2

I wrote the start script at the bottom of this question to try to get one of my devices to automatically create several remote forwarded ports with my VPS upon boot. (I've stripped the LSB tags to keep it to the point, but they're valid.) I do not receive any errors when running the script. It does create the autossh processes, but it does not make any connection to the VPS. (The client is a Raspberry Pi running Debian Wheezy, VPS is Ubuntu Server 14.10.) The ssh command used alone does work properly, so I don't know why the start script would not work. One thing I noticed (if you look below) is that the -f flag is being completely removed from the process when I use the script, but it remains when I just call ssh. PuTTY does flag the -f in green, differently than the rest of the text, but my Googling hasn't been able to tell me why it happens or if it's related to the problem. (Note: All port numbers are changed but still relate to each other correctly.)

My public key is correct, and the remote host is in known_hosts of both user and root. I tried escaping and not escaping the -o parameters, that made no difference, and escaping/using quotes around the -f flag made no difference either.

UPDATE: syslog is showing ssh exited with error status 255; restarting ssh for each autossh line, even though running the individual commands just as ssh (not autossh) works correctly. That error is returned whether the script is run or if I run the line from the script directly in bash.

Relevant part of the init.d script:

case "$1" in
  start)
    echo "Creating SSH tunnels"
    autossh -M 0 -f -N -o \"ServerAliveInterval 60\" -o \"ServerAliveCountMax 3\" -R 11111:localhost:22222 -i /home/username/.ssh/id_rsa -p 3333 user@server_ip
    #same command repeated twice more, everything exactly the same but with different ports
    ;;
  stop)
    echo "Stopping SSH tunnels..."
    ps axf | grep autossh | grep -v grep | awk '{print "kill -9 " $1}' | sh
    ;;
  *)
    echo "Usage: /etc/init.d/autossh-gen.sh {start|stop}"
    exit 1
    ;;
esac

This causes three lines to appear when ps aux | grep autossh is run, but I'll put only one here for brevity. No actual connection is made to the remote server; the port remains closed. Notice that the -f command in the script is not present.

root     14137  0.0  0.1   1700   976 ?        Ss   01:37   0:00 /usr/lib/autossh/autossh -M 0    -N -o "ServerAliveInterval 60" -o "ServerAliveCountMax 3" -R 11111:localhost:22222 -i /home/username/.ssh/id_rsa -p 3333 user@server_ip

If I run just this ssh command...

ssh -f -N -o "ServerAliveInterval 60" -o "ServerAliveCountMax 3" -R 11111:localhost:22222 -i /home/username/.ssh/id_rsa -p 3333 user@server_ip

... then this is output to ps aux and the port is successfully forwarded.

root     14124  0.0  0.1   5728  1720 ?        Ss   01:31   0:00 ssh -f -N -o ServerAliveInterval 60 -o ServerAliveCountMax 3 -R 11111:localhost:22222 -i /home/username/.ssh/id_rsa -p 3333 user@server_ip
  • Note that the manpage states The -f flag is stripped from arguments passed to ssh. – wurtel Mar 4 '15 at 7:44
  • @wurtel I did see that, but it should still appear in the process list, shouldn't it? The process list shows the autossh command, not the ssh command. (Honest question, not saying you're wrong.) – vaindil Mar 4 '15 at 14:30
  • It's showing /usr/lib/autossh/autossh, not /usr/bin/autossh. It doesn't pass the -f option to this helper process. Have you checked syslog for messages from autossh? – wurtel Mar 4 '15 at 15:09
  • @wurtel syslog is showing ssh exited with error status 255; restarting ssh for each autossh line, even though running the individual commands just as ssh works correctly. That error is returned whether the script is run or if I run the line from the script directly in bash. – vaindil Mar 7 '15 at 21:15
1

ssh exited with error status 255 usually points out authentication or connectivity issues. Try running your autossh without -f option so you can see its output:

autossh -M 0 -N -o \"ServerAliveInterval 60\" -o \"ServerAliveCountMax 3\" -R 11111:localhost:22222 -i /home/username/.ssh/id_rsa -p 3333 user@server_ip

Out of autossh manual:

Note that there is a crucial a difference between -f with autossh, and -f with ssh: when used with autossh ssh will be unable to ask for passwords or passphrases.

You can also try passing -v or -vv options to ssh to help your debug:

autossh -M 0 -N -vv -o \"ServerAliveInterval 60\" -o \"ServerAliveCountMax 3\" -R 11111:localhost:22222 -i /home/username/.ssh/id_rsa -p 3333 user@server_ip

Also, please note that /usr/lib/autossh/autossh is the process that monitors your ssh session, and restarts it if required. If your autossh command it's working you should be able to see both autossh and ssh process:

$ps -eo user,pid,args | grep ssh
----------
someuser    16384  /usr/lib/autossh/autossh -M 33332    -N -R 11111:127.0.0.1:22222 serverip
someuser    16385  /usr/bin/ssh -L 33332:127.0.0.1:33332 -R 33332:127.0.0.1:33333 -N -R 11111:127.0.0.1:22222 serverip

And btw, you don't need to pass the -f option to ssh, autossh will start it in background, by default.

0

It might be the case that the init script is running under a different user context than when you try it manually. If the init script is running with different userid, then check if the private key file can be read correctly.

There are known configuration issues on key files and their permissions.

The user who is executing the ssh command needs access to the identity file and, ssh can be strict in this, that the user owns the file, the .ssh directory and that the permissions are 700 for the .ssh directory and 600 for the private key file.

  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. – HalosGhost Mar 20 '15 at 13:53
  • I changed your "comment" to a potential answer, stating your questions as assumptions. Please flesh out the answer by providing the description of the known configuration issues, possible supported with some external links. – Anthon Mar 20 '15 at 14:25
  • @HalosGhost, my reputation does not allow me to comment on other's answers, hence the new answer. – Lambert Mar 20 '15 at 17:43
  • @Lambert It doesn't take long to build up the rep needed. In the future, restrain yourself from such posts until you do have the rep. That's the point. – HalosGhost Mar 20 '15 at 17:53
  • @HalosGhost, I get your point, but (just curious) why do you think my answer is not the right one? I tried to help the author with another possibility since issues on private/public keys are common. – Lambert Mar 20 '15 at 18:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.