Ssh
guest@6admin.io:~$ ls ~/tags/ssh
Windows 11 for build machines: the wrong tool
Windows 11 client on headless bare-metal build machines in a server room: the detail of the provisioning and operational friction and why Windows Server with Desktop Experience does the same job for a fraction of the pain.
Driving opencode behind an SSH tunnel, with direnv
The logical sequel to my ssh and git config: a direnv .envrc that brings up a self-healing SSH tunnel per project, routes opencode and a coding agent to a remote gateway and opens a SOCKS5 for the browser and proxychains. Non-blocking, throttled and always exit 0.
myflec: a Bash dotfiles framework for people who deploy their home directory
A loader that sources core modules first, a bare-git backup that pushes to three forges, an rsync deploy with dry-run and automatic backups and SSH identities split per project tree. My home directory framework, explained.
Driving Windows from Ansible without leaking credentials
Ansible transport to Windows: WinRM, Kerberos over NTLM and how not to carry domain credentials in cleartext.
Hardening Proxmox VE
Proxmox VE hardening: web interface access, network separation, clustering and the hypervisor's sshd.
SSH Security Hardening: Access Control and Monitoring
Hardening sshd without kidding yourself: no root, nominative accounts, keys only and the monitoring that makes actions accountable.
Inbound traffic: expose less and guard what is left
Securing inbound traffic: firewall, minimal exposure, reverse proxy and clean TLS termination.
The Bastion and Guacamole: the two leaves of the front door
OVHcloud's The Bastion for shell people, Apache Guacamole for desktop people: two approaches to the same question, who may touch what and who looked at what.
SSH in 2021: what thirteen years changed since the 2008 series
This blog's SSH series ended in 2013 with PKCS#8. Here is the 2021 version, complete and secure: Ed25519, FIDO2 keys, certificates, sshd hardening, Include and Match, ProxyJump and multiplexing. What 2008 did hopefully, 2021 does with primitives.
Portknocking and SSH tunneling: the magic tricks before WireGuard
WireGuard ships in 2016 and makes two beloved 2008 setups outdated: portknocking (with automatic combination generation, mandatory NTP and an encfs USB key) and SSH tunneling. The era's tone, the in-production demo until 2018 at a hosting provider and why a VPN that says nothing wins.
SSH Hardening: the 2017 Trilogy Reread in 2026
In 2017 I answered a naive SSH hardening article in three comments: root, port, keys. Nine years later the principles hold, the context changed: bastions, native Windows, the client supply chain and the physical threat no config covers.
SSH: ProxyJump and modern multi-hop
ProxyJump, the -J option that arrived with OpenSSH 7.3, replaces the old ProxyCommand + nc for crossing one or more jump hosts. Shorter on the command line, cleaner in config and with no key left lying on the bastion.
Ansible before Ansible: ssh, a CSV and a template engine
Before Ansible existed, there was my 2006-2007 contraption: a host list, an ssh loop, inventory variables in a CSV, pure bash and a template engine whose name I have shamefully forgotten. Assumed archaeology of what worked, what was missing and what Ansible later made explicit.
SSH: hardening your keys with PKCS#8
Converting SSH RSA keys to PKCS#8 with hardened 3DES encryption, the last article of the original SSH series.
SSH: restricting a connection via private/public keys
The authorized_keys options to confine a passphrase-less SSH key to a single task.
SSH: multiple authentication with private/public keys
Using multiple SSH keys with distinct identities, one per server and avoiding Too many authentication failures.
DevOps, a word for what I was already tinkering with
The word DevOps is starting to circulate and I recognise in it what I was tinkering with at my own small scale: ssh and a CSV, git and bash hooks, gitolite on top. What it brings to mind and the honest part about why the wall never bothered me much.
Puppet: my first modules, or moving from the ssh loop to declaring
After my bash scripts and my CSV inventory, Puppet: the install/config/service triad, $::operatingsystem selectors and require/notify chains. What declaring brings to the ssh loop.
Screen: a terminal multiplexer
GNU Screen, the multiplexer that lets multiple text-mode programs run simultaneously from one interface and survive logout.
SSH: secure rsync
Rsync over SSH, incremental backup on the encrypted channel.
SSH: SSH filesystem
Sshfs, mounting a remote filesystem via SSH and FUSE.
Polipo: an ultra-simple proxy
Polipo, the web cache proxy in 1000 lines of C and why you use it behind an SSH tunnel.
Fail2ban: fighting bruteforcing
Fail2ban, the bouncer that bans IPs trying to brute-force your services, by reading the logs.
SSLH: ssh and https on the same port
A 2007 memo: sslh multiplexes ssh and https on port 443, the only port of paranoid firewalls. How it works, what it allowed and why (edit 2026) nobody would put it in production today.
SSH: tunneling
SSH tunneling, making any protocol cross the encrypted channel.
SSH: authentication via private/public keys
SSH keys, the password alternative that is also an authorization mechanism.
Magic SysRq: the sysadmin's crutch
The kernel SysRq key, the REISUB sequence and why it is the last thing you do before pulling the plug.
SSH: where is the fish?
The KDE fish protocol, the file transfer over SSH that Konqueror does natively.