39 lines
2.2 KiB
Markdown
39 lines
2.2 KiB
Markdown
---
|
|
title: "OpenSSH"
|
|
category: "Networking and remote access"
|
|
tagline: "Log in to other machines securely, and let them log in to this one."
|
|
source: "pacman"
|
|
package: "openssh"
|
|
command: "ssh"
|
|
website: "https://www.openssh.com/"
|
|
code: "https://github.com/openssh/openssh-portable"
|
|
---
|
|
|
|
## What it is
|
|
|
|
OpenSSH is the standard implementation of SSH, the encrypted protocol for logging in to another computer's shell, running commands on it and copying files (`scp`, `sftp`). It includes the client, `ssh`, and the server, `sshd`, that accepts connections, plus tools for creating and managing keys.
|
|
|
|
```
|
|
ssh you@machine.local
|
|
```
|
|
|
|
## Why it's here
|
|
|
|
- **Remote shells.** Work on your other machines and servers from this one.
|
|
- **Secure file transfer.** Copy files with `scp`, `sftp` or `rsync` over SSH.
|
|
- **Tunnels.** Forward ports to reach services on another machine.
|
|
|
|
## On CoreDesktop
|
|
|
|
OpenSSH is installed from pacman and `sshd.service` is enabled, so you can SSH into this computer. It accepts keys only, not passwords, so nobody on the same Wi-Fi can try to guess yours. Copy your public key to this computer once, from the computer you connect from:
|
|
|
|
```
|
|
ssh-copy-id you@machine.local
|
|
```
|
|
|
|
To allow passwords again, delete `/etc/ssh/sshd_config.d/10-coredesktop-keys-only.conf` and run `sudo systemctl reload sshd`. On machines installed earlier, where someone has logged in over SSH with a password, `update` leaves passwords on so nobody is locked out; add your key, then run `bash ~/.local/share/coredesktop/system/sshd.sh` to switch.
|
|
|
|
The firewall allows SSH on port 22, and Avahi advertises it on your LAN, so other machines can reach this one as `<hostname>.local`. Commands run with `ssh machine command` can find tools in `~/.local/bin` and mise.
|
|
|
|
For the client, CoreDesktop sets keepalives so a dropped connection is noticed within a minute (your `~/.ssh/config` still wins per host) and uses [Bitwarden](/software/bitwarden/)'s SSH agent while Bitwarden is running it, and GNOME's otherwise. It also adds shell functions for port forwarding: `fip <host> <port>...` forwards local ports to the same ports on a host, `dip <port>...` stops them, and `lip` lists them. `update` keeps OpenSSH current with the pacman packages.
|