2

Problem

I haven't found a solution to run an SSH port forward in a reliable and persistent fashion, when the server you are connecting to does not support public-key authentication.

Question

What is the most reasonable way to keep a persistent SSH port forward alive when a password is required? Taking into account security and reliability (I realise it is not ideal). I'm happy for it to need a password on start (i.e. not persistent over server reboots, this should prevent an actual script from having a plaintext password), but I need it to be reliable over disconnections.

Motiviation

The server I wish to connect to is behind a series of firewalls, and I am using local SSH port forwarding to expose a web-server to the public Internet. I am currently using standard port forwarding, but getting 'broken pipe' errors every few days and I want it to auto-restart the connection on these types of failures.

Attempts

  • I have tried to use AutoSSH but it seems to assume you have public-key authentication. I have not been successful in getting it work with some kind of password authentication.

  • I have tried using sshpass, but then I've been unsuccessful at getting the port forwarding to work with this. I think it might be getting confused by the welcome message the SSH server gives.

Why can't I enable public-key authentication?

It has been setup by design by IT to require a password, for policy reasons. I do not have root access to the server and cannot change it. I'd like to use public-key authentication, but I am stuck with what I have.

Ideas

  • Maybe using something like expect, and building my own script solution, but it doesn't sound great.
0

1 Answer 1

0

The author of the question provided the following work-around solution:

Update - Work-around solution

This isn't really a solution to the given question, but it did solve my original problem. I ended up using a reverse proxy instead of a local proxy, this allowed me to use public keys and autossh.

autossh -M 20000 -nNT -R *:80:localhost:80 [email protected]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .