Improve the way you work with Secure Shell
Safety First
Many Linux users employ Secure Shell to log in remotely and work as if on a local machine. But SSH can do even more – the application will send commands, route other TCP connections through an encrypted tunnel, and provide multiplexing support.
The man pages for the OpenSSH tool [1] read like novels. Most users know only a fraction of the options, and this article, too, is restricted to just a few features. It provides tips on SSH multiplexing, tunneling, and various configuration files.
On My Mark!
One of the oldest SSH tricks is to define a command that SSH runs at the opposite end when executed; this saves you time and typing. The output appears in the local terminal:
<heike@home:~$> ssh huhn@example.com pwd /home/huhn
The command displays the working directory for the user huhn
after logging onto the example.com
machine; in other words, the home directory. Multiple commands are also possible. It is important to quote the commands to make sure they really run on the remote system:
heike@home:~$ ssh huhn@example.com pwd;whoami /home/huhn heike heike@home:~$ ssh huhn@example.com 'pwd; whoami' /home/huhn huhn
If you want SSH to run commands that require user interaction on the other machine, the t
option is also necessary to start a pseudo terminal. This ensures that users remain logged in until the program is finished. In this way, you can, say, edit files with a text editor, use top
to list the active programs list, or view log files with tail-f
(Figure 1).
Well Prepared
If you juggle several accounts on remote servers that listen on different ports, or each use a different SSH key pair for authentication, you can specify the options each time you run SSH. However, you may find a separate ~/.ssh/config
configuration file (Listing 1) more convenient.
Listing 1
Setup file ~/.ssh/config
Each line contains a keyword; this is followed by one or more arguments. In addition to options that apply only to one computer (sections following host
name), global settings (host *
) are also possible. Because SSH evaluates the information in sequence, the general settings are available at the end of the file. The man page lists all the options for ssh_config
.
The example in Listing 1 contains two blocks for individual hosts. For the first computer (accessible via the alias ssh work
), it defines that the SSH server listens on port 2220. Also, the IP address is entered instead of a hostname, and the key to be used is defined, which removes the need to try out all the keys – this speeds up the connection if several key pairs are located in the ~/.ssh
directory.
The following applies for the second computer home.example.com
: It is accessible using the home
short name. CheckHostIP no
prevents matching the IP address against the ~/.ssh/known_hosts
file, which is useful for hosts with a changing, dynamically allocated IP.
In the general instructions, ServerAliveInterval 300
makes sure that the client sends a packet to the server after five minutes, to keep the connection alive and prevent a timeout. Additionally, the behavior of log is defined; users can choose from QUIET
, FATAL
, ERROR
, INFO
(standard), VERBOSE
, Debug
, DEBUG1
, DEBUG2
, and DEBUG3
.
Data compression is turned on in this case, but this is only useful for hosts where the users are faced with a slow connection.
Bundled, We Are Strong
The multiplexing feature, which can send several signals via a TCP connection ensures a speed advantage. The SSH client uses an existing connection to the SSH server, which eliminates the handshake with the opposite end. You do not save time with the first SSH session, but from the second. Users control multiplexing with two options: ControlMaster
and ControlPath
:
ssh -o ControlMaster=yes -o ControlPath=~/.ssh/control-%h_%p_%r user@example.org
The statement ControlMaster = yes
generates a master link, which other sessions with the same destination can use. ControlPath
defines the required socket, composed of the file name control
, the hostname (%h
), the port (%p
), and user name (%r
) of the target computer. For the next connection to this host, users state the socket; ControlMaster
is left at the default value (no
):
ssh -o ControlPath=~/.ssh/control-%h_%p_%r user@example.org
The second link attempts to dock onto the first. Should that fail, the SSH client establishes a normal connection as a fallback solution. Listing 2 shows the comparison with the time
for the who
command measured on the remote machine with and without multiplexing. In a small test setup, the difference is not particularly impressive, but in larger environments the feature should have a positive effect.
Listing 2
SSH without and with multiplexing
The multiplexing configuration does not need to be enabled with -o
; you can also do this in the SSH setup file. Besides the instructions, ControlMaster
and ControlPath
users can optionally define ControlPersist
here; this determines how long the master connection waits for clients in the background after the first connection is done. Users can enter either no
(master does not wait), yes
(master waits forever) or a period of time in seconds. Listing 3 gives you an example.
Listing 3
Multiplexing settings in ~/.ssh/config
By the way, it is not only SSH clients that benefit from the multiplexing feature, but also scp
, rsync
, git,
and other commands that use the SSH protocol.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
AlmaLinux Now Supports Raspberry Pi 5
If you're looking to create with the Raspberry Pi 5 and want to use AlmaLinux as your OS, you're in luck because it's now possible.
-
Kubuntu Focus Releases New Iterations of Ir14 and Ir16 Laptops
If you're a fan of the Kubuntu Focus laptops or have been waiting for the right time to purchase one, that time might be now.
-
NixOS 24.05 Is Ready for Prime Time
The latest release of NixOS (Uakari) has arrived and offers its usual reproducible, declarative, and reliable goodness.
-
Linux Lite 7.0 Officially Released
Based on Ubuntu 24.04 and kernel 6.8, Linux Lite version 7 now offers more options than ever.
-
KaOS Linux 2024.05 Adds Bcachfs Support and More
With updates all around, KaOS Linux now includes support for the bcachefs file system.
-
TUXEDO Computers Unveils New Iteration of the Stellaris Laptop Line
The Stellaris Slim 15 is the 6th generation and includes either an AMD or Intel CPU
-
KDE Releases Plasma 6.0.5
The latest release of the Plasma desktop has arrived with several improvements and the usual bug fixes.
-
Gnome OS Adopting systemd-sysupdate
Gnome OS is about to undergo a major under-the-hood change that promises enhanced security.
-
Endless OS 6 Now Available
After more than a year since the last update, the latest release of Endless OS is now available for general usage.
-
Fedora Asahi 40 Remix Available for Macs with Apple Silicon
If you've been anticipating KDE's Plasma 6 for your Apple Silicon-powered Mac, then you're in luck.