Connect to an SSH target and transfer files

Back to the RDS Proxy main page  |· SSH targets: concepts  |· Create an SSH target and its policy

This page shows the user side of an SSH target.
The user opens the Windows Remote Desktop client, reaches the SSH server through the gateway, then exchanges files with it.
The administrator then finds every command and every file in the recording.

Connect

1. Start Remote Desktop Connection (mstsc).
   In Computer, type the address of the Artica appliance.
   Add the port when the gateway does not listen on 3389, for example rds.example.com:3390.

1. The gateway shows its login screen.
   Type the gateway account: a local member of the RDS Proxy or an Active Directory account.
2. When the policy requires the second factor, type the code of the authenticator application.
   See Second factor.
3. The list of servers shows the targets your policies allow.
   The Protocol column says SSH for SSH targets.
   Select the target and click Connect.

1. The terminal opens in the Remote Desktop window.

The status bar at the bottom shows the target, the account, the authentication mode and that the session is recorded.
On the right, it reminds the Ctrl+Alt+F shortcut of the file explorer when the policy allows downloads.
During an upload, it shows the progress of the transfer.

The terminal follows the size of the window.
Resize the mstsc window or switch to full screen: the server receives the new number of lines and columns.

Account typed at connection

When the target uses Typed at connection, the terminal asks for the Linux account and its password before opening the shell.
The password is not displayed and is never written in the traces.
A password copied in Windows can be pasted at this prompt.

Host key changed

When the host key of the server is not the one the gateway recorded, the connection is refused before any login.
The administrator receives a notification.
Ask the administrator to check the server, then to click Forget the key on the target if the change is expected.

Keyboard and clipboard

The gateway keeps Ctrl+Alt+F and Ctrl+Alt+X for itself.
The server never receives them.

Pasted text is cleaned before it reaches the shell.
Control characters and escape sequences are removed.
A multi-line paste is sent line by line, and each line goes through the command patterns of the policy.

Upload files (Windows to server)

The policy must allow Clipboard: Copy From The Computer To The Target and Clipboard: Files.

1. In Windows Explorer, select files or folders and copy them (Ctrl+C).

1. Click in the terminal and paste (Shift+Insert, Ctrl+Shift+V or right click).
2. The files are written in the home directory of the SSH account.
   A green line confirms each file, with its size and the start of its SHA-256 fingerprint.

How the upload behaves:

• Files always land in the home directory, never in the current directory of the shell.
  Folders keep their tree.
• An existing file is never overwritten.
  When the name is taken, the gateway adds a number: report (1).pdf, folder (1).
• The file is written under a hidden temporary name, then renamed when complete.
  A cancelled or failed transfer leaves nothing behind.
• The new files are readable by the SSH account only (mode 0600, folders 0700).
• You can keep typing in the terminal during the transfer.
• One paste holds at most 1000 files and folders.
• When the policy has command patterns that refuse or disconnect, a name starting with a dot is refused at the top of the home directory (.bashrc, .profile, .ssh).

To stop a transfer, press Ctrl+Alt+X.
The file being written is removed.
Files not started yet are not transferred.

[david: status bar during a large upload, with the percentage and the Ctrl+Alt+X reminder]

Download files (server to Windows)

The policy must allow Clipboard: Copy From The Target To The Computer and Clipboard: Files.

1. Press Ctrl+Alt+F.
   The gateway draws a file explorer over the terminal.
   It opens in the home directory of the SSH account.

1. Move with the arrows and check files or folders with Space.
2. Press C.
   The explorer closes and a green line says how many files are ready.
3. In Windows Explorer, open a folder and paste (Ctrl+V).
   The files are read from the server during the paste.

[david: Windows Explorer pasting the files, with the copy progress window]

The explorer can browse every folder the SSH account can read.
The footer shows the number of checked items and their total size.

What the copy takes and what it skips:

• Checked folders are copied with their content, down to 32 levels and up to 2000 files and folders.
  Beyond that, the whole copy is refused.
• Symbolic links, devices and sockets are skipped.
  So are names Windows cannot hold.
  A yellow line counts the skipped entries.
• A file changed on the server after C fails with the reason fichier modifié depuis la copie.
  Copy it again.
• A new C replaces the previous copy.

Messages of the gateway

The gateway writes its messages in the terminal, starting with [Bastion].
They are in French in this version.

What the administrator sees

Each SSH session is listed in RDS Proxy » Videos with the SSH trace label.

Recordings of SSH sessions

The terminal button opens the SSH session trace window.
Terminal transcript shows everything the terminal displayed, in plain text.

Terminal transcript of a session

Files lists every transfer: time, direction, path, size, SHA-256, status and reason.
The status is Completed, Cancelled, Denied, Failed or Partial.

Files transferred during a session

Download the transcript (.cast) gives the asciicast file.
It plays back with asciinema play.
Download the archive gives the whole recording.

Transfers and refused commands also appear in RDS Proxy » Events.
Uploads, downloads and failed transfers have their own reason.

Access events of SSH sessions

See also Access events and Video recording.