As a side note, Keith Winstein (https://cs.stanford.edu/~keithw/), the creator of mosh, is an interesting guy (e.g. he used to be a WSJ reporter among other things).
I had the pleasure of seeing him speak at a conference last year on the topic of TCP congestion control algorithms. I admit, I expected it to be a boring presentation, but was then thrilled as it was one of the most dynamic, informative, and funny technical talks I've ever seen.
That particular presentation isn't online, but he links to several others on similar topics. I would check them out. They're probably pretty good!
His presentation "Transport Architectures for an Evolving Internet" could be the one you're referring to? It's online and very interesting: https://www.youtube.com/watch?v=UsCOVF0vDe8.
It's useful in a corporate environment where you have tens to hundreds of machines you need to use, and all of them are trusted.
EDIT: "a really dangerous feature" is accurate though. For example if all of the staff have root access on a staging machine, then anybody can steal the ssh-agent of another user on the staging machine, and use it to login as that user on production machines.
It'd be kinda nice if you could wrap it with some minimal level of protection through SELinux or something. Still wouldn't be as secure as switching it off, but at least a malicious insider would have to jump through a couple of hoops to get there.
In such an environment you should be using Kerberos. Then you won't need agent forwarding, and you can maintain security.
I would argue that in such an environment you really should be using LDAP+Kerberos, but if you think LDAP is too much effort (it really isn't), plain Kerberos is comparatively trivial to administer, and adding Kerberos (unlike LDAP) doesn't really require any significant changes to your environment.
Just use kerberos. You don't need LDAP to use Kerberos (although you probably should be using LDAP too). Kerberos without LDAP is trivial to set-up and administer, and it's very non-invasive, so you don't need to do any significant changes to your organization.
ssh'ing through the jumphost when the VPN on it wasn't working properly was a use-case for me. Agent forwarding is fine, as long as you use it judiciously.
Mosh is possibly the most useful piece of software that I've seen: it makes remote links over slow, unreliable networks bearable for doing Real Work. Speaking as somebody who usually has two rubbish networks between the computer I'm on, and the conputer I'm connecting to, that's incredibly useful.
The lack of scrollback support has made mosh pretty useless to me. I like many of its other features, but in order for it to replace ssh for me it needs to look like it's just printing text to stdout. (Yes, this is why I also tend to avoid using screen and tmux for anything other than holding open a remote shell session.)
I would really love to see an adapter layer on top of Mosh, so that it can be a drop-in replacement for an SSH client. Currently even after you install it on your servers you have to change your scripts and learn new CLI options. I know that there are reasons for these differences, but inability to alias `ssh` to `mosh` or hypothetical `mosh-ssh` hurts adoption.
Oh, that's because you're running SSH under the hood. I see what you mean, having the port be passed to SSH would be better from a UX standpoint, but the thing is that mosh doesn't do everything SSH does, so it would need to fake every SSH option and then pass them through. As it is, you only need to learn --ssh and you can do "--ssh=ssh -D 8223 -L 1234:localhost:1234" etc.
One of the weirdest issues I've had with Mosh is when you resize a window (for example you open a new pane in tmux where you have a mosh session open). Mosh will just cut off parts of the scrollback (if you do something like return from vim). Is this a known issue, or should I file a new bug?
It's amazing how well mosh can keep connections alive through network outages. I have unbearably unreliable mobile network connection and plain old SSH connections drop regularly but Mosh just keeps on going.
And it doesn't require me to reconnect when I enable/disable my work VPN.
I personally quite like JuiceSSH. Mosh support being one of the reasons :) It's great for the odd scenario when something is down and I need to a quick fix over 3G.
mosh is fantastic for me when working remotely over vpn.
I don't have to worry about reconnections, disconnections, packet lag (due to local echo feature). mosh in combination with screen (or tmux) gives scrollback support + other features
Previous discussions:
https://news.ycombinator.com/item?id=3819382
https://news.ycombinator.com/item?id=11572146
https://news.ycombinator.com/item?id=8928506
https://news.ycombinator.com/item?id=8252093
https://news.ycombinator.com/item?id=5016745
As a side note, Keith Winstein (https://cs.stanford.edu/~keithw/), the creator of mosh, is an interesting guy (e.g. he used to be a WSJ reporter among other things).
I had the pleasure of seeing him speak at a conference last year on the topic of TCP congestion control algorithms. I admit, I expected it to be a boring presentation, but was then thrilled as it was one of the most dynamic, informative, and funny technical talks I've ever seen.
That particular presentation isn't online, but he links to several others on similar topics. I would check them out. They're probably pretty good!
His presentation "Transport Architectures for an Evolving Internet" could be the one you're referring to? It's online and very interesting: https://www.youtube.com/watch?v=UsCOVF0vDe8.
A great bit of kit, but totally unusable for me because of a lack of agent fowarding support[1]. :(
1: https://github.com/mobile-shell/mosh/issues/120
Why would you need agent forwarding? It's a really dangerous feature.
It's useful in a corporate environment where you have tens to hundreds of machines you need to use, and all of them are trusted.
EDIT: "a really dangerous feature" is accurate though. For example if all of the staff have root access on a staging machine, then anybody can steal the ssh-agent of another user on the staging machine, and use it to login as that user on production machines.
It'd be kinda nice if you could wrap it with some minimal level of protection through SELinux or something. Still wouldn't be as secure as switching it off, but at least a malicious insider would have to jump through a couple of hoops to get there.
A better way of solving it is to resolve the issue i raised: https://github.com/mobile-shell/mosh/issues/285
In such an environment you should be using Kerberos. Then you won't need agent forwarding, and you can maintain security.
I would argue that in such an environment you really should be using LDAP+Kerberos, but if you think LDAP is too much effort (it really isn't), plain Kerberos is comparatively trivial to administer, and adding Kerberos (unlike LDAP) doesn't really require any significant changes to your environment.
Why is Kerberos ticket forwarding better than agent forwarding? Either way, root (or a bad .bashrc) can use your credentials while you're logged in.
Sorry. You are absolutely right. Long day...
I disable Kerberos ticket forwarding here, for this exact same reason. But then you don't have ticket forwarding! I don't know what I was thinking.
How does LDAP solve the problem?
We use LDAP to manage public keys for each user, but they still need to supply a private key at some point.
I was talking about Kerberos, not LDAP. However, that's still not right, see parallel comment.
In my opinion, it's much safer to do one of two things - use `-oProxyCommand=ssh <gateway> nc %h %p`, or set up different keys on the gateway host.
You risk the security of your SSH key when you use -A.
Yeah, that is what my response above points to.
Extraordinarily useful on an internal corporate network, especially when you're scp'ing remote->remote and so on.
Just use kerberos. You don't need LDAP to use Kerberos (although you probably should be using LDAP too). Kerberos without LDAP is trivial to set-up and administer, and it's very non-invasive, so you don't need to do any significant changes to your organization.
ssh'ing through the jumphost when the VPN on it wasn't working properly was a use-case for me. Agent forwarding is fine, as long as you use it judiciously.
I use this patch for some time and it works great for me.
Testing mosh made me aware how much I am relying on the port forwarding feature in ssh in my daily work, and how hard it is to replace it.
Otherwise: Great tool.
Mosh is possibly the most useful piece of software that I've seen: it makes remote links over slow, unreliable networks bearable for doing Real Work. Speaking as somebody who usually has two rubbish networks between the computer I'm on, and the conputer I'm connecting to, that's incredibly useful.
Absolutely. I'm using it for two or years or something by now and the very first thing I do when having a new host: install the mosh server.
As I recall it needs a swath of nearly a thousand ports open. Getting one opened in a corporate environment is difficult enough.
depends on number of connections, 60000-60020 works fine.
That's a weird setup! Why wouldn't they use a single port?
Bunch of udp
Oh, it's just a repost. I thought they released version 1.3 with scrollback support.
The lack of scrollback support has made mosh pretty useless to me. I like many of its other features, but in order for it to replace ssh for me it needs to look like it's just printing text to stdout. (Yes, this is why I also tend to avoid using screen and tmux for anything other than holding open a remote shell session.)
Will have to check out 1.3...
mosh $REMOTE -- tmux new -ADs $SESSION
I would really love to see an adapter layer on top of Mosh, so that it can be a drop-in replacement for an SSH client. Currently even after you install it on your servers you have to change your scripts and learn new CLI options. I know that there are reasons for these differences, but inability to alias `ssh` to `mosh` or hypothetical `mosh-ssh` hurts adoption.
What new CLI options? Mosh pretty much doesn't have any, you use SSH if you want to do what SSH does.
Stuff like connecting to different port, you need to do --ssh="ssh -p 1111"
Oh, that's because you're running SSH under the hood. I see what you mean, having the port be passed to SSH would be better from a UX standpoint, but the thing is that mosh doesn't do everything SSH does, so it would need to fake every SSH option and then pass them through. As it is, you only need to learn --ssh and you can do "--ssh=ssh -D 8223 -L 1234:localhost:1234" etc.
One of the weirdest issues I've had with Mosh is when you resize a window (for example you open a new pane in tmux where you have a mosh session open). Mosh will just cut off parts of the scrollback (if you do something like return from vim). Is this a known issue, or should I file a new bug?
mosh is really good when used from a tablet device, ie. with Blink: https://twitter.com/BlinkShell
Makes managing a cheap European vps from Australia bearable.
While on a train going through a tunnel :) At least that is what I use it for in Switzerland :)
No internet in swiss tunnels? I'm a bit disappointed now.
Yeah, the ISPs don't support tunnelling :(
That was a very. Bad. Joke. :)
Bravo.
It's amazing how well mosh can keep connections alive through network outages. I have unbearably unreliable mobile network connection and plain old SSH connections drop regularly but Mosh just keeps on going.
And it doesn't require me to reconnect when I enable/disable my work VPN.
> It's amazing how well mosh can keep connections alive through network outages
It doesn't. It uses udp, there is no connection to keep alive.
> And it doesn't require me to reconnect when I enable/disable my work VPN.
That's why this works.
Yeah, yeah, I know that it works with UDP and what's happening.
What is amazing is how much it makes my day-to-day work with remote machines much more pleasant.
I love it but the clients I use don't support it. Winscp and serverauditor. I didn't like juicessh on Android
I personally quite like JuiceSSH. Mosh support being one of the reasons :) It's great for the odd scenario when something is down and I need to a quick fix over 3G.
There was a FreeBSD bug in mosh, which led to high CPU usage which prevented me from trying it twice in the past.
mosh is fantastic for me when working remotely over vpn. I don't have to worry about reconnections, disconnections, packet lag (due to local echo feature). mosh in combination with screen (or tmux) gives scrollback support + other features
I really don't get HN's new dedup algorithm.
https://news.ycombinator.com/item?id=12429203
https://news.ycombinator.com/item?id=5016745
With Chrome apps being phased out, is a native Windows app in the pipeline?