SSH 클라이언트 시스템이 있습니다피카드신뢰할 수 없는 여러 인터넷 연결 뒤에는 모두 NAT가 있습니다.
내 서버가 있어요시간, 고정 IP를 사용하여 안정적입니다. 접근할 수 있기를 원함피카드철저한시간. 나는 전에 이것을 해본 적이 있습니다:
$ ssh -N -R 19999:localhost:22 [email protected]
이것은 작동하지만 문제가 발생하면 종료되고 다시 시작되지 않으며 부팅 시 시작되지 않으므로 이제 실행할 systemd 서비스를 추가합니다.
/bin/bash -c "while true; do /usr/bin/ssh -i <unencrypted key> \
-o ServerAliveInterval=10 -v -o ServerAliveCountMax=6 -N \
-R 19999:localhost:22 [email protected]; sleep 5; done"`
while true ... sleep 5 # re-runs ssh if it exits
-o ServerAliveInterval=1010초마다 연결 유지 보내기-o ServerAliveCountMax=66개의 Keep-alive에서 응답이 없으면 종료-v/var/log/messagessystemd를 통해 디버그 정보 보존
서버 측에서 몇 줄을 추가했습니다 sshd_config.
KeepAlive yes
ClientAliveInterval 10
ClientAliveCountMax 6
클라이언트와 동일한 아이디어 - 60초 동안 활동이 없으면 연결이 끊어집니다.
불행하게도 재부팅하는 데 1분 이상 걸리는 것 같습니다.
< tunnel is up and keepalives are coming in >
Jun 7 17:31:02 picard bash[135]: debug1: client_input_global_request: rtype [email protected] want_reply 1
Jun 7 17:31:12 picard bash[135]: debug1: client_input_global_request: rtype [email protected] want_reply 1
Jun 7 17:31:15 picard bash[135]: debug1: client_input_channel_open: ctype forwarded-tcpip rchan 2 win 2097152 max 32768
Jun 7 17:31:15 picard bash[135]: debug1: client_request_forwarded_tcpip: listen localhost port 19998, originator 127.0.0.1 port 38267
Jun 7 17:31:15 picard bash[135]: debug1: connect_next: host localhost ([127.0.0.1]:22) in progress, fd=4
Jun 7 17:31:15 picard bash[135]: debug1: channel 0: new [127.0.0.1]
Jun 7 17:31:15 picard bash[135]: debug1: confirm forwarded-tcpip
Jun 7 17:31:15 picard bash[135]: debug1: channel 0: connected to localhost port 22
Jun 7 17:31:20 picard systemd-logind[137]: New session 1 of user main_username.
< I break eth0 and plug it back in after NM sees it's down >
< eth0 is back up within a few seconds >
< nothing happens with my ssh connection for a LONG time >
Jun 7 17:54:16 picard bash[135]: Write failed: Broken pipe
Jun 7 17:54:22 picard bash[135]: OpenSSH_6.1p1, OpenSSL 1.0.1c-fips 10 May 2012
Jun 7 17:54:22 picard bash[135]: debug1: Reading configuration data /etc/ssh/ssh_config
Jun 7 17:54:22 picard bash[135]: debug1: /etc/ssh/ssh_config line 50: Applying options for *
Jun 7 17:54:22 picard bash[135]: debug1: Connecting to my.domain [123.234.123.234] port 22.
Jun 7 17:54:22 picard bash[135]: debug1: Connection established.
Jun 7 17:54:23 picard bash[135]: debug1: identity file /home/test/.ssh/id_rsa type 1
Jun 7 17:54:23 picard bash[135]: debug1: identity file /home/test/.ssh/id_rsa-cert type -1
Jun 7 17:54:23 picard bash[135]: debug1: Remote protocol version 2.0, remote software version OpenSSH_5.8p1 Debian-1ubuntu3
Jun 7 17:54:23 picard bash[135]: debug1: match: OpenSSH_5.8p1 Debian-1ubuntu3 pat OpenSSH_5*
Jun 7 17:54:23 picard bash[135]: debug1: Enabling compatibility mode for protocol 2.0
Jun 7 17:54:23 picard bash[135]: debug1: Local version string SSH-2.0-OpenSSH_6.1
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_KEXINIT sent
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_KEXINIT received
Jun 7 17:54:23 picard bash[135]: debug1: kex: server->client aes128-ctr hmac-md5 none
Jun 7 17:54:23 picard bash[135]: debug1: kex: client->server aes128-ctr hmac-md5 none
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
Jun 7 17:54:23 picard bash[135]: debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
Jun 7 17:54:23 picard bash[135]: debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
Jun 7 17:54:23 picard bash[135]: debug1: Server host key: RSA 7a:19:72:9d:f5:39:f5:03:cf:16:b2:ee:fc:a4:e6:ba
Jun 7 17:54:23 picard bash[135]: debug1: Host 'my.domain' is known and matches the RSA host key.
Jun 7 17:54:23 picard bash[135]: debug1: Found key in /home/test/.ssh/known_hosts:1
Jun 7 17:54:23 picard bash[135]: debug1: ssh_rsa_verify: signature correct
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_NEWKEYS sent
Jun 7 17:54:23 picard bash[135]: debug1: expecting SSH2_MSG_NEWKEYS
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_NEWKEYS received
Jun 7 17:54:23 picard bash[135]: debug1: Roaming not allowed by server
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_SERVICE_REQUEST sent
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_SERVICE_ACCEPT received
Jun 7 17:54:23 picard bash[135]: debug1: Authentications that can continue: publickey,password
Jun 7 17:54:23 picard bash[135]: debug1: Next authentication method: publickey
Jun 7 17:54:23 picard bash[135]: debug1: Offering RSA public key: /home/test/.ssh/id_rsa
Jun 7 17:54:23 picard bash[135]: debug1: Server accepts key: pkalg ssh-rsa blen 279
Jun 7 17:54:23 picard bash[135]: debug1: read PEM private key done: type RSA
Jun 7 17:54:24 picard bash[135]: debug1: Authentication succeeded (publickey).
Jun 7 17:54:24 picard bash[135]: Authenticated to my.domain ([123.234.123.234]:22).
Jun 7 17:54:24 picard bash[135]: debug1: Remote connections from LOCALHOST:19999 forwarded to local address localhost:22
Jun 7 17:54:24 picard bash[135]: debug1: Requesting [email protected]
Jun 7 17:54:24 picard bash[135]: debug1: Entering interactive session.
Jun 7 17:54:24 picard bash[135]: debug1: remote forward success for: listen 19999, connect localhost:22
Jun 7 17:54:24 picard bash[135]: debug1: All remote forwarding requests processed
Jun 7 17:54:44 picard bash[135]: debug1: client_input_global_request: rtype [email protected] want_reply 1
Jun 7 17:54:45 picard bash[135]: debug1: client_input_channel_open: ctype forwarded-tcpip rchan 2 win 2097152 max 32768
Jun 7 17:54:45 picard bash[135]: debug1: client_request_forwarded_tcpip: listen localhost port 19999, originator 127.0.0.1 port 60222
Jun 7 17:54:45 picard bash[135]: debug1: connect_next: host localhost ([127.0.0.1]:22) in progress, fd=4
Jun 7 17:54:45 picard bash[135]: debug1: channel 0: new [127.0.0.1]
Jun 7 17:54:45 picard bash[135]: debug1: confirm forwarded-tcpip
Jun 7 17:54:45 picard bash[135]: debug1: channel 0: connected to localhost port 22
Jun 7 17:54:50 picard systemd-logind[137]: New session 3 of user main_username.
< whenever I connect the keepalive debug messages stop coming, not sure if this is normal >
나는 뭔가를 간과하고 있다고 확신합니다. 나는 지금 하고 있는 일과 거의 같은 일을 하는 비슷한 프로젝트를 본 적이 있지만 autossh가능하다면 이 문제를 해결할 수 있었으면 좋겠습니다. 지연 시간을 23분에서 2~3분으로 어떻게 줄일 수 있나요?
답변1
autosshSSH 연결을 유지하기 위해 유사한 도구를 사용했다면 어떻게 될까요? 나는 사용한다자동 SSH인터넷상의 서버를 통해 내 노트북에서 smtp(포트 25)와 imap(포트 143)을 열어두고 그 뒤에 있는 여러 서버가 NAT를 통해 인터넷에 액세스합니다.
smtp (25)
__ _
[__]|=|
/::/|_|
laptop .-,( ),-. Ext. Host Int. Host ^
(22) .-( )-. (22) (22) |
__ _ ---->( internet )----> __ _ -----> __ _ ------.
[__]|=| '-( ).-' [__]|=| [__]|=| |
/::/|_| '-.( ).-' /::/|_| /::/|_| v
imap (143)
__ _
[__]|=|
/::/|_|
위의 설정을 사용하여 autossh다음 명령을 사용하여 랩탑에 설정했습니다.
autossh -M 0 -f -N -L 2025:localhost:25 -L 2143:localhost:143 me@int-host
내 $HOME/.ssh/config파일에서 다음과 같은 호스트 규칙을 설정했습니다.
Host int-host
ProxyCommand ssh me@ext-host nc int-host %p