12:53 am, 19 Jan 05
ssh multiplexing
Does anyone use OpenSSH 3.9+'s multiplexing (the ControlMaster and ControlPath options)? How have you made it painless enough to replace ssh-agent?
It seems to me that in an ideal world, rather than having the key exchange, etc. happen once per process, I'd rather be able to indicate "open a secure connection to this host" (which wouldn't bring up a shell) and then be able to open many shells, port forwardings, and copies as I'd like over that connection without reauthenticating. But as I understand these options you need to specify one connection as a sort of master and then explicitly tell the rest to use the master connection...
It seems to me that in an ideal world, rather than having the key exchange, etc. happen once per process, I'd rather be able to indicate "open a secure connection to this host" (which wouldn't bring up a shell) and then be able to open many shells, port forwardings, and copies as I'd like over that connection without reauthenticating. But as I understand these options you need to specify one connection as a sort of master and then explicitly tell the rest to use the master connection...
Have you seen this article? The things listed there seem a little hacky, but close to what you describe.
I'm not sure what flavor of ssh you're used to, but that's how the ssh2 protocol works (and by "ssh2 protocol" I mean the protocol spec, openssh servers, and ssh.com servers at the very least). Most clients don't support the full set of features, though. You can get some of them at the commandline: the ssh -N command just authenticates, and ssh -t will allocate a pseudoterminal (if the program you run doesn't do it for you, like login does) so you can use ssh escapes (usually ~C, in particular) to set up port forwardings, start sftp subsystems, invoke shells, etc. depending on what commandline client you're using. You can set up port-forward only connections that way, too, as well as agent-only connections (though I'n not certain how that would be useful).
Usually, if you can do anything, you can set up more forwarded connections by typing ~C, then typing the forwarding commandline option (either -L lport:desthost:dport or -R lport:desthost:dport). The SSH.com graphical windows client can start new shells and sftp subsystems using the same authentication, but can't add port forwardings. And PuTTY, damn it all, can't do any of it.
Does anyone use OpenSSH 3.9+'s multiplexing (the ControlMaster and ControlPath options)? How have you made it painless enough to replace ssh-agent?
Sorry, not a clue. Never played with it.
As the other guy said, the clients from SSH.com can do this very thing. I've always wondered how to do it with OpenSSH's clients, in fact. I'd guess that with the command line tools it wouldn't be possible, since (for example) a new scp process would have no decent way to talk to the existing ssh process to create a new channel. (or does it?)
One day I would like to make an ssh client which allows me to dynamically add and remove port forwarding channels at runtime, since I've needed that so many times. (not everything works well with SOCKS)
Unix domain sockets immediately come to mind, but whether that's a "decent way" or not is a matter of opinion.
(This was my concern as well, but the more i thought about it, the more i decided it was a strawman argument given the access granted to root.)
I guess I didn't read your entry properly before, so I looked up the ControlMaster/ControlPath stuff. I guess it's new? The version of OpenSSH I have doesn't seem to do it, anyway.