sysadmin - 3.8.2005 - 26.12.2005

Internet Explorer Sucks

Schneier on Security: Internet Explorer Sucks

MSIE was 98% unsafe. There were only 7 days in 2004 without an unpatched publicly disclosed security hole. [...] This underestimates the risk, because it doesn't count vulnerabilities known to the bad guys but not publicly disclosed (and it's foolish to think that such things don't exist). So the "98% unsafe" figure for MSIE is generous, and the situation might be even worse.

Autsch. 7 Tage ohne veröffentlichtes Loch mit passendem Exploit. Und Leute benutzen diesen Müllhaufen immer noch ...

Experts at Work

When a forensic software manufacturer has to use its own tools in its own house, that's already embarrassing. But if this manufacturer also messes up when storing credit card information, you might want to avoid this manufacturer ...

The fraud was also possible because Guidance stored the card's check number, which Visa and Mastercard's terms of service actually prohibit.

slight instability of this site

Right now, I'm experiencing some minor stability issues - the server process seems to be "losing" file descriptors - eventually they run out and the SCGI server is killed. At the moment, I have no idea why this is happening - other sites with the same server software (FLUP - an SCGI/FCGI server for Python) do not have this problem. For now, a regular cron job is running, which checks the process table to see if my process is still running - and if not, simply restarts it. And next, I'll probably have to come up with a debugging scenario to somehow narrow this down ...

Sams Teach Yourself Shell Programming in 24 Hours - A whole book about shell programming. And of course, a pretty good introduction to the various tools that Unix systems provide. Certainly recommended for anyone who, for example, has gotten a root server and now wants to do more with it - but otherwise knows Linux mainly from the GUI.

Jacobian.org : Django performance tips - Jacob, one of the Django Core-Devs, writes about performance tuning for Django applications. Strongly aligns with my experiences.

pgpool page - interesting connection proxy for PostgreSQL with connection pooling and database failover.

Overview of new features in Apache 2.2 - Apache HTTP Server - what's new in Apache 2.2. Very interesting: the Event MPM. With this, Apache finally reports back at the top of the line for Keep-Alive sessions (previously, Apache had to reserve a worker for each Keep-Alive, which made Apache nearly unusable for streaming with a larger number of clients).

What’s New in WordPress 2.0? · Asymptomatic - even though I will soon be leaving WordPress, it's always interesting to see what's going on there. Besides, at least the Metaeule will certainly continue to run with WordPress.

AirPort Blog - a weblog about AirPort (Apple wireless solution)

DOPE Squad Security - open source WLAN driver for Apple Airport. Designed for use as a passive WLAN scanner.

Holographic Storage Media with up to 1.6 Terabytes

News on holographic storage media:

The discs should initially only allow filling at 20 megabits per second and hold data for at least 50 years after writing.

Please with affordable media prices, then I finally have a usable archiving medium for images ...

How Secure is WEP, Anyway? - an interesting link about the security of WLAN, specifically how easy it is to crack a WLAN with WEP.

Microsoft to Standardize Office Formats in ECMA

Stephen Walli(Ex-Microsofter) über die zu erwartenden Fallstricke in der letzten Microsoft-Aktion:

It will likely be a royalty free license, because the current patent license around the proprietary specification is royalty free. That patent license, however, couldn't be sublicensed, so an implementer that wanted to license their implementation under the GPL couldn't. Indeed previous examples around the IETF SenderID standard would force users of other implementations to engage in a license with Microsoft which is a rather onerous problem for free and open source licensed software.

Der Hinweis auf die SenderID-Geschichte ist durchaus wichtig: dort hat Microsoft auch ständig davon geredet, das es ein offener Standard sei, aber dabei immer unterschlagen, das deren Verständnis von offenen Standards absolut inkompatibel mit vielen Bereichen der Open Source Entwicklung sind - mit Sicherheit wird Microsoft wieder die GPL blockieren.

Abgesehen davon, ich find es schon ziemlich armselig, wenn Microsoft sich schlicht weigert ODF zu implementieren und meint einen eigenen Pseudo-Standard ihres Krams machen zu müssen - zumal man ja genau weiss, wie sich Microsoft dann zu solchen Standards verhält. Die werden dann wieder in den passenden Stellen erweitert und schon ists vorbei mit dem freien Zugriff.

Linux on an Apple Powerbook G4 - even more about the Powerbook and Linux, here you'll also find decent keyboard layouts.

Ubuntu on the PowerBook G4 (powerbook5,6) describes some of the problems you have with Ubuntu on PowerBooks - for me as a reference when I switch my notebook.

Ubuntu and Powerbook

Ok, since my Mac Mini is working hard and everything is functioning as it should, I took the opportunity to install Ubuntu on my Powerbook. I wanted to finally check out how well something like this works today - back in the day, notebooks were quite an adventure with Linux.

Overall, everything looks very good - just like the first impression from the Live DVD. Everything starts properly, the components are mostly well recognized, and the settings are mostly sensible - especially the simple installation (for a test drive, I like to use the DAU mode, just to see how well the people understand their job) leaves a well-set-up desktop system.

Unfortunately, I have a notebook. And not just any notebook, but a Powerbook.

Well, the software itself runs. The desktop is nicely set up, and the selection of software is very useful - even all the notebook features are mostly installed. What was missing?

Well, let's start with the simplest thing: a Powerbook has a fixed keyboard layout - the keys are labeled. I'm not planning to rub off the labeling and repaint it to match a PC. Why don't the Torfnasen provide a Powerbook keyboard layout? I did find something on the net, but to implement it, some major efforts are needed (either applying a not fully functional patch or adjusting the X start process - neither of which are particularly DAU-friendly). Why isn't something like this included with the system? After all, anyone who has seen a Mac keyboard up close knows that it's really not identical to PC keyboards. This is further complicated by the fact that there are quite a few Mac keyboard layouts included - but they only make sense with old ADB keyboards, as they have completely different keyboard codes.

Next up: power management. A lot of software is installed, most of which comes without useful documentation. That's fine - in theory, everything should just be set up. And for the most part, it is set up: when I close my display and open it again, the daemon.log properly records that pbbuttonsd was able to execute the appropriate script.

It would just be nice if the script actually did something...

People, power management is not just a nice-to-have feature for a notebook; it's essential. And everything necessary for it is actually present. Please include it and use it. The Ubuntu installation looks as if the part that would execute the actions was simply left out. And I haven't found out on the fly in which package this might be hidden.

Then there's Bluetooth. The system recognizes all sorts of things, and something is being done with someone - but how, what, and where you can now do something with Bluetooth, that's not really clear. Hey guys, Bluetooth is really not ultra-new anymore, and for Linux, there's been something for quite some time - how about at least some rudimentary tools that show the status?

WLAN still doesn't work - but that's not Ubuntu's fault, it's the stupid manufacturer of the cards. 3D acceleration of the graphics also doesn't work, which is why the desktop is a bit sluggish than it should be - same reason as with WLAN. It's really a shame that hardware manufacturers put extra obstacles in the way of a free operating system.

Minor annoyances: the trackpad is set to be ridiculously sensitive - almost unusable for people with motor problems. More conservative settings would be much more sensible. And Gnome is still quite wasteful with screen space - hey, my notebook only has 1024x768, I can't just add pixels!

All in all, Ubuntu confirms its good suitability as a desktop system - because the installed system itself is really useful. But notebooks are still the last adventure for the toughest.

And my notebook? Well, I'll probably just go back to Tiger.

Well, Intel messed up again: Hyperthreading hurts server performance, say developers - what was the reason again why Apple relies on Intel processors? Better performance? Pfft.

Apples WebObjects with new licensing terms

Apple has clarified the licensing issues with WebObjects - Deployment on Linux boxes is now also completely allowed. Thus, the XCode environment with WebObjects is now completely free from development to deployment.

Linux-Vserver on Debian Sarge - the title says it all. Bookmark for later - could be interesting for my server.

Mac-on-Linux - strangely never blogged about, so now. Running Mac operating systems in a virtual environment under Linux on Macs - ideal for Linux-powered Mac Minis where you still want to have the one or other OS X program ...

Mac-on-Mac is the inverse counterpart to Mac-on-Linux - a port of the virtual machine to OS X, with which you can then run Linux or other Mac systems under OS X in a virtual environment. Status is still very raw ...

Phishing: iTAN offers no protection either - which was actually clear to everyone beforehand, but of course did not stop the banks from marketing this nonsense as the best invention since sliced bread ...

Google's Web Accelerator and Damager

Google at it again - Ian pretty much says everything there is to say about it. Google claims they don't want to be "evil." But they are infinitely stupid, as shown by the repeated launch of the Web Damager.

What does the Web Accelerator do, and why is it such a stupid piece of software? Well, it simply follows links. And it does so in advance, before the user does - so to speak, speculative web crawling, but privately for the user. That doesn't sound so bad at first, except that servers are bombarded with traffic they might never have otherwise - because every link is followed, even if the user doesn't go there. And that multiplied by the users who use this thing...

But the traffic is not the real problem - the real problem comes when you consider the context in which this thing runs. And that is, it runs on the user's private computer, between the browser and the network. Just a little proxy of its own. Which, for its work, remembers cookies and similar things and then sends requests to the pages that look as if they come from the user's browser. With their security headers. And cookies.

Apart from the fact that I wouldn't particularly like it if my headers with passwords or session cookies appeared anywhere other than in the browser and the target server - this approach also enables the Web Accelerator to look at areas that a central crawler would not see. For example, areas of pages that are behind logins. Content management systems, where additional links appear after login. Wikis, whose edit links then appear when someone starts a session. Webmail systems, where each mail is represented as a link.

All these systems have one thing in common: for changing actions, a form submission is not always necessary. Often, it is enough to click a link. The current version of a page in the wiki to delete quickly to remove wiki spam - a simple link, only visible to the logged-in user. The mail in the webmail inbox, which is automatically marked as read when called up. The publish link in the CMS, with which a page is put live.

Of course, responsible web application programmers try to put destructive actions behind forms (and thus POST requests) so that a simple link doesn't destroy anything. But this usually only happens in the publicly accessible areas, where otherwise the web robots of the various search engines and spam automata would cause chaos.

But precisely in the areas shielded by login, one normally does not expect automated clicks - and therefore builds comfort features, because one can be sure that a link is clicked consciously and intentionally.

Well, until the Google Web Accelerator came along. From the company that claims to understand the web. Thanks a lot, you assholes.

PS: and contrary to the first version, the new version no longer sends a header with which one could recognize the prefetch requests in order to block them in such critical areas.

Spam Block List Ran Amok

Guess who that was? Exactly - SORBS. My favorite collection of technical incompetence and social stupidity. Couldn't someone initiate a UDP against the pipes?

Ubuntu Breezy Badger

I pulled the Live+Installation DVD (hey, T-DSL 3000 rules!) and must say, I'm really surprised. Okay, there are a few issues: the keyboard layout is suggested as the default for the PC - but a Mac notebook can have different layouts (externally a PC keyboard, but internally always a Mac keyboard), so the selection should be a bit more clever. If you switch to the Macintosh keyboard in the selection, special characters like the pipe symbol and curly and square brackets and AT and such no longer work - with PC allocation, however, the labeling of the Mac keyboard does not match. And there is no allocation for the Mac special characters.

What also doesn't work is the second monitor - it is simply not detected and activated, not even initialized. Too bad, because Macs do have multi-monitor support by default, at least the PowerBooks and PowerMac models (the iBooks and iMacs only partially and then only with hacks). That should also be included in my opinion.

But otherwise - nice thing. That WLAN is not recognized is normal - or it is recognized, but not usable. Apple's WLAN chips are often not supported there. I also don't know where Bluetooth is configured - I probably need to install packages first. But that could also be done automatically in my opinion if a Bluetooth adapter is detected. Nevertheless, Ubuntu seems quite nice overall - it starts with usable defaults and already supports a lot of the computer. And the extensive translation of at least menus and dialogs in Gnome is very pleasant.

And that a Debian architecture is working underneath is of course particularly dear to me.

However, it is catastrophic that in the Live CD it seems that no terminal can be started anywhere ...

Version Control with SVK

Version Control with SVK is an online book about SVK - a distributed version system that works very well with SVN and CVS (among others). And it offers quite a relief especially for working with patches for upstream systems and for local forks of open source software.

The book is far from complete, but you can already find quite a lot of information in it.

Twisted Names I should take a look at - a DNS server in Python based on Twisted. I could rewrite it for database usage as an alternative to PowerDNS.

Nessus soon unusable

Here is the translated Markdown body:

Then Nessus becomes closed source - Golem.de:

The biggest change for Nessus 3, however, is the license. While Nessus has been developed and offered as open source under the GPL so far, version 3 will no longer be published under the GPL. Although the software will continue to be offered for free, even for Windows, the source code will no longer be published.

And a security scanner for which the source is not available is simply nonsense and snake oil. Because tools in the security field urgently need the peer review that is absolutely common for open source software in this area.

TC Trustcenter insolvent

The TC Trustcenter has filed for insolvency - ouch. There was nothing in the media to suggest this - suddenly gone. Quite annoying, because in .de there aren't many places where you can get server certificates that are also accepted in browsers with standard delivery ...

What does Trusted Computing have to do with Trust?

Sure, everyone knows this and it has gone through all the blogs, but the film is so nicely made that you have to link to it more often: A movie about Trusted Computing. Because the film names exactly the central point: if the industry has decided that they do not trust the user - why should the users trust the industry?

They're doing the same shit as in the USA

Here the state also provides backing to a voting machine manufacturer and keeps the inspection reports under lock and key due to alleged protection of know-how:

That the BMI keeps the inspection reports under lock and key weighs heavily, especially in light of a waiver of an additional vote recording independent of the electronics, criticizes Wiesner: "Neither the voter nor the election committee in the polling station can determine which software is actually used in the polling station and how secure the devices used are against manipulation." Consequently, the form for the election record does not even provide for the alleged program version to be recorded.

For me, this is just as dubious as the same nonsense in the USA. Voting computers must - if they are to be trustworthy - withstand public discussion. The alleged know-how protection of the manufacturer must not be valued higher than the citizen's right to information on how the vote counting is conducted. It is simply absurd what the BMI is doing here - but what else can one expect from the authority of Otto Orwell?

DjangoScgi - Django Projects - Trac

Django with Apache and SCGI and Django with Apache and FCGI are two reworked documentations on how to get Django running with both FCGI and SCGI under Apache. I use the same parts as with my previous howtos, only that now SCGI is supported, too.

My gallery is currently running the Apache+SCGI setup, it's quite nice. The configuration in Apache is much nicer and cleaner than with the FCGI setup.

Since 2007 the links in this page didn't work any more, so I removed them.

Security by complete Stupidity

Now it's clear, how to get Paris Hilton's phone number:

The hackers called a T-Mobile store and pretended to be employees of the company headquarters. They said there were network problems and had the non-public internet address of the T-Mobile customer database given to them as well as the necessary login and password information.

Ouch. Ouch. Ouch.

Sometimes the Debianistas Spin

From the response to a bug report by me about a completely wrong version of mod_perl 2:

I'm afraid you will be out of luck here, if I understand the issues correctly. The official release of mod_perl 2.0 never made it to Sarge, the 1.999.21-1 packages in Sarge is a pre-release. The problem was that shortly before mod perl2 went stable, the upstream developers decided to rename lots of things in the API, and Sarge shipped the old API. Thus, mod perl 2.0 as shipped with Sarge won't run in the rest of the world, and vice-versa. Also, the documentation will be confusing. [...] So, well, this isn't a good situation, but it is something we have to live with.

What? They must have lost their minds. Once again, for clarity: the mod_perl 2 version in Debian Sarge—the current stable Debian—is not compatible with the old mod_perl 1 version or the real mod_perl 2 version because it is a 1.99something with a quite different API. Applications based on it are not portable from the old version and not portable to the new version. Anyone who wants to work with Debian Sarge, Apache2, and mod_perl must first get a backport because the version included is simply completely wrong.

This is absurd. Sure, mod_perl 2 wasn't ready for release on time, but the version currently in Sarge is simply garbage. Instead of removing it, an intermediate version is included, making life difficult for anyone who wants to port mod_perl applications to Apache 2—and doubly so, because with the next release, they'll have to port again.

And then the knockout punch last night:

The only valid complaint in this bug report is the fact that we don't include pre-2.0 API docs in sarge. Debian makes absolutely no guarantees that the version of a package shipped in a stable release will match whatever the current API is on its upstream website.

Summary: we don't understand anything and insist on behaving like complete idiots. Instead of at least removing the junk release—which is also classified as "don't use" by upstream—the missing documentation is now listed as a wishlist bug.

iTAN method not secure either

The iTANs (indicated TANs - as recently introduced by the Postbank) are also not the be-all and end-all against phishing attacks. The classic attack would simply be to redirect the user to their own site during phishing and then process the transaction with the bank in parallel with the user's inputs - but of course in a different form than shown to the user. Instead of simply requesting a TAN, the bank server is first contacted and the TAN required from there is then requested from the user. With this TAN, a booking can then be made problem-free while the user spends time on the supposed security update - or whatever the phishing attack pretended to be.

The RedTeam has compiled a scenario and spoken to the banks:

According to a survey by the RedTeam, the problem described was largely understood by the banks, but not taken very seriously. They wanted to continue to adhere to the presentation of secure iTANs. One bank argued that the attack would have to be very quick and take place within seven minutes. Another institution wanted to distance itself from its statements only after the first case of damage to a customer had occurred.

The same arrogant attitude that banks have always taken against abuse - instead of addressing the problems themselves or actively describing security issues and thus taking customer maturity seriously - is being dismissed and lied about. And for such nonsense, we then have to pay booking fees.

1&1 is acting up

Now there's a forced redirect:

When customers of the provider 1&1 in Karlsruhe establish a new DSL connection and then start the browser, they are now always shown the 1&1 portal.

Great. And if these first requests come from some scripts of a server at the DSL connection, the scripts will fail. Just because 1&1 had another rarely stupid idea. And we have to explain to the customers again why something obscure doesn't work - and all of this just for marketing nonsense.

Cooperative Linux is a port of the Linux kernel as a Windows application. This allows you to run Linux as a Windows application without needing a virtualizer like VMWare.

the strange tendency of PHP programmers to eval

Vulnerabilities in PHP modules endanger (once again) numerous web applications - and once again it's XML-RPC. They are still using eval - and that's for evaluating tags. Seriously? Sorry, folks, but this is just ridiculous - eval has already blown up in your face, why weren't all those calls removed back then? Or at least properly secured?

And people wonder why I don't have much faith in PHP software ...

Lazy Posts in WordPress

The new Wordpress 1.5.2 should finally fix the slow posting - caused by pinging - by moving the pinging to the shutdown, i.e. after the actual request-response chain. In German: with 1.5.2, pinging should no longer cause an eternal wait on the browser. It would be very nice if that actually works.

Since there are also security fixes included, an upgrade is generally sensible. Although WordPress, for a PHP application, functions surprisingly stably - but still, there are undoubtedly one or two skeletons in the closet.

Update: well, it hasn't really gotten faster when posting ...

RBL Operator Again

After I already wrote about it in April, it's now also in the Heise Ticker: RFC-ignorant: All .de domains under suspicion of spam. The ignoramuses of RFC-Ignorant will certainly not change their minds, but perhaps now the one or other provider will remove this absurd block list from the mail configuration.

Fuck, I'm slowly getting really annoyed by awstats.pl. I'm already considering switching back to webalizer, which only produces stupid static output. But it can also do less.

Privacy Update under OS X

In IRC, identd, and Privacy I complained that proxies with SOCKS support were rather thin on the ground - meanwhile, things have improved significantly. Because X-Chat Aqua is now in a state that can be described as very usable - after many years of using Snak, I have actually switched.

X-Chat Aqua supports SOCKS and thus allows direct use of tor. However, this is not SOCKS4A - therefore, DNS resolutions are still visible. Ideally, you simply enter the server's IP address, so no name resolution needs to occur.

With Jabber, things now look very good with PSI - PSI is very usable under OS X and the display problems of older versions have also been fixed. And PSI also works with tor.

Browsing over tor was already possible before, but with the current Mac OS X Builds of tor, it is also very easy to install. Tip: I created my own network configuration, with which I can easily change the proxy settings. With this, I can then simply turn Privoxy+Tor on and off in the Apple menu as needed. Of course, this only works with browsers that get their proxy settings from the system settings.

Using ssh over tor is easily done with the ProxyCommand stuff. Instructions are in the Torify HowTo. Many of the tips mentioned there also work under OS X, as there is a normal Unix underneath.

Mac OS X Intel hacked to run on standard PCs

It's quite bitter when OS X Intel is already hacked before it's actually available:

MacBidouille reports that the Apple Developer kit version of Mac OS X x86, released to developers in early June, has been "hacked" to work with a PC notebook. The report includes a video showing Mac OS X x86 booting natively on a Pentium M 735-based notebook.

And this despite TPM and similar tricks. Maybe Apple should switch back to PowerPC after all, which is not more secure, but at least there's no alternative hardware at bargain prices like with Intel.

Sooo cool!

BlackDog is a PowerPC computer with 64 MB of memory and a 512 MB flash disc in a mini case that you can plug into any PC with Windows or Linux via the USB port. The PowerPC processor then takes over the keyboard, mouse, and screen, and starts its Debian Linux, whose desktop you can then see on the PC.

The device runs solely on USB power and also has additional biometric access control via fingerprint. Wow. A nice little hacker kit for on the go, you just need to find a host computer.

And it is completely open and hackable in terms of architecture - there is even a hacking competition to develop interesting applications for it. Although I already know what I would put on it - all the necessary network tools. I think I need to motivate the boss at the company to take a closer look at what you can do with such a device. I haven't had such a strong desire to have something for a long time.

Oracle Cluster File System 2 for Linux

The Oracle Cluster File System could already be a nice alternative to GFS and Coda - at least if this really happens:

The Linux developer responsible for the Linux Kernel 2.6, Andrew Morton, wants to include the Oracle Cluster File System version 2 in the official Linux Kernel as soon as possible. Linux 2.6.14 could already contain OCFS 2 and would then be the first cluster component in the official Linux Kernel.

The previous cluster file systems suffer from the lack of integration - most of the time you can't use them in every kernel version. What is interesting to me is how independent the nodes really are and whether there is also a single point of failure in the Oracle Cluster File System, as there is e.g. the Locking daemon in OpenGFS. So far, we have not been very successful in evaluating cluster file systems in the company, actually they were all somehow stupid ...

The Hidden Boot Code of the Xbox

In The Hidden Boot Code of the Xbox the X-Box-Linux programmers explain how the security code of the X-Box is structured and how Microsoft built in 3 errors in 512 bytes of code. Lots of kindergarten security mistakes. - as Bruce Schneier calls it.

Also nice is the conclusion of the article:

So with the first version of the MCPX, Microsoft was too naive and apparently did not understand basic security concepts. After they had learnt their lesson, they designed a pretty good system with the second version of the MCPX - but the implementation still contained at least three security holes (Visor, MIST, TEA). They were too fast releasing a new version of the MCPX, spending a lot of money in trashing tons of already manufactured MCPX chips and manufacturing updated ones, apparently without any further code audit which should have revealed the security holes.

512 bytes is a very small amount of code (it fits on a single sheet of paper!), compared to the megabytes of code contained in software like Windows, Internet Explorer or Internet Information Server. Three bugs within these 512 bytes compromised the security completely - a bunch of hackers found them within days after first looking at the code. Why hasn't Microsoft Corp. been able to do the same? Why?

Exactly. Why doesn't Microsoft get this right? Why does Microsoft repeatedly fail so badly at security? And don't give me the silly excuse that the bugs at Microsoft are found so quickly because it has so many users - this is basic knowledge that would be required. This is just sloppy.

And now, Mr. McBride?

Shit hits Fan for SCO:

A: There was a release of SCO LinuxWare release 7.1.2 that included the Linux kernel personality and SCO Linux-release 7.1.3 included the Linux kernel personality. At first when it first shipped it did include the Linux kernel packages which were subsequently removed.

I find this somehow fitting when SCO is caught using the Linux kernel - which is under GPL - in their products at least temporarily and delivered with them. Could be one reason why they are now trying to denounce the GPL as un-American and unconstitutional.

Hand Darl McBride the Frog Pills

Here's the translated Markdown body:

now he's really going off the deep end:

In detail, McBride lists ten points that speak for SCO and against Linux. Thus, OpenServer is supposedly much cheaper than Linux systems that work with hidden annual licenses, has a superior kernel, and offers significantly higher security than Linux systems where security gaps remain open for weeks. McBride repeatedly emphasizes that his company owns Unix and, for this reason, enjoys greater trust among customers. Furthermore, SCO, as the owner, ensures that there are no splinter groups of incompatible system variants.

Rarely seen such a compact block of bullshit

You never stop learning

I thought I knew most of the tricks of ssh. But I stumbled upon one that is banal and simple, but was not known to me: the ProxyCommand option. With this option, you can define a tunnel for a specified host that is established before the actual connection is made. With the program nc (Netcat) on the computer one before the target system, you can tunnel through a chain of firewalls wonderfully, especially when working with Auth-Forwarding. Simply build a section similar to this into the .ssh/config:


 Host safe
 Protocol 2
 User me
 HostName 192.168.0.42
 ProxyCommand ssh door nc -q 0 safe 22

Here, when ssh safe is used, a connection to the computer door is established internally via ssh door, and then a Netcat connection to the ssh daemon on the actual target computer safe is created there. This can also be used wonderfully over several ssh hops to transport files directly between two systems through a chain of firewalls. Ssh is just genius, if it didn't exist, you would have to invent it.

(in my case, I needed this for darcs - it can only push repositories over ssh)

Cisco customer passwords are gone - this is so embarrassing, it really hurts. Oops. And it's Cisco.