2

Problem

I haven't found a solution to run an SSH port forward in a reliable and persistent fashion, when the server you are connecting to does not support public-key authentication.

Question

What is the most reasonable way to keep a persistent SSH port forward alive when a password is required? Taking into account security and reliability (I realise it is not ideal). I'm happy for it to need a password on start (i.e. not persistent over server reboots, this should prevent an actual script from having a plaintext password), but I need it to be reliable over disconnections.

Motiviation

The server I wish to connect to is behind a series of firewalls, and I am using local SSH port forwarding to expose a web-server to the public Internet. I am currently using standard port forwarding, but getting 'broken pipe' errors every few days and I want it to auto-restart the connection on these types of failures.

Attempts

  • I have tried to use AutoSSH but it seems to assume you have public-key authentication. I have not been successful in getting it work with some kind of password authentication.

  • I have tried using sshpass, but then I've been unsuccessful at getting the port forwarding to work with this. I think it might be getting confused by the welcome message the SSH server gives.

Why can't I enable public-key authentication?

It has been setup by design by IT to require a password, for policy reasons. I do not have root access to the server and cannot change it. I'd like to use public-key authentication, but I am stuck with what I have.

Ideas

  • Maybe using something like expect, and building my own script solution, but it doesn't sound great.
0
0

The author of the question provided the following work-around solution:

Update - Work-around solution

This isn't really a solution to the given question, but it did solve my original problem. I ended up using a reverse proxy instead of a local proxy, this allowed me to use public keys and autossh.

autossh -M 20000 -nNT -R *:80:localhost:80 user@host.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.