Improve the way you work with Secure Shell
Safety First
![© Lead Image © Maksym Yemelyanov, 123RF.com © Lead Image © Maksym Yemelyanov, 123RF.com](/var/linux_magazin/storage/images/issues/2017/197/ssh-tips-and-tricks/maksym_yemelyanov_123rf-safety.png/694722-1-eng-US/Maksym_Yemelyanov_123RF-Safety.png_medium.png)
© Lead Image © Maksym Yemelyanov, 123RF.com
Many Linux users employ Secure Shell to log in remotely and work as if on a local machine. But SSH can do even more – the application will send commands, route other TCP connections through an encrypted tunnel, and provide multiplexing support.
The man pages for the OpenSSH tool [1] read like novels. Most users know only a fraction of the options, and this article, too, is restricted to just a few features. It provides tips on SSH multiplexing, tunneling, and various configuration files.
On My Mark!
One of the oldest SSH tricks is to define a command that SSH runs at the opposite end when executed; this saves you time and typing. The output appears in the local terminal:
<heike@home:~$> ssh huhn@example.com pwd /home/huhn
The command displays the working directory for the user huhn
after logging onto the example.com
machine; in other words, the home directory. Multiple commands are also possible. It is important to quote the commands to make sure they really run on the remote system:
heike@home:~$ ssh huhn@example.com pwd;whoami /home/huhn heike heike@home:~$ ssh huhn@example.com 'pwd; whoami' /home/huhn huhn
If you want SSH to run commands that require user interaction on the other machine, the t
option is also necessary to start a pseudo terminal. This ensures that users remain logged in until the program is finished. In this way, you can, say, edit files with a text editor, use top
to list the active programs list, or view log files with tail-f
(Figure 1).
Well Prepared
If you juggle several accounts on remote servers that listen on different ports, or each use a different SSH key pair for authentication, you can specify the options each time you run SSH. However, you may find a separate ~/.ssh/config
configuration file (Listing 1) more convenient.
Listing 1
Setup file ~/.ssh/config
Each line contains a keyword; this is followed by one or more arguments. In addition to options that apply only to one computer (sections following host
name), global settings (host *
) are also possible. Because SSH evaluates the information in sequence, the general settings are available at the end of the file. The man page lists all the options for ssh_config
.
The example in Listing 1 contains two blocks for individual hosts. For the first computer (accessible via the alias ssh work
), it defines that the SSH server listens on port 2220. Also, the IP address is entered instead of a hostname, and the key to be used is defined, which removes the need to try out all the keys – this speeds up the connection if several key pairs are located in the ~/.ssh
directory.
The following applies for the second computer home.example.com
: It is accessible using the home
short name. CheckHostIP no
prevents matching the IP address against the ~/.ssh/known_hosts
file, which is useful for hosts with a changing, dynamically allocated IP.
In the general instructions, ServerAliveInterval 300
makes sure that the client sends a packet to the server after five minutes, to keep the connection alive and prevent a timeout. Additionally, the behavior of log is defined; users can choose from QUIET
, FATAL
, ERROR
, INFO
(standard), VERBOSE
, Debug
, DEBUG1
, DEBUG2
, and DEBUG3
.
Data compression is turned on in this case, but this is only useful for hosts where the users are faced with a slow connection.
Bundled, We Are Strong
The multiplexing feature, which can send several signals via a TCP connection ensures a speed advantage. The SSH client uses an existing connection to the SSH server, which eliminates the handshake with the opposite end. You do not save time with the first SSH session, but from the second. Users control multiplexing with two options: ControlMaster
and ControlPath
:
ssh -o ControlMaster=yes -o ControlPath=~/.ssh/control-%h_%p_%r user@example.org
The statement ControlMaster = yes
generates a master link, which other sessions with the same destination can use. ControlPath
defines the required socket, composed of the file name control
, the hostname (%h
), the port (%p
), and user name (%r
) of the target computer. For the next connection to this host, users state the socket; ControlMaster
is left at the default value (no
):
ssh -o ControlPath=~/.ssh/control-%h_%p_%r user@example.org
The second link attempts to dock onto the first. Should that fail, the SSH client establishes a normal connection as a fallback solution. Listing 2 shows the comparison with the time
for the who
command measured on the remote machine with and without multiplexing. In a small test setup, the difference is not particularly impressive, but in larger environments the feature should have a positive effect.
Listing 2
SSH without and with multiplexing
The multiplexing configuration does not need to be enabled with -o
; you can also do this in the SSH setup file. Besides the instructions, ControlMaster
and ControlPath
users can optionally define ControlPersist
here; this determines how long the master connection waits for clients in the background after the first connection is done. Users can enter either no
(master does not wait), yes
(master waits forever) or a period of time in seconds. Listing 3 gives you an example.
Listing 3
Multiplexing settings in ~/.ssh/config
By the way, it is not only SSH clients that benefit from the multiplexing feature, but also scp
, rsync
, git,
and other commands that use the SSH protocol.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
![Learn More](https://www.linux-magazine.com/var/linux_magazin/storage/images/media/linux-magazine-eng-us/images/misc/learn-more/834592-1-eng-US/Learn-More_medium.png)
News
-
NVIDIA Released Driver for Upcoming NVIDIA 560 GPU for Linux
Not only has NVIDIA released the driver for its upcoming CPU series, it's the first release that defaults to using open-source GPU kernel modules.
-
OpenMandriva Lx 24.07 Released
If you’re into rolling release Linux distributions, OpenMandriva ROME has a new snapshot with a new kernel.
-
Kernel 6.10 Available for General Usage
Linus Torvalds has released the 6.10 kernel and it includes significant performance increases for Intel Core hybrid systems and more.
-
TUXEDO Computers Releases InfinityBook Pro 14 Gen9 Laptop
Sporting either AMD or Intel CPUs, the TUXEDO InfinityBook Pro 14 is an extremely compact, lightweight, sturdy powerhouse.
-
Google Extends Support for Linux Kernels Used for Android
Because the LTS Linux kernel releases are so important to Android, Google has decided to extend the support period beyond that offered by the kernel development team.
-
Linux Mint 22 Stable Delayed
If you're anxious about getting your hands on the stable release of Linux Mint 22, it looks as if you're going to have to wait a bit longer.
-
Nitrux 3.5.1 Available for Install
The latest version of the immutable, systemd-free distribution includes an updated kernel and NVIDIA driver.
-
Debian 12.6 Released with Plenty of Bug Fixes and Updates
The sixth update to Debian "Bookworm" is all about security mitigations and making adjustments for some "serious problems."
-
Canonical Offers 12-Year LTS for Open Source Docker Images
Canonical is expanding its LTS offering to reach beyond the DEB packages with a new distro-less Docker image.
-
Plasma Desktop 6.1 Released with Several Enhancements
If you're a fan of Plasma Desktop, you should be excited about this new point release.