CONCH(1)

🦋 CONCH 🦋

okay so bestie, we're in section 1 of the General Commands Manual, and this whole page is about conch — the Conch SSH client. it's giving secure remote login, it's giving encrypted vibes, it's giving "your terminal but make it slay". let's go 💖

---

✨ NAME ✨

conch — Conch SSH client

---

🌈 SYNOPSIS 🌈

conch [-AaCfINnrsTtVvx] [-c cipher_spec] [-e escape_char]
      [-i identity_file] [-K connection_spec] [-L port:host:hostport]
      [-l user] [-m mac_spec] [-o openssh_option] [-p port]
      [-R port:host:hostport] [user@] hostname [command]

---

💅 DESCRIPTION 💅

so conch is a SSHv2 client, right? its whole main character job is logging into a remote machine and executing commands. it gives you encrypted and secure communications across a possibly insecure network (the network is the messy friend, conch is the one who shows up with a plan). arbitrary TCP/IP ports can also be forwarded over the secure connection, which is lowkey iconic.

conch connects and logs into hostname (as user, or as the current username if you didn't say). the user must prove her/his identity through a public-key or a password. OR — and this is the cute part — if a connection is already open to a server, a new shell can be opened over that connection without having to reauthenticate. no re-auth, no stress, we love efficiency 🫶

if command is specified, command is executed instead of a shell. and if the -s option is given, command is treated as an SSHv2 subsystem name.

🔐 Authentication 🔐

Conch supports the public-key, keyboard-interactive, and password authentications. three lanes, all valid.

the public-key method allows the RSA or DSA algorithm to be used. the client uses his/her private key, $HOME/.ssh/id_rsa or $HOME/.ssh/id_dsa, to sign the session identifier, which is known only by the client and server. the server then checks that the matching public key is valid for the user, and that the signature is correct. like a little cryptographic handshake, fr fr 🤝

if public-key authentication fails, conch can authenticate by sending an encrypted password over the connection.

🔀 Connection sharing 🔀

conch has the ability to multiplex multiple shells, commands and TCP/IP ports over the same secure connection. to disable multiplexing for a connection, use the -I flag.

the -K option determines how the client connects to the remote host. it is a comma-separated list of the methods to use, in order of preference. the two connection methods are unix (for connecting over a multiplexed connection) and direct (to connect directly). to disable connecting over a multiplexed connection, do not include unix in the preference list.

as an example of how connection sharing works, to speed up CVS over SSH:

conch --noshell --fork -l cvs_user cvs_host
set CVS_RSH=conch

now, when CVS connects to cvs_host as cvs_user, instead of making a new connection to the server, conch will add a new channel to the existing connection. this saves the cost of repeatedly negotiating the cryptography and authentication. obsessed with the savings, honestly 💸

the options are as follows:

• -A — enables authentication agent forwarding.
• -a — disables authentication agent forwarding (default).
• -C — enable compression. squeeze it, bestie.
• -c cipher_spec — selects encryption algorithms to be used for this connection, as a comma-separated list of ciphers in order of preference. the list that conch supports is (in order of default preference): aes256-ctr, aes256-cbc, aes192-ctr, aes192-cbc, aes128-ctr, aes128-cbc, idea-ctr, idea-cbc, 3des-ctr, 3des-cbc.
• -e ch | ^ch | none — sets the escape character for sessions with a PTY (default: ~). the escape character is only recognized at the beginning of a line (after a newline). the escape character followed by a dot (.) closes the connection; followed by ^Z suspends the connection; and followed by the escape character sends the escape character once. setting the character to "none" disables any escapes.
• -f — fork to background after authentication. go be free 🦋
• -I — do not allow connection sharing over this connection.
• -i identity_spec — the file from which the identity (private key) for RSA or DSA authentication is read. the defaults are $HOME/.ssh/id_rsa and $HOME/.ssh/id_dsa. it is possible to use this option more than once to use more than one private key.
• -K connection_spec — selects methods for connection to the server, as a comma-separated list of methods in order of preference. see Connection sharing for more information.
• -L port:host:hostport — specifies that the given port on the client host is to be forwarded to the given host and port on the remote side. this allocates a socket to listen to port on the local side, and when connections are made to that socket, they are forwarded over the secure channel and a connection is made to host port hostport from the remote machine. only root can forward privieged ports.
• -l user — log in using this username.
• -m mac_spec — selects MAC (message authentication code) algorithms, as a comma-separated list in order of preference. the list that conch supports is (in order of preference): hmac-sha2-512, hmac-sha2-384, hmac-sha2-256, hmac-sha1, hmac-md5.
• -N — do not execute a shell or command.
• -n — redirect input from /dev/null.
• -o openssh_option — ignored OpenSSH options. (yes, ignored. it's a vibe-check-only option, no cap 🙈)
• -p port — the port to connect to on the server.
• -R port:host:hostport — specifies that the given port on the remote host is to be forwarded to the given host and port on the local side. this allocates a socket to listen to port on the remote side, and when connections are made to that socket, they are forwarded over the secure channel and a connection is made to host port hostport from the client host. only root can forward privieged ports.
• -s — reconnect to the server if the connection is lost.
• -s — invoke command (mandatory) as a SSHv2 subsystem.

⚠️ bestie. yes. -s is listed twice in this manual page, with two completely different meanings. that's not me being chaotic, that's literally what the page says. read carefully, i'm begging you 😭

• -T — do not allocate a TTY.
• -t — allocate a TTY even if command is given.
• -V — display version number only.
• -v — log to stderr.
• -x — disable X11 connection forwarding (default).

---

👑 AUTHOR 👑

Written by Paul Swartz <z3p@twistedmatrix.com>. king behaviour honestly 👑

---

💀 REPORTING BUGS 💀

to report a bug, visit https://twistedmatrix.com/trac/

---

📜 COPYRIGHT 📜

Copyright © 2002-2020 Twisted Matrix Laboratories. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

read that again bestie: NO WARRANTY. none. not even the merchantability one. not even the fitness-for-a-particular-purpose one. it's giving "you're on your own and we love that for you" 💀

---

🫶 SEE ALSO 🫶

ssh(1)

---

and that's the whole page, gorgeous ✨ this edition of the conch manual page comes from Debian, dated May 22, 2004 — yeah, it's an elder, but it's still serving. now go forth and conch responsibly, i believe in you 💖🎀🌸