Top
Best
New

Posted by sdovan1 2 days ago

Show HN: Shittp – Volatile Dotfiles over SSH(github.com)
134 points | 84 comments
sdovan1 2 days ago|
I often need to login to colleagues' machines at work, but I find that their settings are not what I am familiar with. So I wrote an SSH wrapper in POSIX shell which tars dotfiles into a base64 string, passes it to SSH, and decodes / setups on the remote temp directory. Automatically remove when session ends.

Supported: .profile, .vimrc, .bashrc, .tmux.conf, etc.

This idea comes from kyrat[1]; passing files via a base64 string is a really cool approach.

[1]: https://github.com/fsquillace/kyrat/

Joker_vD 2 days ago||

   scp my-precious-dotfiles remote:~
   trap 'ssh remote rm my-precious-dotfiles' EXIT
   ssh remote
Or you can even bake the trap into the remote bash's invocation, although that'd be a bit harder.
stephenlf 1 day ago||
That overwrites the remote dotfiles. Any workarounds?
godelski 1 day ago|||
:h netrw

You can also just place config files anywhere if you know what you then load. That's what I do in my dotfiles, but not exactly like the parent. I also purposefully keep the repo size tiny so it's also just easy to clone. I'd recommend setting a env var so you can always just set that

Also don't forget you can have local vim files. I have a function at the end of my vimrc that looks for '.exrc', '.vim.local', '.nvim.local' in the current directory. Helpful for setting project settings.

zeech 1 day ago||||
I've found lnk [0] to be a nice tool for this. Similar to GNU Stow as another comment mentioned, but plays a bit nicer with git (and, in my opinion, is nicer to use).

Edit: just remembered there was a good comparison of lnk and stow on the HN discussion of lnk from a few months back [1].

[0] https://github.com/yarlson/lnk

[1] https://news.ycombinator.com/item?id=44080514

sigwinch 1 day ago||||
You can set HOME to some temporary path of your choosing. You’ll still need to be a little careful.
rzzzt 1 day ago|||
GNU Stow? https://systemcrafters.net/managing-your-dotfiles/using-gnu-...

Keep the alternate sets in different subdirectories.

Joker_vD 1 day ago||
It's kinda amusing how much of interesting software there is beyond coreutils and GCC that came from GNU, and how little adoption it has actually seen.
alsetmusic 2 days ago|||
I came across something similar a few months ago. I pieced together a working hybrid by patching in parts from an older release with the latest version. I didn't ever work out if the latest version failed because of something in my environment or not, but I'm on a Mac fwiw.

https://github.com/cdown/sshrc

amelius 2 days ago|||
Ok, but what if your colleague does not have Vim installed?

Wouldn't it make more sense to have a tool that brings files over to the local computer, starts Vim on them, and then copies them back?

Joker_vD 2 days ago|||
That starts to sound like using VS Code in remote mode.
exe34 2 days ago||
Emacs in tramp mode.
QuinnyPig 2 days ago||||
I can’t recall encountering a system in the last 15 years that didn’t have vim (or at least vi for esoteric things) on it.
SoftTalker 1 day ago|||
Would not be uncommon in a container or purpose-built VM.
godelski 1 day ago||
Have you run into that? I can't recall ever facing that issue. Seems very weird to strip down that much and then use a different editor. Do you remember if ed was missing in those machines?
bartvk 1 day ago|||
> Do you remember if ed was missing in those machines

I had to laugh out loud. I couldn't imagine such a system, that wouldn't be POSIX compliant. So I looked it up, and indeed, it's entirely possible. Debian doesn't necessarily include it.

https://unix.stackexchange.com/a/609067

SoftTalker 1 day ago|||
Yes I've run into containers where every utility that wasn't needed to run the service was stripped out. Even tools such as "less."
godelski 20 hours ago||
So what was the editor?
godelski 1 day ago|||
While not mandatory, vi is part of the POSIX commands. I mean you could use ed or even hack your way with awk, sed, and/or grep but no one wants to deal with that bullshit. And if you're installing vi you might as well install vim, right?

I've been on a lot of systems and can't remember a single instance of not having vi (though I do vim). So pretty rare, like you said

https://en.wikipedia.org/wiki/List_of_POSIX_commands

sdovan1 2 days ago|||
We usually work on the VM with daily-built ISO. For example, I would compile and upload Java program to the frontend team member's VM, and type "srt" for "systemctl restart tomcat."
xuhu 1 day ago|||
How much time does it add when running e.g. "shittp user@lan-host uname" ?
fragmede 1 day ago||
> I often need to login to colleagues' machines at work, but I find that their settings are not what I am familiar with

I'd hate to jump to conclusions, but what username are you looking into what machines with for that to be an issue?

foltik 2 days ago||
I have a python script [0] which builds and statically links my toolbox (fish, neovim, tmux, rg/fd/sd, etc.) into a self contained —-prefix which can be rsynced to any machine.

It has an activate script which sets PATH, XDG_CONFIG_HOME, XDG_DATA_HOME, and friends. This way everything runs out of that single dir and doesn’t pollute the remote.

My ssh RemoteCommand then just checks for and calls the activate script if it exists. I get dropped into a nice shell with all my config and tools wherever I go, without disturbing others’ configs or system packages.

[0] https://github.com/foltik/dots

stijnveken 2 days ago|
Is this available somewhere? I'm curious to see how this works.
foltik 2 days ago||
Published a minimal version and added a link! This implements everything I mentioned except for static linking, so YMMV depending on your C/CXX toolchain and installed packages.
stijnveken 2 days ago||
Thank you!
throw2772 2 days ago||
This reminds me - in a previous company I worked at, we had a bunch of old firewalls and switches that ran SSH servers without support for modern key exchange algorithms etc

One of the engineers wrote a shell alias called “shitssh”, which would call ssh with the right options to allow the old crufty crypto algorithms to be used. This alias got passed down to new members of the team like a family heirloom.

psd1 1 day ago|
Nice, although wouldn't work today. Modern distros (ime, fedora 42) need you to update policy and reboot. You can't connect with just --key-exchange YOLO1 any more

I hate network vendors. Wish I could put BSD on my old Catalysts.

Y_Y 2 days ago||

  tmp="$(mktemp -d)" && rsync -a --exclude='.ssh' user@host:~/.[!.]* "$tmp"/ && HOME="$tmp" exec "$SHELL"
grepfru_it 2 days ago||
I think this will copy your 9gb Mozilla cache directory as well? Still one liners like this is all you need lol
Bender 2 days ago|||
My mozilla cache would be under ~/.mozilla/firefox. Is the nightly version moving to ~/.config?

Reason I say would be is that I disable disk cache among other things performed by Arkenfox [1]

[1] - https://github.com/arkenfox/user.js

lights0123 2 days ago||||
Yes, Firefox 147 will respect XDG dirs.
grepfru_it 2 days ago|||
What does config have to do with the one liner?
Bender 2 days ago||
Prevents some data from ending up in ~/.mozilla. We dont sync what does not exist.
grepfru_it 2 days ago||
My guy, the one liner as written copies all dot files. Mozilla included
Bender 2 days ago||
My guy, the one liner as written copies all dot files. Mozilla included

Exactly why I apply Sun Tzu methodology.

grepfru_it 3 hours ago||
ψ ︿_____︿_ψ_

¯\_(ツ)_/¯

sigwinch 2 days ago|||
Any sufficiently-advanced automated rsync would have a filter for caches.
grepfru_it 2 days ago||
Except only ssh is filtered. Just commenting on what I see, not what should be
sigwinch 1 day ago|||
What I mean is an .rsync-filter with ‘H Cache/‘ or some lines of patterns to exclude. You’ll need to run with -F every time. On the sending side, a recent tar will accept —-exclude-caches if you can be diligent about creating CACHEDIR.TAG.
Y_Y 2 days ago|||
For sure, you need to exclude whatever "dotfiles" you don't want copied (or explicitly copy the ones you want), particularly caches and other giant hidden things.
imiric 2 days ago|||
I use something similar.

It's surprising to me how many projects can be replaced with just a line or two of shell script. This project is a slightly more sophisticated shell script that exposes a friendlier UI, but I don't see why it's needed when the alternative is much simpler, considering the target audience.

flakes 1 day ago|||
I do the same, but I skip rsync for git.

    git clone $uri dotfiles; export HOME=$(pwd)/dotfiles 
These days, my laptop acts as a dumb SSH gateway for Linux VMs. No configuration or setup, aside from VS code connecting to VMs. Any server that I would want to load my dotfiles onto will almost always have git installed.

Rant (not directed at any comment here): If it's a production server without git, then please do not run scripts like this. Do not create junk directories on (or ideally any modifications to) secure machines. It inevitably causes new and uninteresting puzzles for your colleagues. Create documented workflows for incident responses or inspection.

sdovan1 2 days ago||
Overriding HOME variable is neat! Make things much easier.
goku12 2 days ago||
How about mounting your dotfiles directory (~/.config) or even your entire home directory on the remote system using SSHFS or NFS? I'm sure somebody would have tried it or some project may already exist. Any idea why that isn't as prevalent as copying your dotfiles over?
sigwinch 2 days ago||
I’m trying to imagine why sshfs mounting the less-capable remote onto the workstation would be blocked.
cl3misch 2 days ago|||
That requires the remote machine to be configured to SSH into your local machine. In the scenario where OP's project is useful (SSH to foreign machines) I might not want that.

On the other hand, if the remote machine is mine, it will have my config anyway.

goku12 2 days ago||
There should be some way to mount a local directory onto a remote system without requiring the remote system to log in to the local system. SSH provides a secure bidirectional communication channel between the two systems. While we normally use sshfs to mount a remote directory to the local system, why should the reverse be impossible? Besides, you could also use NFS over SSH or TLS.
vbernat 2 days ago||
This would enable a lot of attacks.
goku12 2 days ago|||
Could you elaborate?
oasisaimlessly 2 days ago|||
Now anybody with root/sudo/physical access to the remote machine has full R/W access to your entire home directory.
goku12 2 days ago||
Well, what if it's a separate directory meant exclusively for remote systems alone? And what if the remote mount is read-only, perhaps with a writable layer on top using overlayfs that can be discarded on logout?
vbernat 1 day ago||
This now looks very complex.
goku12 1 day ago||
It's actually far less complex than what container runtimes do. I've even done parts of those, which is why I'm able to suggest it. I'm thinking about implementing it and was checking if anybody else wanted to do it or if they foresee any problems that I can't.
drewr 2 days ago||
I didn't look closely at the project, but why take the extra step of base64? I do this all the time with tar by itself and it's wire-proof enough to work fine.
sigwinch 1 day ago|||
In some cases, shar would be a useful wrapper for that.
owl_vision 1 day ago||
something like this, i recon:

  $ tar cf - ~/.shrc | ssh target '(cd ~ && tar xf -)'
twp 2 days ago||
chezmoi has similar functionality, but it does install a binary on the target machine:

https://www.chezmoi.io/reference/commands/ssh/

thunderbong 2 days ago||
Is this similar to sshrc?

https://github.com/cdown/sshrc

K0IN 2 days ago|
Maybe also kind of related xxh

https://github.com/xxh/xxh

5-0 22 hours ago||
It's nice to read the different takes on this.

On that note, I didn't see any mention of https://github.com/romkatv/zsh4humans/blob/master/tips.md#ex... , so there.

yoan9224 2 days ago|
I love the concept but I'd be worried about security in enterprise environments. Some of the dotfiles (especially .bashrc) could override security policies or compliance settings that IT has configured.

That said, for personal servers this is brilliant. I've been using a git repo for dotfiles but having them automatically cleanup on disconnect is clever.

One improvement: consider using SSH's ProxyCommand or LocalCommand instead of wrapping SSH entirely. That way it works transparently with tools that call SSH directly (git, rsync, etc).

Also curious - does this handle tmux sessions properly? I often SSH in, start tmux, disconnect, then reconnect later. Would the dotfiles still be there?

More comments...