# OpenSSH Open-source SSH protocol suite for encrypted remote login, file transfer, tunneling, and authentication. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Security updates for Wednesday DevFeed: [Security updates for Wednesday]() Original publisher: [Read original article]() Author: corbet Published: 2026-09-16T13:40:53Z Content type: news Language: en Sources: [LWN.net]() Topics: [Security](), [Linux](), [nginx](), [openssl](), [Python](), [OpenSSH]() Tags: [debian](), [linux](), [nginx](), [openssh](), [openssl](), [python](), [security](), [updates]() ### AI overview Security updates were issued by AlmaLinux, Debian, Fedora, Oracle, Red Hat, SUSE, and Ubuntu for packages including kernels, nginx, OpenSSL, Python, Perl, Git, Docker, OpenSSH, and other software. ### Source excerpt Security updates have been issued by AlmaLinux (kernel, kernel-rt, libkcapi, nginx, nginx:1.24, openssl, osbuild-composer, perl, perl:5.32, python-tornado, rsync, and rust), Debian (cjose and nginx), Fedora (environment-modules, erlang, GitPython, knot, perl-Authen-SASL, python-configargparse, ruby, rubygems, and sblim-sfcb), Oracle (firefox, git-lfs, gstreamer1-plugins-base, kernel, libkcapi, nginx, nginx:1.26, openssl, osbuild-composer, perl, perl-YAML-Syck, postgresql18, python-tornado, and rust), Red Hat (fence-agents, git-lfs, microcode_ctl, osbuild-composer, podman, python-pyasn1, and resource-agents), SUSE (389-ds, ant, bson-devel, chirp-20260911, docker, gimp, google-cloud-sap-agent, hauler, kernel, kimi-code, libpcap, python-GitPython, python310, syncthing, yast2-samba-client, and zstd-jni), and Ubuntu (aom, imagemagick, kitty, openssh, phpseclib, policykit-1, python-sql, python-webob, shibboleth-sp, simplesamlphp, snapcast, srt, and suricata-update). ## How to Run Codex in an Ubuntu Virtual Machine on Proxmox DevFeed: [How to Run Codex in an Ubuntu Virtual Machine on Proxmox]() Original publisher: [Read original article]() Author: Travis Henderson Published: 2026-09-15T12:00:11Z Content type: tutorial Language: en Sources: [Atomic Object]() Topics: [AI-assisted coding](), [codex](), [Linux](), [Ubuntu](), [Proxmox](), [OpenSSH](), [Authorization]() Tags: [ai-agent](), [ai-for-developers](), [codex](), [coding-agents](), [development](), [linux](), [openssh](), [permissions](), [proxmox](), [sandbox](), [ubuntu]() ### AI overview This guide explains how to isolate Codex in a headless Ubuntu virtual machine running on Proxmox, using a separate Linux account and OpenSSH. The setup limits the files, dependencies, and network access available to the agent while keeping administrator tasks separate, but it does not eliminate risks from credentials, network access, or mistakes pushed to GitHub. ### Source excerpt The more useful coding agents become, the more access they tend to need. Installing dependencies, running commands, changing files, and generally more autonomy are part of the appeal. They're also the point where I start thinking about what else the coding agent can reach, especially while these tools are changing so quickly. My answer is [...] The post Your Coding Agent Should be in Jail. Here's Why and How. appeared first on Atomic Spin. ## Unlock a LUKS root over SSH on Fedora and Red Hat Enterprise Linux DevFeed: [Unlock a LUKS root over SSH on Fedora and Red Hat Enterprise Linux]() Original publisher: [Read original article]() Author: Josephine Pfeiffer Published: 2026-09-11T13:01:51Z Content type: tutorial Language: en Sources: [Red Hat](), [Red Hat Developer]() Topics: [Fedora](), [Linux](), [OpenSSH](), [ssh](), [systemd](), [datacenter](), [Network](), [Server]() Tags: [config](), [datacenter](), [developer](), [how-to](), [linux](), [network](), [red-hat](), [remote](), [rhel](), [server](), [ssh](), [systemd]() ### AI overview This tutorial explains how to unlock an encrypted LUKS root remotely over SSH on Fedora and Red Hat Enterprise Linux. It describes adding NetworkManager and an SSH server to the dracut initramfs, configuring networking, rebuilding the initramfs, and using the rd.neednet=1 kernel argument. ### Source excerpt An encrypted server in a datacenter reboots and stops in the initramfs, waiting for a passphrase at a console nobody is sitting at. 3 commands and a kernel argument get NetworkManager and sshd into a Fedora or Red Hat Enterprise Linux (RHEL) initramfs, so a remote server with an encrypted root can be unlocked over the network. The post Unlock a LUKS root over SSH on Fedora and Red Hat Enterprise Linux appeared first on Red Hat Developer. ## Tailscale PAM beta: Manage connectivity and privileged access in one place DevFeed: [Tailscale PAM beta: Manage connectivity and privileged access in one place]() Original publisher: [Read original article]() Author: Smriti Sharma Published: 2026-08-27T14:00:00Z Content type: release Language: en Sources: [Blog on Tailscale]() Topics: [Authorization](), [Security](), [Kubernetes](), [OpenSSH](), [API](), [Databases](), [web applications](), [incident]() Tags: [api](), [compliance](), [databases](), [external](), [identity](), [incident](), [infrastructure](), [kubernetes](), [logs](), [production](), [security](), [servers](), [slack](), [ssh](), [web-applications]() ### AI overview Tailscale PAM beta brings privileged access management into the Tailscale admin console. It provides resource-specific access policies, just-in-time approvals through Slack, and session logs and recordings for audits and investigations across databases, servers, Kubernetes clusters, and web applications. ### Source excerpt Just-in-time access, resource policies, and session auditing, right where you need them. ## Linux ssh-keygen: Set Up SSH Key Authentication the Right Way DevFeed: [Linux ssh-keygen: Set Up SSH Key Authentication the Right Way]() Original publisher: [Read original article]() Author: Hayden James Published: 2026-08-03T10:53:19Z Content type: tutorial Language: en Sources: [Hayden James]() Topics: [OpenSSH](), [ssh](), [Linux](), [Authentication](), [Security](), [passwords]() Tags: [authentication](), [blog](), [guide](), [linux](), [openssh](), [password](), [private-key](), [public-key](), [security](), [server](), [ssh](), [sysadmins]() ### AI overview A practical guide to setting up SSH key authentication on Linux with ssh-keygen. It covers generating key pairs, copying public keys to servers, disabling password login safely, configuring multiple identities, and using passphrases or FIDO2 security keys. ### Source excerpt Password-based SSH login is a liability. This guide walks through generating SSH key pairs with ssh-keygen, deploying public keys, disabling password authentication, and managing multiple keys cleanly with ~/.ssh/config. Continue reading... ## June 2026 Updates #1 for XCP-ng 8.3 LTS DevFeed: [June 2026 Updates #1 for XCP-ng 8.3 LTS]() Original publisher: [Read original article]() Author: Philippe Coval Published: 2026-06-02T16:17:58Z Content type: release Language: en Sources: [XCP-ng Blog]() Topics: [Linux](), [Vulnerabilities](), [Security](), [OpenSSH](), [UEFI](), [USB](), [io\_uring]() Tags: [2026](), [bugfixes](), [linux](), [linux-kernel](), [lts](), [maintenance-updates](), [openssh](), [release](), [security](), [security-vulnerabilities](), [uefi](), [update](), [updates](), [usb]() ### AI overview XCP-ng 8.3 LTS receives security and maintenance updates. The release fixes Linux kernel vulnerabilities in the control domain, including issues that could allow an unprivileged local user to gain root privileges, and rejects obsolete insecure OpenSSH clients. It also includes improvements for USB smartcard passthrough, QEMU memory mapping, UEFI booting and CPU limits, PXE booting, and dmidecode. ### Source excerpt Security vulnerabilities have been identified and fixed in the Linux kernel used by XCP-ng's control domain (dom0). Additional lower-priority maintenance updates are included in this release alongside these security fixes. ## RFC 9987: SSH Agent Protocol DevFeed: [RFC 9987: SSH Agent Protocol]() Original publisher: [Read original article]() Published: 2026-05-28T00:00:00Z Content type: article Language: fr Sources: [Blog de Stéphane Bortzmeyer]() Topics: [OpenSSH](), [ssh](), [Protocol (disambiguation)](), [client](), [Internet Engineering Task Force (IETF)]() Tags: [client](), [ietf](), [openssh](), [protocol](), [rfc](), [ssh]() ### AI overview This French article explains RFC 9987, which standardizes the long-established SSH Agent Protocol. It describes how the agent stores private keys, handles signing requests, and communicates with clients through a client-server protocol using TLV messages. ### Source excerpt Voici encore un RFC qui normalise quelque chose qui existait depuis longtemps : le protocole Agent de SSH. ## Backdoored node-ipc npm releases steal developer credentials through DNS queries DevFeed: [Backdoored node-ipc npm releases steal developer credentials through DNS queries]() Original publisher: [Read original article]() Author: Nick Frichette Published: 2026-05-14T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Malware](), [npm](), [backdoor](), [payload](), [Amazon Route 53](), [Code](), [Cloud](), [Kubernetes](), [Databases](), [OpenSSH]() Tags: [analysis](), [backdoor](), [cloud](), [code](), [database](), [developer](), [dns](), [fork](), [kubernetes](), [malware](), [npm](), [payload](), [process](), [ssh]() ### AI overview This article analyzes three backdoored node-ipc releases published to npm on May 14, 2026. The malicious CommonJS entrypoint launches a detached process, collects environment, host, developer, cloud, package manager, source control, Kubernetes, database, and SSH credentials, archives the data, and attempts DNS TXT exfiltration. ### Source excerpt An analysis of backdoored node-ipc npm releases that add an obfuscated credential collection and DNS exfiltration payload to the CommonJS entrypoint. ## From SSH to REST: A Security-Driven Modernization of Slack's EMR Data Pipelines DevFeed: [From SSH to REST: A Security-Driven Modernization of Slack's EMR Data Pipelines]() Original publisher: [Read original article]() Author: Mahendran Vasagam Published: 2026-05-05T14:00:01Z Content type: article Language: en Sources: [Engineering at Slack]() Topics: [Security](), [OpenSSH](), [Amazon Web Services](), [airflow](), [DataOps](), [Architecture & Design](), [Kubernetes]() Tags: [airflow](), [architecture](), [aws](), [big-data](), [data-analytics](), [data-engineering](), [data-infrastructure](), [kubernetes](), [modernization](), [security](), [ssh](), [uncategorized]() ### AI overview Slack describes migrating more than 700 SSH-based data pipeline jobs to a REST-based architecture across eight data regions, eliminating SSH access to production AWS EMR clusters without downtime. The article explains the security and operational problems that motivated the modernization, including attack-surface exposure, key-management overhead, resource contention, broken connections, zombie jobs, and unreliable job-status detection. ### Source excerpt Excerpt By 2024, Slack's data platform had accumulated 700+ SSH-based operators orchestrating critical data pipelines. We're talking daily search indexing that processed terabytes of data, analytics jobs powering business intelligence, the whole shebang. Every single one of these jobs required direct SSH access to production AWS Elastic MapReduce (EMR) clusters. We had a massive security... ## SSH Port 22: Custom Ports, Port Forwarding Security, and Production SSH Hardening DevFeed: [SSH Port 22: Custom Ports, Port Forwarding Security, and Production SSH Hardening]() Original publisher: [Read original article]() Author: info@goteleport.com (Matt Keib) Published: 2026-05-01T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Security](), [OpenSSH](), [ssh](), [Authentication](), [rate-limiting](), [Authorization](), [configuration]() Tags: [configuration](), [hardening](), [port](), [rate-limiting](), [security](), [server](), [ssh](), [tcp](), [tcp-handshake]() ### AI overview This article explains that SSH port 22 is a historical TCP entry point with no inherent cryptographic or authentication significance. It covers port forwarding risks, cryptographic and authentication configuration, rate limiting, and production SSH hardening. ### Source excerpt Learn about SSH port 22, its limitations, port forwarding security, and how to harden production SSH. ## Deploying SSH host keys and certificates with Ansible DevFeed: [Deploying SSH host keys and certificates with Ansible]() Original publisher: [Read original article]() Author: Jan-Piet Mens Published: 2026-04-06T22:00:00Z Content type: tutorial Language: en Sources: [Jan-Piet Mens]() Topics: [Ansible](), [OpenSSH](), [deploy](), [private key](), [public key](), [passwords]() Tags: [ansible](), [certificates](), [configuration](), [deploy](), [jan-piet-mens](), [jpm](), [jpmens](), [openssh](), [private-key](), [public-key]() ### AI overview A practical Ansible playbook deploys SSH host keys and certificates to nodes. It generates host key pairs on each node, delegates local temporary-file handling and certificate signing to the Ansible controller, and uses an SSH agent-held CA key. ### Source excerpt If all you have is a hammer ... It occurs to me that we can deploy SSH host keys and their certificates to nodes using Ansible, as it has two existing modules we can use for the task: community.crypto.openssh_keypair generates OpenSSH private public key pairs community.crypto.openssh_cert generates OpenSSH user or host certificates Assuming we want a host's private key to be generated on a node and reside on the node only, and assuming our SSH CA (certification authority) is on the Ansible controller, we can use delegation to localhost for the bits which should happen on the controller. In the following simple playbook I use a block in which I create a temporary unique directory locally into which the public key from the host is copied and signed, and the always portion of the block ensures the directory is cleared out even on error within the block. The public portion of the SSH key pair is returned in openssh_keypair's metadata. - hosts: d13 gather_facts: yes remote_user: jp vars: dirname: "/etc/ssh" tasks: - name: Generate ED25519 SSH host key on node community.crypto.openssh_keypair: backend: "opensshbin" path: "{{ dirname }}/ssh_host_ed25519_key" comment: "ansible-made™ for host {{ inventory_hostname }}" type: "ed25519" become: true register: keydata - debug: var=keydata - block: - name: Create a local temporary directory ansible.builtin.tempfile: prefix: "jp" suffix: "cert" state: directory register: p delegate_to: localhost - name: Save public host key to local temporary file ansible.builtin.copy: content: "{{ keydata.public_key }}" dest: "{{ p.path }}/{{ keydata.filename | basename }}" delegate_to: localhost - name: Sign SSH certificate on local copy of public host key community.crypto.openssh_cert: identifier: "{{ inventory_hostname }}" public_key: "{{ p.path }}/{{ keydata.filename | basename }}" principals: "{{ [ ansible_fqdn ] + ansible_all_ipv4_addresses }}" path: "{{ p.path }}/{{ keydata.filename | basename }}-cert.pub" serial_number: 10 signing_key: "../ ## SSH certificates: the better SSH experience DevFeed: [SSH certificates: the better SSH experience]() Original publisher: [Read original article]() Author: Jan-Piet Mens Published: 2026-04-02T22:00:00Z Content type: tutorial Language: en Sources: [Jan-Piet Mens]() Topics: [OpenSSH](), [ssh](), [private key](), [public key](), [trust](), [passwords](), [Server](), [Shell](), [ed25519](), [sha256]() Tags: [ed25519](), [jan-piet-mens](), [jpm](), [jpmens](), [password](), [private-key](), [public-key](), [server](), [sha256](), [shell](), [ssh](), [trust]() ### AI overview A practical explanation of SSH host verification and key-based authentication. It covers checking host fingerprints, Trust on First Use, SSH key pairs, passphrases, and using an SSH agent to avoid repeated passphrase entry. ### Source excerpt When I ssh into a server for the first time, I'm confronted with a dialog which asks me to verify I'm actually talking to the machine I expect to be talking to. $ ssh -l jp 192.0.2.65 The authenticity of host '192.0.2.65 (192.0.2.65)' can't be established. ED25519 key fingerprint is SHA256:4WTRnq2OR1m03TpnHCfkFdlh1gN/PBXE4vDi0WnjFEc. No matching host key fingerprint found in DNS. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? It is likely that the majority of users cross their fingers and type 'yes', which is not really a clever response. This Trust on First Use (TOFU) is what permits SSH to ensure that my SSH client verifies which server it's talking to. I ought to have asked the administrator of the server to tell me its fingerprint, and if I am the administrator I ought to know how to do this: (in the following examples, a shell prompt % indicates I'm working as `root) % ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key 256 SHA256:4WTRnq2OR1m03TpnHCfkFdlh1gN/PBXE4vDi0WnjFEc root@d13 (ED25519) If the two fingerprints compare equal, I can trust that I am connecting to the correct server and can continue with 'yes' or I paste a known host fingerprint into the prompt: trust on first use is accomplished. (Utilities such as ssh-keyscan gather public keys from remote hosts, but I still ought to verify out-of-band whether I'm talking to the correct machine. SSH fingerprints can also be in the DNS, what can't?, but that's a different story.) The session then possibly continues with me being asked for the target user's password which, if entered correctly, grants me access to the machine. SSH key pairs If I create an SSH key pair, install my public key in the correct location (typically $HOME/.ssh/authorized_keys on the target node), and present the private key upon connection, then I don't need to type the target user's password; instead I enter the key's passphrase, a hopefully much more complicated combination ## Supabase docs over SSH DevFeed: [Supabase docs over SSH]() Original publisher: [Read original article]() Author: Greg Richardson Published: 2026-04-01T07:00:00Z Content type: release Language: en Sources: [Supabase Blog]() Topics: [Supabase](), [AI-assisted coding](), [Bash](), [OpenSSH](), [Filesystems](), [Open Source](), [TypeScript](), [Vercel]() Tags: [agent](), [ai](), [ai-coding](), [bash](), [cli](), [open-source](), [ssh](), [typescript](), [vercel]() ### AI overview Supabase introduces supabase.sh, a public SSH server that exposes Supabase documentation to AI coding agents through a bash-accessible virtual file system. The public experiment is designed to help agents browse current Markdown documentation and avoid hallucinated APIs, incorrect CLI commands, and missed configuration steps. ### Source excerpt Browse Supabase docs with grep, find, and cat. ## PowerShell, OpenSSH, and DSC team investments for 2026 DevFeed: [PowerShell, OpenSSH, and DSC team investments for 2026]() Original publisher: [Read original article]() Author: Steve Lee Published: 2026-02-17T19:21:34Z Content type: article Language: en Sources: [PowerShell Team]() Topics: [PowerShell](), [OpenSSH](), [Security](), [Tooling](), [pull-requests]() Tags: [community](), [openssh](), [post](), [powershell](), [pull-requests](), [security](), [tooling]() ### AI overview The PowerShell, OpenSSH, and DSC teams outline planned investments for 2026, emphasizing security and compliance, critical bug fixes, community pull requests, and upcoming PowerShell improvements. Proposed work includes relocating PSUserContentPath, enabling module features without profile scripts, and improving update notifications. ### Source excerpt Planned team investments for 2026 for PowerShell, OpenSSH, DSC, and related tooling. The post PowerShell, OpenSSH, and DSC team investments for 2026 appeared first on PowerShell Team. ## Configurar Fail2Ban para proteger servicios DevFeed: [Configurar Fail2Ban para proteger servicios]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-01-28T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [Fail2ban](), [OpenSSH](), [nginx](), [Debian](), [Ubuntu](), [rhel 9]() Tags: [debian](), [error](), [fail2ban](), [internet](), [ip](), [login](), [logs](), [nginx](), [rhel](), [rhel-9](), [ssh](), [ubuntu]() ### AI overview A practical guide to installing and configuring Fail2Ban to protect SSH, Nginx, and other services from brute-force attacks. It covers jail configuration, custom Nginx filters, nftables and iptables actions, status checks, and manually unbanning IP addresses. ### Source excerpt Guía práctica para instalar y configurar Fail2Ban: protege SSH, Nginx y otros servicios contra ataques de fuerza bruta. ## Hardening básico de servidores Linux DevFeed: [Hardening básico de servidores Linux]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-01-22T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [Linux](), [Firewall](), [ssh](), [Fail2ban](), [OpenSSH](), [Kernel]() Tags: [fail2ban](), [firewall](), [hardening](), [hash](), [kernel](), [linux](), [ssh]() ### AI overview This Spanish tutorial presents a basic hardening checklist for Linux servers and explains why the measures should be applied in a specific order. It covers system updates, SSH, firewall configuration, user policies, sudo restrictions, kernel parameters, unnecessary services, Fail2ban, auditing, and final verification. ### Source excerpt Checklist de hardening en el orden correcto: SSH, firewall, usuarios, kernel, AIDE, chrony y verificación final con Lynis. ## Cómo configurar un servidor SSH seguro en Linux DevFeed: [Cómo configurar un servidor SSH seguro en Linux]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-01-01T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [OpenSSH](), [Linux](), [Fail2ban]() Tags: [fail2ban](), [firewall](), [hardening](), [linux](), [openssh]() ### AI overview A step-by-step guide to securing an OpenSSH server on Linux. It covers layered protections including non-standard ports, public-key authentication, hardened ciphers, two-factor authentication, and fail2ban, along with configuration and verification guidance. ### Source excerpt Guía paso a paso para configurar y securizar un servidor SSH en cualquier servidor Linux, incluyendo autenticación por clave, fail2ban y mejores prácticas. ## Advanced techniques for porting libraries to ESP-IDF components DevFeed: [Advanced techniques for porting libraries to ESP-IDF components]() Original publisher: [Read original article]() Author: John Lee Published: 2025-11-24T00:00:00Z Content type: tutorial Language: en Sources: [Blog on Developer Portal]() Topics: [ESP-IDF](), [Library](), [AWS IoT Core](), [OpenSSH](), [WebSocket](), [aio](), [CMake](), [make](), [POSIX]() Tags: [blog](), [cmake](), [compiler](), [component](), [components](), [esp-idf](), [feature-flags](), [library](), [linux](), [mqtt](), [porting](), [posix](), [ssh](), [systems](), [techniques]() ### AI overview This follow-up article presents advanced techniques for porting larger libraries, particularly those designed for Linux or POSIX systems, into reusable ESP-IDF components. It covers assessing reusable code, adapting build systems and port layers, configuration, header injection, linker wrapping, and compiler-warning management, with examples including asio, mosquitto, libssh, and libwebsockets. ### Source excerpt This article follows up on the article 'Porting a library to an ESP-IDF component' and shows some advanced tips and tricks when porting larger libraries into ESP-IDF components. ## The 2025 Go Cryptography State of the Union DevFeed: [The 2025 Go Cryptography State of the Union]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2025-11-20T15:42:24Z Content type: article Language: en Sources: [Filippo Valsorda]() Topics: [Go Language](), [Cryptography](), [Security](), [Post-Quantum](), [TLS (Transport Layer Security)](), [OpenSSH]() Tags: [2025](), [cryptography](), [encryption](), [go](), [post-quantum](), [security](), [ssh](), [tls]() ### AI overview A transcript of the 2025 Go Cryptography State of the Union, covering developments in Go cryptography over the previous year. It highlights post-quantum key exchanges, FIPS 140 work, and the security track record of Go cryptography packages, including vulnerability trends. ### Source excerpt I delivered my traditional Go Cryptography State of the Union talk at GopherCon US 2025 in New York. It goes into everything that happened at the intersection of Go and cryptography over the last year. ## Recovering/undeleting short deleted files in 50 SLOC of pure C, any filesystem supported. DevFeed: [Recovering/undeleting short deleted files in 50 SLOC of pure C, any filesystem supported.]() Original publisher: [Read original article]() Published: 2025-10-13T22:00:00Z Content type: tutorial Language: en Sources: [Dennis Yurichev]() Topics: [C](), [OpenSSH](), [Linux](), [SQLite](), [Bitcoin](), [Cryptography]() Tags: [bitcoin](), [bug](), [c](), [encryption](), [files](), [filesystem](), [linux](), [openssh](), [private-key](), [sqlite]() ### AI overview This article presents a small pure-C utility for recovering short deleted files by scanning storage for known file headers or boundary strings. It describes recovering data from Linux ext4 SSDs, virtual-machine images, and RAM save files, and notes that deleted OpenSSH keys and Bitcoin wallets may be identifiable. It recommends secure deletion and filesystem encryption to reduce recovery risk. ### Source excerpt Recovering/undeleting short deleted files in 50 SLOC of pure C, any filesystem supported. ## Mobian Trixie Released as the New Stable Version with Rotating Signing Keys DevFeed: [Mobian Trixie Released as the New Stable Version with Rotating Signing Keys]() Original publisher: [Read original article]() Author: Mobian team Published: 2025-10-13T12:00:00Z Content type: release Language: en Sources: [Mobian's Blog]() Topics: [Debian](), [Mobile](), [Kernel](), [OpenSSH]() Tags: [kernel](), [mobile](), [openssh](), [release](), [stable](), [upgrade]() ### AI overview Mobian has released Trixie as its new stable version and is beginning to rotate the PGP/GPG keys used to sign its images and package archive. The release includes mobile images based on Phosh 46.0 and Plasma Mobile 6.3, with a 6.12 kernel for most supported devices. ### Source excerpt A little more than 2 months after Debian, we're finally releasing Mobian Trixie as our new stable release! We're also taking this opportunity to start rotating the PGP/GPG keys we're using for signing both our images and package archive. Trixie has landed! Over 2 years in the making, and with a small delay following the Debian release, we're proud to finally announce Mobian Trixie has just been released and is therefore our new stable! This release offers images based on Phosh 46.0 and Plasma Mobile 6.3, running a 6.12 kernel for almost all supported devices (the Librem 5 is still using a 6.6 kernel), the list of which is growing as we now provide stable images for the following phones and tablets: PINE64 PinePhone, PinePhone Pro and PineTab Purism Librem 5 Google Pixel 3a and 3a XL OnePlus 6 and 6T Xiaomi Pocophone F1 Trixie images are also available for the following devices, although important hardware features (such as e.g. WiFi or audio) are not working: Fairphone 4 and 5 PINE64 PineTab 2 SHIFT6mq Please check our installation instructions and download the image for your device. Upgrade procedure Although we do our best to provide a smooth upgrade path for each Mobian release, as a downstream Debian derivative, and the mobile software stack being a quickly moving target, major Mobian upgrades are usually trickier than we'd hoped for. This time is no exception, and therefore we highly recommend that you backup all your personal data, flash your device with a fresh Trixie image, then restore your files. If you feel brave enough to go the "manual upgrade" route, here are a few tricks you should know: keep your device plugged to a power source: such an upgrade can be a rather long process, you don't want to run out of battery half-way there! backup all your personal data really, we mean it: backup all your personal data! install openssh-server and execute the entire upgrade process over SSH (and preferrably using screen or a similar tool, so the upgrade can carry o ## Resolving the Reverse Tunnel Remote port forwarding failed for listen port SSH Error DevFeed: [Resolving the Reverse Tunnel Remote port forwarding failed for listen port SSH Error]() Original publisher: [Read original article]() Author: Hiks Gerganov Published: 2025-06-09T04:49:53Z Content type: tutorial Language: en Sources: [Baeldung - Linux]() Topics: [ssh](), [OpenSSH](), [Network](), [Firewall](), [Virtual Private Network](), [Bash](), [Debian](), [Server](), [client](), [Protocol (disambiguation)](), [systems](), [aio]() Tags: [bash](), [debian](), [firewall](), [how-to](), [learn](), [linux](), [network](), [network-configuration](), [network-configuration-network-monitoring-security-ssh](), [remote](), [security](), [server](), [ssh](), [tutorial](), [vpn]() ### AI overview This tutorial explains reverse SSH tunnels, also called SSH remote port forwarding. It covers how they allow a protected client behind NAT, a firewall, a router, or a VPN to expose local services to a remote server, along with prerequisites and common connection problems. ### Source excerpt Learn about reverse SSH tunnels, i.e., SSH port forwarding, and issues that you might encounter when trying to use them. The post Resolving the Reverse Tunnel Remote port forwarding failed for listen port SSH Error first appeared on Baeldung on Linux. Related Stories Sending a Password via SSH or SCP Using subprocess.Popen in Linux What Is SELinux? How To Automatically Connect to a VPN in Linux ## VSCode's SSH Agent Is Bananas DevFeed: [VSCode's SSH Agent Is Bananas]() Original publisher: [Read original article]() Published: 2025-02-07T00:00:00Z Content type: opinion Language: en Sources: [The Fly Blog]() Topics: [Visual Studio Code](), [OpenSSH](), [Security](), [Large Language Model](), [Shell](), [WebSocket](), [Linux](), [Command-line interface](), [Emacs](), [Development]() Tags: [agentic](), [bash](), [cdn](), [close-to-users](), [commands](), [deploy-app-servers](), [docker](), [elixir](), [filesystem](), [fly](), [fly-io](), [front-end](), [heroku-alternative](), [heroku-competitor](), [hosting](), [i](), [linux](), [llm](), [networking](), [postgresql-clusters](), [processes](), [protocol](), [security](), [servers](), [ssh](), [typescript](), [vscode]() ### AI overview The article critiques VSCode's SSH-based remote editing architecture, especially its use of a Bash stager to download an agent with Node, forward it over SSH, and connect it to the VSCode frontend through WebSockets. It contrasts this design with Emacs Tramp and raises security concerns about the agent's ability to access files, launch shell processes, and persist itself. The article also discusses using isolated Linux instances for closed-loop LLM-assisted development. ### Source excerpt We're interested in getting integrated into the flow VSCode uses to do remote editing over SSH, because everybody is using VSCode now, and, in particular, they're using forks of VSCode that generate code with LLMs. "hallucination" is what we call it when LLMs get code wrong; "engineering" is what we call it when people do. LLM-generated code is useful in the general case if you know what you're doing. But it's ultra-useful if you can close the loop between the LLM and the execution environment (with an "Agent" setup). There's lots to say about this, but for the moment: it's a semi-effective antidote to hallucination: the LLM generates the code, the agent scaffolding runs the code, the code generates errors, the agent feeds it back to the LLM, the process iterates. So, obviously, the issue here is you don't want this iterative development process happening on your development laptop, because LLMs have boundary issues, and they'll iterate on your system configuration just as happily on the Git project you happen to be working in. A thing you'd really like to be able to do: run a closed-loop agent-y ("agentic"? is that what we say now) configuration for an LLM, on a clean-slate Linux instance that spins up instantly and that can't screw you over in any way. You get where we're going with this. Anyways! I would like to register a concern. Emacs hosts the spiritual forebearer of remote editing systems, a blob of hyper-useful Elisp called "Tramp". If you can hook Tramp up to any kind of interactive environment -- usually, an SSH session -- where it can run Bourne shell commands, it can extend Emacs to that environment. So, VSCode has a feature like Tramp. Which, neat, right? You'd think, take Tramp, maybe simplify it a bit, switch out Elisp for Typescript. You'd think wrong! Unlike Tramp, which lives off the land on the remote connection, VSCode mounts a full-scale invasion: it runs a Bash snippet stager that downloads an agent, including a binary installation of Node. I th ## How to control the SSH multiplexing with the control commands DevFeed: [How to control the SSH multiplexing with the control commands]() Original publisher: [Read original article]() Author: Vivek Gite Published: 2025-01-15T08:29:10Z Content type: tutorial Language: en Sources: [nixCraft: Linux Tips, Hacks, Tutorials, And Ideas In Blog Format (RSS/FEED)]() Topics: [ssh](), [OpenSSH](), [Command-line interface](), [Amazon EC2]() Tags: [cli](), [commands](), [freebsd](), [how-to](), [intermediate](), [linux](), [openbsd](), [remote](), [server](), [ssh](), [tcp](), [unix]() ### AI overview A tutorial on SSH multiplexing explains how to reuse a master TCP connection for subsequent sessions, configure multiplexing in SSH, and use control commands to inspect, stop, or exit the master connection. ### Source excerpt Multiplexing will boost your SSH connectivity or speed by reusing existing TCP connections to a remote host. This is useful when you frequently connect to the same server using SSH protocol for remote login, server management, using IT automation tools over SSH or even running hourly backups. However, sometimes your SSH command (client) will not respond or get hung up on the session when using multiplexing. Typically, this happens when your public IP changes (IPv4 to IPv6 changes when using DNS names), VPN issues, or firewall cuts connections. Hence, knowing SSH client control commands can save you time and boost your productivity when such gotchas occur. Love this? sudo share_on: Twitter - Facebook - LinkedIn - Whatsapp - Reddit The post How to control the SSH multiplexing with the control commands appeared first on nixCraft. [Next page]()