1

I am using autossh with remote port forwarding from VPS to Raspberry PI in order to be able to access the PI from anywhere on the Internet, but it works only once.

I have a Raspberry PI 2 (Raspbian, fresh install, to make sure I could reproduce the issue) in my local network, and I'd like to access it from the internet using remote port forwarding (forward some port of VPS to PI port 22, so that, from the VPS, I can ssh to localhost to access the PI). This works, however, I will not have physical or local access to the PI for weeks, as I'll be away, and I'd like to automate the persistent autossh connection using crontab (autossh remote-port-forwarding command being run during boot, so that I can connect to the PI even if there is a power outage). Using autossh manually works, however, when using crontab, issues arise, those are the steps that I used:

Before crontab, trying if the autossh command works (This command is run from the PI, and it involves remote port forwarding to the VPS, so that port 7997 of the VPS is forwarded to port 22 of the PI)

0) /usr/bin/autossh -4 -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -i path/to/private/key -R 7997:localhost:22 username@ip-address-of-vps

(Now, from the VPS, I connect to the PI)

1) ssh pi@localhost -p 7997 

The authenticity of host 'x.x.x.x' can't be established.
ECDSA key fingerprint is x
Are you sure you want to continue connecting (yes/no)? yesa
Please type 'yes' or 'no': yes)

This works, in fact, If done manually, (as shown with steps 0 and 1), it connects successfully.

However, issues arise when I try to make the ssh connection persistent across reboots:

Typed "crontab -e" from the PI, and inserted:

2) @reboot sleep 30; /usr/bin/autossh -4 -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -i path/to/private/key -R 7997:localhost:22 username@ip-address-of-vps

3) sudo reboot

Wait 1-2 minutes, and from the VPS, typed:

4) ssh pi@localhost -p 7997

After successfully connecting to the PI, I type (from the PI)

5) sudo reboot (again)

6) ssh pi@localhost -p 7997 (again from the VPS, after waiting 1-2 minutes)

This time, I get an error:

username@vps:~$ ssh pi@localhost -p 7997
ssh_exchange_identification: read: Connection reset by peer
username@vps:~$ ssh pi@localhost -p 7997
ssh: connect to host localhost port 7997: Connection refused
username@vps:~$ ssh pi@localhost -p 7997
ssh: connect to host localhost port 7997: Connection refused

Additional observation: If, at this point, I ssh to the PI locally (from my local network), then manually run autossh (as shown in step 0), then ssh to the PI from the VPS as shown in step 1, it connects, and if I reboot the PI after that it still connects again (from the VPS), but if I reboot again after that, it shows "Connection reset by peer" output, followed by "connection refused" outputs. I can repeat this indefinitely, run autossh manually, then connect form VPS, it works, reboot, it works, reboot again, Connection reset by peer.

Additional observation 2: This is the relevant output of /var/log/auth of my VPS

Oct 30 01:27:20 vps sshd[1217]: Accepted publickey for username from x.x.x.x port 43008 ssh2: RSA SHA256:xxxxetc 
Oct 30 01:27:20 vps sshd[1217]: pam_unix(sshd:session): session opened for user username by (uid=0) 
Oct 30 01:27:20 vps sshd[1223]: error: bind: Address already in use 
Oct 30 01:27:20 vps sshd[1223]: error: channel_setup_fwd_listener_tcpip: cannot listen to port: 7997

What can I do to solve this?

UPDATE:

What worked was editing /etc/ssh/sshd_config on the server side

ClientAliveInterval 60
ClientAliveCountMax 1

Specific values depend on how you want it to behave. And rebooting both server and client. You might also consider uninstalling fail2ban before this (if you have it installed), and reinstalling it after you confirmed you can reboot your client machine and it works even after multiple reboots, because fail2ban has likely banned the IP of the client machine from the previous attempts.

1

UPDATE:

What worked was editing /etc/ssh/sshd_config on the server side

ClientAliveInterval 60
ClientAliveCountMax 1

Specific values depend on how you want it to behave. And rebooting both server and client. You might also consider uninstalling fail2ban before this (if you have it installed), and reinstalling it after you confirmed you can reboot your client machine and it works even after multiple reboots, because fail2ban has likely banned the IP of the client machine from the previous attempts.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.