News for hackers. Stuff that matters.

A comment on Simplify your life with an SSH config file. Parent comment

Re:Simplify your life with an SSH config file by nikcub on Sunday October 21, 2012 @12:51AM (#4679013)
IMO terminal protocols are more suited to UDP than TCP and I use ssh over UDP all the time. There are three main advantages:

* There is no connection session, so you can close your laptop or put it to sleep and open it up again and the connection will still be there.

* You don't have the lag of sending and then responding, it appears locally immediately

* It is much easier to get UDP around firewalls and it can't be blocked easily in the same way most VPN protocols or SSH can. I have yet to find a network where I can't get my terminal UDP packets through.

The alternative to Mosh is setting up OpenVPN[1]. It is especially worthwhile if you have a network of public servers that you administer. It is easy to setup[2] and works on Windows, Mac, Linux, BSD etc.

The best tip is to add a second interface to all your machines and setup a private VLAN across them. This way if you are experiencing a DoS attack or high traffic you can still login and administer the machine (this also applies with standard ssh - you put it in a different range of IPs and on your public machines then only have 80 and 443 open).

EC2[3], Linode[4] et al all support adding a second network interface to each machine (or to just one of the machines, which is then used as a gateway to the remainder) which can be assigned an IP address in a different range. You then setup a separate hostname to this network, or even register a separate administrative domain name (eg. company-admin.com) which you keep on a different registrar, whois record, etc.

[1] http://openvpn.net/

[2] http://openvpn.net/index.php/open-source/documentation/howto...

[3] http://aws.typepad.com/aws/2012/07/multiple-ip-addresses-for...

[4] http://www.linode.com/wiki/index.php/Multiple_IPs

[ Parent | on HN ]
Re:Simplify your life with an SSH config file by beagle3 on Sunday October 21, 2012 @04:05AM (#4679252)
> It is much easier to get UDP around firewalls and it can't be blocked easily in the same way most VPN protocols or SSH can. I have yet to find a network where I can't get my terminal UDP packets through.

Err, not in my world. Many hotels block udp. Amtrak's on train internet does too (they block a lot of tcp ports as well, and proxy http to stop videos).

I haven't tried recently, but most guest networks (at conferences, companies I visited, etc) did not let UDP through.

[ Parent | on HN ]
Re:Simplify your life with an SSH config file by nikcub on Monday October 22, 2012 @01:30AM (#4681975)
you can proxy UDP over HTTP proxies, which is supported by OpenVPN and is what I do. so if you have web access you have SSH over UDP access.
[ Parent | on HN ]
Re:Simplify your life with an SSH config file by beagle3 on Monday October 22, 2012 @12:30PM (#4683924)
Of course you can do that. But in the context we are discussing - that of Mosh - does it still provide any benefit over regular ssh/tcp?
[ Parent | on HN ]