5
----------         /|                      /|             ------------
|  Home  |        | |                     | |             |    Work   |
|        |--------| |---------------------| |-------------|           |
|ssh-serv|   Firewall:Port-22=open     Firewall           |           |
----------        | |                     | |             ------------
                  |/                      |/

Here is the scenario for the above picture:

A worker has access at his Work machine and has also set up a Home ssh server. The worker wants to access his Work machine from his PC@Home but the policy of the company restricts access via the Firewall@Work, but allows him to connect via reverse ssh tunnel. So the worker gives the following command from his workstation@Work :

ssh -fN -R 19999:localhost:22 Home-user@Home

Now from his PC@Home he is able to give the following command and connect to the ssh server of his workstation@Work:

ssh -v Work-user@localhost -p 19999

Is it possible for the worker to use rsync to copy a directory from his PC@Home to his workstation@Work using the existing tunnel?

  • 2
    Since the port 22 is open on the home server, the worker can just use rsync over SSH and use it as usual without any port forwarding or am I misunderstanding the problem here? – Marco Jul 19 '13 at 19:56
  • Is SSH out allowed through the firewall? – Karlson Jul 19 '13 at 19:58
  • @Karlson I suppose you mean out from the workstation.Yes it is allowed. – Vaios Argiropoulos Jul 19 '13 at 20:00
  • @Marco Which command would do that? – Vaios Argiropoulos Jul 19 '13 at 20:03
  • 2
    @VaiosArgiropoulos Did you try rsync username@homeserver.com:/directory /destination/ from the work computer? – Marco Jul 19 '13 at 20:09
6

I think the feature you're looking for is called connection sharing. Add this to your $HOME/.ssh/config file:

ControlMaster auto
ControlPath /tmp/ssh_mux_%h_%p_%r

excerpt #1 from SSH Can Do That? Productivity Tips for Working with Remote Servers

Fortunately OpenSSH has a feature which makes it much snappier to get another terminal on a server you’re already connected to: connection sharing.

excerpt #2

Shared connections aren’t just a boon with multiple terminal windows; they also make copying files to and from remote servers a breeze. If you SSH to a server and then use the scp command to copy a file to it, scp will make use of your existing SSH connection ‒ ... Connections are also shared with rsync, git, and any other command which uses SSH for connection.

References

  • Investigating now.... – Vaios Argiropoulos Jul 19 '13 at 20:07
  • Marco in the comments above was right. I just didn't know that you could rsync from remote to local. I though it was only from local to remote. – Vaios Argiropoulos Jul 19 '13 at 20:33
  • You gave me food for thought with your post. Thanks – Vaios Argiropoulos Jul 19 '13 at 20:35
  • @VaiosArgiropoulos - NP, glad you got a solution, good luck. – slm Jul 19 '13 at 20:38
2

You can control the ssh command (strictly speaking, the rsh command even though the default is ssh these days) that rsync uses in two ways.

  • Set RSYNC_RSH environment variable
  • By passing the -e flag

You can set either of those to all of the flags you'll need for ssh to connect.

By environment variable:

home$ RSYNC_RSH="ssh -p 19999"
home$ rsync somelocalfile Work-user@localhost:~

By -e flag:

home$ rsync -e "ssh -p 19999" somelocalfile Work-user@localhost:~
2

The easy way to deal with complex SSH setups such as tunnels is to create an alias in your ~/.ssh/config file. For example, if you've determined that ssh -fN -R 19999:localhost:22 Home-user@Home works to create a tunnel and ssh -v Work-user@localhost -p 19999 works to use it, then make aliases for these:

Host work-tunnel
Hostname Home
Username Home-user
RemoteForward 19999 localhost:22

Host workstation
Hostname localhost
Username Work-user
Port 19999

Then run ssh -fN work-tunnel to establish the tunnel, and use ssh workstation to log into the workstation.

As far as other applications are concerned, workstation is a host like any other that you connect to with SSH. They don't care what SSH is doing under the hood. So you can use them as usual. For example, rsync somefile workstation:somedir will copy a file to the workstation.

0

yes, as the worker is taking access through port 22 of ssh so SSH out and in is allowed through the firewall. You can check whether there is no policy written for ssh in your firewall access-list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.