did you know that SSH has a little-known secret menu?

[rebane2001@infosec.exchange]

did you know that SSH has a little-known secret menu?

i wrote a post about this on cohost a while back, but since that site shut down i'm posting it here too

[schrotthaufen@mastodon.social]

@rebane2001 @bert_hubert I wasn’t aware that there’s more than `~.` 🤯

[ozzelot@mstdn.social]

@rebane2001
and of course the examples are my little pony references :D my hat's off to you.

[agowa338@chaos.social]

@rebane2001

Yes, but did you know that it is basically inaccessible on Keyboard layouts like e.g. de-DE?

[agowa338@chaos.social]

@rebane2001

Oh and if I recall correctly the keyboard combination is also different on macOS too...

[knu@toot.community]

@rebane2001
I learned about this escape feature during my Solaris sysadmin training in 2007, but never used it and had forgotten all about it.

[jarm@qdon.space]

@rebane2001 Always know that there is a key combination to close ssh connection
Also always forget what key is

[walrus@toot.wales]

@rebane2001

Ooh, useful! Thanks!

[bob_zim@infosec.exchange]

@agowa338 @rebane2001 MacOS and Windows both have plain OpenSSH, and the listed escape sequences work on both.

[phl@mastodon.social]

@rebane2001 I'm forever annoyed that the command sequence starter is a newline of all things.

Telnet's UX was a lot better in this regard imo.

[phl@mastodon.social]

@bob_zim @agowa338 @rebane2001 *if* your keyboard layout has a functioning tilde key (a deadkey might output something else and it's nontrivial to make it output just the character itself (and it depends on the OS how it deals with it))

[bosconet@ioc.exchange]

@rebane2001 I did!!!!! do I win anything?!?!?!

[thing@plasmatrap.com]

@rebane2001@infosec.exchange yes. i just happened to look at the man page for it yesterday.

[khrister@mastodon.social]

@phl @bob_zim @agowa338 @rebane2001 For me, on a mac, hitting the deadkey and then space works. So, <Enter> ~ <Space> ? gets me to that menu.

[bob_zim@infosec.exchange]

@phl Huh. I’m not sure I’ve seen a non-exotic (e.g, not for a Corne) layout which entirely lacks tilde as a discrete character. On my German keyboards, it’s on the AltGr layer of the +/* key. Same on Spanish QWERTY keyboards I’ve seen.

Not doubting that such a keyboard exists, I just thought I had seen most of the mass-produced layouts.

[baloo@sfba.social]

@rebane2001 Disabled by default on openssh *client* 9.2 and above.

https://github.com/openssh/openssh-portable/commit/f7cebbbf407d772ed71403d314343766782fe540

```
Host *
EnableEscapeCommandline yes
```
In your ssh_config file to re-enable it.

[mica@mk.absturztau.be]

@baloo@sfba.social @rebane2001@infosec.exchange that's only the command line (~c). the other escape sequences still work by default.

[baloo@sfba.social]

@mica @rebane2001 fair.

[gkrnours@mastodon.gamedev.place]

@agowa338 @rebane2001 you can whine about it or you can read the manual and add EscapeChar to your ssh config to set it to any other character.

[rogandawes@infosec.exchange]

@baloo @mica @rebane2001 it’s a good security default. Imagine a bastion host or other program that allows you to ssh to a target host. The expectation is that all you can do is interact with the terminal on the target, or exit. However, the ssh escape allows you to create and delete tunnels, amongst other things, which might not have been anticipated. Disabling by default removes the surprise.