5 ms·
This is a pretty old school method for using a master connection. Now-a-days, if you don't like screen for some reason, you can still do much better by using th
by DEinspanjer 17y ago
This is a pretty old school method for using a master connection.
Now-a-days, if you don't like screen for some reason, you can still do much better by using the ssh ControlMaster feature. This allows you to have an SSH session open up a socket that allows subsequent connections to that machine to re-use the secure communication channel.
That said, fanout can still be a useful utility.
I should make a blog post detailing my setup, but for now, I'll share the critical pieces:
In my local .ssh/config:
==========
Host vpn
ForwardAgent=yes
ProxyCommand none
ControlMaster auto
ControlPath=~/.ssh/%r@%h:%p
HostName myvpn.domain.com
Host dest??
ProxyCommand ssh vpn 'nc -w 60 %h.internal.domain.com %p'
==========
Then, if I ssh to any dest machine like dest01 or dest05, the first one will create the connection to the vpn jumphost, and all the subsequent ones will reuse that connection.
- spudlyo 17y agoThe ControlMaster is a great feature. We use SSH as a mechanism for running remote monitoring plugins in Nagios, using the ControlMaster socket socket saves us a lot of crypto overhead.
- fragmede 17y agoAn alternative to ProxyCommand is ssh -t, as in "ssh -t gateway ssh inside_machine". ControlMaster is definitely the way to go for the original problem w/ the OTP setup. "ssh -t" is usable on arbitrary terminals for places where gateway is password accessible (and handy when you have to pay per static public IP).
- DEinspanjer 17y agoThanks for the tip. I fought with ssh -t before and just couldn't get it working in my example above. I'm trying again now. Maybe what needs to happen is I need to give up on having my ssh_config as the central location defining my aliases and instead use bash aliases to give me the short name connect.