The document discusses various SSH tricks and configurations, including setting up port forwarding tunnels for a "poor man's VPN", configuring SSH keys and host fingerprints, and using the ~/.ssh/config file to define SSH connection settings and aliases. It also covers enabling SSH autocompletion and disabling host key checking for automated deployments.

1. SSH tricks
Davide Ferrari - @vide
September 2016 - Billy Mobile

2. You have passed through this:
$ ssh moria.middle.earth -p 1234
Speak friend and enter

3. And through this:
$ ssh -l balrog moria.middle.earth
Connection timed out

4. Clickety clack
$ scp -P 666 ~/hobbits_archives/*
-i .ssh/smeagol.rsa
gollum@mordor.middle.earth

5. Enter ~/.ssh/config

6. Enter ~/.ssh/config
$ cat /home/lotr/.ssh/config
Host moria.middle.earth
User gandalf
Port 1234
Host mordor.middle.earth
User gollum
IdentityFile ~/.ssh/smeagol.rsa
Port 666
Host *.middle.earth
User hobbits
KexAlgorithms diffie-hellman-group1-sha1

7. Enter ~/.ssh/config
$ cat /home/lotr/.ssh/config
Host moria.middle.earth
User gandalf
Port 1234
Host mordor.middle.earth
User gollum
IdentityFile ~/.ssh/smeagol.rsa
Port 666
Host *.middle.earth
User hobbits
KexAlgorithms diffie-hellman-group1-sha1
You can put almost any ssh config option in there, and use wildcard
expansion. It’s respected by scp and ssh and anything using libssh

8. Enter ~/.ssh/config
$ cat /home/lotr/.ssh/config
Host moria.middle.earth
User gandalf
Port 1234
Host mordor.middle.earth
User gollum
IdentityFile ~/.ssh/smeagol.rsa
Port 666
Host *.middle.earth
User hobbits
KexAlgorithms diffie-hellman-group1-sha1
You can put almost any ssh config option in there, and use wildcard
expansion. It’s respected by scp and ssh and anything using libssh
This is just the beginning of what you can do in .ssh/config

9. In any case
man ssh_config

10. In any case
man ssh_config
is your friend

11. What about some tunneling?

12. Poor man’s VPN

13. Poor man’s VPN
ssh user@remote_host -L 8000:127.0.0.1:9091 -N -f

14. Human readable please?

15. ssh user@remote_host -L 8000:127.0.0.1:9091 -N -f

16. ssh user@remote_host -L 8000:127.0.0.1:9091 -N -f
user@remote host: . . .

17. ssh user@remote_host -L 8000:127.0.0.1:9091 -N -f
user@remote host: . . .
8000: port opened on MY machine

18. ssh user@remote_host -L 8000:127.0.0.1:9091 -N -f
user@remote host: . . .
8000: port opened on MY machine
127.0.0.1:9091: address referred to the REMOTE network

19. ssh user@remote_host -L 8000:127.0.0.1:9091 -N -f
user@remote host: . . .
8000: port opened on MY machine
127.0.0.1:9091: address referred to the REMOTE network
-N: don’t execute anything on remote host

20. ssh user@remote_host -L 8000:127.0.0.1:9091 -N -f
user@remote host: . . .
8000: port opened on MY machine
127.0.0.1:9091: address referred to the REMOTE network
-N: don’t execute anything on remote host
-f: execute in background

21. The other way round
ssh user@remote_host -R 8111:127.0.0.1:80 -N -f

22. Fingerprint?

23. Fingerprint?

24. >THIS< fingerprint

25. >THIS< fingerprint
The authenticity of host ’178.36.62.115 (178.36.62.115)’ can’t b
ECDSA key fingerprint is SHA256:F0B6XIdcukwjjkI+edez42aQt6W73f+O
Are you sure you want to continue connecting (yes/no)

26. >THIS< fingerprint
The authenticity of host ’178.36.62.115 (178.36.62.115)’ can’t b
ECDSA key fingerprint is SHA256:F0B6XIdcukwjjkI+edez42aQt6W73f+O
Are you sure you want to continue connecting (yes/no)
This is a great security feature, protecting against MITM attacks, but
can be a real PITA especially when automatically deploying/copying
something and maybe remote server got reinstalled without preserving
the old keys

27. Solution?

28. Solution?
ssh -o UserKnownHostsFile=/dev/null
-o StrictHostKeyChecking=no
somebody@somewhere

29. Solution?
ssh -o UserKnownHostsFile=/dev/null
-o StrictHostKeyChecking=no
somebody@somewhere
This line will disable fingerprint checking (StrictHostKeyChecking=no)
and route to the void content directed to the Known Hosts file
(UserKnownHostsFile=/dev/null)

30. In other words

31. In other words
Host somewhere
User somebody
UserKnownHostsFile /dev/null
StrictHostKeyChecking no

32. Poor man’s VPN revisited
$ ssh foo@remote_host -L 8000:127.0.0.1:9091 -N -f

33. Poor man’s VPN revisited
$ ssh foo@remote_host -L 8000:127.0.0.1:9091 -N -f
$ cat ~/.ssh/config
Match user foo
LocalForward 8000 127.0.0.1:9091
$ ssh foo@remote_host -N -f
$ ssh foo@another_host -N -f

34. Autocompletion FTW

35. Autocompletion FTW
OSX: brew install bash-completion

36. Autocompletion FTW
OSX: brew install bash-completion
Ubuntu: sudo apt-get install bash-completion

37. Autocompletion FTW
OSX: brew install bash-completion
Ubuntu: sudo apt-get install bash-completion
Just to be sure:
echo "HashKnownHosts No" >> ~/.ssh/config

38. THE END. QUESTIONS?