Problem
I haven't found a solution to run an SSH port forward in a reliable and persistent fashion, when the server you are connecting to does not support public-key authentication.
Question
What is the most reasonable way to keep a persistent SSH port forward alive when a password is required? Taking into account security and reliability (I realise it is not ideal). I'm happy for it to need a password on start (i.e. not persistent over server reboots, this should prevent an actual script from having a plaintext password), but I need it to be reliable over disconnections.
Motiviation
The server I wish to connect to is behind a series of firewalls, and I am using local SSH port forwarding to expose a web-server to the public Internet. I am currently using standard port forwarding, but getting 'broken pipe' errors every few days and I want it to auto-restart the connection on these types of failures.
Attempts
I have tried to use AutoSSH but it seems to assume you have public-key authentication. I have not been successful in getting it work with some kind of password authentication.
I have tried using sshpass, but then I've been unsuccessful at getting the port forwarding to work with this. I think it might be getting confused by the welcome message the SSH server gives.
Why can't I enable public-key authentication?
It has been setup by design by IT to require a password, for policy reasons. I do not have root access to the server and cannot change it. I'd like to use public-key authentication, but I am stuck with what I have.
Ideas
- Maybe using something like expect, and building my own script solution, but it doesn't sound great.
