Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Autossh – automatically restart SSH sessions and tunnels

github.com

Post reply on HN
Print view View original

41–50 of 90 posts

Re: Autossh – automatically restart SSH sessions and tunnels

#41

Post by johnklos »

xk3 wrote: post #6

If you have systemd, you could do this: [Unit] Description=look ma, no autossh After=network.target [Service] Type=exec ExecStart=/usr/bin/ssh -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes -Nn -R 7070:localhost:22 pc 'sleep 20m' Restart=always RestartSec=20 RuntimeMaxSec=30m [Install] WantedBy=default.target

This is no better than ssh in a loop, which is trivially done by a shell script - no systemd needed.

However, when you have shitty NAT routers (SonicWall, any AT&T fiber device, for instance), the connections will be timed out or will die and there'll be long periods where you're waiting for the next iteration of the loop, and/or sometimes it'll get stuck and never try again.

autossh deals with this by actually passing traffic and taking action if traffic doesn't move.

Re: Autossh – automatically restart SSH sessions and tunnels

#42

Post by elashri »

8xeh wrote: post #28
xk3 wrote: post #6

If you have systemd, you could do this: [Unit] Description=look ma, no autossh After=network.target [Service] Type=exec ExecStart=/usr/bin/ssh -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes -Nn -R 7070:localhost:22 pc 'sleep 20m' Restart=always RestartSec=20 RuntimeMaxSec=30m [Install] WantedBy=default.target

This approach works very well. I've had dozens of extremely remote systems hooked up this way for about 8 years. The only problem I've seen is that occasionally the server ssh process will get stuck, so you have to log in to the server and kill it. It seems to happen when a remote goes offline and reconnects without closing the old connection first. If I were doing it now, I'd probably use wireguard, probably. This i…

Can't you just add something like ServerAliveCountMaxto help with solving stale connections?

So something like that would solve that

[Unit] Description=look ma, no autossh After=network.target

[Service] Type=exec ExecStart=/usr/bin/ssh -o ServerAliveInterval=60 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes -Nn -R 7070:localhost:22 pc 'sleep 20m' Restart=always RestartSec=20 RuntimeMaxSec=30m

[Install] WantedBy=default.target

Re: Autossh – automatically restart SSH sessions and tunnels

#43

Post by jauntywundrkind »

johnklos wrote: post #41
xk3 wrote: post #6

If you have systemd, you could do this: [Unit] Description=look ma, no autossh After=network.target [Service] Type=exec ExecStart=/usr/bin/ssh -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes -Nn -R 7070:localhost:22 pc 'sleep 20m' Restart=always RestartSec=20 RuntimeMaxSec=30m [Install] WantedBy=default.target

This is no better than ssh in a loop, which is trivially done by a shell script - no systemd needed. However, when you have shitty NAT routers (SonicWall, any AT&T fiber device, for instance), the connections will be timed out or will die and there'll be long periods where you're waiting for the next iteration of the loop, and/or sometimes it'll get stuck and never try again. autossh deals with this by actually passi…

If you read what the person wrote, you'll see a ServerAliveInterval.

If there are ServerAliveIntevalMaxCount (defaults to 3) attempts that fail, the ssh connection will drop. And systemd will restart it.

Today you learned. Nice. I've dropped autossh for years and you can too, even on flaky connections.

Re: Autossh – automatically restart SSH sessions and tunnels

#44

Post by oasisaimlessly »

johnklos wrote: post #41
xk3 wrote: post #6

If you have systemd, you could do this: [Unit] Description=look ma, no autossh After=network.target [Service] Type=exec ExecStart=/usr/bin/ssh -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes -Nn -R 7070:localhost:22 pc 'sleep 20m' Restart=always RestartSec=20 RuntimeMaxSec=30m [Install] WantedBy=default.target

This is no better than ssh in a loop, which is trivially done by a shell script - no systemd needed. However, when you have shitty NAT routers (SonicWall, any AT&T fiber device, for instance), the connections will be timed out or will die and there'll be long periods where you're waiting for the next iteration of the loop, and/or sometimes it'll get stuck and never try again. autossh deals with this by actually passi…

> autossh deals with this by actually passing traffic and taking action if traffic doesn't move.

The `ServerAliveInterval` option above achieves this.

Re: Autossh – automatically restart SSH sessions and tunnels

#45

Post by johnklos »

oasisaimlessly wrote: post #44
johnklos wrote: post #41

Earlier quoted context omitted.

This is no better than ssh in a loop, which is trivially done by a shell script - no systemd needed. However, when you have shitty NAT routers (SonicWall, any AT&T fiber device, for instance), the connections will be timed out or will die and there'll be long periods where you're waiting for the next iteration of the loop, and/or sometimes it'll get stuck and never try again. autossh deals with this by actually passi…

> autossh deals with this by actually passing traffic and taking action if traffic doesn't move. The `ServerAliveInterval` option above achieves this.

No, it actually doesn't, or at least not properly. It's not hard to get ssh sessions that are wedged.

Re: Autossh – automatically restart SSH sessions and tunnels

#46

Post by aborsy »

Wouldn’t ssh with systemd or auto ssh be a more secure means of remote access to apps (like http/https apps) than the zero trust network access solutions (like Cloudflare Tunnels which terminates the TLS) or even Tailscale (which should be a trusted third party)?

You set up public key authentication with SSH to a reverse proxy, a persistent tunnel, and a socks proxy. In a Firefox profile, you set localhost:port. Done! All your services are available in that browser all the time.

Autossh with a reverse ssh tunnel can also be used to expose an internal service to the Internet through a VPS.

SSH has been very secure over the decades. A good feature of SSH is that it can jump from host to host, unlike VPN.

Re: Autossh – automatically restart SSH sessions and tunnels

#47

Post by johnklos »

jauntywundrkind wrote: post #43
johnklos wrote: post #41

Earlier quoted context omitted.

This is no better than ssh in a loop, which is trivially done by a shell script - no systemd needed. However, when you have shitty NAT routers (SonicWall, any AT&T fiber device, for instance), the connections will be timed out or will die and there'll be long periods where you're waiting for the next iteration of the loop, and/or sometimes it'll get stuck and never try again. autossh deals with this by actually passi…

If you read what the person wrote, you'll see a ServerAliveInterval. If there are ServerAliveIntevalMaxCount (defaults to 3) attempts that fail, the ssh connection will drop. And systemd will restart it. Today you learned. Nice. I've dropped autossh for years and you can too, even on flaky connections.

Today I learned that some people make mistakes, but I already knew that ;) ServerAliveInterval doesn't do this properly and consistently.

I've used my own autossh type script for two decades now. It's mostly used to give access to machines behind shitty NAT, and/or that have addresses that constantly change, and/or for systems on CGNAT, like Starlink.

If ServerAliveInterval works so well and negates the need for something like autossh to exist, then why have sessions created by my script, which has ServerAliveInterval (and ServerAliveIntevalMaxCount) gotten hung up where the script needs to kill the old and create a new ssh connection now and then? My script logs each timeout, each session hang, and each new connection, and depending on the network, it can happen often.

Please read the bit where it's explained how autossh sends test data back and forth. Do you think you just magically and cleverly discovered ServerAliveIntevalMaxCount and that the autossh people have no idea that it exists?

Or perhaps they know it exists, they know it's not perfect, and they used another mechanism to make up for the shortcomings of what ssh offers out of the box?

Re: Autossh – automatically restart SSH sessions and tunnels

#48

Post by walrus01 »

xk3 wrote: post #6

If you have systemd, you could do this: [Unit] Description=look ma, no autossh After=network.target [Service] Type=exec ExecStart=/usr/bin/ssh -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes -Nn -R 7070:localhost:22 pc 'sleep 20m' Restart=always RestartSec=20 RuntimeMaxSec=30m [Install] WantedBy=default.target

This is not very dissimilar from how the RIPE Atlas software probe (debian package) maintains a persistent SSH command/control session to the anchors and RIPE infrastructure. As I recall it installs itself as a systemd service.

https://atlas.ripe.net/docs/howtos/software-probes.html

Re: Autossh – automatically restart SSH sessions and tunnels

#49

Post by sjf »

amelius wrote: post #22

Nice tool, but I'm getting tired of using port numbers for everything instead of more descriptive strings. My system has more than 10 tunnels and servers running, and since I only do sysadmin work once every half year or so, the port numbers are very cumbersome to deal with.

Agreed, I have so many services that all want to run their own webserver, db, elasticsearch, etc. I have to start using non-standard port numbers and it’s a burden to have to keep track of them.

Re: Autossh – automatically restart SSH sessions and tunnels

#50

Post by pferde »

polalavik wrote: post #34
xk3 wrote: post #6

If you have systemd, you could do this: [Unit] Description=look ma, no autossh After=network.target [Service] Type=exec ExecStart=/usr/bin/ssh -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes -Nn -R 7070:localhost:22 pc 'sleep 20m' Restart=always RestartSec=20 RuntimeMaxSec=30m [Install] WantedBy=default.target

I think this is actually superior to autossh. Doesn’t autossh not restart after crash/reboot?

You could run autossh as a systemd service that starts on boot. :-)
Post reply on HN