OpenSSH

OpenSSH is a popular suite of software utilities implementing Secure Shell (SSH) protocol. OpenSSH includes the ability to set up a TCP secured channel and it is widely use as a replacement for not secured telnet and secure replacement of file transfers such as rcp and ftp. OpenSSH offers a great number of features including ssh session multiplexing.

The OpenSSH suite includes the following command-line utilities and daemons:

• ssh, ssh client and TCP secure replacement for rlogin, rsh and telnet to allow shell access to a remote machine.
• scp, a replacement for rcp
• sftp, a replacement for ftp to copy files between computers
• sshd, the SSH server daemon which allows shell access and file transfers to a remote machine.
• ssh-keygen, a tool to inspect and generate the RSA, DSA and Elliptic Curve keys that are used for user and host authentication
• ssh-keyscan, which scans a list of hosts and collects their public keys
• ssh-agent and ssh-add, utilities to ease authentication by holding keys ready and avoid the need to enter passphrases every time they are used
• ssh-copy-id, copy local keys to remote machine.

Readings

• Wikibooks: OpenSSH
• OpenSSH changelog

Config

• Client: /etc/ssh/ssh_config or ~./config
• Server: /etc/ssh/sshd_config

ssh clients

OpenSSH includes an ssh client:ssh. Others clients are available such us PuTTY, mosh, paramiko and autossh.

autossh main feature not include in OpenSSH ssh client is the capability to monitor an ssh connection and restart it if necessary.

• Loop waiting to connect to server: AUTOSSH_POLL=5 AUTOSSH_GATETIME=0 autossh -M 0 -o ServerAliveInterval=5 -o ServerAliveCountMax=1 YOUR_SERVER_NAME_OR_IP

Ssh clients in Linux are frequently executed inside a terminal or using any kind of terminal multiplexer such as tmux or screen.

Activities

Basic

• Install OpenSSH: apt install openssh-server
• Convert a PuTTY ssh key format to Openssh format, you can follow the following instructions http://www.codeblocq.com/2016/05/Convert-a-putty-ppk-key-to-a-pem-file-on-OSX/, https://stackoverflow.com/questions/3475069/use-ppk-file-in-mac-terminal-to-connect-to-remote-connection-over-ssh
• Open a reverse ssh tunnel, follow the following instructions https://www.howtoforge.com/reverse-ssh-tunneling
• Configure OpenSSH to reuse ssh connections (ControlMaster)
• Generate a public Key from a private Key: ssh-keygen -f ~/.ssh/id_rsa -y > ~/.ssh/id_rsa.pub (example for RSA keys but can be applied to other key types)
• Configure OpenSSH to allow Public-key authentication (authorized_keys)
• Activate SSH on macOS: sudo systemsetup -setremotelogin on
• Activate OpenSSH on Windows (Windows Server 2019 or Windows 10):

Intermediate

• Learn about different client connection options, such us: -oBatchMode=yes or -o ConnectTimeout=2
• Connect to remote server temporarily turning off host key checking, (security implications): ssh -oStrictHostKeyChecking=no SERVER_NAME

Advanced

1. Read ssh documentation about multiplexing https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Multiplexing and its implementation details: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.mux?annotate=HEAD
2. Configure ssh session multiplexing
3. Use ProxyJump directive to connect using a "Jump Server"
4. Run a shell script on a remote machine using ssh: ssh root@MachineB 'bash -s' < local_script.sh. See also: parallel
5. Read https://github.com/openssh/openssh-portable source code
6. Read OpenSSH changelog

Related terms

• MAC (message authentication code)
• Damien Miller
• Key Revocation Lists (KRL)
• AWS EC2 Instance Connect (Jun 2019)
• Telnet (deprecated use), netcat

See also

• OpenSSH (changelog): /etc/ssh/sshd_config | /etc/ssh/ssh_config | ~/.ssh/ | openSSL | sshd logs | sftp | scp | authorized_keys | ssh-keygen | ssh-keyscan | ssh-add | ssh-agent | ssh | Ssh -O stop | ssh-copy-id | CheckHostIP | UseKeychain, OpenSSF, ~/.ssh/authorized_keys
• sslh Applicative Protocol Multiplexer (e.g. share SSH and HTTPS on the same port)
• sshpass (brew install http://git.io/sshpass.rb)
• conch client written in python
• openssl [ rand | s_client | passwd | openssl req | openssl rsa | openssl genrsa | openssl x509 | openssl ca | openssl verify | openssl ec | openssl dgst | openssl pkcs12 | openssl asn1parse | openssl help | .cer to .pem, openssl version
• Port knocking, fail2ban fwknop, DenyHosts

https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Multiplexing

https://stackoverflow.com/questions/20410252/how-to-reuse-an-ssh-connection

https://linux.die.net/man/1/autossh

https://linux.die.net/man/1/autossh

https://serverfault.com/questions/52285/create-a-public-ssh-key-from-the-private-key

https://www.digitalocean.com/community/tutorials/how-to-configure-ssh-key-based-authentication-on-a-linux-server

https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse

https://linux.die.net/man/1/ssh

https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Passing_Through_One_or_More_Gateways_Using_ProxyJump

https://stackoverflow.com/a/2732991

https://github.com/yrutschle/sslh

https://serverfault.com/a/608976