I am using autossh with remote port forwarding from VPS to Raspberry PI in order to be able to access the PI from anywhere on the Internet, but it works only once.
I have a Raspberry PI 2 (Raspbian, fresh install, to make sure I could reproduce the issue) in my local network, and I'd like to access it from the internet using remote port forwarding (forward some port of VPS to PI port 22, so that, from the VPS, I can ssh to localhost to access the PI). This works, however, I will not have physical or local access to the PI for weeks, as I'll be away, and I'd like to automate the persistent autossh connection using crontab (autossh remote-port-forwarding command being run during boot, so that I can connect to the PI even if there is a power outage). Using autossh manually works, however, when using crontab, issues arise, those are the steps that I used:
Before crontab, trying if the autossh command works (This command is run from the PI, and it involves remote port forwarding to the VPS, so that port 7997 of the VPS is forwarded to port 22 of the PI)
0) /usr/bin/autossh -4 -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -i path/to/private/key -R 7997:localhost:22 username@ip-address-of-vps
(Now, from the VPS, I connect to the PI)
1) ssh pi@localhost -p 7997 The authenticity of host 'x.x.x.x' can't be established. ECDSA key fingerprint is x Are you sure you want to continue connecting (yes/no)? yesa Please type 'yes' or 'no': yes)
This works, in fact, If done manually, (as shown with steps 0 and 1), it connects successfully.
However, issues arise when I try to make the ssh connection persistent across reboots:
Typed "crontab -e" from the PI, and inserted:
2) @reboot sleep 30; /usr/bin/autossh -4 -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -i path/to/private/key -R 7997:localhost:22 username@ip-address-of-vps 3) sudo reboot
Wait 1-2 minutes, and from the VPS, typed:
4) ssh pi@localhost -p 7997
After successfully connecting to the PI, I type (from the PI)
5) sudo reboot (again) 6) ssh pi@localhost -p 7997 (again from the VPS, after waiting 1-2 minutes)
This time, I get an error:
username@vps:~$ ssh pi@localhost -p 7997 ssh_exchange_identification: read: Connection reset by peer username@vps:~$ ssh pi@localhost -p 7997 ssh: connect to host localhost port 7997: Connection refused username@vps:~$ ssh pi@localhost -p 7997 ssh: connect to host localhost port 7997: Connection refused
Additional observation: If, at this point, I ssh to the PI locally (from my local network), then manually run autossh (as shown in step 0), then ssh to the PI from the VPS as shown in step 1, it connects, and if I reboot the PI after that it still connects again (from the VPS), but if I reboot again after that, it shows "Connection reset by peer" output, followed by "connection refused" outputs. I can repeat this indefinitely, run autossh manually, then connect form VPS, it works, reboot, it works, reboot again, Connection reset by peer.
Additional observation 2: This is the relevant output of /var/log/auth of my VPS
Oct 30 01:27:20 vps sshd: Accepted publickey for username from x.x.x.x port 43008 ssh2: RSA SHA256:xxxxetc Oct 30 01:27:20 vps sshd: pam_unix(sshd:session): session opened for user username by (uid=0) Oct 30 01:27:20 vps sshd: error: bind: Address already in use Oct 30 01:27:20 vps sshd: error: channel_setup_fwd_listener_tcpip: cannot listen to port: 7997
What can I do to solve this?
What worked was editing /etc/ssh/sshd_config on the server side
ClientAliveInterval 60 ClientAliveCountMax 1
Specific values depend on how you want it to behave. And rebooting both server and client. You might also consider uninstalling fail2ban before this (if you have it installed), and reinstalling it after you confirmed you can reboot your client machine and it works even after multiple reboots, because fail2ban has likely banned the IP of the client machine from the previous attempts.