2

Problem

I haven't found a solution to run an SSH port forward in a reliable and persistent fashion, when the server you are connecting to does not support public-key authentication.

Question

What is the most reasonable way to keep a persistent SSH port forward alive when a password is required? Taking into account security and reliability (I realise it is not ideal). I'm happy for it to need a password on start (i.e. not persistent over server reboots, this should prevent an actual script from having a plaintext password), but I need it to be reliable over disconnections.

Motiviation

The server I wish to connect to is behind a series of firewalls, and I am using local SSH port forwarding to expose a web-server to the public Internet. I am currently using standard port forwarding, but getting 'broken pipe' errors every few days and I want it to auto-restart the connection on these types of failures.

Attempts

  • I have tried to use AutoSSH but it seems to assume you have public-key authentication. I have not been successful in getting it work with some kind of password authentication.

  • I have tried using sshpass, but then I've been unsuccessful at getting the port forwarding to work with this. I think it might be getting confused by the welcome message the SSH server gives.

Why can't I enable public-key authentication?

It has been setup by design by IT to require a password, for policy reasons. I do not have root access to the server and cannot change it. I'd like to use public-key authentication, but I am stuck with what I have.

Ideas

  • Maybe using something like expect, and building my own script solution, but it doesn't sound great.

Update - Work-around solution

This isn't really a solution to the given question, but it did solve my original problem. I ended up using a reverse proxy instead of a local proxy, this allowed me to use public keys and autossh.

autossh -M 20000 -nNT -R *:80:localhost:80 user@host.com

migrated from serverfault.com Mar 13 '15 at 20:32

This question came from our site for system and network administrators.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.