Hacker News new | ask | show | jobs
by hartator 1163 days ago
I wish there is an easy way to have the reverse: a “sticky” ssh session.

It’s so annoying that the connection is lost when going to sleep or network issues. And the solutions to fix this are not really worth the effort.

4 comments

I run ssh in a loop and auto-attach to a persistent tmux session on the other end. I also kill ssh processes as part of suspend so that the new one gets launched in the loop as soon as we wake up.
Check out autossh(1)!
WireGuard[1] might help here, at least with network issues. It's literally designed to be able to keep a connection even when moving to one network to another ("roaming").

And as a side-benefit, if your SSH daemon only listens on the WireGuard interface, that's another layer of defense you get for free (not to mention you'll stop getting noise in your logs).

Ironically though, here you actually need to know about `<Enter>~.` because if the remote host actually goes down, WG will keep trying to contact the remote peer for some time; this is the same behavior that allows you to keep a connection open even when roaming, but seen from the other side.

[1]: https://www.wireguard.com/

et survives reboots and IP roaming, pretty much anything: https://eternalterminal.dev/
I’m not sure about resuming from sleep, but does mosh address your network stability issues?

https://mosh.org/

The main thing about Mosh is you need both on the sever and the client. Installing on random servers you might be ssh -in only once feels gross.
Has Mosh crypto been reviewed? Last I checked they were using some custom crypto on top of UDP instead of using something like DTLS or QUIC. Given SSH is one of the most battle tested protocols out there I am wary of replacing it with something else.
https://mosh.org/#faq:~:text=Q%3A%20What%20is%20Mosh%27s%20s...

The cryptography is standard AES-128 in OCB3 mode. It's been around long enough, and has had enough security scrutiny to at least discover a few minor DoS vulnerabilities, that it isn't entirely unreviewed.

For the cipher itself, see https://en.wikipedia.org/wiki/OCB_mode#Attacks

> QUIC

Mosh has been effectively unmaintained since long before QUIC even existed. It should be rewritten to use QUIC, except that QUIC's requirement for TLS certificates rather than generic asymmetric cryptography basically breaks any integrations like this.

It was AES-OCB last time I looked at it. Not sure if this is good/bad.