The lack of scrollback support has made mosh pretty useless to me. I like many of its other features, but in order for it to replace ssh for me it needs to look like it's just printing text to stdout. (Yes, this is why I also tend to avoid using screen and tmux for anything other than holding open a remote shell session.)
It's useful in a corporate environment where you have tens to hundreds of machines you need to use, and all of them are trusted.
EDIT: "a really dangerous feature" is accurate though. For example if all of the staff have root access on a staging machine, then anybody can steal the ssh-agent of another user on the staging machine, and use it to login as that user on production machines.
It'd be kinda nice if you could wrap it with some minimal level of protection through SELinux or something. Still wouldn't be as secure as switching it off, but at least a malicious insider would have to jump through a couple of hoops to get there.
In such an environment you should be using Kerberos. Then you won't need agent forwarding, and you can maintain security.
I would argue that in such an environment you really should be using LDAP+Kerberos, but if you think LDAP is too much effort (it really isn't), plain Kerberos is comparatively trivial to administer, and adding Kerberos (unlike LDAP) doesn't really require any significant changes to your environment.
Just use kerberos. You don't need LDAP to use Kerberos (although you probably should be using LDAP too). Kerberos without LDAP is trivial to set-up and administer, and it's very non-invasive, so you don't need to do any significant changes to your organization.
ssh'ing through the jumphost when the VPN on it wasn't working properly was a use-case for me. Agent forwarding is fine, as long as you use it judiciously.
It's amazing how well mosh can keep connections alive through network outages. I have unbearably unreliable mobile network connection and plain old SSH connections drop regularly but Mosh just keeps on going.
And it doesn't require me to reconnect when I enable/disable my work VPN.
I would really love to see an adapter layer on top of Mosh, so that it can be a drop-in replacement for an SSH client. Currently even after you install it on your servers you have to change your scripts and learn new CLI options. I know that there are reasons for these differences, but inability to alias `ssh` to `mosh` or hypothetical `mosh-ssh` hurts adoption.
Oh, that's because you're running SSH under the hood. I see what you mean, having the port be passed to SSH would be better from a UX standpoint, but the thing is that mosh doesn't do everything SSH does, so it would need to fake every SSH option and then pass them through. As it is, you only need to learn --ssh and you can do "--ssh=ssh -D 8223 -L 1234:localhost:1234" etc.
As a side note, Keith Winstein (https://cs.stanford.edu/~keithw/), the creator of mosh, is an interesting guy (e.g. he used to be a WSJ reporter among other things).
I had the pleasure of seeing him speak at a conference last year on the topic of TCP congestion control algorithms. I admit, I expected it to be a boring presentation, but was then thrilled as it was one of the most dynamic, informative, and funny technical talks I've ever seen.
That particular presentation isn't online, but he links to several others on similar topics. I would check them out. They're probably pretty good!
His presentation "Transport Architectures for an Evolving Internet" could be the one you're referring to? It's online and very interesting: https://www.youtube.com/watch?v=UsCOVF0vDe8.
mosh is fantastic for me when working remotely over vpn.
I don't have to worry about reconnections, disconnections, packet lag (due to local echo feature). mosh in combination with screen (or tmux) gives scrollback support + other features
One of the weirdest issues I've had with Mosh is when you resize a window (for example you open a new pane in tmux where you have a mosh session open). Mosh will just cut off parts of the scrollback (if you do something like return from vim). Is this a known issue, or should I file a new bug?
Mosh is possibly the most useful piece of software that I've seen: it makes remote links over slow, unreliable networks bearable for doing Real Work. Speaking as somebody who usually has two rubbish networks between the computer I'm on, and the conputer I'm connecting to, that's incredibly useful.
I personally quite like JuiceSSH. Mosh support being one of the reasons :) It's great for the odd scenario when something is down and I need to a quick fix over 3G.
51 comments
[ 2.3 ms ] story [ 107 ms ] threadWill have to check out 1.3...
1: https://github.com/mobile-shell/mosh/issues/120
EDIT: "a really dangerous feature" is accurate though. For example if all of the staff have root access on a staging machine, then anybody can steal the ssh-agent of another user on the staging machine, and use it to login as that user on production machines.
I would argue that in such an environment you really should be using LDAP+Kerberos, but if you think LDAP is too much effort (it really isn't), plain Kerberos is comparatively trivial to administer, and adding Kerberos (unlike LDAP) doesn't really require any significant changes to your environment.
I disable Kerberos ticket forwarding here, for this exact same reason. But then you don't have ticket forwarding! I don't know what I was thinking.
We use LDAP to manage public keys for each user, but they still need to supply a private key at some point.
You risk the security of your SSH key when you use -A.
Bravo.
And it doesn't require me to reconnect when I enable/disable my work VPN.
It doesn't. It uses udp, there is no connection to keep alive.
> And it doesn't require me to reconnect when I enable/disable my work VPN.
That's why this works.
What is amazing is how much it makes my day-to-day work with remote machines much more pleasant.
Otherwise: Great tool.
I had the pleasure of seeing him speak at a conference last year on the topic of TCP congestion control algorithms. I admit, I expected it to be a boring presentation, but was then thrilled as it was one of the most dynamic, informative, and funny technical talks I've ever seen.
That particular presentation isn't online, but he links to several others on similar topics. I would check them out. They're probably pretty good!
https://news.ycombinator.com/item?id=3819382
https://news.ycombinator.com/item?id=11572146
https://news.ycombinator.com/item?id=8928506
https://news.ycombinator.com/item?id=8252093
https://news.ycombinator.com/item?id=5016745
https://news.ycombinator.com/item?id=12429203
https://news.ycombinator.com/item?id=5016745