222 Technique 33: Securing Your Connections with SSH

they don’t belong. If the system fingerprints don’t match, SSH will warn you and you’ll know you have a potential man-in-the-middle attack. If that happens, ask the remote system administrator to read you his or her server’s fingerprint over the phone.

Getting graphic

You can also run graphical programs from your remote machine on your local desktop. The SSH server forwards X Windows traffic over the SSH connection automatically. Here are a few examples to illustrate how this works:

To see what time it is on the remote system, type the command xclock &. The clock displays the time on your local desktop, but it also displays the time on the server (you can’t tell the difference if you’re in the same time zone).

To see the files on the server, type konqueror & and press Enter. The Konqueror browser starts running on the server, but the display appears on your local desktop.

Creating Shortcuts to Your Favorite SSH Locations

SSH is handy at the command line, but you can also launch SSH sessions from a desktop link. And, if you’re a KDE aficionado, you can use the fish: protocol to create a link to a remote file or folder.

To add a desktop link that opens a terminal window connected to an SSH server, follow these steps:

1. Right-click on your desktop and choose Create New Link to Application.

A dialog opens.

2. Type a name for the link and click the Execute tab.

3. In the Command field, enter the following command:

gnome-terminal -x ssh bastille

4. Click OK.

Double-click the new link, and you’re logged in and working. If you’ve configured your desktop as we describe earlier in “Passing on your passphrase,” you don’t need to stop and enter passwords along the way.

With your remote terminal, you can open any graphical application on your Linux host.

At the command line, enter the name of the program — kedit, kate, konqueror . . . the list is endless.

You can open as many windows on your local desktop as your connection will support. These windows work like local windows in all respects, with the exception of drag and drop. Instead of drag and drop, we recommend using scp at the command line. See the next section for details.

If you’re using KDE as your desktop environment, you can create a link to a remote file or directory. Double-click a link to a remote directory, and KDE will open the directory with the Konqueror browser. After you double-click a link to a remote file, KDE opens the file using the right application (based on the file’s MIME type). Follow these steps to create a new link to a remote directory:

1. Right-click on the desktop and choose Create New Link to Location (URL) from the pop-up menu.

2. Enter the following command in the Enter Link to Location (URL) field and click OK:

fish://bastille/home

Substitute your remote machine’s name or IP address for bastille.

fish: is a KDE protocol that provides remote file management over an SSH connection. See Technique 1 for more information.

Secure (And Fast) Port Forwarding with SSH

223

When the dialog closes, a link on the server’s /home directory appears on your desktop.

3. To connect to the remote machine, just doubleclick the icon.

A Konqueror browser window opens, showing the /home directory.

Copying Files with scp

scp is similar to the cp command: It copies a file from a source to a destination. The difference between scp and cp is that scp can deal with files stored on remote hosts. scp uses the SSH protocol to encrypt the file being transferred and can take advantage of SSH’s compression feature to save you time. You can use scp to completely replace cp. To copy a file from one directory to another (on your local machine), use the following command:

$ scp /tmp/drink-recipes.txt /home/

If you want to copy a file from an SSH server or to an SSH server, include the remote host name on the command line, like this:

$ scp louvre:/pics/monalisa.jpg /tmp/ $ scp /tmp/monalisa.jpg orsay:/pics/

If you see a name that includes a colon, it most likely refers to a remote computer.

The first command copies /pics/monalisa.jpg from host louvre to the /tmp directory on your local computer. The second command copies the picture from your local computer to host orsay. If you haven’t copied your public key to louvre or orsay, you’re asked for a password.

You can also use scp to copy from one remote machine to another remote machine:

$scp louvre:/pics/monalisa.jpg orsay:/pics

Enable compression with the -C option:

$ scp -C /tmp/monalisa.jpg orsay:/pics/

If you don’t specify a fully qualified pathname, scp assumes that you want to copy into (or from) your home directory on the remote computer. For example, the command

$ scp -C louvre:paintings.list orsay:

copies a file from your home directory on louvre to your home directory on orsay.

You can include wildcards in an scp command, but you have to quote them if you want the wildcards to be expanded by the computer on the other end of the connection. For example, to copy all the .jpg files in your home directory on louvre to your local machine, use the following command:

$ scp -C “louvre:*.jpg” /tmp/

If you forget the quotes, the bash shell expands the wildcard before scp ever gets a chance to see it.

You can use scp to copy an entire directory tree with the -r option.

Secure (And Fast) Port

Forwarding with SSH

No Web site should be without a good firewall because too many villains are out there waiting to attack your computer. Firewalls keep the bad guys out, but they can sure make life tough for those of us wearing the white hats. Fortunately for the good guys, SSH can slip you past a firewall in no time.

Port forwarding lets you securely connect to a specific port on a remote computer without being blocked by a firewall. Neither the remote machine nor your local system can even tell that a firewall is there.

224 Technique 33: Securing Your Connections with SSH

Port forwarding with SSH can solve a lot of problems	To set up port forwarding between a PostgreSQL
for you, such as the following:	client running on your local computer and a
	PostgreSQL server running on louvre, simply use

Some software packages require access to spe- SSH to log into louvre and include a bit of command

cific port numbers.	line magic:
You can reach software on the other side of a	$ ssh -L 5432:louvre:5432 louvre
firewall.

Your data is traveling in encrypted form and can’t be seen by villains.

Your data is compressed and zips through the network much faster.

Port forwarding is kind of a strange process. The basic idea is that you connect to a port on your local computer, and SSH takes all the data that you send to that port and forwards it to another port on another computer. SSH also sends data back in the other direction for a complete connection.

To break that command down a bit, the ssh command connects to the SSH server running on host louvre. The cryptic-looking bit in the middle of the command (-L 5432:louvre:5432) forwards data from port 5432 on your local computer to port 5432 on louvre. Now when you start up a PostgreSQL client, you connect to local port 5432, even though the PostgreSQL server is running on a different computer:

$ psql -h localhost -p 5432 Welcome to psql, the PostgreSQL

interactive terminal freddie=#

Here’s an example. PostgreSQL database servers typically listen for clients on TCP port 5432. When you run a PostgreSQL client application, the client connects to the server on that port. The client and server exchange SQL queries and results over the connection and disconnect when they’re finished. A PostgreSQL client can connect to a server on the same computer (using local port 5432) or a server running on a remote computer (using the remote host name and port 5432).

You can introduce SSH into this mix to solve three different problems:

If a firewall is present between the client and the server, SSH can carry the data across the firewall for you.

If you have a slow connection to the server, SSH can compress the data stream to improve performance.

If you’re transmitting sensitive data across an insecure network, SSH will encrypt the data stream for you.

If you have a firewall between yourself and louvre, you can ask SSH to forward data across the firewall to a third computer. For example, if bastille is acting as a firewall (meaning that you can’t directly connect to any machines behind bastille), this command arranges for SSH to carry PostgreSQL data across the firewall and deliver it to louvre:

$ ssh -L 5432:louvre:5432 bastille

Notice that with this command, you’re logging into bastille, but SSH is forwarding the data to louvre. SSH can forward data to any machine that bastille can talk to. When SSH forwards data for you, the data stream is automatically encrypted. If you want to compress the data as well, just add a -C to the command line.

Choosing good passwords

Choose your passwords carefully. A good password should include both upperand lowercase letters, numbers, and punctuation if allowed. The system will set a limit on the length of your password, but generally speaking, the longer the password the better. It’s a bad idea to honor pets,

Secure (And Fast) Port Forwarding with SSH

225

children, and spouses in your password unless you’ve taken care to obscure the name with other characters like Fr3ddi3*! — and even then it’s not a great idea. It’s also a bad idea to use your license plate number — that should be obvious, but you’d be surprised how many people do it.

Be sure to choose a password that is obscure, but memorable. Writing it down leaves the password susceptible to

the prying eyes of anyone who gets access to your workspace. One common mnemonic is to use the first letter of each word in a phrase you won’t forget. Throw in some punctuation, or change case now and then, and you have a memorable password that’s also hard to guess. All King Edward’s Horses Can Master Big Fences! translates to AkehCmBf!, which is pretty unguessable.

Part VI

Networking Like

a Professional