ssh

ssh USER@HOST logs in; ssh USER@HOST COMMAND runs one command and returns. -J reaches a device behind a bastion in one step. -L and -D carry other traffic through the encrypted connection. -v prints the handshake, which shows whether the problem is reaching the server, the host key, or the login. The server's log (/var/log/…sshd.log in the labs) records every failed and accepted password.

ssh command usage

ssh [-p PORT] [-J JUMPHOST] [-L LOCAL:HOST:PORT] [-v] USER@HOST [COMMAND]

Options

-p 2222

connect to that port instead of 22

-J admin@bastion.lab

go through that jump host

-L 8080:10.0.3.10:80

local port 8080 reaches 10.0.3.10:80 through the tunnel

-v

print each step of the handshake

-o ConnectTimeout=5

give up after 5 seconds

ssh examples

ssh admin@10.0.1.10 hostname

Logs in to 10.0.1.10 as admin, runs hostname, and returns.

ssh -p 2222 admin@10.0.2.2

Logs in through port 2222, which the router forwards to the inside.

ssh -J admin@bastion.lab admin@10.0.3.10

Reaches an inside server by going through the bastion host.

ssh -L 8080:10.0.3.10:80 admin@bastion.lab

Makes local port 8080 lead to the inside web server, through the bastion.

grep 'Failed password' /var/log/netlab-sshd.log | tail

Shows the latest failed logins recorded by the SSH server.

ssh -i ~/.ssh/lab_ed25519 admin@10.0.1.10

Logs in with that private key instead of the default ones.

ssh-keygen -t ed25519 -C ana@laptop

Makes a new key pair, ~/.ssh/id_ed25519 and its .pub, the type to choose today.

ssh-copy-id admin@10.0.1.10

Adds your public key to the server's ~/.ssh/authorized_keys, so later logins need no password.

ssh -R 9000:localhost:3000 admin@bastion.lab

Makes port 9000 on the bastion lead back to port 3000 on your machine: a reverse tunnel.

ssh -D 1080 admin@bastion.lab

Runs a SOCKS proxy on local port 1080 that sends whatever a browser gives it out through the bastion.

ssh -f -N -L 8080:10.0.3.10:80 admin@bastion.lab

Keeps the tunnel open in the background without a shell: -N runs no command, -f goes to the background.

ssh -t admin@10.0.1.10 sudo vtysh

Runs an interactive program on the server; -t gives it the terminal it needs.

ssh admin@10.0.1.10 'tar czf - /etc/frr' > frr.tgz

Runs tar on the server and saves its output on your side: a backup in one line.

ssh -v admin@10.0.1.10

Prints every step of the login: which keys it offers and why the server refuses them.

ssh-keygen -R 10.0.1.10

Forgets the stored host key after a server was rebuilt, the cause of REMOTE HOST IDENTIFICATION HAS CHANGED.

ssh -o ConnectTimeout=5 admin@10.0.1.10 true

Gives up after five seconds when the server does not answer, instead of hanging.

Pitfalls

• Connection refused: nothing listens on that port. A hang: a firewall drops it. Permission denied: you reached it, the login failed.
• REMOTE HOST IDENTIFICATION HAS CHANGED: the server's key is not the one you saw before. Find out why before you continue.

Run it on real machines