This morning a discussion with a friend about various shells lead me to think it would be nice if my bash shell could tab complete hostnames from .ssh/known_hosts when I type ‘ssh <tab>’. I soon found this blog post which nicely documents how to do it. I made a directory in $HOME called .bash.completion and then added this to my .profile, which loops round any files in there, sourcing them individually:
if [ -d ${HOME}/.bash.completion ]; then
for file in ${HOME}/.bash.completion/* ; do
source $file
done
fi
All sorted. However, it wasn’t long before I discovered that ‘ssh user@<tab>’ doesnt work, I tend to use this quite a lot so wanted to see if I could fix up the bash function to support that use case. Bit of hacking around and I’ve got it working, the replacement ssh-completion file is shown below:
__ssh_known_hosts() {
if [[ -f ~/.ssh/known_hosts ]]; then
cut -d " " -f1 ~/.ssh/known_hosts | cut -d "," -f1
fi
}
_ssh() {
local cur known_hosts
COMPREPLY=()
cur="${COMP_WORDS[COMP_CWORD]}"
known_hosts="$(__ssh_known_hosts)"
if [[ ! ${cur} == - ]] ; then
if [[ ${cur} == @ ]] ; then
COMPREPLY=( $(compgen -W "${known_hosts}" -P ${cur/@/}@ -- ${cur/*@/}) )
else
COMPREPLY=( $(compgen -W "${known_hosts}" -- ${cur}) )
fi
fi
return 0
}
complete -o bashdefault -o default -o nospace -F _ssh ssh 2>/dev/null \
|| complete -o default -o nospace -F _ssh ssh
Une astuce utile pour faire un audit des connexions par clé sur un compte (quand on a plusieurs personnes avec des clés différentes qui accèdent au meme user)
Implémentation rapide :
#On convertit le authorized_keys pour ajouter la variable d'env
cp ~/.ssh/authorized_keyz ~/.ssh/authorized_keyz.ORIGINAL
IFS=$'\n'
for line in $(cat .ssh/authorized_keys)
do
comment=$(echo $line|cut -d' ' -f3)
echo "environment=\"SSH_USER=$comment\" $line" >> ~/.ssh/authorized_keyz.COMMENT
done
cp ~/.ssh/authorized_keyz.COMMENT ~/.ssh/authorized_keyz
Puis dans le bashrc de l'user, ajouter ça :
if [ "$SSHUSER" != "" ]; then
now=$(date +%Y-%m-%d%H-%M-%S)
echo $now : User $SSH_USER logged in >> ~/ssh-audit.log
fi
Ahah a tester
alternatives à authorized_keys
via Skunnyk
Cool stuff :
ssh user@server 'bash -s' < local_script.sh > local_script.log 2>&1
not bad
$ sudo /usr/sbin/sshd -t
$ echo $?
In Firefox, the solution is easy. Simply type about:config in the address bar and set network.proxy.socks_remote_dns to true. This will have the remote end (i.e., the machine you are SSH’ing to) handle the DNS lookups.
Un serveur, mais surtout un client pour faire du port knocking
Pour utiliser machinerebond pour accéder aux *.vm automatiquement :
$ cat .ssh/config
Host=machinerebond
Hostname=machinerebond.fqdn.com
User=root
Host=*.distant
User=root
ProxyCommand=ssh -W %h:22 machinerebond
Alternative :
D'abord se co sur la machine rebond avec un -A pour ramener sa key dans l'agent distant
Ensuite on peut se co sur les autres machines, mais plus long.
Autres directives possibles :
ServerAliveInterval 30
ServerAliveCountMax 120
Port 22000
User fooey
IdentityFile ~/.ssh/github.key
LocalForward 9906 127.0.0.1:3306
more : http://www.openbsd.org/cgi-bin/man.cgi?query=ssh_config&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html