0

I need to establish a permanent ssh tunnel between private server behind firewall and a public server so that I can ssh into private server anytime via the public server.

When I manually execute this in private server, 

ssh -R 6666:localhost:22 username@public_host

everything works fine. But when I put this line into crontab -e so that the tunnel will be automatically re-established upon reboot, it does not work. Any idea what went wrong?

Note: public/private key pair between servers already set and working fine.

Improve this question
3
  • 2
    Does /usr/bin/ssh -R 6666:localhost:22 username@public_host work?
    – heemayl
    Commented Jul 18, 2016 at 9:59
  • Is the key file password-protected? Is the key file on an encrypted home directory?
    – Gilles 'SO- stop being evil'
    Commented Jul 18, 2016 at 23:17
  • I generated key pair with keytool and did not use passphrase. I did not do anything specific to password-protect the key file or home directory, so I think it is not password-protected. /usr/bin/ssh -R 6666:localhost:22 username@public_host works when executed manually, but when I inserted @reboot /usr/bin/ssh -R 6333:localhost:22 username@public_host in crontab -e, it does not work.
    – Nxter
    Commented Jul 19, 2016 at 5:30

2 Answers 2

Reset to default
1

Use autossh, which does this for you. It is designed for persistent connections that don't need manual starting or restarting, are self monitored, and do any of the same tunneling jobs that a normal ssh client does.

Improve this answer
2
  • thanks. autossh also works when done manually. My problem is to make it work on reboot. I tried crontab -e and also adding a file with that command to /etc/rc0.d/. Any idea on how to make either the ssh or autossh command work on reboot will be appreciated.
    – Nxter
    Commented Jul 18, 2016 at 11:31
  • you just use it in your init/rc system as usual... it should come with an init script, and then you just enable that. And if they didn't give you one, you could stick it in crontab or make your own init script, and simply run your manual command in there, or if that doesn't work, try forking and using nohup like nohup autossh ... &
    – Peter
    Commented Jul 18, 2016 at 14:00
0

You're executing the ssh command outside of the context of your session, so you may be missing some things that are normally available.

Presumably, you're authenticating with a key. Is the key available from the cron job?

  • If the key file is password-protected, then obviously the key isn't available since you might not have entered the password yet. Even if you have entered the password, the key lives in the memory of your session's key agent. ssh commands launched from your session know how to contact the key agent through the environment variable SSH_AUTH_SOCK, but ssh launched from the crontab doesn't have this variable.
  • If your home directory is encrypted, then the key file isn't available yet at boot time, since the decrypted home directory isn't mounted yet. The decrypted home directory can't be mounted until you type the decryption password.

If the problem is that the key is password-protected somehow then there's just no way you can establish the tunnel before entering the password. You have two solutions:

  • Wait until the session starts to establish the tunnel. This retains the security of the setup but means that the tunnel isn't available until later. You can add the tunnel establishment to your session startup scripts.
  • Use a private key that's stored in cleartext on the disk to establish the tunnel.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .