there is any faults in this summary about my ssh use and setup.\n\n**Edit:**  \nI figured something else out, I always wanted to keep my ssh config in sync between some computers. The problem was the synced folder is not ~/.ssh but ~/some/other/folder and in there I have a \"ssh\\_config\" file. So I tried to symlink that to my ~/.ssh which did not work (ln -s ~/some/other/folder/ssh\\_config ~/.ssh/config did not work) because auf some permission issue I think. Host in the file were just not found.   \nToday I figured out that I can include another file in my ~/.ssh/config by adding the following line in my ssh config file:\n\n```\nInclude ~/some/other/folder/ssh_config\n```\n\nThis now allows me to sync ~/some/other/folder/ssh\\_config between computers and include that file in my ssh config files on any computer I like to.\n","content_format":"markdown","date":"2019-04-14T20:03:29Z","description":"This will be a short post about the above mentioned parts, lets start right away. ### SSH config Every user can have a SSH client configuration file, it is located in ~/.ssh/config (where **config** ist the filename). My SSH config file, I guess as many other users file, grew over time. Lets start w","html_url":"https://newblog.utzer.de/2019/04/14/ssh-config-ssh-via-jumphost-and-autossh-ssh-to-tor-hidden-service/","json_url":"https://newblog.utzer.de/2019/04/14/ssh-config-ssh-via-jumphost-and-autossh-ssh-to-tor-hidden-service/index.json","lastmod":"2019-04-14T20:03:29Z","markdown_url":"https://newblog.utzer.de/2019/04/14/ssh-config-ssh-via-jumphost-and-autossh-ssh-to-tor-hidden-service/index.md","media":[],"schema_version":1,"tags":["autossh","CompressionLevel","hidden service","linux","onion","SSH","tor"],"title":"SSH config, ssh via jumphost and autossh (ssh to Tor hidden service)","type":"blog_post"}