I'm trying to set up an sshfs mount in fstab for persistent mounting of a network directory that has to be accessed via an ssh tunnel.

my .ssh/config looks like this:

Host A
    Hostname outer.server
    User <user>
    IdentityFile /home/<user>/.ssh/id_rsa
    ForwardAgent yes

Host B
    Hostname inner.server
    User <user>
    IdentityFile /home/<user>/.ssh/id_rsa
    ProxyCommand ssh -q A "nc %h %p"
    ForwardAgent yes

This works fine:

sshfs B:/home/<user>/ /mnt/B

In fstab this does not

sshfs#B:/home/<user>/    /mnt/B      fuse.sshfs      defaults,idmap=user,allow_other,reconnect,_netdev,users 0       0

and, when mount -a is run after updating fstab to put the changes into effect returns:

read: Connection reset by peer

I'd welcome any suggestions as to why the fstab version might not be working.

  • I suspect maybe mounting from fstab basically uses root's (and/or global) ssh config to actually connect, regardless of other user-related options. I cannot confirm at the moment. The config you pasted is your regular user's config, right? Make the relevant fragment applicable to ssh initiated by root. Any progress? Oct 18 '19 at 12:40
  • Thanks for the suggestion. Assuming placing a copy of ~/.ssh/config in /.ssh/config should mean root initiated ssh commands have the same ssh tunnel set up as my user, this does not appear to have made any difference. Oct 18 '19 at 14:07
  • Does sshfs B:/home/<user>/ /mnt/B work as the normal user and also as root? Oct 18 '19 at 14:28
  • No sudo sshfs B:/home/<user>/ /mnt/B is also giving me connection reset error. I'm using absolute paths for everything so there shouldn't be any ~ user vs root home issues. So maybe setting /.ssh/config is not affecting the root ssh - if not I don't know how to change the ssh config for the root user... Oct 18 '19 at 15:14

The root does not see your per-user ssh configuration file. You need to place it in the root home directory (/root/) or into the system-wide configuration file in /etc/ssh/ssh_config, assuming the authentication key is not encrypted (does not have passphrase).

You can also save a lot of trouble by throwing away the netcat and using the -W switch for IO forwarding directly in SSH or if you have new-enough OpenSSH, you can use just the ProxyJump option (see the manual for details).

And remove also the ForwardAgent yes. You do not need it for anything and it is just exposing your private keys to the server.

  • Thanks - forgot root's home was /root and not just in / when I set up the .ssh/config duh! I also had to drop the sshfs# from the beginning of my fstab lines for it to work. Oct 18 '19 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.