Date: Tue, 10 Oct 2006 23:55:44 +0200 From: martinko <gamato@pobox.sk> To: freebsd-questions@freebsd.org Subject: Re: ssh tunnel - remote access through nat Message-ID: <452C16E0.1010903@pobox.sk> In-Reply-To: <200607261247.53917.nvass@teledomenet.gr> References: <715841970607251003o1d358d3dl894291f50a0b8053@mail.gmail.com> <200607261247.53917.nvass@teledomenet.gr>
next in thread | previous in thread | raw e-mail | index | archive | help
Nikos Vassiliadis wrote: > On Tuesday 25 July 2006 20:03, Drew wrote: >> Hi, >> I've got a box that's nat'd out to the internet. It is occassionally >> neccessary for me to access this box remotely. The obvious answer is: >> >> ssh -R 7777:localhost:22 remote.box cat >> >> run from the nat'd box where remote box is a place I pretty much always >> have access too from anywhere, anytime. The problem is that the connection >> between these two boxes is famously unreliable - so I need to ensure that >> this connection stays available. Unfortunately, the procedure for this is >> not obvious to me. I've thought about a cron job, as the connection would >> simply fail if it couldn't bind to 7777 on the remote box to listen. But >> I'm thinking there has to be something that makes more sense. Suggestions? >> Feedback? Thanks in advance for any pointers. > > you can do something like this in bourne-like shells: > > while true; do > ssh -N ... > sleep 1 > done > > and something like this in csh: > while ( 1 ) > ... > end > > from ssh manual: > -N Do not execute a remote command. This is useful for just for- > warding ports (protocol version 2 only). > > The sleep command is used to add a little delay in case there is some- > thing really wrong and ssh returns immediately, resulting in looping > very fast. > > Then you just have to ensure that ssh will be aware of a dropped > connection (by the means of keep-alives) and exit. You can do this > with ssh, but you have configure keep-alives on both machines, > client and server. > > An alternative method would be ipfw keep-alives for dynamic rules > and you have to configure it only on the box you're ssh'ing from. It > works very nice. > > In both cases you have to use public key authentication in order to > log on automatically after a network failure. I guess it's already > set up. > > A few pointers, read ssh, sshd, ssh-keygen and ipfw manuals > > HTH, Nikos Hello, I was just thinking along these lines this evening -- putting ssh in loop so that the tunnel is recreated whenever connection drops. However, I'd like to automate it somehow so that the machine creating tunnel can be restarted and it tries to open up tunnel when it boots up. The thing is that if I just simply create an rc script to achieve this, the script is run under root and ssh cannot make use of public key authentication which is set up now for a user running it manually. Or is there a way to change identity somehow or to run an rc script under different user account ?? Cheers, Martin
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?452C16E0.1010903>