Skip to content
Search

OpenSSH

lastmod 2026-05-31created 2014-01-12129 edits

OpenSSH (OpenBSD Secure Shell) is a suite of computer programs that provides encrypted communication sessions over a computer network using the ssh protocol. It was written as open source to replace the proprietary Secure Shell software suite offered by SSH Communications Security. Led by Theo de Raadt, OpenSSH was developed as part of the security-focused OpenBSD project. Development of the project is funded by donations.

Categories

SSH PORT CHANGE

To change the SSH port number, open and edit the /etc/ssh/sshd_config file. After editing, however, you must tell SELinux about the changed SSH port as shown below. 

$ semanage port -a -t ssh_port -p tcp [PORTNUMBER]

How to install

CentOS 7

Install the openssh-clients and openssh-server packages. 

$ sudo yum -y install openssh-server openssh-clients

## SSH Port(22)가 열렸는지 확인한다.
$ netstat -tulpn | grep :22

## 서비스 등록.
$ chkconfig sshd on

## 그리고 SSH를 시작한다.
$ service sshd start

Or 

$ /etc/init.d/sshd start

Ubuntu server

On Ubuntu, proceed as follows. 

## 포트 및 서비스 활성화 확인
$ netstat -ntlp | grep sshd
$ service ssh status

## 설치 확인
$ dpkg --get-selections | grep ssh

## 설치
$ sudo apt-get update
$ sudo apt-get install openssh-server

## 설치 확인
$ dpkg --get-selections | grep ssh

## 서비스 활성화 및 포트 확인
$ service ssh status
$ ps -ef | grep sshd | grep -v grep
$ netstat -ntlp | grep sshd

Arch Linux 

$ sudo pacman -S openssh

Additional install for x11-related authentication: 

$ sudo pacman -S xorg-xauth

Windows

Do this in PowerShell.

First, look for packages that can be installed online: 

PS C:\Users\User> Get-WindowsCapability -Online | ? Name -like 'OpenSSH*'

The installable OpenSSH client and server are listed: 

Name  : OpenSSH.Client~~~~0.0.1.0
State : Installed

Name  : OpenSSH.Server~~~~0.0.1.0
State : NotPresent

Pick the server from the output: 

PS C:\Users\User> Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

After a fairly long wait, the following is printed along with whether a restart is needed (False): 

Path          :
Online        : True
RestartNeeded : False

Start the service: 

PS C:\Users\User> Start-Service sshd

The following is printed. 

WARNING: Waiting for service 'OpenSSH SSH Server (sshd)' to start...

Register the service to start automatically on reboot: 

PS C:\Users\User> Set-Service -Name sshd -StartupType 'Automatic'

How to check the registered firewall rule: 

PS C:\Users\User> Get-NetFirewallRule -Name OpenSSH-Server-In-TCP

The output looks like this. Enabled should be True. 

Name                          : OpenSSH-Server-In-TCP
DisplayName                   : OpenSSH SSH Server (sshd)
Description                   : Inbound rule for OpenSSH SSH Server (sshd)
DisplayGroup                  : OpenSSH Server
Group                         : OpenSSH Server
Enabled                       : True
Profile                       : Any
Platform                      : {}
Direction                     : Inbound
Action                        : Allow
EdgeTraversalPolicy           : Block
LooseSourceMapping            : False
LocalOnlyMapping              : False
Owner                         :
PrimaryStatus                 : OK
Status                        : The rule was parsed successfully from the store. (65536)
EnforcementStatus             : NotApplicable
PolicyStoreSource             : PersistentStore
PolicyStoreSourceType         : Local
RemoteDynamicKeywordAddresses : {}
PolicyAppId                   :

Now you can connect.

If it still doesn't work, register a new firewall rule: 

PS C:\Users\User> New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

PS C:\Users\User> Get-NetFirewallRule -Name sshd

How to enable login with SSH keys

Open the C:\ProgramData\ssh\sshd_config file in administrator mode and uncomment the following lines: 

PubkeyAuthentication    yes
AuthorizedKeysFile      .ssh/authorized_keys

Restart SSHD: 

Restart-Service -name sshd -force
  • Regular users just copy their public key to the configured path %HOME%\.ssh\authorized_keys.
  • However, administrators must copy their public key to C:\ProgramData\ssh\administrators_authorized_keys, not that file. <- Usually the user you enter when first installing Windows is registered as an administrator, so copying the public key to the home directory probably won't work.

If you want to remove it 

Remove-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

How to change the default shell

Change the default shell by editing the registry. The available registry paths are:

  • HKEY_LOCAL_MACHINE\SOFTWARE\OpenSSH\DefaultShell - full path of the shell executable
  • HKEY_LOCAL_MACHINE\SOFTWARE\OpenSSH\DefaultShellCommandOption - (optional) - switch that the configured default shell requires to execute a command, immediately exit and return to the calling process. By default this is -c.
  • HKEY_LOCAL_MACHINE\SOFTWARE\OpenSSH\DefaultShellEscapeArguments - (optional) - flag that allow you to skip escaping the arguments of default shell. By default this is 0. This option is only applicable to shells other than powershell, bash, cygwin, cmd, and ssh-shellhost.exe.

PowerShell setup: 

New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force

Setup for the Bash installed with Git for Windows: 

New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Program Files\Git\bin\bash.exe" -PropertyType String -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShellCommandOption -Value "--login" -PropertyType String -Force

SSHD Config

AllowGroups
Only groups listed here can connect.
AllowUsers
Only accounts listed here can connect.
DenyGroups
Everyone can connect; only groups listed here are denied.
DenyUsers
Everyone can connect; only accounts listed here are denied.
PermitRootLogin no
Disallows remote logins as root. Prevents attackers from discovering the root password and helps block attacks that use root privileges.
PermitRootLogin yes
Allows remote logins as root.
PermitRootLogin prohibit-password
Blocks root password logins and allows only key file logins.
X11Forwarding yes
X11 forwarding setting.
PubkeyAuthentication yes
Whether public key authentication is used
PasswordAuthentication no
Change to no here to disable tunneled clear text passwords! <- Disallows password logins.
PermitEmptyPasswords no
Disallows empty passwords, which helps prevent passwords from being guessed.
KbdInteractiveAuthentication no
Disables keyboard-interactive authentication. This simplifies the authentication process and helps strengthen security.
AllowAgentForwarding no
Disables SSH agent forwarding. This prevents a malicious server from using the user's local SSH agent.
X11Forwarding no
Disables X11 forwarding. This prevents X11 sessions from being hijacked.
ClientAliveInterval 300
Interval for checking whether the SSH client is alive. Used together with ClientAliveCountMax.
This lets inactive SSH sessions be terminated sooner.
ClientAliveCountMax 2
Maximum number of alive checks for the SSH client. Used together with ClientAliveInterval.
This lets inactive SSH sessions be terminated sooner.
LoginGraceTime 1m
Shortens the time allowed after an SSH connection attempt until authentication succeeds. This limits the time an attacker has to try random passwords. The default is usually 2 minutes; this reduces it to 1 minute.
MaxAuthTries 3
Number of authentication attempts. Limits the scope of an attacker's attacks on the SSH server.
MaxSessions 3
Limits the maximum number of sessions, thereby limiting the scope of an attacker's attacks on the SSH server.
PubkeyAuthentication yes
Uses public key authentication. Used together with AuthorizedKeysFile.
This provides stronger security and helps prevent password-based attacks.
AuthorizedKeysFile .ssh/authorized_keys
Allows connections using SSH keys instead of passwords. Used together with PubkeyAuthentication.
Sets the path, relative to the logged-in user's home directory, where SSH looks for public keys.

Basic settings for hardening SSH server security

If you're not sure, start from the defaults and set just these two. 

PasswordAuthentication no
PermitRootLogin no

Allowing password login from specific hosts

Allow password login from specific trusted computers and only key login from everywhere else 

PasswordAuthentication no
PermitRootLogin no
Match Address 192.168.0.0/24 User gdhong
    PasswordAuthentication yes
Match Address 172.12.0.0/24 User gdhong
    PasswordAuthentication yes
Match all

My setup

  • With a VPN (Nebula Overlay Network) set up, I can move around the networks of all the computers I manage,
  • and only "my own" PC can connect by default.
  • I still keep one access route for emergencies, configured as follows. 
PasswordAuthentication no
PermitRootLogin no
Match Address 192.168.0.0/24 User {사용자명}
    PasswordAuthentication yes
~/.ssh
Directory containing the current user's ssh-related files
~/.ssh/id_rsa
File storing the RSA Private Key
~/.ssh/id_rsa.pub
File storing the RSA public key (can be shared with others)
~/.ssh/authorized_keys
On the server, stores client public keys allowed to connect, one per line.
~/.ssh/known_hosts
On the client, stores the Korean: 핑거프린트 (fingerprint) of each authenticated server to connect to, one per line.
C:\ProgramData\ssh\administrators_authorized_keys
When OpenSSH is installed on Windows, public keys for administrators must be registered separately. Check the AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys line under Match Group administrators in the sshd_config file.

Checking that password authentication is denied 

ssh -o PubkeyAuthentication=no 192.168.1.101

If you get a "Permission denied" message, password authentication has been denied.

Built-in escape sequences

In an SSH session, press ↵ (Enter) and then type ~? to see the list of supported escape sequences

  • These sequences are built into the SSH client itself, so they work even when the SSH server is not responding or the connection has dropped
  • The most useful is ~., which exits immediately in any situation when a session hangs
  • Escape sequences are recognized only right after a newline

Main sequences

  • ~. - Terminate the connection (including multiplexed sessions)
  • ~B - Send a BREAK to the remote system
  • ~C - Open a command line (port forwarding can be set up; type help for guidance)
  • ~R - Request rekey
  • ~V/v - Increase/decrease verbosity (LogLevel)
  • ~^Z - Suspend SSH
  • ~# - List forwarded connections
  • ~& - Background SSH (when waiting for connections to terminate)
  • ~? - this message
  • ~~ - Send the escape character itself (type it twice)

How to generate new host keys

If you looked in /etc/ssh and didn't see any key files or you just want to create new host keys yourself, use ssh-keygen to create a new key pair. This must be done as root, and you have to specify the name of the new key pair. You only need one key pair. Always specify a passphrase: 

# ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /etc/ssh/ssh_host_rsa_key.
Your public key has been saved in /etc/ssh/ssh_host_rsa_key.pub.
The key fingerprint is:
6c:24:75:54:d3:21:17:c9:11:db:41:dd:95:3f:d0:ac root@windbag

This example uses the default key names, but you can call the keys anything you like. If you use different names, be sure to enter them in /etc/ssh/sshd_config: 

# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key

Comment out or delete any entries for keys that do not exist.

Limit SSH access to specific clients by IP address

Option 2: Using TCP wrappers

You can also configure which hosts can connect using TCP wrappers. With TCP wrappers, in addition to IP addresses you can also use hostnames in rules.

By default, deny all hosts.

/etc/hosts.deny: 

sshd : ALL

Then list allowed hosts in hosts.allow. For example to allow network 192.168.0.0/24 and localhost.

/etc/hosts.allow: 

sshd : 192.168.0.0/24
sshd : 127.0.0.1
sshd : [::1]

SSH Key

Append the id_rsa.pub file sent from the remote machine to the authorized_keys file. If several local machines connect to the remote machine, add each local machine's id_ras.pub file to authorized_keys. 

$ cat $HOME/id_rsa.pub >> $HOME/.ssh/authorized_keys

Connecting with SSH 

## 만약 id_rsa 파일을 $HOME/.ssh/id_rsa에 만들지 않고 다른 디렉토리에 만들었다면 -i 옵션을 사용한다.
## 홈디렉토리에 auth라는 이름의 파일에 id_rsa의 내용이 담겨 있다면 아래와 같이 한다.
$ ssh -i $HOME/auth egoing.net

ClientAlive

To set a Linux session timeout, I set ClientAliveInterval and ClientAliveCountMax in sshd_config, but it did not work as I intended. My goal was to have the session drop when no command was typed in the terminal for 60 seconds. The problem came from mistaking the ClientAlive* directives in sshd_config, which serve a different purpose, for a login session timeout.

  • ClientAliveInterval sets how long to keep (wait on) the session until a response is received from the client. The unit is seconds.
  • ClientAliveCountMax is the number of times the connection is kept even if the client does not respond.

So the total session time is: 

ClientAliveInterval * ClientAliveCountMax

However, setting the ClientAlive* directives above does not drop the session just because a client connected over ssh typed no command in the terminal for 5 seconds. The ClientAlive* settings in sshd_config are, literally, settings for sshd. While a client is logged in to a shell, it sends response packets to the server's requests by default, so the server considers the client alive. When the whole client dies (e.g. it terminates unexpectedly or the network drops), it can no longer send session response packets to the server, and the ClientAlive* directives detect that situation. So to end a session based on whether there is "interaction" with the logged-in shell for a set time, you need to set the TMOUT shell environment variable.

TMOUT is a shell environment variable that sets how long a user account's login session is kept. If there is no account activity for the given time, the login shell logs out automatically. (Unit: seconds) 

[root@wglee-server ~]# tail -n 2 /etc/profile
export HISTTIMEFORMAT="[%Y/%m/%d %H:%M] "
export TMOUT=60

[root@wglee-vm ~]# history timed out waiting for input: auto-logout
[centos@wglee-vm ~]$

[wglee3@wglee-vm ~]$ timed out waiting for input: auto-logout
[root@wglee-vm ~]#

ForwardX11

X11 forwarding is a mechanism that allows the graphical interface of X11 programs running on a remote system to be displayed on a local client system. For X11 forwarding, the remote host does not need a full X11 system installed, but it must at least have xauth installed. xauth is a utility that maintains the Xauthority configuration used by the server and client for authentication of X11 sessions (source).

WARNING

X11 forwarding has significant security implications, which should be acknowledged at least by reading the relevant sections of the ssh (1), sshd_config (5) and ssh_config (5) manual pages. See also this StackExchange question.

The important thing is to check that the server's sshd configuration file (/etc/ssh/sshd_config) has X11Forwarding yes.

Then connect with the command below. 

$ ssh -X server
## or
$ ssh -Y server

If the GUI is displayed incorrectly or errors occur, you can enable the ForwardX11Trusted option (the -Y switch on the command line). This exempts X11 forwarding from the X11 SECURITY extension controls. In that case, read the warning above.

SOCKS 

ssh -N -D 9090 [USER]@[SERVER_IP]
  • -N - Tells SSH not to execute a remote command.
  • -D 9090 - Opens a SOCKS tunnel on the specified port number.

Connect through the proxy server with a command like this: 

/usr/bin/google-chrome --user-data-dir="$HOME/proxy-profile" --proxy-server="socks5://localhost:9090"

Flags

-X
Enables X11 forwarding. This can also be specified on a per-host basis in a configuration file.
-Y
Enables trusted X11 forwarding. Trusted X11 forwardings are not subjected to the X11 SECURITY extension controls.

Piping password

The most recommended way is to use the ssh-copy-id command.

SSH keys

First of all, the best solution for you would be to create new ssh keypair and use this key to login to all your servers (or some, based on preferences). If you don't know how, you can find it many times here on stackexchange, but shortcut: 

ssh-keygen
## ...

ssh-copy-id your-host

Basically you should set passphrase for your key, so you will log in only once with the one password.

SSH pass

But if you really insist on using your passwords from files, you can do it quite simply as described in comments: 

sshpass -f /path/to/myfile ssh user@localhost

But note that this is not really preferred method of using ssh with passwords stored in plaintext.

Expect

You can do the same thing using expect script like this: 

#!/usr/local/bin/expect
spawn  ssh [email protected]
expect "password:"
send "your_password\n";
interact

Tunneling example

Assume the following setup.

  • The server you ultimately want to reach has the hostname server.
  • server cannot reach external networks and sits on a private network (192.168.0.0/24).
  • server has ssh open on port 22.
  • Another server with the hostname sshserver exists on the same network as server.
  • sshserver accepts ssh connections from outside on port 8888.
  • All other ports are blocked by a firewall.
  • You want to ssh into server from an external network.

Our goal is to temporarily open local port 9999 (it can listen on localhost only) and use this port to connect to server via sshserver.

First, the syntax is: 

ssh -p [PORT] [HOSTNAME] -N -L [LOCALPORT:REMOTE2HOST:REMOTE2PORT]

Each flag is as follows.

  • -p [number] : Connect on port number.
  • -N: Keep the connection open without running a remote shell.
  • -L [로컬포트번호:호스트:호스트포트번호]: Opens a listening socket on the local port number and forwards incoming packets from the remote side to host:hostport.
    • The separator may also be /.

In this case you need two terminals open; the first one is as follows. 

ssh -p 8888 sshserver -N -L 9999:server:22
## 로그인에 성공하며 반응이 없는 빈 콘솔이 나타난다.

Once connected, localhost:9999 is in the listen state. Check it with lsof or similar.

Now connect to server from the second terminal. 

ssh -p 9999 localhost

You must connect to localhost as shown above.

Other example

To access the settings page of a remote router, open a tunnel like this. 

ssh -p 8888 admin.server-project.com -N -L 9999:192.168.0.1:80

Then go to http://localhost:9999/.

Device tunneling

Something like: 

$ dd if=/dev/video0 | mplayer tv://device=/dev/stdin
$ works for me (SOA#1) locally. So does:
$ ssh localhost dd if=/dev/video0 | mplayer tv://device=/dev/stdin

As well as 

$ mkfifo test
$ dd if=/dev/video0 of=test &
$ mplayer tv://device=test

If you have a low bandwidth I recommend compression of the video stream: 

$ ssh USER@REMOTEHOST ffmpeg -an -f video4linux2 -s 640x480 -i /dev/video0 -r 10 -b:v 500k -f matroska - | mplayer - -idle -demuxer matroska

Remote Port Forwarding (Reverse Tunneling)

Use the -R option. 

ssh -R [remote_port]:[destination_address]:[local_port] [username]@[ssh_server]

Dynamic Port Forwarding

Dynamic port forwarding lets users create a secure tunnel between the local system and a remote SSH server, turning the SSH server into a proxy server.

With this technique, users can set up a dynamic SOCKS proxy over an SSH connection. Dynamic port forwarding creates a general-purpose encrypted tunnel that can redirect traffic from many ports and applications over the SSH connection. This differs from local and remote port forwarding, which redirect a specific port to a specific destination.

Dynamic port forwarding is used for many purposes, for example: accessing blocked websites or services, bypassing censorship, and protecting personal information. With dynamic port forwarding, traffic is encrypted and routed through the SSH server, which makes it harder for third parties to track or intercept your activity.

Use the -D option. 

ssh -D [local_port] [username]@[ssh_server]

VPN over SSH (connecting two networks) 

root » ssh -o "PermitLocalCommand=yes" \
           -o "LocalCommand=brctl addif br-local tap5 && ifconfig tap5 up" \
           -o Tunnel=ethernet \
           -w 5:5 \
           -t root@REMOTE_HOST \
           "brctl addif br-remote tap5 && ifconfig tap5 up"

Create Network Interface from SSH Tunnel 

sudo sysctl -w net.ipv4.ip_forward=1

Connecting with reverse tunneling

A way to enable HTTP/HTTPS connections for a remote server without internet access by using Mitmproxy.

  • For convenience, the client-side PC with internet access is called <Local PC>,
  • and the remote server without internet is called <Remote server>.

Run the Mitmproxy server on <Local PC> (assume host port 3128 is used): 

# mitmproxy 의 기본 포트는 8080 이다.
docker run --rm -it -p 3128:8080 mitmproxy/mitmproxy

Then, from <Local PC>, open an SSH connection using #Remote Port Forwarding (Reverse Tunneling): 

## Usage: ssh -R [원격지포트]:[로컬기준목적지]:[로컬기준포트] [username]@[ssh_server]
ssh -R 3129:localhost:3128 username@ssh_server

Apply the proxy environment variables in the terminal of <Remote server>. Or edit /etc/environment. 

export http_proxy=http://127.0.0.1:3129
export https_proxy=http://127.0.0.1:3129

## 또는 한번에 HTTP/HTTPS 프록시를 적용 하려면

export all_proxy=http://127.0.0.1:3129

If you want to install packages with apt, see Advanced Package Tool#Proxy server settings and use it as follows. 

sudo apt -o Acquire::http::proxy=http://127.0.0.1:3129/ -o Acquire::https::proxy=http://127.0.0.1:3129/ -o Acquire::https::Verify-Peer=false ...

The network connection diagram is shown below:

Give_server_access_to_Internet,_via_client_connecting_by_SSH.jpg

Name used in the description

Name used in the figure

<Local PC>

Host A

<Remote server>

Host B

Mitmproxy

Squid Proxy

WARNING

However, connecting to HTTPS this way causes SSL certificate errors such as CERTIFICATE_VERIFY_FAILED, so you need to use a skip option or similar

Email alert

On Ubuntu 14.04, install postfix as follows. 

$ sudo apt-get install mailutils
## 설치시 General type of mail configuration: 'Internet Site' 선택.

Create the /etc/profile.d/ssh_notify.sh file and write the following. 

#!/bin/bash
TAG=SSH_CONNECTION_INFO
DATE_FORMAT=`date +%Y%m%d_%H-%M-%S`
CONTENT="USER($USER) HOSTNAME($HOSTNAME) DATE($DATE_FORMAT): $SSH_CONNECTION"
SMTP_TITLE="SSH LOGIN ALERT"
SMTP_TO=[email protected]

if [[ -n "$SSH_CONNECTION" ]]; then
    logger -t $TAG "$CONTENT"
    echo "$CONTENT" | mail -s "$SMTP_TITLE" $SMTP_TO
fi

Then add execute permission as follows. 

$ sudo chmod +x /etc/profile.d/ssh_notify.sh

Warning

  • On Ubuntu 14.04, the method using /etc/ssh/sshrc and sendmail did not work properly. sendmail worked fine from the Bash command line after login, but the /etc/ssh/sshrc file did not work after SSH login. (The script itself was called.)
  • If a ~/.ssh/rc file exists, the /etc/ssh/sshrc file may not work properly.

OpenSSH Client Example

Notes on using the ssh client.

ssh -p 8022 [email protected]
Connects to the server-project.com host on port 8022 with the username yourid.
scp -r -P 8022 [email protected]:/Users/yourid/Documents/fonts ~/Downloads/LocalFonts
Stackoverflow: Transferring files over SSH
Copies the remote host's /Users/yourid/Documents/fonts directory and everything under it to the local host's ~/Downloads/LocalFonts directory. (The -r option is important)

How to run a GUI program on the display of another logged-in session

Use w to see the list of currently logged-in users: 

$ w

The output looks like this: 

 16:34:22 up 36 days,  2:56,  2 users,  load average: 41.63, 41.91, 42.59
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
aaa      :1       :1               14Nov23 ?xdm?  49days  0.01s /usr/lib/gdm3/gdm-x-session --run-script env GNOME_SHELL_SESSION_MODE=ubuntu /usr/bin/gnome-session --systemd --session=ubuntu
aaa      pts/0    172.17.17.2      16:29    1.00s  0.06s  0.01s w

Check the user and TTY. It is usually shown as :1.

Check permissions: 

$ xhost

The output looks like this: 

access control enabled, only authorized clients can connect
SI:localuser:yourid

If you want to control that user's display as another user: 

$ xhost +SI:localuser:다른사용자

Log in (if needed): 

sudo -i -u {사용자명}

Set the DISPLAY environment variable to the TTY value found above 

$ export DISPLAY=:1

Run the program you want: 

$ gnome-terminal

Remove the permission for security reasons: 

$ xhost -SI:localuser:다른사용자

Why SSH sends 100 packets per keystroke

A case of tracing why hundreds of packets were sent for a single keystroke in an SSH session

  • tcpdump analysis showed that most packets were repeated 36-byte messages, sent at about 20 ms intervals
  • The cause was the ‘keystroke timing obfuscation’ feature added to SSH in 2023, which sends many ‘chaff’ packets (SSH2_MSG_PING) to hide the user's typing timing
  • Disabling this feature or changing the server so it does not advertise the [email protected] extension cut CPU usage and bandwidth by more than half
  • Shows that SSH's security features can be a heavy load for applications where real-time performance matters (e.g. games)

Troubleshooting

Hangs when connecting by domain name

When you connect through a domain address such as ssh git.yourname.com, sometimes nothing works afterward. In that case, use nslookup to check that the domain resolves correctly. Depending on the case, check the Domain name resolution process.

If this happens onArchLinux, try installing thexorg-xauthpackage.

Connection refused

  • A network path to the target host exists
  • The host is up and able to respond
  • But no service is running on port 22 (SSH), or it refuses the connection
  • A firewall blocks the port, or the SSH daemon is stopped

Simply put, "I found the house, but the door is locked"

No route to host

  • There is no network path to the target host at all
  • The host is off or completely disconnected from the network
  • The routing table has no route to it, or there is a problem with network equipment in between
  • The IP address is wrong or the network range does not exist

Simply put, "I can't find the house at all"

See also

  • semanage
  • Secure Shell
  • sshfs
  • Mosh - Connects over SSH with the existing authentication method, then runs mosh-server on the remote side and connects over UDP
  • ContainerSSH - An SSH Server that creates a container and connects you to it
  • scp
  • rsync
  • rclone
  • Devzat - An SSH chat server for developers
  • Keypub.sh - OAuth for the terminal using SSH keys
  • GGH - A tool to Recall SSH sessions
  • OpenPubkey SSH (OPKSSH) - A single sign-on system integrated with SSH
  • XPipe - A tool to access your entire server infrastructure from your local machine
  • pussh - A tool for running SSH commands in parallel
  • Vet – A tool for running remote shell scripts more safely
  • Exe.dev - A modern VM service where you control everything over SSH
  • sshpiper is the reverse proxy for sshd. all protocols, including ssh, scp, port forwarding, running on top of ssh are supported.

Favorite site

References

  1. SSH_Key_-_auth_key.pdf ↩

author Zer0 sitemap