HN Explorer

60 comments

[ 1.8 ms ] story [ 194 ms ] thread
Samin100
This is a fantastic tool! I've always had to reference a markdown file with SSH tunnel syntax whenever I wanted to create one. I can see myself using this quite a bit in the future.
viraptor
Is the syntax difference really that interesting? It's

    mole -local 127.0.0.1:3306 -remote 127.0.0.1:3306 -server example@172.12.0.100
vs

    ssh -L 3306:127.0.0.1:3306 example@172.12.0.100
With the extra installation of mole on top.
goliatone
This whole thread makes me think of Alan Cooper, and how he bashes developers in The Inmates Are Running the Asylum basically as people out of touch with the rest of humanity in that we got used to rudimentary tools and our love for them and maybe the time and pain spent learning them makes us victim blame users, not that your comment is doing that, but maybe we do that unconsciously. I was going to comment on the whole persona thing he started but it’s to early in the morning for such things
leowoo91
I guess we won't need IPv6 that much.
dest
Very nice. I'd consider pinging the guys of OpenBSD to suggest upstreaming this interesting, user friendly, syntax into SSH itself.
8fingerlouie
is the ssh syntax for doing the same thing really that bad ?

I find it easy to remember, it's just one flag (-L) with local_port:remote_ip:remote_port

to forward local port 3306 to mysqlhost:3306:

    ssh -L 3306:mysqlhost:3306
The strength of using ssh is that you can forward multiple ports with the same connection. i.e.

    ssh -L 3306:mysqlhost:3306 -L 8080:webhost:80
dest
If it's easy for you to remember ssh syntax, then for you ssh is the better tool. As far as I'm concerned, I never remember the different syntax between -L, -R, -D, etc. Always have to read a doc somewhere.

In the same topic, do you remember the syntax of tar? I don't. https://www.xkcd.com/1168/

8fingerlouie
I use tar daily, so yes, i remember the syntax :)

copy files from a to b:

    (cd /src && tar cf - .) | (cd /dest && tar xf -)
operations are easy :(c)reate, e(x)tract, (t)est options the same: (f)ile, (v)erbose, g(z)ip compression. the only illogical ones is bzip2 compression and xz compression with -j and -J

I think i can remember cpio syntax as well, though i haven't used that i a decade, but did use it quite often in my old sysadm job.

copy files from a to b by piping :

    find /somewhere -print | cpio -o | (cd /destination && cpio -i)
or simply for all you kids:

    find /somewhere -print | cpio -p /destination
dest
Well, it turns out we have different expectations regarding those tools.

My brain chooses to store other things in life.

melq
This seems to imply that he is not 'storing other things in life' because he's able to remember that L=local forwarding R=remote forwarding and D=socks proxy
colemickens
The irony being that remembering that is almost guaranteedly easier than acquiring and installing mole on every machine where you may need to Port forward.
ryall
It was fun when I mixed up source and destination in my tar command and overwrote 4 hours of work ;)
peterwwillis
You can do the same thing with the ~/.ssh/config file. Add a configuration block for the host you want to connect to with the ports you want to map. I agree that an official user interface to editing the config with the most common examples would be really handy.
kstenerud
I'm not sure if I missed something? Normally I use -L syntax for tunneling (-L local_port:remote_addr:remote_port). Does this tool do more?
8fingerlouie
I don't think i've missed anything, it does the same thing as ssh -L with slightly different syntax.

It's the same with mosh. Normally i use tmux on the destination host, and i simply cannot see any reason to use mosh over ssh/tmux.

therein
> i simply cannot see any reason to use mosh over ssh/tmux.

How about automatic session resumption and predictive character insertion to improve typing when under latency?

8fingerlouie
session resumption:

    tmux a
As for predictive character insertion, when i'm working in a shell, especially with high latency, i prefer my commands to be as i type them, not something some algorithm "guessed" i was going to type.
deivid
It doesn't guess. It sinoly has local echo, and the characters that are not-yet-ack'd are underlined. Changes your life when working with 175ms+ latency
satiani
That's not what mosh is, it doesn't predict what you're going to type. It however proactively renders the characters you type before it receives confirmation from the tty on the other end.

In other words, imagine typing ssh somebox.typo.com and waiting 1 second before the text renders and discovering the typo, then pressing backspace, waiting a while for the backspaces to render, then going through all of this again. With mosh you'll be able to instantly see what you typed and fix it. On high latency connections it makes a huge difference in quality of life.

dspillett
> It however proactively renders the characters you type before it receives confirmation from the tty on the other end.

Basically for those with experience of text terminals genrally: local echo.

8fingerlouie
I worked as a sysadm at at "large" (local scale) UNIX SysV installation back in the early 90s.

Everything there connected via serial ports, remote offices got multiplexed over a 9600 baud connection. Back then we had local echo for the sometimes slow link, i.e. printing a spreadsheet converted to 3Mb PostScript, and still only 9600 baud in total.

So i know what local echo is. It has nothing to do with prediction :)

I'm still not convinced about mosh, but it sounds like it really does help a lot of people, so who am i to judge. I guess i'm privileged since i don't usually experience latency. We have about 95% 4G coverage in this country, coupled with fiber connections.

The last time i experienced any noticeable latency was when editing files on a clients SCO OpenServer across The Atlantic Ocean over a 1200 baud connection.

jpitz
For me, the advantage of mosh is that it handles network changes seamlessly.
dspillett
I've taken to using OpenVPN to home when mobile, except for the absolute basics (I don't have it running on my phone 24/7), which deals with that fine too.

As well as that and protecting unencrypted traffic on public WiFi, I get my ad blocker & other protection and credit card payments are smoother as the payment processors think I am at home not coming from some random address so doesn't ask for extra security details as often as they otherwise would.

satiani
> So i know what local echo is. It has nothing to do with prediction :)

Not precisely, because you're sometimes predicting whether a keypress should be rendered as a letter on the screen or not (e.g. if you click 'j' in vim command mode it doesn't actually print j). mosh, at least from my experimentation, seems smart enough to do that reliably.

nsomaru
You are privileged! It is a daily part of life in South Africa -- around 200ms to the EU and more for anywhere else. That kind of delay becomes extremely jarring when you are working on a VPS or doing anything, really. Local VPSs are expensive and just not on par with something like DO. I believe there's a great opportunity for opening up a DO-like service in JHB with VPS @ R70/mo.

We also never have enough players for the latest FPS games that require low latency :(

maeln
Mosh support roaming and intermittent connectivity which is really super useful if you have to debug a server on a very dodgy 3g connection in a moving train.
lkuty
I just learned about mosh, ty. I use SSH sessions all the time and sometimes over satellite links.
Filligree
You should run tmux or screen inside it anyway. There's no way to reattach to a broken mosh session, as happens if you close the local terminal.
Daviey
tmux solves the session resumption at a lower level. You can have a connection from home, jump on a train, open your laptop and keep typing and do the same when you get into the office. You don't need to re-auth each time (or deal with delayed disconnects).

It works well WITH tmux, not instead of tmux.

Which means your solution would be something like:

  while true; do
    ssh -t ${HOST} tmux a
  done
But that lacks the other benefits, especially having to wait for the session to timeout.. Take a look at: https://en.wikipedia.org/wiki/Mosh_(software)#Performance
craftyguy
Since mosh relies on UDP, it's completely useless for folks who are behind proxies (e.g. for work, school, etc)
vectorEQ
there's multiple ways to make tunnels in ssh. -L is one of them (local forwarding). basically, local, remote and dynamic forwarding are possible. there's some interesting uses for the latter 2 as well so if you only know -L it might be nice to check out the other methods and how you can use those. You can for example, forward a remote localhost port of a server to your own localhost, and then have a fully encrypted channel to some internal or locally bound service. for example if some server hosts a site on it's loopback or some service is listening there which you want to interact with, then you can do it directly from your own machine instead of through an active ssh session. (for example with websites this is useful, because then you can have a graphical browser instead of links via ssh x11 forwarding or w/e)
davrodpin
The tool can select the local port on your behalf.

It also has aliases to store configuration that user usually use, but that is comparable to the ssh config file.

johntash
I don't think you missed anything.. I'm pretty sure I've seen a few similar apps like this on HN, but I don't really understand the draw of them over just using ssh's built in options.. You can even configure tunnels in ~/.ssh/config for "aliases".
dalore
It can bind to a local available port without having to specify what it is. Stops port clashes.
Symbiote
Here are the example commands, with the SSH equivalent. There's a small syntax difference, but otherwise I don't think this tool adds much.

  $ mole -local 127.0.0.1:3306 -remote 127.0.0.1:3306 -server example@172.12.0.100
  $ ssh -L3306:127.0.0.1:3306 example@172.12.0.100

  $ mole -v -local 127.0.0.1:8080 -remote 172.17.0.100:80 -server user@example.com:22 -key ~/.ssh/id_rsa
  $ ssh -v -L8080:172.17.0.100:80 -p 22 -I ~/.ssh/id_rsa user@example.com

  $ mole -v -local 127.0.0.1:8080 -remote 172.17.0.100:80 -server example1
  $ ssh -v -L8080:172.17.0.100:80 example1

  $ mole -remote 172.17.0.100:80 -server example1
  $ ssh -L2937:172.17.0.100:80 example1
  NB Random port is predefined to be 2937, see https://xkcd.com/221/. Or use $RANDOM.

  $ mole -v -local :8080 -remote 172.17.0.100:80 -server example1
  $ ssh -L8080:172.17.0.100:80 example1
  NB difference with SSH, -L:8080... would bind the local port to 0.0.0.0:8080.

  $ mole -v -local 127.0.0.1:8080 -remote :80 -server example1
  $ ssh -L8080:127.0.0.1:80 example1

  $ mole -alias example1 -v -local :8443 -remote :443 -server user@example.com
  Add to SSH config: "LocalForward 8443 localhost:443"
I don't know if Mole supports it, but SSH also has the option to forward a remote port through the local machine.

  home $ ssh -R8888:example.net:80 work.example.com
  ...
  work $ curl -H "Host: example.net" localhost:8888
But the most useful of all is perhaps:

  work $ ssh -D3128 personal-vm-or-raspberry-pi-whatever.example.net
Then configure Firefox to use a SOCKS proxy on localhost:3128. You now bypass any corporate HTTP proxy.
darrenf
mole also doesn't seem to support DynamicForward for creating SOCKS proxies. Mind you, I'm not sure how it could improve on native ssh for concision:

    ssh -D *:1080 work
Combined with a .pac file that proxies my work domain(s) through the tunnel, it's all the forwarding I ever need.

ETA: largely redundant comment now the parent now also mentions this option. :)

Symbiote
I think it's worth drawing attention to it. It's a very useful feature; just don't tell the network administrators.

NB including

  *:
does mean anyone on your local network (assuming a firewall at the gateway) can use your computer to proxy to work. That's great if you're on a private LAN and want to look at a work site on your phone, but not great at a coffee shop.
Bluecobra
> You now bypass any corporate HTTP proxy.

Assuming that said corporation isn’t blocking random ssh connections with their fancy NGFW. ;)

loeg
Yeah, this hits close to home. Our corp firewall blocks anything other than 80 and 443, and MITM's 443.
YouKnowBetter
And when that proxy is worth it's salt, it shall detect attempts to tunnel plain ssh over said ports.

This is 2018, anyone who can bypass their corporate proxy with that example, should find employment elsewhere or atleast prepare to do so since your company's internals will surface on twitter any time now.

davrodpin
There is another interesting example:

$ mole -v -remote :80 -server example1

The missing "-local" flag will make mole to listen on a random local port.

cperciva
For many purposes, users may want to consider spiped as a simpler and more reliable alternative.
justaaron
because it is very difficult to type this instead?

ssh -L 21234:localhost:1234 bob@server.com

I will confess that I googled it numerous times until one day I realized how silly and obvious it was and now it's burned into my brain...

jmngomes
This is cool, but it's not very clear to me what is the benefit of using this over autossh.

autossh detects and restarts broken tunnels and uses aliases and tidy config files: https://www.everythingcli.org/ssh-tunnelling-for-fun-and-pro...

alexeiz
But does your autossh have a beautiful web page? Didn't think so!
loeg
Just syntax, I think. autossh was kind of a pain for me to set up and debug.
davrodpin
The tool can select the local port on your behalf. One less thing to configure :)
dschep
What about reverse & dynamic ssh tunnels? (ssh -R or ssh -D instead of ssh -L)
fiatjaf
If you like this, but think that SSH tunnels are too complicated, I must suggest that you try https://www.zerotier.com/.

ZeroTier solves all your networking needs and much more, the thing is pure power.

loeg
This is maybe a nicer syntax around autossh, which just uses the ssh. And the functionality is ssh's '-R' flag.
mitchtbaum
What do you guys think of that cross-distro, Linux installation method?

curl -L https://... | tar xz -C /usr/local/bin

peterwwillis
This command actually fails if /usr/local/bin doesn't exist. He could simplify it by releasing the binary alone and running `curl -L --create-dirs -o /usr/local/bin/mole https://...`, but my guess is uncompressed it's huge. (edit: possible that the GitHub server would support `curl --compressed ...`, allowing the HTTP connection to compress it in transit)
donatj
I have a number of connections I need to maintain - e.g. have reopened automatically - and I've been using Secure Pipes on Mac for a couple months now, very happy with it.

https://www.opoet.com/pyro/

mbrumlow
So is ~C !!
deathanatos
Sadly, the tilde commands don't work at all if you're using ControlMaster.