9

I have a PC behind a NAT which makes a reverse SSH connection to my Digitalocean VPC. I utilise this reversed SSH connection from home to login to my office PC (I am authorised to do so) and copy files and do other important things.

Although not often, I noticed that my office PC restarts (due to power failures etc) and breaks the reversed SSH connection it has made with my VPC. In these kind of cases, I am unable to connect from my home PC to my office PC.

I run the following script to make the reversed connection + dynamic proxy to anonymise my traffic ( As I am not required to share browsing information) generated at the office PC.

autossh -CD 8080 -i digitalOcean -R 8081:localhost:22 root@IPofDigitalOceanPC

There is no way I can run thsi script again on my office PC upon a restart as I am not physically there. In order to solve this problem I installed the following crontab.

Note: rev.sh file contains the above line. The certificate "digitalOcean" and rev.sh is located in Ubuntu home. Therefore, when I execute ./rev.sh in my Ubuntu terminal I obtain a dynamic proxy and also access to ym DigitalOcean server. This method works 100%.

However when I install the chrontab in the following method, My ubuntu PC never makes a Dynamic proxy. I can see this because when I check this proxy from Google Chrome, it says proxy is refusing connection.

Here are the cronejobs I tried as roots cronejobs. I also tried these as a normal user, still they didn't work.

@reboot bash /home/user/rev.sh 
@reboot /home/user/rev.sh 
@reboot cd /home/user && ./rev.sh

I then installed a chrontab a several minutes before the current time and waited for it to execute.

24 12 8 * * * bash /home/user/rev.sh
24 12 8 * * * /home/user/rev.sh

these did not execute either.

Please be kind enough to help me spot my mistake. There are many similar questions on this website on my issue. I have referred many answers hence but none of them seemed to help.

  • I'm not quite sure what is your problem here. Is it cron not starting any job? Or script not working? With both problems, please, consult logs. Cron should write somewhere to /var/log/cron*. For test purposes you could simply write something like */2 * * * * /path/to/script - it will run a script every 2 minutes. Also check for mails for user running cron. Is it root? Use mail command. Oh, I can see that you are using ssh key? I doubt that cron job will be able to find it if you won't give a full path to it after -i switch. – Kalavan Nov 22 '16 at 11:06
8

I'm not sure if using cron to run a script on startup is such a good idea. An alternative I see more fit is to create a SystemD service, as described here. Create a file named /etc/systemd/system/autossh.service:

[Unit]
Description=Auto Reverse SSH
Requires=systemd-networkd-wait-online.service
After=systemd-networkd-wait-online.service
[Service]
ExecStart=/full/path/to/autossh -CD 8080 -i digitalOcean -R 8081:localhost:22 root@IPofDigitalOceanPC
[Install]
WantedBy=multi-user.target

Then run the following command as root:

systemctl enable autossh.service
1

A couple of things you can try:

chmod +x rev.sh

Sometimes your path isn't fully set at boot time or through cronjobs, so replace autossh with the full path, on my system that is

/usr/bin/autossh

@reboot motif depends on the cron daemon startup time, therefore it may be invoked before other subsystems (network?) are up and running

And your crontab example:

24 12 8 * * * bash /home/user/rev.sh

will only invoke on the 8th of every month. And it has an extra field. Try

24 12 * * * /home/user/rev.sh
  • sorry it was a mistake. I did try '24 12 * * * /home/user/rev.sh' but it still ddidnt work. To my surprise not even '24 12 * * * reboot' worked. – Denis Nov 17 '16 at 8:56
  • 1
    Well reboot certainly wont work unless you're invoking as root. – slowko Nov 17 '16 at 9:00
  • I tried adding /usr/bin/autossh. It did not work. – Denis Nov 17 '16 at 9:01
  • I tried 24 12 8 * * * reboot in the roots crontab. It did not work. Does it work on yours? – Denis Nov 17 '16 at 9:02
  • /usr/bin is always in the default PATH, even for cron – roaima Nov 21 '16 at 8:45
1

It seems to be, that when the script is executed via crontab it can't find your certificate.

When you as user execute the script, it uses the certificate from /home/ubuntu-user/.ssh/... However when the script is executed from crontab it runs as root. root takes the certificats from /root/.ssh

So you have multiple ways to make it work, but I think running the script as ubuntu-user in crontab does it.

Edit:

make sure to provide a full qualified path for the certificate

1

Try using su:

su -l user -c /home/user/rev.sh

Will it help with your issue?

0

since the question doesn't have so much data in it, I'll start from scratch with what I would do

I would put all the configurations in /etc/ssh/ssh_config:

 Host mytunnel
    HostName      IPofDigitalOcean
    User          root     # Are you sure about this??
    IdentityFile  /etc/ssh/mytunnel_key
    RemoteForward 8081 localhost:22
    DynamicForward 8080

I would put the key in /etc/ssh/mytunnel_key

then I would try with a cron entry (an upstart/systemd service would be better) like this:

@reboot /usr/bin/autossh -f -M 0 -T -N mytunnel
0

You need to use -f and run a command when you run without a terminal. So here's an example:

autossh -M 12374 \
-R 2205:127.0.0.1:22 \
-p 2200 \
-f \
user@www.hostname.com \
sleep 31536000

-f places it in the background, but placing it in the background means that ssh will connect, then disconnect as soon as it's completed its task. So you need a task.

sleep 31536000 tells ssh to run "sleep" for 1 year after connecting. During this time, your tunnels will remain up.

If you do not run a command, ssh will connect, setup the reverse tunnel on port 2205, and when it's done with that, it will exit. Using autossh, if the connection fails, it will reconnect and restart the sleep again. Even with a really stable internet connection, I doubt a year is possible.

BTW - unlike these other jokers, I know this works, since I actually tested it because of course I'm doing something similar and since I have it working now, very reliably, I can give you the correct answer.

-f and "command"

That's what you're missing.

  • 1
    I don't think we need to call other people names here. – Jeff Schaller Feb 13 '19 at 23:41
  • 1
    I'm not calling other people names. I'm pointing out the solutions that were suggested previously were never tried by the people who suggested them. Don't believe me? Try them. – Jimminy Doe Feb 14 '19 at 0:46
  • 1
    I don't think you've addressed the point of the question, either -- the OP claims This method works 100%. I believe their question centers around running their script in an automated way after their PC restarts. – Jeff Schaller Feb 14 '19 at 1:32
  • 1
    If he's at work, he can setup the reverse tunnels to home, because the OP is running in a terminal - THAT works 100% of the time. The ssh (and autossh) programs act differently if they do not have a terminal associated with the process. He had problems having crontab (which runs without a terminal) reconnect the tunnels, precisely because he's not using -f, and even if he was, the ssh would exit once the tunnels were setup, without running something - in my case, I go run sleep, for a year. In the script -f must be used WITH A COMMAND that prevents SSH from exiting. That's his problem. – Jimminy Doe Feb 14 '19 at 2:34
  • 1
    I suppose it was you, Jeff Schaller, for giving me a downvote, for giving the correct solution and actually testing it. I'm basically doing the same exact setup he is, except I'm setting up a PI to go through a firewall, and startup rdesktop, and giving it to our office manager, who doesn't know anything about Linux, to use it. Pretty certain I have a bulletproof solution, since I'm using it now, and I've rebooted both my pi remotely, and my local cable modem - just to be safe.. But heck, don't let a correct answer get in the way of an overblown, unearned, ego. – Jimminy Doe Feb 14 '19 at 5:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.