2

I setup a new Ubuntu 14.04.4 server to replace a 12.04 machine, but the new server is having problems with the old ssh config. I can ssh without the config, and can even ssh through a bastion server with no problem from the command line. For example,

ssh -o ProxyCommand="ssh -W %h:%p bastion.my.company.com" lab123.my.company.com

But if I create a /home/myname/.ssh/config file with the following settings, I'm having problems.

ServerAliveInterval 150
ServerAliveCountMax 6

ControlMaster auto
ControlPath /tmp/ssh_%h_%p_%r

Host *.my.company.com
User   myname
IdentityFile /home/myname/.ssh/mykey.pem
ProxyCommand ssh bastion -W %h:%p
ForwardAgent yes

Host bastion
Hostname        bastion.my.company.com
User            myname
IdentityFile    /home/myname/.ssh/mykey.pem

When I try to use ssh with the config above, I get hundreds of ssh processes like the following:

myname 29855 29854  0 12:24 pts/6    00:00:00 ssh bastion -W bastion.my.company.com:22
myname 29856 29855  0 12:24 pts/6    00:00:00 ssh bastion -W bastion.my.company.com:22
myname 29857 29856  0 12:24 pts/6    00:00:00 ssh bastion -W bastion.my.company.com:22
myname 29858 29857  0 12:24 pts/6    00:00:00 ssh bastion -W bastion.my.company.com:22

ssh just hangs until I hit Ctrl + C, and then all the ssh processes die.

A trace of the last few lines of every processes looks like:

....
write(4, "SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2"..., 43) = 43
read(5, 0xbfe08efc, 1)                  = ? ERESTARTSYS (To be restarted if SA_RESTART is set)
--- SIGINT {si_signo=SIGINT, si_code=SI_KERNEL} ---
+++ killed by SIGINT +++

A look further up in the trace shows the file handles are from the following:

...
socket(PF_LOCAL, SOCK_STREAM, 0)        = 3
connect(3, {sa_family=AF_LOCAL, sun_path="/tmp/ssh_bastion.my.company.com_22_myname"}, 57) = -1 ENOENT (No such file or directory)
close(3)                                = 0
pipe([3, 4])                            = 0
pipe([5, 6])                            = 0
..

It seems strange that there's no socket file in /tmp, and there's no bind in the trace.

4
  • Have you tried excluding bastion.my.company.com from the wildcard host match e.g. Host *.my.company.com !bastion.my.company.com as described here Stop ssh config on first match Oct 15, 2016 at 21:29
  • I also tried changing "ControlPath /tmp/ssh_%h_%p_%r" to "ControlPath /tmp/ssh_control_socket" incase it didn't like some character in one of the variables. I don't understand why it's not creating the socket..
    – Joe
    Oct 15, 2016 at 22:35
  • And ssh -v says?
    – waltinator
    Oct 16, 2016 at 1:15
  • The solution was your first suggestion to exclude bastion from Host - *.my.company.com !bastion.my.company.com Thank you!!!!
    – Joe
    Oct 17, 2016 at 16:03

2 Answers 2

1

The solution was provided in a comment by steeldriver, whom suggested I exclude bastion.my.company.com from the wildcard host match.

For example,

ServerAliveInterval 150
ServerAliveCountMax 6

ControlMaster auto
ControlPath /tmp/ssh_%h_%p_%r

Host *.my.company.com !bastion.my.company.com
User   myname
IdentityFile /home/myname/.ssh/mykey.pem
ProxyCommand ssh bastion -W %h:%p
ForwardAgent yes

Host bastion
Hostname        bastion.my.company.com
User            myname
IdentityFile    /home/myname/.ssh/mykey.pem
0

ControlPath /tmp/ssh_%h_%p_%r

This is pretty bad idea to put your Control sockets into the "public-accessible" /tmp. It should be in some safe directory, where no other users can access.

The behavior looks like there was changed default of CanonicalizeHostname. What does this option defaults to in your system? Try to disable it: CanonicalizeHostname no.

Setting LogLevel DEBUG3 is also good start with debugging problems with ssh. Can you set this option in you configuration and post the logs?

1
  • Thanks for the suggestions, but today I was able to get ssh working by excluding bastion.my.company.com from the wildcard host match. My original change to the config file was wrong, so it didn't work (wondering if I should remove the comment from yesterday).
    – Joe
    Oct 17, 2016 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .