Differences

This shows you the differences between two versions of the page.

Link to this comparison view

wiki:infrastructure_tools:ssh:ssh-tweaking-openssh-client [2014/01/25 23:15] (current)
Line 1: Line 1:
 +====== SSH Tweaking OpenSSH Client ======
 +
 +===== Preface =====
 +
 +In general it is possible to say that all described option from this document are optional. On another hand to play with this options can simplify your life. \\
 +All described options is possible to configure in:
 +
 +<​code>​
 +“ /​etc/​ssh/​ssh_config “               # To change any option in this file will affect all users of the server
 +“ ~/​.ssh/​ssh_config “                 # To change the option in this file will affect just particular user
 +</​code>​
 +
 +===== Options =====
 +
 +==== Compression (Compression) ====
 +
 +Description:​ "​Compression yes/​no"​
 +
 +This option will enable the compression of traffic passing through SSH session. SSH is using same compressing algorithms like gzip. In many cases you can help with this option to the SSH session.
 +
 +On another hand at some causes it is not really needed (all that you can get is higher CPU and RAM utilization). Nice example for cause where you shall not use it is at transferring already comprised data through SSH session.
 +
 +==== RandomArt (VisualHostKey) ====
 +
 +Description:​ "​VisualHostKey yes/​no"​
 +
 +In the case that you will enable this option you will see ASCI pictogram based on SSH Server key, any time when you will login to the server:
 +
 +<​code>​
 +[user@SSH_Client ~]$ ssh SSH_Server
 +Host key fingerprint is 0b:​f4:​46:​57:​a5:​ff:​30:​70:​00:​f8:​22:​90:​fb:​f2:​ed:​70
 ++--[ RSA 2048]----+
 +|     ​. ​  ​...o.. ​ |
 +|    o   ​. ​ . o   |
 +|     o. ... o .  |
 +|    ...o... ​ +   |
 +|     ​...S. ​   +  |
 +|    . .o .     + |
 +|     ​o..E ​      .|
 +|      .o.        |
 +|       ​.. ​       |
 ++-----------------+
 +
 +user@SSH_Server'​s password:
 +Last login: Sat Jan 25 19:11:46 2014 from SSH_Client
 +[user@SSH_Server ~]$
 +</​code>​
 +
 +==== Keep alive (ServerAliveInterval) ====
 +
 +Description:​ "​ServerAliveInterval <​time>"​
 +
 +\\
 +In some cases it is important to keep some traffic passing between SSH Server and SSH Client to keep the session open. According to this it is really handy to send a null packet periodically between SSH Server and SSH Client.
 +
 +\\
 +According to this you can configure to send null packet periodically with the option:\\
 +ServerAliveInterval 10
 +
 +\\
 +<note tip>As well you can configure SSH server to send null packet periodically with option “ClientAliveInterval” in “/​etc/​ssh/​sshd_config” ​  </​note>​
 +==== Multiplexing SSH connect (ControlMaster) ====
 +
 +Description:​
 +
 +<​code>​
 +" ControlMaster auto " ​                                # Open the Unix Socket automaticly
 +" ControlPath ~/​.ssh/​controlsock-%h-%p-%r " ​           # Location of the Unix Scocekt (%h=host, %p=poprt, %r=user)
 +" ControlPersist 30 " ​                                 # After log out of last sesion keep 30s the session open
 +</​code>​
 +
 +In this case you will open one TCP connection from SSH Client to SSH Server. In parallel you will create a Unix Socket. In the case that you would like to open parallel SSH connection to same SSH Server from your SSH Client your SSH client program will instead of connecting to SSH Server connect to local Unix Socket.
 +
 +<note tip>\\
 +Benefit: \\
 +- Any additional connection will skip the user authentication and authorization \\
 +Contra:\\
 +- Any additional connection will skip the user authentication and authorization
 +
 +According to this you need to carefully decide where you are going to use it and if it is safe.\\
 +</​note>​
 +
 +<note tip> For connection with TCP Port Forwarding you shall use switch " -S " to disable this function for particular session </​note>​
 +==== SSH Agent Forwarding(ForwardAgent) ====
 +
 +Description:"​ ForwardAgent yes "
 +
 +This option will automatically start SSH Agent Forwarding from your SSH Client to SSH Server. It is same as you will use “ –A “ switch at ssh command. In the case that you will enable this parameter SSH Client will start SSH Agent forwarding automatically.
 +
 +==== Special SSH Server / Host related ​ configuration (Host) ====
 +
 +Description:​ " Host <​name_that_we_will_call>"​
 +
 +In some cases you are looking for host specific configuration. In this case it is possible to configure it at the end of our config file.
 +
 +<​code>​
 +host SSH_Server ​                                             # For this server enable SSH Agent Forwarding2
 +     ​ForwardAgent yes
 +</​code>​
 +
 +<note tip> it is possible to use as well " Host<​nowiki>​ *</​nowiki>​ " to set parameters for rest of not defined hosts</​note>​
 +==== Use DNSSEC (VerifyHostKeyDNS) ====
 +
 +Description:​ "​VerifyHostKeyDNS <​yes|ask>"​
 +
 +In some cases you are looking for host specific configuration. In this case it is possible to configure it at the end of our config file.
 +
 +In the case that you are storing all public keys in DNS and you are using DNSSEC it is handy to use this as an authentication authority. In this way client will connect to SSH Server. To validate SSH Server’s keys will be used DNS instead of “ ~/​.ssh/​known_hosts ”.
 +
 +<note tip>\\
 +Option “yes” will not ask you for validating the SSH Server key when it will match the SSH key stored at DNS. \\
 +Option “ask” will ask you any time for confirmation for all SSH Servers.\\
 +</​note>​ \\
 +<note tip>To create a DNS record for your server it is possible to use “ssh-keygen –r <​hostname>​ “</​note>​
 +==== X Server Forwarding ====
 +
 +Description:​ " ForwardX11 yes/no "
 +
 +This option will enable X Server Forwarding from SSH Client to SSH Server. This option is handy in case that you would like to run application requiring X server on your SSH Server but you do not wont to install the X Server with Windows manager on the SSH Server. In this case you can use X Server running on your SSH Client site.
  
Navigation
Print/export
QR Code
QR Code wiki:infrastructure_tools:ssh:ssh-tweaking-openssh-client (generated for current page)