Docs/Shell - Revision history

D2wn at 03:43, 8 October 2025

2025-10-08T03:43:55Z

← Older revision		Revision as of 03:43, 8 October 2025
Line 26:		Line 26:
	There's a service on port 8443 to allow wrapping ssh traffic in TLS, so if you're connecting from a *nix client you can use the following options to do the TLS-wrapped-SSH:		There's a service on port 8443 to allow wrapping ssh traffic in TLS, so if you're connecting from a *nix client you can use the following options to do the TLS-wrapped-SSH:

	=== Using ~~package~~ <code>openssl</code> ===		=== Using <code>openssl</code> ===
	<code>openssl</code> should be installed on most *NIX systems, including MacOS, by default.		<code>openssl</code> should be installed on most *NIX systems, including MacOS, by default.

Line 47:		Line 47:
	More information about the SSH Host configuration file can be found [https://linuxize.com/post/using-the-ssh-config-file/ here]		More information about the SSH Host configuration file can be found [https://linuxize.com/post/using-the-ssh-config-file/ here]

	=== Using ~~package~~ <code>socat</code> ===		=== Using <code>socat</code> ===
	If the above doesn't work, (or if <code>openssl</code> keeps dropping the connection randomly) you can use <code>socat</code> instead.		If the above doesn't work, (or if <code>openssl</code> keeps dropping the connection randomly) you can use <code>socat</code> instead.

D2wn at 17:40, 7 October 2025

2025-10-07T17:40:50Z

@@ Line 1: / Line 1: @@
 [[Docs|<small>~/Docs</small>]]
 == SSH-Over-TLS ==
@@ Line 84: / Line 104: @@
 * 4AM EST: cronjob recursively makes a snapshot of /home and each user's homedir, prefixed by "Auto".
 * 4:15AM EST a cronjob recursively deletes >8th oldest /home snapshot starting with "Auto".

D2wn at 17:18, 7 October 2025

2025-10-07T17:18:52Z

← Older revision		Revision as of 17:18, 7 October 2025
Line 68:		Line 68:

	=== ZFS ===		=== ZFS ===
	Shell uses ZFS for the main data pool, which is mounted at /home (and each user's homedir is an individual dataset)		Shell uses ZFS for the main data pool, which is mounted at /home (and each user's homedir is an individual dataset).
			As of Fall 2025, it has roughly ~8TB in raw space (4x2TB drives), ~4TB after formatting (RAID10 / striped-mirrors) and ~1TB used with ~3.5TB free.

	Some helpful commands are:		Some helpful commands are:

		⚫	* View general pool status (and disk health)
			** <code>zpool status</code>
	* View all ZFS snapshots		* View all ZFS snapshots
	** zfs list -t snapshot		** <code>zfs list -t snapshot</code>
	* Delete specific snapshot		* Delete specific snapshot
	** zfs destroy -r zhome@example-snapshot		** <code>zfs destroy -r zhome@example-snapshot</code>

⚫	* View general pool status (and disk health)
			Automated tasks (cronjobs):

	4AM EST a cronjob recursively makes a snapshot of /home and each user's homedir, prefixed by "Auto".4:15AM EST a cronjob recursively deletes >8th oldest /home snapshot starting with "Auto".View all ZFS snapshots: zfs list -t snapshotDelete specific snapshot: zfs destroy -r zhome@example-snapshotGeneral pool status: zpool status		* 4AM EST: cronjob recursively makes a snapshot of /home and each user's homedir, prefixed by "Auto".
			* 4:15AM EST a cronjob recursively deletes >8th oldest /home snapshot starting with "Auto".

D2wn at 17:15, 7 October 2025

2025-10-07T17:15:11Z

← Older revision		Revision as of 17:15, 7 October 2025
Line 45:		Line 45:

	Contact a LUG sysadmin if you need help using a different TLS client application for this purpose.		Contact a LUG sysadmin if you need help using a different TLS client application for this purpose.

			== Notes for sysadmins ==

			=== Scripts ===
			Shell has scripts for administrators in /root/ to automate various tasks.

			These are:

			* add-new-user.sh
			** Use this to make a new user account. useradd doesn't make home directories a ZFS dataset. (useful in case a user wants to rollback their homedir to a snapshot)
			* generate-homepage.sh
			** Generates the index.html page for shell. Called by a cronjob to run every minute.
			* list-administrators.sh
			** Prints a (colored) list of administrators.
			* list-logins.sh
			** Prints an ordered list of user logins
			* list-user-creation.sh
			** Displays a sorted list of each user's creation date based on their homedir
			* user-popularity.awk
			** Prints number of unique IPs that visited each user's shell website path
			** Plan to use this to make "most popular user of the day" blurb in generate-homepage.sh at some point

			=== ZFS ===
			Shell uses ZFS for the main data pool, which is mounted at /home (and each user's homedir is an individual dataset)

			Some helpful commands are:

			* View all ZFS snapshots
			** zfs list -t snapshot
			* Delete specific snapshot
			** zfs destroy -r zhome@example-snapshot
			* View general pool status (and disk health)

			4AM EST a cronjob recursively makes a snapshot of /home and each user's homedir, prefixed by "Auto".4:15AM EST a cronjob recursively deletes >8th oldest /home snapshot starting with "Auto".View all ZFS snapshots: zfs list -t snapshotDelete specific snapshot: zfs destroy -r zhome@example-snapshotGeneral pool status: zpool status

D2wn at 07:42, 23 April 2025

2025-04-23T07:42:32Z

← Older revision		Revision as of 07:42, 23 April 2025
Line 1:		Line 1:
	~~<small>~~[[~~Infrastructure~~\|~/~~Infrastructure]]~~</small>		[[Docs\|<small>~/Docs</small>]]

	== SSH-Over-TLS ==		== SSH-Over-TLS ==

D2wn: D2wn moved page Infrastructure/Shell to Docs/Shell

2025-04-23T07:39:22Z

D2wn moved page Infrastructure/Shell to Docs/Shell

← Older revision	Revision as of 07:39, 23 April 2025
(No difference)

D2wn at 21:06, 22 April 2025

2025-04-22T21:06:37Z

← Older revision		Revision as of 21:06, 22 April 2025
Line 1:		Line 1:
	<small>[[Infrastructure\|../Infrastructure]]</small>		<small>[[Infrastructure\|~/Infrastructure]]</small>

	== SSH-Over-TLS ==		== SSH-Over-TLS ==

D2wn at 21:01, 22 April 2025

2025-04-22T21:01:14Z

← Older revision		Revision as of 21:01, 22 April 2025
Line 1:		Line 1:
			<small>[[Infrastructure\|../Infrastructure]]</small>


	== SSH-Over-TLS ==		== SSH-Over-TLS ==

D2wn at 17:35, 17 February 2025

2025-02-17T17:35:00Z

← Older revision		Revision as of 17:35, 17 February 2025
Line 28:		Line 28:

	=== Using package <code>socat</code> ===		=== Using package <code>socat</code> ===
	If the above doesn't work, (or if openssl keeps dropping the connection randomly) you can use socat instead.		If the above doesn't work, (or if <code>openssl</code> keeps dropping the connection randomly) you can use <code>socat</code> instead.

	Just replace:		Just replace:
Line 40:		Line 40:
	in either the single-use command or persistent config.		in either the single-use command or persistent config.

	So long as socat is installed, it should work without hassle.		So long as <code>socat</code> is installed, it should work without hassle.

	You can also use other TLS client you like, such as ncat or stunnel, but <code>openssl</code> and <code>socat</code> are some of the most popular programs for this purpose so I decided to only cover the configs for them.		You can also use other TLS client you like, such as <code>ncat</code> or <code>stunnel</code>, but <code>openssl</code> and <code>socat</code> are some of the most popular programs for this purpose so I decided to only cover the configs for them.

	Contact a LUG sysadmin if you need help using a different TLS client application for this purpose.		Contact a LUG sysadmin if you need help using a different TLS client application for this purpose.

D2wn: initial commit, ssh-over-tls

2025-02-17T17:25:08Z

initial commit, ssh-over-tls

New page

== SSH-Over-TLS ==
IT blocks all inbound SSH connections from outside of the 141.219.0.0/16 range so by default you can't ssh into Shell from off-campus (or the guest WiFi).

There's a service on port 8443 to allow wrapping ssh traffic in TLS, so if you're connecting from a *nix client you can use the following options to do the TLS-wrapped-SSH:

=== Using package <code>openssl</code> ===
<code>openssl</code> should be installed on most *NIX systems, including MacOS, by default.

It can be installed on Windows with <code>winget install openssl</code> or <code>scoop install openssl</code>

==== Single-Use Command ====
You can use the following command to ssh into shell without editing any persistent configuration files:

<code>ssh -o ProxyCommand="openssl s_client -quiet shell.lug.mtu.edu:8443 2>/dev/null" username@shell.lug.mtu.edu</code>

==== Persistent Config ====
Otherwise, you can add the following to <code>~/.ssh/config</code>, and have it auto-apply any time you type <code>ssh shell</code>:<syntaxhighlight lang="text">
Host shell
ProxyCommand openssl s_client -quiet shell.lug.mtu.edu:8443 2>/dev/null
ServerAliveInterval 10
</syntaxhighlight>This is what I recommend, as you can just type <code>ssh shell</code> and it'll apply the SSH-over-TLS settings automatically.

You can also add your username and pubkey to the host config for a very quick login, so you don't have to type your password every time.

More information about the SSH Host configuration file can be found [https://linuxize.com/post/using-the-ssh-config-file/ here]

=== Using package <code>socat</code> ===
If the above doesn't work, (or if openssl keeps dropping the connection randomly) you can use socat instead.

Just replace:

<code>openssl s_client -quiet shell.lug.mtu.edu:8443 2>/dev/null</code>

with

<code>socat - OPENSSL:shell.lug.mtu.edu:8443,verify=0</code>

in either the single-use command or persistent config.

So long as socat is installed, it should work without hassle.

You can also use other TLS client you like, such as ncat or stunnel, but <code>openssl</code> and <code>socat</code> are some of the most popular programs for this purpose so I decided to only cover the configs for them.

Contact a LUG sysadmin if you need help using a different TLS client application for this purpose.