SSH memo

• X11 forwarding on. (X program said ``Can not open display''.)
• Port forwarding
• Too slow ssh login
• ssh remote host without password

X11 forwarding on. (X program said ``Can not open display''.)

Situation: When you slogined machine, but can not run X11 program, please add -X to slogin or ssh.

Details: For a security reason, new environment usually disables the X11 protocol forwarding in default. You should enable this explicitly.

Note: Some cygwin environment does not fully trust the X auth connection. In such case, your X connection looks like to be cut out in short period. If you know the host can be trusted, you can use -Y option. But use with care.

Port forwarding

Situation:

• You want to access a local machine's local disk and the disk is not exported (e.g., no NFS export)
• Your remote machine is behind a firewall.
• You can (ssh) login both your remote machine and the firewall machine.

Solution: Use port forwarding function of ssh. ssh's `-L' option can forward a port on a local host to the given host and port on the remote machine.

Example 1: vnc connection : There are machines: local, firewall, and remote. The remote side, you run `vncserver' and want to connect from local through the firewall.

• Check the port number of vncserver (ex. by netstat). Here assume it as 30000. On your local machine:
• local # ssh -L 30000:remote:30000 firewall
  This localport (first 30000) is forwarded to remote's 30000 (second 30000) through the firewall.
• local # vncviewer localhost:30000

Example 2: scp :

• Please select a non privilege port number. It should be more than 1023. The number of local port is from 49152 through 65535. At least check the /etc/services and please make sure the no other program used the port. If you get someting strange, chenge the port number. There are some programs which use a port even not in the /etc/services. Here, try 50000. The number 22 is the port number of ssh.
• local # ssh -L 50000:remote:22 firewall
  
• local # scp -P 50000 localfile localhost:/some/where/to/put/
  

Too slow ssh login

Situation:

• When you ssh login to a host, the login takes somewhat 10 to 20 seconds.

Suggestion: Check the GSSAPIAuthentication status with 'ssh -v'.

Solution: Please check the ssh_config manual page and understand the situation. If it is OK to not use GSSAPIAuthentication, you can add the folloing line in your ssh's configfile. (~/.ssh/config)

    GSSAPIAuthentication no
  

ssh remote host without password

Situation:

• When you want to automate some cluster computing/test, the cluster is your cluster, hosts in the cluster communicate with ssh.
• Under such condition, you can put the public key to remote hosts and login via ssh without the password.

Solution:

• Consider the homehost_A and the remotehost_B.
• Step 1: Login the homehost_A and generate a pair of keys. Don't enter a passpharase.

         homehost_A# ssh-keygen -t rsa
        

  Then a pair of key is created in ~/.ssh/id_rsa (private key) and ~/.ssh/id_rsa.pub (publi key) as default.
• Copy the public key to the remotehost_B. You can do it by hand, but there is a convenient command. The public key will be appended to the ~/.ssh/authorized_keys .

         homehost_A# ssh-copy-id -i ~/.ssh/id_rsa.pub remotehost_B
        

• Now you can ssh to the remotehost_B without password.

         homehost_A# ssh remoteost_B