6 useful things you can do with SSH

SSH is probably my favorite piece of software. It is free, gives me freedom, it is easy to use, yet is very powerful. With SSH, you can encrypt communications. That works out to a very universal way for almost every problem. In this small howto I will show 6 useful things that you - can do with ssh - without too much stress. SSH is more than "just" a secure remote shell!

Thing # 1 - A secure remote shell

This is the most obvious thing you can do with SSH and most Linux users have probably done this before: A secure connection with another computer to produce and administer them about it.

This is very simple:

  ssh user @ box_B 

This connects you to BOX B as "user". Then you can as a "user" to work on BOX B.

Sometimes one needs no interactive session to a remote computer, but would only run a single command.

  ssh user @ box_B command 

Here you will be connected to box B as a "user" command "command" is executed, the result ends up on the local standard output and terminates the connection.

Thing # 2 - Copy files between computers safely

Cool, we can manage a remote machine with SSH, but you can also copy files using SSH from one machine to another. It basically works like the "cp" command, but it is called "scp" - Secure Copy.

  scp / home / me / a_file.txt box_B user @ :/ home / me / 

This copies the local file '/ home / me / a_file.txt "in Box A for" / home / me / a_file.txt "in Box B.

It works the other way:

  scp user @ box_B :/ home / me / b_file.txt / home / me 

This would copy the file "/ home / me / b_file.txt" from box B to box A on the home directory.

Because "scp" something like that works like "cp" wildcards are allowed:

  scp / var / log / * user @ box_B :/ home / me / logsbackup 

This copies all the log files from box A to '/ home / me / logsbackup "in Box B.

Thing # 3 - A directory tree on a remote machine's local file system

Sometimes it's not just a few files from one computer to another copy. To mount a remote directory to the local file system is super useful when you want to edit remote files with local programs. A good example would be, for example, work on a Web page on a remote server. It is simply the web directory on the remote server to the local file system and then save and open the files with all the cool locally installed HTML editors and graphics programs. Quite as if the files on the disk loaklen. For this one needs "sshfs". The FUSE file system is not installed in many distributions by default, but usually included in the repositories. On Debian and Ubuntu you can install it like this:

  apt-get install sshfs 

After installation you can start using it

  mkdir / mnt / b_data
 sshfs user @ box_B b_data :/ / mnt / b_data 

This will mount the directory "/ b_data" according to Box B '/ mnt / b_data "in the local file system. Now you can work with local program the remote files. When you're done, you can remove the mount again:

  fusermount-u / mnt / b_data 

If the unmount fails should you check to see if there are open files from remote computers or whether it is still with the shell or file manager in the mounted directory.

Thing # 4 - uncensored and anonymous surfing by "critical locations" from the Web

Company policies, fascist governments, Internet cafes and other unfriendly regimes, institutions and places can make a secure and private access to the Web rather difficult. Firewalls and proxies could block out on the web, where you can log surfing around, run man-in-the-middle attack, or simply generate only a queasy feeling. SSH is the solution to all these problems. It offers the opportunity as a web proxy (SOCKS) to work. It simply connects via SSH to good trusted BOX B and surf through this connection.

(Local Browser <-> local SSH proxy <-> SSH <-> Box B <-> Website)

Then no one can censor block the hostile local LAN, or sniffing.
Sounds good? It is actually very easy to set up and use! SSH provides the "-D" option to use a SOCKS proxy on the local machine set up:

  ssh-D 1234 user @ box_B 

Now you have a SOCKS proxy on localhost port listens to the 1234th Now you only have to configure their browser so still that he used this proxy for internet connections. One can check that all is well, if you call in a web browser that issues the IP address that was used for the connection. http://www.whatismyip.com would work, but there are 1000s of other sites. If there is the IP of box B appears, everything is fine. Portalbler a browser on a USB flash drive, such as Portable Firefox would make things even more enjoyable.

Thing # 5 - The encrypt traffic from local programs and services in tunnels or on LAN access, which are not normally accessible via the Internet.

OK, we have certainly managed machines, copy files from machine to machine safely and have even censored in China surf the Web. However, SSH can do more! One can thus use the data exchange between all the TCP send local programs through a tunnel to a trusted computer. As with the SOCKS proxy, you can send data traffic through the tunnel first, for example, by the local e-mail client, so it does not have to flow through the local LAN. We want to get our e-mail in a "critical" condition. Script kiddies, stupid admins and terror-China hackers could read along the mitsniffen mail or even e-mail password. SSH helps. The syntax for using SSH tunnel is a little cramped at first, and quite a brain-twister, but actually quite logical and not difficult with a little practice:

  ssh-L local_port: target_host: user @ target_port box_B 

for example:

  ssh-L 10000: pop3.mailprovider.com: 110 user @ box_B 

What happened here? SSH is a need Tunnnel with a local (L) at endpoint port to create 10000th Everything is thrown into this local endpoint of data flows to Box B first encrypted and then to "pop3.mailprovider.com" on port 110 (port 110 is POP3). The data flow that is, from local e-mail client encrypts to Box B and from there to the e-mail provider. The e-mail account on the local client needs so the POP server, the following settings: Server: localhost / port: 10000. But it must be e-mail is not necessarily. Any application that uses the TCP protocol can be tunneled. For example, IRC, FTP, HTTP, IMAP, etc.

If the server should not be accessed anywhere on the Internet but on box B is itself the target machine can also be BOX B:

  ssh user @ L 10000:127.0.0.1:110 box_B 

The aim in this example, "127.0.0.1", because it is the goal from the perspective of Box B is. Because "127.0.0.1" as seen from Box B Box B is itself

Tunnels can be useful to protect Internet services, but also about access to services in BOX B's private network. If you own an externally accessible SSH account on a LAN, you can gain instant access to all TCP services in diesm LAN, just as if you were a "real" client in the LAN.

Suppose B is in a BOX Intrantet, which houses an interesting Web server, but which is not accessible from the Ineternet. This server is running on the LAN box to 192.168.0.77. With SSH tunneling is now simply a local port to port 80 of the web server on the LAN:

  ssh user @ L 10000:192.168.0.77:80 box_B 

If you now "http://127.0.0.1:10000" in the local web browser calls it lands on the home page of the web server in the remote intranet.

Thing # 6 - A tunnel - the other way around

If # 5 is clear, should reverse tunnel be a problem anymore. Here is a remote endpoint for the tunnel is created. Everything is there, flows into an encrypted format to BOX A (the local computer) and then forwarded to the destination computer.

  ssh-R remote_port: target_host: user @ target_port box_B 

for example:

  ssh-R 10000: pop3.mailprovider.com: 110 user @ box_B 

In the e-mail client would be as a POP server "box B" port and enter "10000."
BOX B then tunnels the traffic in order to first make A BOX. Box A, then forward to "pop3.mailprovider.com" port "110"

Quick command-line options for SSH

-C "Compress"

The "-c" option compresses the transmitted data with gzip before they flow through Inetrnet. This increases the speed when transferring uncompressed data (such as plain text) thick. It is useful in transferring
long text files or web surfing when using SSH as a proxy.

  ssh-C-D 1234 user @ box_B 

-G "Grant Access"

The "-g" option eraubt other hosts than localhost to access the locally created tunnel endpoints. Thus, for example, other computers on the LAN using the local-scale tunnel.

  ssh-L-g 10000:127.0.0.1:110 user @ box_B 

-P "port"

The "-p" option is needed if the remote SSH server is listening on the default port 22.

  ssh-p 22 000 user @ box_b 

-V "verbose"

With this option you can see a lot of technical connection information if you want to delve deeper into SSH.

More reading:

I've tried to write this article as simple as possible, as he is to serve myself primarily as a reference. There are still many more things you can do with SSH:

The SSH man page

The SSH RFC

Wikipedia on SSH

SSH - The Definitive Guide by O'Reilly