I'd like to do backup over ssh on a server in DMZ, the backup would be executed by a backup server which can ssh to DMZ. I was thinking to use reverse ssh port forwarding with dynamic port, ie.
ssh -R 0:127.0.0.1:22 but I can't figure out how to get dynamicaly allocated port on remote which is printed in standard output of the client (backup server) session.
backupsrv$ ssh -A -M -f -N -T -R 0:127.0.0.1:22 -O forward dmzmachine Allocated port 20545 for remote forward to 127.0.0.1:22 backupsrv$ ssh dmzmachine "tar -cvzf - /path | ssh -p 20545 127.0.0.1 'tar -xzpf - -C /dest'" backupsrv$ ssh -O exit dmzmachine
The problem is how to "catch" the allocated port number, I can't figure out.
I found out there's another approach but it did not work for me either. It uses fifos and 'ProxyCommand=-' hack. See http://lists.mindrot.org/pipermail/openssh-unix-dev/2013-May/031353.html or here https://www.nico.schottelius.org/blog/openssh-6.2-add-callback-functionality-using-dynamic-remote-port-forwarding/.
I suppose it should work like this but first ssh command does not even initiate ssh connection to the server in DMZ.
backupsrv$ mkfifo fromssh tossh backupsrv$ ssh <fromssh >tossh -T -y dmzserver "ssh -y -N -T -MS/tmp/ctl -oProxyCommand=- backupsrv" & backupsrv$ /usr/sbin/sshd -i -f < $fromssh > $tossh backupsrv$ ssh dmzserver "tar -cvzf - /path | ssh -S /tmp/ctl backupsrv 'tar -xzpf - -C /dest'"
I don't want to use static ports.