autossh in /etc/inittab

Question

I have setup ssh tunnel to be able to connect a target computer behind NAT. I have put the following into /etc/inittab on the computer:

tu:2345:respawn:/usr/bin/autossh -M 20000 -f -n -N -T -R 6790:localhost:22 me@servername.cz

It works, ie i can connect by issuing ssh -p 6790 me@localhost. But every now and then i get the following message on the target computer:

INIT: Id "tu" respawning too fast, disabled for 5 minutes

In /var/log/secure on the server, I can see the following:

Oct 29 03:11:15 vm sshd[19725]: Accepted publickey for me from 90.179.155.74 port 37416 ssh2
Oct 29 03:11:15 vm sshd[19727]: Received disconnect from 90.179.155.74: 11: disconnected by user
Oct 29 03:17:04 vm sshd[20892]: Accepted publickey for me from 90.179.155.74 port 40116 ssh2
Oct 29 03:17:15 vm sshd[20896]: error: bind: Address already in use
Oct 29 03:17:19 vm sshd[20896]: error: channel_setup_fwd_listener: cannot listen to port: 20000

And this goes on. Any idea what can be wrong?

Answer 1

Ok, found the answer. If autossh is called with -f option, it forks itself as a daemon and the parent process exits. Hence init respawns it again..and again....

I think I should not have used autossh but just ssh cause respawning is done by init and there is, I guess, no need for another autorespawning by autossh. I changed the line to just tu:2345:respawn:/usr/bin/ssh -n -N -T -R 6791:localhost:22 me@servername.cz

Also I added

ServerAliveInterval 15
ServerAliveCountMax 2

into /etc/ssh/ssh_config to keep the connection alive.

I think this setup might work pretty well.

Answer 2

If using good old ssh instead of autossh as you say in your own answer works well, that's great, you can stop reading.

I have been many times in the situation that no amount of ssh/sshd config tuning would help, from time to time my trusty tunnel would hang as opposed to kindly crashing, no matter what. In all those situations autossh worked like a charm.

So if you end up returning to autossh, here's how I use it. Instead of inittab, I run it inside a screen session. Create a simple script, let's call it autossh.sh:

#!/bin/sh
tunnelsite=autossh-host1
if ! screen -ls | grep -F .$tunnelsite >/dev/null; then
    screen -d -m -S $tunnelsite autossh -N $tunnelsite
fi

The script just checks if there is a screen session with the given name already running, exit it yes, otherwise create it.

Schedule a cron job to run this periodically:

*/15 * * * * AUTOSSH_PORT=0 /path/to/autossh.sh

The AUTOSSH_PORT=0 is just to workaround a strange issue I had on a Mac OS X. You can omit that, but I'm using this method in Linux too with no problems.

Lastly, a security tip: unless you're doing it already, I using a dedicated ssh key for authenticating the tunnel with autossh, and restricting the key authorization in .ssh/authorized_keys with these options:

command="/bin/false",no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa AAAA...

This way even if your key ever gets compromised, it will only be usable for creating the tunnel.

I hope this helps. Actually I have a script project on GitHub to make this setup easier. https://github.com/janosgyerik/autossh-tunnel