other:ssh
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
|
other:ssh [2020/08/05 06:50] jypeter [Using an ssh agent] Moved the agent section |
other:ssh [2020/08/20 14:04] jypeter [Standard usage] Improved |
||
|---|---|---|---|
| Line 14: | Line 14: | ||
| * We assume below that you have a ''my_login'' account on the remote ''remote_server'' computer, and you know your password | * We assume below that you have a ''my_login'' account on the remote ''remote_server'' computer, and you know your password | ||
| - | * This page will also show some examples using the LSCE and IPSL (ciclad) servers | + | * This page will also show some examples using the LSCE and [[https://mesocentre.ipsl.fr/|IPSL Mésocentre ESPRI]] servers |
| - | * Instead of a password, you can also use a set of //private and public keys// and a //passphrase// | + | * Instead of a password, you can also [[other:ssh#using_ssh_keys|use a set of private and public keys and a passphrase]] |
| + | * This is the only kind of authentication that will work if you need to use the [[https://mesocentre.ipsl.fr/|IPSL Mésocentre ESPRI]] (aka **ciclad** and **climserv**)! | ||
| * Many programs are said to //work over ssh// when they implicitly use the //ssh protocol// to securely transfer their data from one server to another: ''scp'' (copy remote directories and files), ''rsync'' (synchronize remote directories and files), ... | * Many programs are said to //work over ssh// when they implicitly use the //ssh protocol// to securely transfer their data from one server to another: ''scp'' (copy remote directories and files), ''rsync'' (synchronize remote directories and files), ... | ||
| Line 27: | Line 28: | ||
| <WRAP center round tip 60%> | <WRAP center round tip 60%> | ||
| - | Note: the following will work in a **Linux** terminal, but can also work in a //terminal// on a **Mac** or on a **Windows 10** computer (''ssh'' is directly available in ''Windows Powershell'', ''Windows Terminal'' or the old ''cmd'', but it is not the most user-friendly way to use ''ssh'' on Windows) | + | * The following will work in a **Linux** terminal, but can also work in a //terminal// on a **Mac** or on a **Windows 10** computer |
| - | If you have a Windows computer, it is much easier to use [[other:putty_conf|PuTTY]] for creating an ''ssh'' connection | + | * On **Windows 10**, ''ssh'' is directly available in a ''Windows Powershell'', a ''Windows Terminal'' or the old ''cmd'', but the most user-friendly way to use ''ssh'' is to use [[other:putty_conf|PuTTY]] |
| </WRAP> | </WRAP> | ||
| Line 35: | Line 36: | ||
| * **''ssh [options] [my_login@]remote_server''** | * **''ssh [options] [my_login@]remote_server''** | ||
| * If your login is the same on the local and remote computer, you can omit the optional ''my_login@'' part:\\ e.g. just use ''ssh ssh1.lsce.ipsl.fr'' | * If your login is the same on the local and remote computer, you can omit the optional ''my_login@'' part:\\ e.g. just use ''ssh ssh1.lsce.ipsl.fr'' | ||
| - | * The **first time** you connect to a **new server**, ''ssh'' will ask if you are sure of what you are doing, and then store some unique information about the remote server in the ''known_hosts'' file ([[#configuration_files|details]]). ''ssh'' will check this security information (without asking you) each time you connect to the same server, and warn you if something seems wrong\\ <code>PS C:\Users\my_login> ssh ssh1.lsce.ipsl.fr | + | * The **first time** you connect to a **new server**, ''ssh'' will ask if you are sure of what you are doing, and then store some unique information about the remote server in the ''known_hosts'' file ([[#configuration_files|details]]).\\ <code>PS C:\Users\my_login> ssh ssh1.lsce.ipsl.fr |
| The authenticity of host 'ssh1.lsce.ipsl.fr (157.136.66.99)' can't be established. | The authenticity of host 'ssh1.lsce.ipsl.fr (157.136.66.99)' can't be established. | ||
| ECDSA key fingerprint is SHA256:vMAvkidEg0EukP/RZwPAVuo5+TBegQFx1v8WN9pZLXg. | ECDSA key fingerprint is SHA256:vMAvkidEg0EukP/RZwPAVuo5+TBegQFx1v8WN9pZLXg. | ||
| Are you sure you want to continue connecting (yes/no)? yes | Are you sure you want to continue connecting (yes/no)? yes | ||
| Warning: Permanently added 'ssh1.lsce.ipsl.fr,157.136.66.99' (ECDSA) to the list of known hosts. | Warning: Permanently added 'ssh1.lsce.ipsl.fr,157.136.66.99' (ECDSA) to the list of known hosts. | ||
| - | my_login@ssh1.lsce.ipsl.fr's password:</code> | + | my_login@ssh1.lsce.ipsl.fr's password:</code>\\ ''ssh'' will automatically check this security information each time you connect to the same server, and warn you if something seems wrong |
| * Most common options: | * Most common options: | ||
| - | * ''-X'': Enable //X11 forwarding//. This option will allow you to start graphical programs on the remote server | + | * ''-X'': **enable //X11 forwarding//**. This option will allow you to **use graphical programs on the remote server** |
| * If ''-X'' does not work, use ''-Y'' instead (Enable //trusted// X11 forwarding) | * If ''-X'' does not work, use ''-Y'' instead (Enable //trusted// X11 forwarding) | ||
| * Using the ''-X''/''-Y'' option will automatically define the ''DISPLAY'' environment variable that is required by graphical programs on the remote server. Otherwise, ''DISPLAY'' will not be defined\\ <code>my_login@lsce5203:~$ echo $DISPLAY | * Using the ''-X''/''-Y'' option will automatically define the ''DISPLAY'' environment variable that is required by graphical programs on the remote server. Otherwise, ''DISPLAY'' will not be defined\\ <code>my_login@lsce5203:~$ echo $DISPLAY | ||
| localhost:0.0 | localhost:0.0 | ||
| + | |||
| my_login@lsce5203:~$ ssh ssh1.lsce.ipsl.fr | my_login@lsce5203:~$ ssh ssh1.lsce.ipsl.fr | ||
| Last login: Wed Jul 8 14:45:31 2020 from 176-142-31-75.abo.bbox.fr | Last login: Wed Jul 8 14:45:31 2020 from 176-142-31-75.abo.bbox.fr | ||
| Line 53: | Line 55: | ||
| [my_login@ssh1 ~]$ logout | [my_login@ssh1 ~]$ logout | ||
| Connection to ssh1.lsce.ipsl.fr closed. | Connection to ssh1.lsce.ipsl.fr closed. | ||
| + | |||
| my_login@lsce5203:~$ ssh -X ssh1.lsce.ipsl.fr | my_login@lsce5203:~$ ssh -X ssh1.lsce.ipsl.fr | ||
| [my_login@ssh1 ~]$ echo $DISPLAY | [my_login@ssh1 ~]$ echo $DISPLAY | ||
| localhost:43.0</code> | localhost:43.0</code> | ||
| - | * In order to display graphical windows, you also need to have a local //X server// running! | + | * In order to display graphical windows, you also need to **have a local //X server// running**!\\ An X server is basically |
| * Linux computer: nothing to do, an X server is already running | * Linux computer: nothing to do, an X server is already running | ||
| * Windows: [[other:win10wsl#installing_an_x_server|install, configure and launch VcXsrv]] | * Windows: [[other:win10wsl#installing_an_x_server|install, configure and launch VcXsrv]] | ||
| * Mac: FIXME | * Mac: FIXME | ||
| - | * ''-A'': enable //agent forwarding//. This is useful when you use //ssh keys//, and an //ssh agent// | + | |
| - | * ''-t command'': this option allows you to execute a command on the remote server (without displaying the output of the initial ''ssh''). We use this mostly to //chain ssh connections//, when we want to automatically go through a specific //gateway// server to access another server\\ e.g. ''ssh -A -X my_login@ssh1.lsce.ipsl.fr -t ssh -A -X obelix'' | + | * ''-A'': **enable //agent forwarding//**. This is useful when you use [[other:ssh#using_ssh_keys|ssh keys and an ssh agent]] |
| - | * ''-v'': verbose mode. Use this option only when you can't connect, or things don't seem to work correctly. Analyzing the verbose output when you start ''ssh'' should allow you, or the [[other:newppl:starting#getting_help_from_the_lsce_system_administrators|system administrators]], to find out what is wrong | + | |
| + | * ''-t command'': this option allows you to **execute a specific command on the remote server** (without displaying the output of the initial ''ssh''). We use this mostly to //chain ssh connections//, when we want to automatically go through a specific //gateway// server to access another server\\ e.g. ''ssh -A -X my_login@ssh1.lsce.ipsl.fr -t ssh -A -X obelix'' | ||
| + | |||
| + | * ''-v'': **verbose mode**. Use this option only when you can't connect, or things don't seem to work correctly. Analyzing the verbose output when you start ''ssh'' should allow you, or the [[other:newppl:starting#getting_help_from_the_lsce_system_administrators|system administrators]], to find out what is wrong | ||
| ==== Useful aliases ==== | ==== Useful aliases ==== | ||
| Line 97: | Line 103: | ||
| Sometimes you just need to copy files from one remote server (or your desktop) to the other. The files can be securely copied //over ssh// with the ''scp'' command | Sometimes you just need to copy files from one remote server (or your desktop) to the other. The files can be securely copied //over ssh// with the ''scp'' command | ||
| - | Note: if you work with big data files, you should keep the files were they are instead of duplicating them, and move the data processing (your scripts, etc...) to the server where the files are located (e.g. the ciclad server) | + | Note: if you work with big data files, you should keep the files were they are instead of duplicating them, and move the data processing (your scripts, etc...) to the server where the files are located (e.g. the ''ciclad'' server at IPSL) |
| ==== Copying files with scp ==== | ==== Copying files with scp ==== | ||
| Line 111: | Line 117: | ||
| * Most common options: | * Most common options: | ||
| - | * ''-p'': **preserves modification times**, access times, and modes from the original file. This option is very useful if you want the copied file(s) to have the same date/time as the original file(s). Otherwise, the time will be the time when you copy the file | + | * ''-p'': **preserves modification times**, access times, and modes from the original file.\\ This option is **very useful** if you want the copied file(s) to have the same date/time as the original file(s). Otherwise, the time will be the time when you copy the file(s) |
| - | * ''-r'': **recursively** copy entire directories. **You have to use this option if the source location is a directory**. ''scp -r'' will copy the complete content of the directory (including sub-directories) | + | * ''-r'': **recursively** copy entire directories.\\ **You have to use this option if the source location is a directory**. ''scp -r'' will copy the complete content of the directory (including sub-directories) |
| ==== A recommended graphical scp client for Windows ==== | ==== A recommended graphical scp client for Windows ==== | ||
| Line 130: | Line 136: | ||
| ===== Using ssh keys ===== | ===== Using ssh keys ===== | ||
| + | |||
| + | ==== What are ssh keys? ==== | ||
| + | |||
| + | |||
| + | ==== Creating ssh keys ==== | ||
| + | |||
| + | |||
| + | ==== Installing ssh keys ==== | ||
| + | |||
| + | |||
| + | ==== Using the keys ==== | ||
| + | |||
| + | |||
| + | ==== Using an ssh agent ==== | ||
| + | |||
other/ssh.txt · Last modified: 2023/05/03 08:32 by jypeter
