SSH

Running SSH

to run ssh type:

ssh -X user@hostname

The -X allows X traffic to go back through the ssh connection.

Running SSH with port forwarding

X11 forwarding

To forward X11 connections use the -X flag

ssh -X <server>

forwarding client -> server

To forward a port, so that on the client machine you can use localhost:1234 to get to <server>:111 (so the server will see the connection coming locally, as if from inside the server) do

ssh -L 1234:localhost:111 <server>

To forward a port, so that on the client machine you can use localhost:1234 to get to <other-server>:111 (where <other-server> will see the connection coming from <server>) do

ssh -L 1234:<other-server>:111 <server>

forwarding server -> client

To forward a port, so that on the server machine you can use localhost:1234 to get to <client>:111 (so the client will see the connection coming locally, as if from the client) do

ssh -R 1234:localhost:111 <server>

To forward a port, so that on the server machine you can use localhost:1234 to get to <other-server>:111 (where <other-server> will see the connection coming from <server>) do

ssh -R 1234:<other-server>:111 <server>

Fancier port forwarding

If you want the connection to actually come from any source (instead of just the client (-L) or the server (-R)), specify *: as a prefix to the above addresses. For example:

ssh -R '*:1234:<other-server>:111' <server>

(Note: you need the 'quotes' to keep the shell from interpreting the *)

Setting up identity (log in without password)

NOTE: try ssh_install_key script.

On the machine you want to login FROM, do the following:

      ssh-keygen -t dsa -N "" -f $HOME/.ssh/id_dsa
      ssh-keygen -t rsa -N "" -f $HOME/.ssh/id_rsa

This creates

      ~/.ssh/id_dsa
      ~/.ssh/id_dsa.pub
      ~/.ssh/id_rsa
      ~/.ssh/id_rsa.pub

Now scp the id_dsa.pub files to the target machine (the machine you will be logging in TO) and cat it into ~/.ssh/authorized_keys2 as follows:

   On the FROM machine
      scp ~/.ssh/id_*.pub user@remotehost:
      ssh user@remotehost
         (you will need a password)
   On remotehost:
      mkdir ~/.ssh
      chmod 700 ~/.ssh
      touch ~/.ssh/authorized_keys
      ln ~/.ssh/authorized_keys ~/.ssh/authorized_keys2
      chmod 600 ~/.ssh/authorized_keys

      cat ~/id_dsa.pub >> ~/.ssh/authorized_keys
      rm ~/id_*sa.pub
      exit

Now you will be able to use ssh to login from the FROM machine to the TO machine without having to supply a password.

If you get messages about mismatched host keys

This will mention a line in the known_hosts file. Edit the file and delete the offending lines. Then try again. You will be prompted to be sure you want to connect to the unknown host. If you are sure you are not being spoofed, say yes.

If a server key changes or server gets reinstalled

On client, do the following to remove the old host key for the server <server-hostname> :

    ssh-keygen -R <server-hostname>

If it does not work

Sshd may use "authorized_keys" or "authorized_keys2" or something else. Check /etc/ssh/sshd_config on the server. Look for a line with "AuthorizedKeysFile" which tells sshd which filename to use.
Try using ~/ssh2 in place of ~/.ssh (rename the directory).

Try the following

    chmod 700 ~/.ssh
    chmod go-w ~        # may make ssh happy
    ssh-vulnkeys        # will show if any keys are vulnerable

Running sshd on windows

This info is from http://www.noah.org/ssh/cygwin-sshd.html

Install the following Cygwin packages (rerun setup if necessary -- you can add packages after you have already installed Cygwin).

    Admin --> cygrunsrv
    Net --> openssh

Open a new bash shell window and run the SSH configure stuff.

    ssh-host-config -y

This step will create necessary configuration files, a priviledge separation user and necessary directories.

When prompted with "CYGWIN=" type for following:

    tty ntsec

Now you are ready to start the service.

    cygrunsrv -S sshd

Finished

Note: sshd will now be started automatically on reboot. To start by hand use one of

	cygrunsrv --start sshd
	cygrunsrv -S sshd
    net start sshd

and to stop use one of

	cygrunsrv --stop sshd
	cygrunsrv -E sshd

OLD - IGNORE THIS!!! Setting up identity (log in without password)

On the machine you want to login FROM, do the following:

      ssh-keygen -t rsa
      ssh-keygen -t dsa

This creates

      ~/.ssh/id_rsa
      ~/.ssh/id_rsa.pub
      ~/.ssh/id_dsa
      ~/.ssh/id_dsa.pub

Now scp the id_rsa.pub and id_dsa.pub files to the target machine (the machine you will be logging in TO) and cat them into ~/.ssh/authorized_keys2 as follows:

   On the FROM machine
      scp ~/.ssh/id_*.pub user@remotehost:
      ssh user@remotehost
         (you will need a password)
   On remotehost:
      touch ~/.ssh/authorized_keys2
      chmod 600 ~/.ssh/authorized_keys2
      cat ~/id_rsa.pub >> ~/.ssh/authorized_keys2
      cat ~/id_dsa.pub >> ~/.ssh/authorized_keys2
      rm ~/id_*sa.pub
      exit

Now you will be able to use ssh to login from the FROM machine to the TO machine without having to supply a password.