How-to: Establish stable SSH Tunnels with autossh

[fschneider]

Establish stable SSH Tunnels with autossh

Intro

It is possible that the univention support is asking you to open a SSH Tunnel for a direct investigation by the univention staff as we describe in our Knowledge-Base.

As common SSH-Tunnels are not 100% stable but might close during long inactivity, temporary network outages or also reboots of the corresponding tunnel server it’s recommended to setup some way of retry mechanism if they should remain open for longer, or repeated outages are noticed.

This article will cover the required steps of setting up autossh for that purpose.

Starting Point

If a SSH-Tunnel is requested from the univention support, it will commonly contain a line by the following pattern:

root@ucs:~# screen ssh -o PubkeyAuthentication=no -o "ServerAliveInterval 10" -R4321:localhost:22 -N univention@tunnel.univention.de
Password: dummy1234

We can evaluate these values for the following example as follows:

Username: univention
Port: 4321

Step 1 Create and Upload the SSH Key

1. Create a new SSH Key (if not already present), without a password

   ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_univention -C "root@$(hostname -f)"
   

2. Upload the public key
   The Univention Support will deploy the created SSH key for you to the corresponding account. To do so, please just provide them with the content of ~/.ssh/id_ed25519_univention.pub (or the corresponding public key)

Step 2 Connect via autossh

1. If not done already, autossh can be installed from the official Univention-Repository:

   univention-install autossh
   

2. Now you can simply establish the autossh connection filling out the blanks using the following command:

   $ screen autossh -o "ServerAliveInterval 10" -R${PORT?}:localhost:22 -N ${USERNAME?}@tunnel.univention.de -i ~/.ssh/id_ed25519_univention
   Debian GNU/Linux 11
   Connection to tunnel.univention.de closed by remote host.
   Debian GNU/Linux 11
   

3. Afterwards you can leave the screen window using CTRL + A → D. If the session should be terminated, you can do that be entering screen using screen -x, terminating the autossh process using CTRL + C.

Step 3 Tell the Univention Support

Now everything is ready and you can let us know. Please also keep the remaining instructions from the mail in mind, for instance the required ssh-key set on the host or a password for the connection.