<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" media="screen" href="/~d/styles/rss2full.xsl"?><?xml-stylesheet type="text/css" media="screen" href="http://feeds.feedburner.com/~d/styles/itemcontent.css"?><rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/" xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" version="2.0">

<channel>
	<title>RTFM</title>
	
	<link>http://joshua.hoblitt.com</link>
	<description>[Read This Fine Material] from Joshua Hoblitt</description>
	<lastBuildDate>Tue, 17 Jan 2012 06:41:43 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="self" type="application/rss+xml" href="http://feeds.feedburner.com/jhoblitt/rtfm" /><feedburner:info uri="jhoblitt/rtfm" /><atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="hub" href="http://pubsubhubbub.appspot.com/" /><feedburner:emailServiceId>jhoblitt/rtfm</feedburner:emailServiceId><feedburner:feedburnerHostname>http://feedburner.google.com</feedburner:feedburnerHostname><item>
		<title>QR codes for business cards</title>
		<link>http://feedproxy.google.com/~r/jhoblitt/rtfm/~3/bORt1cW0Cxk/</link>
		<comments>http://joshua.hoblitt.com/rtfm/2012/01/qrcodes_for_business_cards/#comments</comments>
		<pubDate>Tue, 17 Jan 2012 06:29:32 +0000</pubDate>
		<dc:creator>jhoblitt</dc:creator>
				<category><![CDATA[Random Commentary]]></category>

		<guid isPermaLink="false">http://joshua.hoblitt.com/?p=491</guid>
		<description><![CDATA[SCALE10x is coming up and, at the last moment, I decided to tryout an idea I&#8217;ve been toying with since OSCON 2011 last summer. At OSCON I noticed that the first thing I do when receiving a new acquaintance&#8217;s business &#8230; <a href="http://joshua.hoblitt.com/rtfm/2012/01/qrcodes_for_business_cards/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<p><a href="https://www.socallinuxexpo.org/scale10x">SCALE10x</a> is coming up and, at the last moment, I decided to tryout an idea I&#8217;ve been toying with since <a href="http://www.oscon.com/oscon2011">OSCON 2011</a> last summer. At OSCON I noticed that the first thing I do when receiving a new acquaintance&#8217;s business card is to look them up on LinkedIn and add them to my network. It seems it would same some time and ambiguity to have the LinkedIn profile URL on the card itself. Typing in URLs (even shortened URLs) can be error prone so why not just encode them as a QR code?</p>
<p>After some Googling, I discovered that Android has the ability to read <a href="http://www.ietf.org/rfc/rfc2426.txt">vCards</a> encoded in a QR Code. The downside to this is that vCard is a fairly verbose format and you burn up bytes rather quickly. A high byte count QRcode is difficult to fit in a usable size on a US standard 2&#8243;x3.5&#8243; card. <a href="http://www.qrstuff.com/">qrstuff</a> claims to have a work around for this by just encoding a HTTP URL. I tried this myself (not using the qrstuff service) and it did not work for me under Android 2.2 on my Droid2 (2.3.20).  Experimentally, it seems that an encoded vCard stripped down to only a couple of entries is feasible.</p>
<p>I created the QR codes for the back of my new business cards using the <a href="http://fukuchi.org/works/qrencode/">qrencode</a> package and then did the layout of the card using <a href="http://www.gimp.org/">Gimp</a>. It would probably have been better to use a package better suited to page layout like <a href="http://www.scribus.net/canvas/Scribus">Scribus</a> but I was in hurry to get the cards in time for SCALE10x and didn&#8217;t want to learn a new package. This is the Makefile I used to generate the QR code images.</p>
<pre>
all: jhoblitt_vcf.png jhoblitt_linkdin.png

jhoblitt_vcf.png: jhoblitt.vcf
cat jhoblitt.vcf | qrencode -l L -s 16 --margin=4 -o jhoblitt_vcf.png

jhoblitt_linkdin.png:
qrencode -l L -s 27 --margin=4 -o jhoblitt_linkdin.png "http://linkd.in/jhoblitt"

clean:
rm jhoblitt_vcf.png jhoblitt_linkdin.png
</pre>
<p>The <code>-s</code> flag is the number of pixels in the output image to use to present a QR code pixel. The values I used were from trial and error trying to get the output image as close to 900x^2 as possible. Since the number of pixels in a QR code depends on the number of bytes being encoded, this value needs to be adjust based on the input. I then scaled the images to 900px square with the intent (hope?) that the card printer I used (<a href="http://www.uprinting.com/standard-business-card-printing.html">uprinting.com</a>) will be printing at 600dpi. I would have preferred to use <a href="http://www.whcc.com/">WHCC</a>, as I trust their color management, but they couldn&#8217;t guarantee me a 1 day production window needed to get the cards by Wednesday and I leave for SCALE10x on Thursday.</p>
<p>Here are the finished results. The versions used for printing are 2100x * 1200px.</p>

<a href='http://joshua.hoblitt.com/rtfm/2012/01/qrcodes_for_business_cards/jhoblitt_card_front_350x200/' title='jhoblitt_card_front_350x200'><img width="150" height="150" src="http://joshua.hoblitt.com/wp/wp-content/uploads/2012/01/jhoblitt_card_front_350x200-150x150.png" class="attachment-thumbnail" alt="jhoblitt_card_front_350x200" title="jhoblitt_card_front_350x200" /></a>
<a href='http://joshua.hoblitt.com/rtfm/2012/01/qrcodes_for_business_cards/jhoblitt_card_back_350x200/' title='jhoblitt_card_back_350x200'><img width="150" height="150" src="http://joshua.hoblitt.com/wp/wp-content/uploads/2012/01/jhoblitt_card_back_350x200-150x150.png" class="attachment-thumbnail" alt="jhoblitt_card_back_350x200" title="jhoblitt_card_back_350x200" /></a>
<a href='http://joshua.hoblitt.com/rtfm/2012/01/qrcodes_for_business_cards/jhoblitt_vcf/' title='jhoblitt_vcf'><img width="150" height="150" src="http://joshua.hoblitt.com/wp/wp-content/uploads/2012/01/jhoblitt_vcf-150x150.png" class="attachment-thumbnail" alt="jhoblitt_vcf" title="jhoblitt_vcf" /></a>
<a href='http://joshua.hoblitt.com/rtfm/2012/01/qrcodes_for_business_cards/jhoblitt_linkdin/' title='jhoblitt_linkdin'><img width="150" height="150" src="http://joshua.hoblitt.com/wp/wp-content/uploads/2012/01/jhoblitt_linkdin-150x150.png" class="attachment-thumbnail" alt="jhoblitt_linkdin" title="jhoblitt_linkdin" /></a>

<img src="http://feeds.feedburner.com/~r/jhoblitt/rtfm/~4/bORt1cW0Cxk" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://joshua.hoblitt.com/rtfm/2012/01/qrcodes_for_business_cards/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://joshua.hoblitt.com/rtfm/2012/01/qrcodes_for_business_cards/</feedburner:origLink></item>
		<item>
		<title>Default Password for Infortrend DS S12S-R2240-4</title>
		<link>http://feedproxy.google.com/~r/jhoblitt/rtfm/~3/-ZzoD9yjbIs/</link>
		<comments>http://joshua.hoblitt.com/rtfm/2011/11/default_password_for_infortrend_ds_s12s_r2240_4/#comments</comments>
		<pubDate>Tue, 15 Nov 2011 11:13:59 +0000</pubDate>
		<dc:creator>jhoblitt</dc:creator>
				<category><![CDATA[Default Passwords]]></category>

		<guid isPermaLink="false">http://joshua.hoblitt.com/?p=481</guid>
		<description><![CDATA[username: configuration password: (password is blank) username: information password: (password is blank)]]></description>
			<content:encoded><![CDATA[<p><a href="http://joshua.hoblitt.com/wp/wp-content/uploads/2011/11/infortrend.png"><img class="alignnone size-medium wp-image-482" title="infortrend" src="http://joshua.hoblitt.com/wp/wp-content/uploads/2011/11/infortrend-300x130.png" alt="" width="300" height="130" /></a></p>
<pre>
username: configuration
password:
(password is blank)
</pre>
<pre>
username: information
password:
(password is blank)
</pre>
<img src="http://feeds.feedburner.com/~r/jhoblitt/rtfm/~4/-ZzoD9yjbIs" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://joshua.hoblitt.com/rtfm/2011/11/default_password_for_infortrend_ds_s12s_r2240_4/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://joshua.hoblitt.com/rtfm/2011/11/default_password_for_infortrend_ds_s12s_r2240_4/</feedburner:origLink></item>
		<item>
		<title>Things to look for in an TLS/SSL certificate authority</title>
		<link>http://feedproxy.google.com/~r/jhoblitt/rtfm/~3/KtrGXep1YSM/</link>
		<comments>http://joshua.hoblitt.com/rtfm/2011/11/things_to_look_for_in_an_tlsssl_certificate_authority/#comments</comments>
		<pubDate>Tue, 15 Nov 2011 11:08:31 +0000</pubDate>
		<dc:creator>jhoblitt</dc:creator>
				<category><![CDATA[Random Commentary]]></category>

		<guid isPermaLink="false">http://joshua.hoblitt.com/?p=477</guid>
		<description />
			<content:encoded><![CDATA[<p><a href="http://joshua.hoblitt.com/wp/wp-content/uploads/2011/11/auth.startssl.com_.png"><img class="alignnone size-large wp-image-478" title="auth.startssl.com" src="http://joshua.hoblitt.com/wp/wp-content/uploads/2011/11/auth.startssl.com_-1024x480.png" alt="" width="620" height="290" /></a></p>
<img src="http://feeds.feedburner.com/~r/jhoblitt/rtfm/~4/KtrGXep1YSM" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://joshua.hoblitt.com/rtfm/2011/11/things_to_look_for_in_an_tlsssl_certificate_authority/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://joshua.hoblitt.com/rtfm/2011/11/things_to_look_for_in_an_tlsssl_certificate_authority/</feedburner:origLink></item>
		<item>
		<title>My VLA naming suggestion</title>
		<link>http://feedproxy.google.com/~r/jhoblitt/rtfm/~3/Y9KDB9FpGDc/</link>
		<comments>http://joshua.hoblitt.com/rtfm/2011/11/my_vla_naming_suggestion/#comments</comments>
		<pubDate>Tue, 15 Nov 2011 11:04:52 +0000</pubDate>
		<dc:creator>jhoblitt</dc:creator>
				<category><![CDATA[Random Commentary]]></category>

		<guid isPermaLink="false">http://joshua.hoblitt.com/?p=472</guid>
		<description><![CDATA[You can submit your own suggestion&#8230;]]></description>
			<content:encoded><![CDATA[<p>You can submit your own <a href="http://www.nrao.edu/namethearray/namethearray_form.php">suggestion</a>&#8230;</p>
<p><a href="http://joshua.hoblitt.com/wp/wp-content/uploads/2011/11/vla_name_the_array_suggestion.png"><img class="alignnone size-large wp-image-473" title="vla_name_the_array_suggestion" src="http://joshua.hoblitt.com/wp/wp-content/uploads/2011/11/vla_name_the_array_suggestion-1024x680.png" alt="" width="620" height="411" /></a></p>
<img src="http://feeds.feedburner.com/~r/jhoblitt/rtfm/~4/Y9KDB9FpGDc" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://joshua.hoblitt.com/rtfm/2011/11/my_vla_naming_suggestion/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://joshua.hoblitt.com/rtfm/2011/11/my_vla_naming_suggestion/</feedburner:origLink></item>
		<item>
		<title>Default Password for Supermicro IPMI/BMCs</title>
		<link>http://feedproxy.google.com/~r/jhoblitt/rtfm/~3/8IWdp4muw5o/</link>
		<comments>http://joshua.hoblitt.com/rtfm/2011/10/default_password_for_supermicro_ipmibmcs/#comments</comments>
		<pubDate>Tue, 25 Oct 2011 05:06:38 +0000</pubDate>
		<dc:creator>jhoblitt</dc:creator>
				<category><![CDATA[Default Passwords]]></category>

		<guid isPermaLink="false">http://joshua.hoblitt.com/?p=465</guid>
		<description><![CDATA[Supermicro seems to use more or less that same BMC firmware, at least that&#8217;s how it appears from looking at the BMC firmware version numbers, across all of their motherboards.   Unlike many other BMCs (notably the Intel BMC/RMM3), you can &#8230; <a href="http://joshua.hoblitt.com/rtfm/2011/10/default_password_for_supermicro_ipmibmcs/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<p>Supermicro seems to use more or less that same BMC firmware, at least that&#8217;s how it appears from looking at the BMC firmware version numbers, across all of their motherboards.   Unlike many other BMCs (notably the Intel BMC/RMM3), you can not set enable/disable usernames or set passwords from the BIOS. The Supermicros default to DHCP and come up immediately with the default name and password.</p>
<p>Many version of the BMC include a java console redirect applet that *does not* work with 64bit JVM on Linux.</p>
<p>Every SM board I&#8217;ve touched has used the same default user/passwd.</p>
<pre>username: ADMIN
password: ADMIN</pre>
<img src="http://feeds.feedburner.com/~r/jhoblitt/rtfm/~4/8IWdp4muw5o" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://joshua.hoblitt.com/rtfm/2011/10/default_password_for_supermicro_ipmibmcs/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://joshua.hoblitt.com/rtfm/2011/10/default_password_for_supermicro_ipmibmcs/</feedburner:origLink></item>
		<item>
		<title>default password for Raritan PDUs</title>
		<link>http://feedproxy.google.com/~r/jhoblitt/rtfm/~3/Ws1ky1ip-Iw/</link>
		<comments>http://joshua.hoblitt.com/rtfm/2011/10/default_password_for_raritan_pdus/#comments</comments>
		<pubDate>Sat, 15 Oct 2011 16:38:04 +0000</pubDate>
		<dc:creator>jhoblitt</dc:creator>
				<category><![CDATA[Default Passwords]]></category>

		<guid isPermaLink="false">http://joshua.hoblitt.com/?p=458</guid>
		<description><![CDATA[username: admin password: raritan Known to be the default password for Raritan PX-5000 series (Outlet Metered, Outlet Switched) models: DPXR20A-20L6 DPXR20A-30L6]]></description>
			<content:encoded><![CDATA[<pre>username: admin
password: raritan</pre>
<p>Known to be the default password for Raritan PX-5000 series (Outlet Metered, Outlet Switched) models:</p>
<ul>
<li><a href="http://www.raritan.com/px-5000/dpxr20a-20l6/tech-specs/">DPXR20A-20L6</a></li>
<li><a href="http://www.raritan.com/px-5000/dpxr20a-30l6/tech-specs/">DPXR20A-30L6</a></li>
</ul>
<img src="http://feeds.feedburner.com/~r/jhoblitt/rtfm/~4/Ws1ky1ip-Iw" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://joshua.hoblitt.com/rtfm/2011/10/default_password_for_raritan_pdus/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://joshua.hoblitt.com/rtfm/2011/10/default_password_for_raritan_pdus/</feedburner:origLink></item>
		<item>
		<title>default password for APC UPS Network Management Card 2</title>
		<link>http://feedproxy.google.com/~r/jhoblitt/rtfm/~3/qmaYwj7YRYI/</link>
		<comments>http://joshua.hoblitt.com/rtfm/2011/10/default_password_for_apc_ups_network_management_card_2/#comments</comments>
		<pubDate>Sat, 15 Oct 2011 16:29:48 +0000</pubDate>
		<dc:creator>jhoblitt</dc:creator>
				<category><![CDATA[Default Passwords]]></category>

		<guid isPermaLink="false">http://joshua.hoblitt.com/?p=455</guid>
		<description><![CDATA[I configured an AP9631 on 2011-10-14 and APC is still following their standard default password scheme of: username: apc password: apc]]></description>
			<content:encoded><![CDATA[<div>
<div id="techspecs_cart_sku_label">
<p>I configured an <a href="http://www.apc.com/resource/include/techspec_index.cfm?base_sku=AP9631&amp;tab=features">AP9631</a> on 2011-10-14 and APC is still following their standard default password scheme of:</p>
<pre>username: apc
password: apc</pre>
</div>
</div>
<img src="http://feeds.feedburner.com/~r/jhoblitt/rtfm/~4/qmaYwj7YRYI" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://joshua.hoblitt.com/rtfm/2011/10/default_password_for_apc_ups_network_management_card_2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://joshua.hoblitt.com/rtfm/2011/10/default_password_for_apc_ups_network_management_card_2/</feedburner:origLink></item>
		<item>
		<title>Raritan ferrite cores</title>
		<link>http://feedproxy.google.com/~r/jhoblitt/rtfm/~3/EjKKu33dLtM/</link>
		<comments>http://joshua.hoblitt.com/rtfm/2011/10/raritan_ferrite_cores/#comments</comments>
		<pubDate>Sat, 15 Oct 2011 16:09:46 +0000</pubDate>
		<dc:creator>jhoblitt</dc:creator>
				<category><![CDATA[SysAdmin]]></category>

		<guid isPermaLink="false">http://joshua.hoblitt.com/?p=445</guid>
		<description><![CDATA[Raritan requires a ferrite core to be installed 1.5-3&#8243; from the end of Ethernet patch cables attached to their PDUs if your using on of their external sensor assemblies. I can&#8217;t believe that this is to suppress noise from entering &#8230; <a href="http://joshua.hoblitt.com/rtfm/2011/10/raritan_ferrite_cores/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<p>Raritan requires a ferrite core to be installed 1.5-3&#8243; from the end of Ethernet patch cables attached to their PDUs if your using on of their external sensor assemblies. I can&#8217;t believe that this is to suppress noise from entering into the PDU since PDUs are basically attached to a  giant antenna. The only reason I can come up for this is to reduce cross talk between the Ethernet and sensor wires before they attach to the PDU as their ports are adjacent on the chassis.  Does anyone have a better explanation?</p>
<div id="attachment_446" class="wp-caption alignnone" style="width: 310px"><a href="http://joshua.hoblitt.com/wp/wp-content/uploads/2011/10/2011-10-14_18-00-39_636.jpg"><img class="size-medium wp-image-446" title="2011-10-14_18-00-39_636" src="http://joshua.hoblitt.com/wp/wp-content/uploads/2011/10/2011-10-14_18-00-39_636-300x224.jpg" alt="" width="300" height="224" /></a><p class="wp-caption-text">Raritan ferrite core on cat6 patch cable</p></div>
<img src="http://feeds.feedburner.com/~r/jhoblitt/rtfm/~4/EjKKu33dLtM" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://joshua.hoblitt.com/rtfm/2011/10/raritan_ferrite_cores/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://joshua.hoblitt.com/rtfm/2011/10/raritan_ferrite_cores/</feedburner:origLink></item>
		<item>
		<title>WordPress Yoko theme 1.0.5 released</title>
		<link>http://feedproxy.google.com/~r/jhoblitt/rtfm/~3/vrZ_tvBilq4/</link>
		<comments>http://joshua.hoblitt.com/rtfm/2011/09/wordpress_yoko_theme_1_05_released/#comments</comments>
		<pubDate>Sun, 04 Sep 2011 18:59:13 +0000</pubDate>
		<dc:creator>jhoblitt</dc:creator>
				<category><![CDATA[Blogging]]></category>

		<guid isPermaLink="false">http://joshua.hoblitt.com/?p=434</guid>
		<description><![CDATA[The excellent WordPressYoko theme has a new version 1.0.5 release. Please see the changelog (PDF) for details. If you haven&#8217;t explored this theme I would highly encourage you to do so. It&#8217;s well designed, works on small form factor devices, &#8230; <a href="http://joshua.hoblitt.com/rtfm/2011/09/wordpress_yoko_theme_1_05_released/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<p>The excellent WordPress<a href="http://www.elmastudio.de/wordpress-themes/yoko/">Yoko theme</a> has a new version 1.0.5 release.  Please see the <a href="http://www.elmastudio.de/wp-content/uploads/themes/yoko-changelog.pdf">changelog</a> (PDF) for details.  If you haven&#8217;t explored this theme I would highly encourage you to do so.  It&#8217;s well designed, works on small form factor devices, has a <a href="http://www.elmastudio.de/wp-content/uploads/themes/yoko-theme-documentation-en.pdf">manual</a>, and the author even provides a <a href="http://www.elmastudio.de/wp-content/uploads/themes/yokochildthemefolder.zip">template</a> for starting your own sub theme.</p>
<p>I created a child theme of Yoko to tweak a few things for this blog.  My theme is named <a href="https://github.com/jhoblitt/yokogeek">YokoGeek</a> and a list the tweaks I&#8217;ve made are in the README.  I&#8217;m completely open to merging features for technical blogging into YokoGeek; patches welcome. <img src='http://joshua.hoblitt.com/wp/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' /> </p>
<img src="http://feeds.feedburner.com/~r/jhoblitt/rtfm/~4/vrZ_tvBilq4" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://joshua.hoblitt.com/rtfm/2011/09/wordpress_yoko_theme_1_05_released/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://joshua.hoblitt.com/rtfm/2011/09/wordpress_yoko_theme_1_05_released/</feedburner:origLink></item>
		<item>
		<title>Recursively chaining SSH ProxyCommand</title>
		<link>http://feedproxy.google.com/~r/jhoblitt/rtfm/~3/b9EFm7VEiOg/</link>
		<comments>http://joshua.hoblitt.com/rtfm/2011/09/recursively_chaining_ssh_proxycommand/#comments</comments>
		<pubDate>Sat, 03 Sep 2011 18:49:41 +0000</pubDate>
		<dc:creator>jhoblitt</dc:creator>
				<category><![CDATA[SysAdmin]]></category>

		<guid isPermaLink="false">http://joshua.hoblitt.com/?p=417</guid>
		<description><![CDATA[I just came across this blog post, SSH through jump hosts, on setting up ssh proxing with netcat. The new, highly cleaver, twist here is instead of having to manually add each proxy/jump you want into your ssh config, using &#8230; <a href="http://joshua.hoblitt.com/rtfm/2011/09/recursively_chaining_ssh_proxycommand/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<p>I just came across this blog post, <a href="http://glandium.org/blog/?p=303">SSH through jump hosts</a>, on setting up ssh proxing with <a href="http://netcat.sourceforge.net/">netcat</a>.  The new, highly cleaver, twist here is instead of having to manually add each proxy/jump you want into your ssh config, using a wildcard host statement that can recursively match itself.  If your confused as to what ssh proxy/jump/proxycommand is all about, I found a diagram &#038; explanation on the SSH Menu <a href="http://sshmenu.sourceforge.net/articles/transparent-mulithop.html">Transparent Multi-hop SSH</a> page.</p>
<p>Verbatim from the post:</p>
<pre>
Host */*
ProxyCommand ssh $(dirname %h) nc -w1 $(basename %h) %p
</pre>
<p>This is pretty slick in that you can bounce through an arbitrary number of hosts.  eg.</p>
<pre>
ssh 1sthost/2ndhost/3rdhost
</pre>
<p>This method isn&#8217;t perfect, and while there are some good comments at the bottom of the blog post, I believe there are a few problems that aren&#8217;t fully fleshed out in the discussion.  If you have different usernames on the systems you want to proxy through, this approach is going to run into trouble.  The first ssh hop can get the correct username from the command line as in <code>ssh <username>@...</code> but after that ssh defaults to using <code>$USERNAME</code>.  Ideally, one could somehow specify the username for each subsequent hop. Perhaps something like:</p>
<pre>
ssh foo.example.com/a@bar.example.com/b@baz.example.com/...
</pre>
<p>However, ssh splits <code>[user@]hostname</code> input into a remote login username part (<code>%r</code>) and a target host name part (<code>%h</code>).  The splitting is done on the right most <code>@</code> and this can lead to the <code>%h</code> no longer being matched by <code>Host */*</code>.  eg.</p>
<pre>
ssh foo@bar.example.com/baz@quix.example.com
</pre>
<p>Would get parsed as:</p>
<pre>
%r = foo@bar.example.com/baz
%h = quix.example.com
</pre>
<p>Since <code>%h</code> does not contain a <code>/</code> at this point, it will not match <code>Host */*</code>.  One ugly thing that could be done is change the match to <code>Host *</code> and to make sure this directive stays at the very bottom of the configuration file.  Then the original ssh argument could be recreated with <code>%r@%h</code>.  At which point you would need to do your own host separator parsing.  This approach is highly undesirable because the <code>Host *</code> rule will match any hostname not matched in the configuration file.  The more obvious thing to do here is to replace the remote login username separator with another meta-character.  This is what the first comment on the post tries to do:</p>
<pre>
Vincent Bernat Says:
2009-04-10 00:51:16+0200

Here is an “enhanced” version:

Host */*
ProxyCommand ssh ${$(dirname %h)/\%%/@} nc -w5 ${$(basename %h)#*%%} %p

You can specify the login for each hop with “%” instead of “@”.
</pre>
<p>Which is probably the correct general idea but this syntax won&#8217;t work under <a href="http://wiki.bash-hackers.org/syntax/pe#search_and_replace">bash parameter expansion</a>.  Comment #6 suggests that this does work under zsh but I&#8217;m not generally a zsh user, nor is zsh as commonly installed as bash/ssh/nc.  Even if this did work under bash, it would be more convenient to not have to specify data that&#8217;s already contained in the ssh client config file.  As far as I can tell, there is no way to accomplish this with a recursively matching <code>Host</code> directive as <code>%r</code> will always be the string that was matched when ssh was first invoked.  It looks like the only solution would be to write some code that can parse the the ssh config and pull out the appropriate username for each hop in the proxy chain.</p>
<p>The second issue is with the <code>-w1</code> argument to netcat.  Which tells it to disconnect if the connection is idle for one second.  Unless your only executing remote commands, this value is probably too short.  It needs to be at least <code>>= ServerAliveInterval</code> and probably more like <code>>= ServerAliveInterval * ServerAliveCountMax</code>.  A wait timeout shouldn&#8217;t be needed at all as a broken ssh connection will kill off the associated shell, which should terminate the netcat invocation.  The <code>-w[n]</code> param can just be removed.</p>
<p>If anyone knows a working solution to the the username issue, please let me know.</p>
<img src="http://feeds.feedburner.com/~r/jhoblitt/rtfm/~4/b9EFm7VEiOg" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://joshua.hoblitt.com/rtfm/2011/09/recursively_chaining_ssh_proxycommand/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://joshua.hoblitt.com/rtfm/2011/09/recursively_chaining_ssh_proxycommand/</feedburner:origLink></item>
	</channel>
</rss>

