Editing Linux 101 hacks (section)

='''Chapter 3: SSH Client Commands'''=


=='''Hack 12. Identify SSH Client Version'''==


Sometimes it may be necessary to identify the SSH client that you are currently running and it’s corresponding version number. Use ssh –V to identify the version number. Please note that Linux comes with OpenSSH.


The following example indicates that this particular system is using OpenSSH:


$ ssh -V


OpenSSH_3.9p1, OpenSSL 0.9.7a Feb 19 2003


The following example indicates that this particular system is using SSH2:


$ ssh -V


ssh: SSH Secure Shell 3.2.9.1 (non-commercial version) on i686-pc-linux-gnu


=='''Hack 13. Login to Remote Host using SSH'''==


The First time when you login to a remotehost from a localhost, it will display the host key not found message and you can give “yes” to continue. The host key of the remote host will be added under .ssh2/hostkeys directory of your home directory, as shown below.


localhost$ '''ssh -l jsmith remotehost.example.com'''


Host key not found from database. Key fingerprint:


xabie-dezbc-manud-bartd-satsy-limit-nexiu-jambl-title-jarde-tuxum

You can get a public key’s fingerprint by running % ssh-keygen -F publickey.pub


on the keyfile.


Are you sure you want to continue connecting (yes/no)? '''Yes'''


Host key saved to /home/jsmith/.ssh2/hostkeys/key_22_remotehost.example.com.pub host key for remotehost.example.com, accepted by jsmith Mon May 26 2008 16:06:50 -0700


jsmith@remotehost.example.com password:


remotehost.example.com$


The Second time when you login to the remote host from the localhost, it will prompt only for the password as the remote host key is already added to the known hosts list of the ssh client.


localhost$ '''ssh -l jsmith remotehost.example.com''' jsmith@remotehost.example.com password:


remotehost.example.com$


For some reason, if the host key of the remote host is changed after you logged in for the first time, you may get a warning message as shown below. This could be because of various reasons such as:


o Sysadmin upgraded/reinstalled the SSH server on the remote host


o Someone is doing malicious activity etc.,


The best possible action to take before saying “yes” to the message below, is to call your sysadmin and identify why you got the host key changed message and verify whether it is the correct host key or not.


localhost$ '''ssh -l jsmith remotehost.example.com'''



{| style="border-spacing:0;"
| colspan="4"  style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
| colspan="0"  style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| 

|-
| style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| @
| colspan="2"  style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| WARNING: HOST IDENTIFICATION
| style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| HAS CHANGED!
| colspan="0"  style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| <div align="right">@</div>

|-
| colspan="4"  style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
| colspan="0"  style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| 

|-
| colspan="2"  style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| IT IS POSSIBLE THAT SOMEONE IS
| style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| DOING
| style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| SOMETHING NASTY!
| colspan="0"  style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| 

|-
| style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| Someone
| style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| could be eavesdropping
| colspan="2"  style="border:none;padding-top:0in;padding-bottom:0in;padding-left:0.075in;padding-right:0.075in;"| on you right now (man-in-the-

|}




middle attack)!


It is also possible that the host key has just been changed. Please contact your system administrator.


Add correct host key to “/home/jsmith/.ssh2/hostkeys/key_22_remotehost.example.com.pu b”


to get rid of this message. Received server key’s fingerprint:


xabie-dezbc-manud-bartd-satsy-limit-nexiu-jambl-title-arde-tuxum


You can get a public key’s fingerprint by running % ssh-keygen -F publickey.pub


on the keyfile.


Agent forwarding is disabled to avoid attacks by corrupted servers.


Are you sure you want to continue connecting (yes/no)? '''yes'''


Do you want to change the host key on disk (yes/no)? '''yes'''


Agent forwarding re-enabled. Host key saved to


/home/jsmith/.ssh2/hostkeys/key_22_remotehost.example.com.pub host key for remotehost.example.com, accepted by jsmith Mon May 26 2008 16:17:31 -0700


jsmith @remotehost.example.com’s password:


remotehost$


'''Hack 14. Debug SSH Client Session'''


Sometimes it is necessary to view debug messages to troubleshoot any SSH connection issues. pass -v (lowercase v) option to the ssh as shown below to view the ssh debug messages.


'''Example without SSH client debug message:'''


localhost$ '''ssh -l jsmith remotehost.example.com'''


warning: Connecting to remotehost.example.com failed: No address associated to the name

'''Example with SSH client debug message:'''


locaclhost$ '''ssh -v -l jsmith remotehost.example.com'''


debug: SshConfig/sshconfig.c:2838/ssh2_parse_config_ext: Metaconfig parsing stopped at line 3.


debug: SshConfig/sshconfig.c:637/ssh_config_set_param_verbose: Setting variable ‘VerboseMode’ to ‘FALSE’.


debug: SshConfig/sshconfig.c:3130/ssh_config_read_file_ext: Read 17 params from config file.


debug: Ssh2/ssh2.c:1707/main: User config file not found, using defaults. (Looked for ‘/home/jsmith/.ssh2/ssh2_config’)


debug: Connecting to remotehost.example.com, port 22… (SOCKS not used)

warning: Connecting to remotehost.example.com failed: No address associated to the name


=='''Hack 15. Toggle SSH Session using SSH Escape Character'''==


When you’ve logged on to the remotehost using ssh from the localhost, you may want to come back to the localhost to perform some activity and go back to remote host again. In this case, you don’t need to disconnect the ssh session to the remote host. Instead, follow the steps below.


# Login to remotehost from localhost: localhost$ ssh -l jsmith remotehost 




# Now you are connected to the remotehost: remotehost$ 

# To come back to the localhost temporarily, type the escape character ~ and Control-Z. 

<nowiki>When you type ~ you will not see that immediately on the screen until you press <Control-Z> and press enter. So, on the remotehost in a new line enter the following key strokes for the below to work: ~<Control-Z></nowiki>


remotehost$ '''~^Z'''


<nowiki>[1]+ </nowiki>Stopped ssh -l jsmith remotehost


localhost$


4. Now you are back to the localhost and the ssh remotehost client session runs as a typical UNIX background job, which you can check as shown below:


localhost$ '''jobs'''


<nowiki>[1]+ </nowiki>Stopped ssh -l jsmith remotehost


5. You can go back to the remote host ssh without entering the password again by bringing the background ssh remotehost session job to foreground on the localhost.


localhost$ '''fg %1'''


ssh -l jsmith remotehost


remotehost$


=='''Hack 16. SSH Session Statistics using SSH Escape Character'''==


To get some useful statistics about the current ssh session, do the following. This works only on SSH2 client.


# Login to remotehost from localhost. localhost$ ssh -l jsmith remotehost 

# On the remotehost, type ssh escape character ~ followed by s as shown below. This will display lot of useful statistics about the current SSH connection. 

remotehost$ <nowiki>[</nowiki>'''Note:''' The ~s is not visible on the command line when you type.]

remote host: remotehost local host: localhost

remote version: SSH-1.99-OpenSSH_3.9p1 local version: SSH-2.0-3.2.9.1 SSH Secure


Shell (non-commercial) compressed bytes in: 1506


uncompressed bytes in: 1622 compressed bytes out: 4997 uncompressed bytes out: 5118 packets in: 15


packets out: 24 rekeys: 0 Algorithms:

Chosen key exchange algorithm: diffie-hellman-group1-sha1

Chosen host key algorithm: ssh-dss


Common host key algorithms: ssh-dss,ssh-rsa Algorithms client to server:

Cipher: aes128-cbc MAC: hmac-sha1 Compression: zlib


Algorithms server to client:


Cipher: aes128-cbc


MAC: hmac-sha1


Compression: zlib


localhost$


'''Additional SSH Info'''


On a side note, to setup SSH key based authentication, refer [http://www.thegeekstuff.com/2008/06/perform-ssh-and-scp-without-entering-password-on-openssh/ ][http://www.thegeekstuff.com/2008/06/perform-ssh-and-scp-without-entering-password-on-openssh/ openSSH][http://www.thegeekstuff.com/2008/06/perform-ssh-and-scp-without-entering-password-on-openssh/  ]and [http://www.thegeekstuff.com/2008/06/comprehensive-guide-for-ssh2-key-based-authentication-setup/ ][http://www.thegeekstuff.com/2008/06/comprehensive-guide-for-ssh2-key-based-authentication-setup/ SSH2 ]tutorials.