[HN Gopher] Using SSH_config Match to connect to a host using mu...
___________________________________________________________________
Using SSH_config Match to connect to a host using multiple IP or
Hostnames
Author : srijan4
Score : 101 points
Date : 2022-08-17 11:42 UTC (11 hours ago)
(HTM) web link (fmartingr.com)
(TXT) w3m dump (fmartingr.com)
| blueflow wrote:
| The ssh config is quite versatile, its worth giving the manual a
| look: https://man7.org/linux/man-pages/man5/ssh_config.5.html
| nwatson wrote:
| Could also set up DNS server to return different IP addresses for
| same hostnames depending on the which interface the DNS client is
| connecting from. There'd only be one hostname per server, two (or
| more) IP addresses each mapped to originating network.
|
| Edit: autocorrect
| TechBro8615 wrote:
| What if the client cached the DNS lookup from when it connected
| on a previous interface?
| spicymellon wrote:
| egberts1 wrote:
| While I draft an easy prompting for complex YubiKey SSH MatchHost
| (not yet git-pushed), I've got this OpenSSH configuration tool
| based on user-prompting of many other OpenSSH-related
| configuration settings into sshd.conf/ssh.conf file using
| /etc/ssh[d].conf.d directory holding many setting files.
|
| Each setting file has a full comment page on how to use its
| keyword, a commented-out default setting, and a CISecurity-
| recommended setting.
|
| Each setting files are named (via numeric prefix) to be in
| execution order, which enables for easier thinking of "how deep"
| it goes into the SSH protocol.
|
| As a default, the config files are written into a local
| build/etc/ssh subdirectories for perusal before being implemented
| manually into /etc
|
| Plus, I code-review OpenSSH regularly.
|
| https://github.com/egberts/easy-admin/tree/main/490-net-ssh
| HvTfMhdTZ8Lths6 wrote:
| What is "SDN", how is it different from the thing that everyone
| else has called "VPN" for a few decades, and why not just have
| its resolver serve answers for the same TLD? Or better yet why
| not just route your home subnet over the VPN subnet (probably
| with a high metric, so that it doesn't override "real" routes) so
| you don't need a different IP?
|
| Match is extremely useful though. It's in use on a few systems I
| control to allow password authentication from certain subnets.
| srijan4 wrote:
| I used ssh_config's `Match` recently to route only okta-managed
| servers via their auth proxy command. That was quite powerful.
| mmh0000 wrote:
| I love Match. I use it to automatically select my bastion/jump
| host when not on my home network and not on my local VPN:
| $ cat ~/.ssh/config # Define external nodes here
| ...SNIP... # If connecting to a *.xn0.org host and
| router.xn0.org = 10.0.0.1, must be home/vpn. Match host
| *.xn0.org exec "getent ahosts router.xn0.org | grep -q ^10.0.0.1"
| ProxyJump none # If connecting to a *.xn0.org host and the
| macaddr of 10.0.0.1 is NOT f0:9f:XX:XX:XX:XX, then use
| jump.xn0.org: Match host *.xn0.org exec "! arp -ne 10.0.0.1
| | grep -Fq f0:9f:XX:XX:XX:XX" ProxyJump jump.xn0.org
| # Define internal nodes here ...SNIP...
| linsomniac wrote:
| I also used to do mosh+tmux for remote development from my Mac.
|
| A few months ago I switched to WezTerm, which has a built-in
| first class terminal multiplexer and remote protocol, including
| typeahead. The benefits are that I'm using the same terminal I
| (now) use on my Linux box, so I have the same keyboard shortcuts
| on Mac and Linux, and various things like cut/paste aren't
| weirded out by tmux.
|
| The one downside I've had so far is that often when I've
| suspended too long my wezterm client disconnects and I have to
| reconnect to the session (just up-arrow+enter in my terminal),
| where mosh+tmux would just stay always there.
| zokier wrote:
| Neat trick, but seems like something that should be solveable few
| layers lower. Does he mean VPN when he says "SDN"? Like why does
| the laptop have two different IPs and hostnames to begin with?
| AdamJacobMuller wrote:
| Probably means something NG-vpn like tailscale
| uberduper wrote:
| `Match exec` lets you do some convenient stuff. Like using env
| vars to determine which environment you're ssh'ing to when you
| re-use cidrs in multiple regions or w/e.
|
| `Match exec "test ${REGION}.${ENVIRONMENT} = us-east-1.staging"
| ProxyJump yourRegionEnvSpecificBastion`
| 0x0 wrote:
| I had no idea .ssh/config could do arbitrary command exec. Neat
| (and scary!) :)
| ape4 wrote:
| Yeah seems like there should be an option to disable that
| blueflow wrote:
| Its not increasing any attack surface, or can you construct a
| situation where it could be exploited?
| jarym wrote:
| I did not know we could do exec in ssh config so I learnt
| something new today!
|
| However, I also have a similar setup but for my SDN I use
| Twingate which lets me re-route DNS when its connected so all I
| need to do is the equivalent of defining *.lan
|
| as a resource in the UI and then I can reach it no matter when
| I'm connected via SDN or not.
| Haegin wrote:
| Match is useful, but for anyone trying to solve the problem of
| accessing a given machine from different networks check out
| Tailscale. It's one of the closest things to magic that I've
| found in recent years and just works. I used to have a dynamic
| DNS thing set up, and all kinds of firewall rules to be able to
| ssh to my home machine when on the road from my laptop and now I
| just ssh [hostname] and it just works, wherever I am.
| bin_bash wrote:
| ICYMI make sure you check out the "ssh tips" thread from
| yesterday: https://news.ycombinator.com/item?id=32486031
|
| (As someone that's a long-term SSH user most of the good stuff
| was in the thread)
|
| I also believe the day before yesterday someone showed an
| incredible rsync/dotfile/ssh trick in the comments but I have no
| idea what article it was on.
|
| I'm not sure if Big SSH is astroturfing HN lately or not but I'm
| here for it.
| InvaderFizz wrote:
| The dotfile post: https://news.ycombinator.com/item?id=32468605
|
| I bookmarked that for reference last night.
___________________________________________________________________
(page generated 2022-08-17 23:01 UTC)