I need to SSH to a computer that is behind a NAT. To this end a reverse SSH tunnel from that computer (with SSH server installed) is established to my publicly visible server (
ssh -f -N -T -R 9999:localhost:22 -p 7777 firstname.lastname@example.org
Now in order for me to get to that computer from any place I do:
ssh -J email@example.com:7777 -p 9999 user_behind_NAT@localhost
- I need to keep this tunnel alive for days or even weeks. I've heard about two ways to achieve this:
-o TCPKeepAlive=yestogether with above mentioned options
What is the difference between those two options? Which is better for which situation? Does it make sense to use both?
- As the sysadmin of
middleman.example.orgI don't want to trust this user behind a NAT and would like to limit the account
mmas tough as possible. In the best case I would like to disable both interactive shell and even sftp, allowing only establishing reverse SSH connections (I myself will use my regular account to "jump" into the reverse tunnel). Is this possible somehow?