OpenSSH

OpenSSH is a powerful, open-source implementation of the Secure Shell protocol.

Connection multiplexing

OpenSSH 4.0 added connection multiplexing, which can tremendously accelerate ssh connection setup. I discern no weaker security here than that accepted when forwarding an agent -- root on the target machine can take advantage of the control named pipe created, unless the "ask"/"autoask" properties are used (and even then, they could be snooping memory...). There's some serious speed wins to be had:

[recombinator](127) $ \time -f %E ssh -oControlPath=none hogwarts true 
0:01.44
[recombinator](0) $ \time -f %E ssh -oControlPath=none hogwarts true 
0:01.65
[recombinator](0) $ \time -f %E ssh -oControlPath=none hogwarts true 
0:01.68
[recombinator](0) $ \time -f %E ssh -oControlPath=none hogwarts true 
0:01.61
[recombinator](0) $ \time -f %E ssh hogwarts true
0:00.26
[recombinator](0) $ \time -f %E ssh hogwarts true
0:00.20
[recombinator](0) $ \time -f %E ssh hogwarts true
0:00.20
[recombinator](0) $ \time -f %E ssh hogwarts true
0:00.22
[recombinator](0) $ 

Just set ControlPath to something like ~/.tmp/ssh/%r-%l-%h-%p (make sure the directory exists!), and ControlMaster to auto or autoask. Display and agent forwardings will be available to all multiplexed connections, but (at least as of 5.2) it is impossible to forward multiple displays or agents. The GCC Wiki recommend creating a master ssh connection, ala persistent port forwardings, via an early ssh -fMN. Note that the master connection will not, by default, exit until any connections multiplexed atop it have disconnected.

If the master connection goes bad for some reason, all multiplexed connections tend to suffer similarly (as one would expect).

External Links

• OpenSSH home page
• ScanSSH home page
• David Hilley's "SSH Tips and Tricks", GT-LUG 2007-02-28