SSH is one of the most important tools I have. I use it every day to communicate securely between many different computers, and consider it indespensable. In this article I’ll show you how to forward your SSH agent to connect from any remote server to any other remote server without putting your private key on either of them.
Introduction
First, the concept: SSH is a secure protocol for setting up a communications channel between two computers on a network. This communications channel can act as the “carrier” for any number of uses. All traffic is encrypted, so you can get a “secure line” across an insecure network.
Probably the most familiar usage of SSH is connecting and logging in remotely to another computer. Once logged in, you can use the command line just as though you were sitting at the other computer’s terminal. Other uses include secure FTP, secure file copies, secure CVS access, running GUI applications on another computer and forwarding the display to the computer you’re working on so it appears to be running on your own computer, and on and on.
If there’s a UNIX or GNU/Linux distribution that doesn’t include SSH by default, I’ve never heard of it. Even Mac OS X includes it. Microsoft Windows does not, but there’s an excellent free implementation that runs under Windows: PuTTY.
No more passwords!
One of the really nice things about SSH is that it supports multiple authentication methods. One is passwords. Passwords, though, are one of the least secure and convenient methods of authenticating. Enter public-key authentication: SSH can authenticate me with an encryption key. If I put my public key on someserver, present my private key to the SSH program and tell it to connect to someserver, the SSH server on the other end uses my public key to log me in. I never have to type a password.
All I have to do is generate an encryption key pair. The keys are matched to each other in such a way that anything I encrypt with my private key can only be decrypted with my public key, and vice versa. That’s how I can log in without sending my private key to the other server — my SSH program just encrypts the traffic and sends it, and the server at the other end of the connection can either decrypt it or it can’t. If it has my public key available, it can.
Now, to make it really convenient, I need to load my private key into memory. I use the handy keychain program to do this. One done, my key is ready for use until I reboot the computer. At my previous employer I used PuTTY on Windows, so I used the Pageant program to load my private key. I also used the excellent free CVS client TortoiseCVS (there’s a similar one for Subversion, too — TortoiseSVN).
Guess what? No more passwords! Any computer I connect to will just magically log me in, as long as it has my public key. For more information on this, please read the keychain documentation, especially the IBM DeveloperWorks articles to which it links.
One thing to watch out for: don’t let anyone have your private key. Keep it private and secure. Make sure you know which of your keys is the public key and which is the private key. Nobody needs your private key, and you shouldn’t have it on any other computer — you put your public key on the computers to which you need to connect.
More convenience: forwarding keys
OK, so I’ve set everything up. I have put my public key on the two computers I connect to, server1 and server2. I open a terminal and type ssh server1. Boom! I’m logged in. Then I realize I put a file on server2 and I need it. I’m on server1 right now. No problem; I connect via SSH. But wait, server2 asks me for my password! What’s this?
What happened is, I logged into server1 with my private key, but when I tried to connect to server2, my private key wasn’t available to authenticate me. At this point, I might copy my private key to server1, but that’s not the best way to do it. In fact, it’s possible to tell SSH to forward my private key to servers when I connect to them. This is in-memory only; the key never gets stored on the disk, so it stays secure. But it’s available if it’s needed to connect to other servers. This chain of forwarding can go on and on. All I need to do is tell SSH to forward the keys (more strictly, forward the agent, which has loaded my keys into memory). This is a configuration option, set in the .ssh/config file on my local computer — the one I’m sitting at:
Host * ForwardAgent yes
That configuration directive tells SSH to forward my SSH agent to all hosts. Voila!
Next steps
I’ve covered a lot of ground here, and not really gone into much depth with any of it, but I hope this gives you an idea of how much there is to SSH — one of those great tools that can be as simple or as complex as you need it to be. I’m not even pretending to be an expert; I know I don’t know that much about it myself. I only know as much as I’m motivated to learn :-)
While I’m on the subject, I want to point out that probably the most widely used implementation of SSH is OpenSSH. It’s from the same people that make OpenBSD, a famously secure operating system. And though it is nearly ubiquitous and indispensable, even for Microsoft folks, very little attention goes to the fact that it’s free but nobody really contributes money to it. The OpenSSH project is painfully underfunded, and there is widespread discussion about the problems this may cause. I encourage you to donate something to it, even if it’s just ten dollars. It is easily the most underfunded project I can think of, especially considering how much of the world depends on it.
Technorati Tags:No Tags
Blogs as glamour magazines
I wrote previously about IE blog’s excellent quality. Unfortunately, there’s bad news to report, too. I’ve been noticing some trends in web design blogs. Many have a similar style to glamour magazines. While many elements of glamour magazines are not echoed in these blogs, to the extent they are, I think it detracts from them quite a bit.
Top X lists
Many blogs posts try to “bite-size” a topic. A common theme is Top n Lists. Some are good, but many are completely substanceless. Anyone can write one in a few minutes.
Compare this to the cover of a glamour magazine:
I think the appeal is the number itself. It subtly implies the list is complete — if the number isn’t there, the title doesn’t assert anything about completeness. Who wants to read Easy moves to firmer thighs? There’s subconscious psychology at work here. Of course, the list often falls short of a strong start, much less completeness!
Repetitive, non-original content
The Internet is becoming an echo chamber. Someone writes a post, then someone else writes a post about it, then… it’s not uncommon to find thousands of links to a post. Many of these posts appear to be original content, until you read carefully and realize it’s a formulaic, substanceless copy-and-paste (partial or complete) with little or no original content — sometimes not even a short intro sentence.
For an example, try a Google search for “top 10 custom javascript functions of all time” and see how many results you get. I’m getting about 142,000 results. MSN finds thousands of pages that link directly to the post on the author’s site. One such post, on a very popular blog, misspelled two words in the title until it was corrected a few minutes later! That’s an indication of how little time goes into these echo-chamber posts.
It’s becoming harder and harder to find original content in the soup of copy-and-paste posts. Some blog networks, such as 9rules (of which this site is a member) are acting as trusted filters, but even then a lot of the content is derived.
Glamour magazines are often similarly unoriginal. At first glance, many articles look like real journalism, but then it becomes apparent much of the material is secondary, often just copied from some “authority” on the subject with a few sentences framing the quotes. I know people who’ve been exploited by such “article-writing” practices. There are many vultures waiting for someone else to make something they can use.
How glamour magazines are better
I wish it weren’t true, but glamour magazines are often written better than blogs. For example, let me pick on one particular blog which claims to be well written, and is therefore a fair target for criticism: Good Copywriting. The second post contained this text urging people to clean up their spelling:
Amusingly, the author misspelled “definitely” as “definately” a few paragraphs later. I corrected this in a comment, which never got approved by the moderator — but minutes later, the spelling was fixed. Subsequent posts have been just as bad, with jewels like “truely” (twice in a couple of sentences!), “guarenteed,” “an equal’s sign,” “brining” (should be “bringing”), “effected” (instead of “affected” — there is a difference), run-on sentences, and so forth. Glamour magazines, for all their faults, generally seem to be proofread!
The future
I don’t have a crystal ball, but I have a feeling people will tire of repetitive, non-original content. I think the current blogging fad will fade quite a bit, and the folks doing it for the better reasons will probably continue writing quality material. I welcome such a change.
One final note: please feel free to leave comments telling me how I can improve my own writing, too!
Technorati Tags:No TagsYou might also like: