ssh reverse tunnel

[Rick Bilonick]

I re-installed Fedora 8 and now I can get a reverse ssh tunnel (from
server to home) by typing on the server:

>  ssh -R 2022:server.ip:22 home(a)home.ip 

Then when at the home computer, I type:

>  ssh -p 2022 server@localhost 
This works fine. The only problem is the connection always times out
even though I've changed the sshd_config files on both machines to keep
it alive. I've restarted the sshd daemon also. Not sure why the
connection keeps closing.

Rick B.

[Christopher K. Johnson]

Rick Bilonick wrote:
>  This works fine. The only problem is the connection always times out
>  even though I've changed the sshd_config files on both machines to keep
>  it alive. I've restarted the sshd daemon also. Not sure why the
>  connection keeps closing.
>     
Some firewalls have a time limit on connections, and the connections 
will fail as soon as that timeout occurs.  Note when the ssh session is 
started, and when it times out.  See if there is a consistent connection 
duration.

If that is occuring the only solutions are to alter the timeout on the 
firewall (I did that on some checkpoint firewalls a few years ago) or 
re-initiate the connection whenever it goes down (yum install autossh).  
Obviously the latter is not ideal because your inbound session is lost 
uncleanly and you cannot predict when it will happen unless you know 
what the firewall connection timeout is for that port, and when the 
session was initiated.  But if it means that getting a connection 
remains possible that would be better than losing the capability until 
you are next in the office.


Chris

-- 
   "Spend less!  Do more!  Go Open Source..." -- Dirigo.net
   Chris Johnson, RHCE #804005699817957

[Jaakko Ruutiainen]

Rick Bilonick wrote:
>  I re-installed Fedora 8 and now I can get a reverse ssh tunnel (from
>  server to home) by typing on the server:
>  
> > ssh -R 2022:server.ip:22 home(a)home.ip
>  
>  
>  Then when at the home computer, I type:
>  
> > ssh -p 2022 server@localhost
>  
>  This works fine. The only problem is the connection always times out
>  even though I've changed the sshd_config files on both machines to keep
>  it alive. I've restarted the sshd daemon also. Not sure why the
>  connection keeps closing.
>   
Run something like
while date ; do sleep 60; done
in the ssh session setting up the tunnel, adjust sleep time if needed. 
That will generate some traffic to keep the connection from timing out.

-- 
Jaakko Ruutiainen

[Jeffrey Ross]

>  Rick Bilonick wrote:
> > I re-installed Fedora 8 and now I can get a reverse ssh tunnel (from
> > server to home) by typing on the server:
> >
> >> ssh -R 2022:server.ip:22 home(a)home.ip
> >
> >
> > Then when at the home computer, I type:
> >
> >> ssh -p 2022 server@localhost
> >
> > This works fine. The only problem is the connection always times out
> > even though I've changed the sshd_config files on both machines to keep
> > it alive. I've restarted the sshd daemon also. Not sure why the
> > connection keeps closing.
> >
>
>  Run something like
>  while date ; do sleep 60; done
>  in the ssh session setting up the tunnel, adjust sleep time if needed.
>  That will generate some traffic to keep the connection from timing out.
>  
I found a little utility called "spinner"  it will draw a spinning bar
in
the corner of the screen or with the "-n" option send a null char once a
second (adjustable)  I simply type "spinner -n".  This will keep your
session open indefinitely.

Program is here: http://www.laffeycomputer.com/spinner.html

[Aldo Foot]

On Mon, Jun 30, 2008 at 9:15 AM, Rick Bilonick <rab(a)nauticom.net&gt; wrote:
>  I re-installed Fedora 8 and now I can get a reverse ssh tunnel (from
>  server to home) by typing on the server:
>
> > ssh -R 2022:server.ip:22 home(a)home.ip
>
>
>  Then when at the home computer, I type:
>
> > ssh -p 2022 server@localhost
>
>  This works fine. The only problem is the connection always times out
>  even though I've changed the sshd_config files on both machines to keep
>  it alive. I've restarted the sshd daemon also. Not sure why the
>  connection keeps closing.
>
>  Rick B.
>  
If you have root access increase the ssh session idle time
     echo "3600" > /proc/sys/net/ipv4/tcp_keepalive_time
that's 3600 seconds (1hr), you can change it.

or just run the command "top" in the active terminal.
~af

[Rick Bilonick]

On Mon, 2008-06-30 at 13:51 -0400, Christopher K. Johnson wrote:
>  Rick Bilonick wrote:
>  > This works fine. The only problem is the connection always times out
>  > even though I've changed the sshd_config files on both machines to keep
>  > it alive. I've restarted the sshd daemon also. Not sure why the
>  > connection keeps closing.
>  >   
>  Some firewalls have a time limit on connections, and the connections 
>  will fail as soon as that timeout occurs.  Note when the ssh session is 
>  started, and when it times out.  See if there is a consistent connection 
>  duration.
>  
>  If that is occuring the only solutions are to alter the timeout on the 
>  firewall (I did that on some checkpoint firewalls a few years ago) or 
>  re-initiate the connection whenever it goes down (yum install autossh).  
>  Obviously the latter is not ideal because your inbound session is lost 
>  uncleanly and you cannot predict when it will happen unless you know 
>  what the firewall connection timeout is for that port, and when the 
>  session was initiated.  But if it means that getting a connection 
>  remains possible that would be better than losing the capability until 
>  you are next in the office.
>  
>  
>  Chris
>  
>  -- 
>     "Spend less!  Do more!  Go Open Source..." -- Dirigo.net
>     Chris Johnson, RHCE #804005699817957
>   
I just checked - I was wrong. The ssh tunnel connection to home doesn't
time out. What timed out was just a regular ssh connection (that I was
using to test the reverse tunnel). I'm not sure why the regular one
timed out but the reverse tunnel did not (but I'm not complaining).

Thanks.

Rick B.

[Rick Bilonick]

On Mon, 2008-06-30 at 17:58 -0400, Rick Bilonick wrote:

>  
>  I just checked - I was wrong. The ssh tunnel connection to home doesn't
>  time out. What timed out was just a regular ssh connection (that I was
>  using to test the reverse tunnel). I'm not sure why the regular one
>  timed out but the reverse tunnel did not (but I'm not complaining).
>  
>  Thanks.
>  
>  Rick B.
>   
It took a few minutes of reading the man page for sftp, but it turns out
it's quite easy to do this also with sftp:

# From home to firewalled server with user "server" 
# and port 2022 forwarded
>  sftp -oPort=2022 server@localhost 
Rick B.

[Bill Davidsen]

Rick Bilonick wrote:
>  I re-installed Fedora 8 and now I can get a reverse ssh tunnel (from
>  server to home) by typing on the server:
>  
> > ssh -R 2022:server.ip:22 home(a)home.ip
>  
>  
>  Then when at the home computer, I type:
>  
> > ssh -p 2022 server@localhost
>  
>  This works fine. The only problem is the connection always times out
>  even though I've changed the sshd_config files on both machines to keep
>  it alive. I've restarted the sshd daemon also. Not sure why the
>  connection keeps closing.
>   
And the reason this is desirable? You can easily set iptables to accept 
ssh packets on 2022 from only your computer, and not run encryption 
through encryption. And if you want a real connection, OpenVPN is 
probably a better solution.


-- 
Bill Davidsen <davidsen(a)tmr.com&gt;
   "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot

[Rick Bilonick]

On Tue, 2008-07-01 at 14:07 -0400, Bill Davidsen wrote:
>  Rick Bilonick wrote:
>  > I re-installed Fedora 8 and now I can get a reverse ssh tunnel (from
>  > server to home) by typing on the server:
>  > 
>  >> ssh -R 2022:server.ip:22 home(a)home.ip
>  > 
>  > 
>  > Then when at the home computer, I type:
>  > 
>  >> ssh -p 2022 server@localhost
>  > 
>  > This works fine. The only problem is the connection always times out
>  > even though I've changed the sshd_config files on both machines to keep
>  > it alive. I've restarted the sshd daemon also. Not sure why the
>  > connection keeps closing.
>  > 
>  And the reason this is desirable? You can easily set iptables to accept 
>  ssh packets on 2022 from only your computer, and not run encryption 
>  through encryption. And if you want a real connection, OpenVPN is 
>  probably a better solution.
>  
>  
>  -- 
>  Bill Davidsen <davidsen(a)tmr.com&gt;
>     "We have more to fear from the bungling of the incompetent than from
>  the machinations of the wicked."  - from Slashdot
>   
And if I had any control over any of this, that would be exactly what I
would do. But since I don't, this fits the bill.

Rick B.

[Bill Davidsen]

Rick Bilonick wrote:
>  On Tue, 2008-07-01 at 14:07 -0400, Bill Davidsen wrote:
> > Rick Bilonick wrote:
> >> I re-installed Fedora 8 and now I can get a reverse ssh tunnel (from
> >> server to home) by typing on the server:
> >>
> >>> ssh -R 2022:server.ip:22 home(a)home.ip
> >>
> >> Then when at the home computer, I type:
> >>
> >>> ssh -p 2022 server@localhost
> >> This works fine. The only problem is the connection always times out
> >> even though I've changed the sshd_config files on both machines to keep
> >> it alive. I've restarted the sshd daemon also. Not sure why the
> >> connection keeps closing.
> >>
> > And the reason this is desirable? You can easily set iptables to accept 
> > ssh packets on 2022 from only your computer, and not run encryption 
> > through encryption. And if you want a real connection, OpenVPN is 
> > probably a better solution. 
>  
>  And if I had any control over any of this, that would be exactly what I
>  would do. But since I don't, this fits the bill. 
Just be aware of the laws about unauthorized access to computers, and 
CYA. Something in writing might be nice, in case you ever need proof.

[ not cc to any list ]


-- 
Bill Davidsen <davidsen(a)tmr.com&gt;
   "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot