Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have setup ssh tunnel to be able to connect a target computer behind NAT. I have put the following into /etc/inittab on the computer:

tu:2345:respawn:/usr/bin/autossh -M 20000 -f -n -N -T -R 6790:localhost:22 me@servername.cz

It works, ie i can connect by issuing ssh -p 6790 me@localhost. But every now and then i get the following message on the target computer:

INIT: Id "tu" respawning too fast, disabled for 5 minutes

In /var/log/secure on the server, I can see the following:

Oct 29 03:11:15 vm sshd[19725]: Accepted publickey for me from 90.179.155.74 port 37416 ssh2
Oct 29 03:11:15 vm sshd[19727]: Received disconnect from 90.179.155.74: 11: disconnected by user
Oct 29 03:17:04 vm sshd[20892]: Accepted publickey for me from 90.179.155.74 port 40116 ssh2
Oct 29 03:17:15 vm sshd[20896]: error: bind: Address already in use
Oct 29 03:17:19 vm sshd[20896]: error: channel_setup_fwd_listener: cannot listen to port: 20000

And this goes on. Any idea what can be wrong?

share|improve this question
add comment

2 Answers

Ok, found the answer. If autossh is called with -f option, it forks itself as a daemon and the parent process exits. Hence init respawns it again..and again....

I think I should not have used autossh but just ssh cause respawning is done by init and there is, I guess, no need for another autorespawning by autossh. I changed the line to just tu:2345:respawn:/usr/bin/ssh -n -N -T -R 6791:localhost:22 me@servername.cz

Also I added

ServerAliveInterval 15
ServerAliveCountMax 2

into /etc/ssh/ssh_config to keep the connection alive.

I think this setup might work pretty well.

share|improve this answer
add comment

If using good old ssh instead of autossh as you say in your own answer works well, that's great, you can stop reading.

I have been many times in the situation that no amount of ssh/sshd config tuning would help, from time to time my trusty tunnel would hang as opposed to kindly crashing, no matter what. In all those situations autossh worked like a charm.

So if you end up returning to autossh, here's how I use it. Instead of inittab, I run it inside a screen session. Create a simple script, let's call it autossh.sh:

#!/bin/sh
tunnelsite=autossh-host1
if ! screen -ls | grep -F .$tunnelsite >/dev/null; then
    screen -d -m -S $tunnelsite autossh -N $tunnelsite
fi

The script just checks if there is a screen session with the given name already running, exit it yes, otherwise create it.

Schedule a cron job to run this periodically:

*/15 * * * * AUTOSSH_PORT=0 /path/to/autossh.sh

The AUTOSSH_PORT=0 is just to workaround a strange issue I had on a Mac OS X. You can omit that, but I'm using this method in Linux too with no problems.

Lastly, a security tip: unless you're doing it already, I using a dedicated ssh key for authenticating the tunnel with autossh, and restricting the key authorization in .ssh/authorized_keys with these options:

command="/bin/false",no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa AAAA...

This way even if your key ever gets compromised, it will only be usable for creating the tunnel.

I hope this helps. Actually I have a script project on GitHub to make this setup easier. https://github.com/janosgyerik/autossh-tunnel

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.