Vas*_*pov 7 ssh ssh-tunneling sshd
我在多个不可靠的互联网连接后面有一个 ssh 客户端机器picard - 全部使用 NAT。
我有我的服务器时间，可靠的静态 IP。我希望能够访问皮卡德thorugh时间。我以前做过这个：
$ ssh -N -R 19999:localhost:22 user@my.domain
这有效，但如果出现问题，它会退出并且不会重新启动，并且不会在启动时启动，所以现在我添加一个 systemd 服务来运行：
/bin/bash -c "while true; do /usr/bin/ssh -i <unencrypted key> \
-o ServerAliveInterval=10 -v -o ServerAliveCountMax=6 -N \
-R 19999:localhost:22 user@my.domain; sleep 5; done"`
while true ... sleep 5 # re-runs ssh if it exits
-o ServerAliveInterval=10 每 10 秒发送一次 keep-alive-o ServerAliveCountMax=6 如果 6 个 keep-alive 没有响应就退出-v/var/log/messages通过 systemd保留调试信息在服务器端，我添加了几行sshd_config：
KeepAlive yes
ClientAliveInterval 10
ClientAliveCountMax 6
与客户端相同的想法 - 在 60 秒不活动后断开连接。
不幸的是，重新启动似乎需要一分钟以上的时间：
< tunnel is up and keepalives are coming in >
Jun 7 17:31:02 picard bash[135]: debug1: client_input_global_request: rtype keepalive@openssh.com want_reply 1
Jun 7 17:31:12 picard bash[135]: debug1: client_input_global_request: rtype keepalive@openssh.com want_reply 1
Jun 7 17:31:15 picard bash[135]: debug1: client_input_channel_open: ctype forwarded-tcpip rchan 2 win 2097152 max 32768
Jun 7 17:31:15 picard bash[135]: debug1: client_request_forwarded_tcpip: listen localhost port 19998, originator 127.0.0.1 port 38267
Jun 7 17:31:15 picard bash[135]: debug1: connect_next: host localhost ([127.0.0.1]:22) in progress, fd=4
Jun 7 17:31:15 picard bash[135]: debug1: channel 0: new [127.0.0.1]
Jun 7 17:31:15 picard bash[135]: debug1: confirm forwarded-tcpip
Jun 7 17:31:15 picard bash[135]: debug1: channel 0: connected to localhost port 22
Jun 7 17:31:20 picard systemd-logind[137]: New session 1 of user main_username.
< I break eth0 and plug it back in after NM sees it's down >
< eth0 is back up within a few seconds >
< nothing happens with my ssh connection for a LONG time >
Jun 7 17:54:16 picard bash[135]: Write failed: Broken pipe
Jun 7 17:54:22 picard bash[135]: OpenSSH_6.1p1, OpenSSL 1.0.1c-fips 10 May 2012
Jun 7 17:54:22 picard bash[135]: debug1: Reading configuration data /etc/ssh/ssh_config
Jun 7 17:54:22 picard bash[135]: debug1: /etc/ssh/ssh_config line 50: Applying options for *
Jun 7 17:54:22 picard bash[135]: debug1: Connecting to my.domain [123.234.123.234] port 22.
Jun 7 17:54:22 picard bash[135]: debug1: Connection established.
Jun 7 17:54:23 picard bash[135]: debug1: identity file /home/test/.ssh/id_rsa type 1
Jun 7 17:54:23 picard bash[135]: debug1: identity file /home/test/.ssh/id_rsa-cert type -1
Jun 7 17:54:23 picard bash[135]: debug1: Remote protocol version 2.0, remote software version OpenSSH_5.8p1 Debian-1ubuntu3
Jun 7 17:54:23 picard bash[135]: debug1: match: OpenSSH_5.8p1 Debian-1ubuntu3 pat OpenSSH_5*
Jun 7 17:54:23 picard bash[135]: debug1: Enabling compatibility mode for protocol 2.0
Jun 7 17:54:23 picard bash[135]: debug1: Local version string SSH-2.0-OpenSSH_6.1
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_KEXINIT sent
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_KEXINIT received
Jun 7 17:54:23 picard bash[135]: debug1: kex: server->client aes128-ctr hmac-md5 none
Jun 7 17:54:23 picard bash[135]: debug1: kex: client->server aes128-ctr hmac-md5 none
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
Jun 7 17:54:23 picard bash[135]: debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
Jun 7 17:54:23 picard bash[135]: debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
Jun 7 17:54:23 picard bash[135]: debug1: Server host key: RSA 7a:19:72:9d:f5:39:f5:03:cf:16:b2:ee:fc:a4:e6:ba
Jun 7 17:54:23 picard bash[135]: debug1: Host 'my.domain' is known and matches the RSA host key.
Jun 7 17:54:23 picard bash[135]: debug1: Found key in /home/test/.ssh/known_hosts:1
Jun 7 17:54:23 picard bash[135]: debug1: ssh_rsa_verify: signature correct
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_NEWKEYS sent
Jun 7 17:54:23 picard bash[135]: debug1: expecting SSH2_MSG_NEWKEYS
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_NEWKEYS received
Jun 7 17:54:23 picard bash[135]: debug1: Roaming not allowed by server
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_SERVICE_REQUEST sent
Jun 7 17:54:23 picard bash[135]: debug1: SSH2_MSG_SERVICE_ACCEPT received
Jun 7 17:54:23 picard bash[135]: debug1: Authentications that can continue: publickey,password
Jun 7 17:54:23 picard bash[135]: debug1: Next authentication method: publickey
Jun 7 17:54:23 picard bash[135]: debug1: Offering RSA public key: /home/test/.ssh/id_rsa
Jun 7 17:54:23 picard bash[135]: debug1: Server accepts key: pkalg ssh-rsa blen 279
Jun 7 17:54:23 picard bash[135]: debug1: read PEM private key done: type RSA
Jun 7 17:54:24 picard bash[135]: debug1: Authentication succeeded (publickey).
Jun 7 17:54:24 picard bash[135]: Authenticated to my.domain ([123.234.123.234]:22).
Jun 7 17:54:24 picard bash[135]: debug1: Remote connections from LOCALHOST:19999 forwarded to local address localhost:22
Jun 7 17:54:24 picard bash[135]: debug1: Requesting no-more-sessions@openssh.com
Jun 7 17:54:24 picard bash[135]: debug1: Entering interactive session.
Jun 7 17:54:24 picard bash[135]: debug1: remote forward success for: listen 19999, connect localhost:22
Jun 7 17:54:24 picard bash[135]: debug1: All remote forwarding requests processed
Jun 7 17:54:44 picard bash[135]: debug1: client_input_global_request: rtype keepalive@openssh.com want_reply 1
Jun 7 17:54:45 picard bash[135]: debug1: client_input_channel_open: ctype forwarded-tcpip rchan 2 win 2097152 max 32768
Jun 7 17:54:45 picard bash[135]: debug1: client_request_forwarded_tcpip: listen localhost port 19999, originator 127.0.0.1 port 60222
Jun 7 17:54:45 picard bash[135]: debug1: connect_next: host localhost ([127.0.0.1]:22) in progress, fd=4
Jun 7 17:54:45 picard bash[135]: debug1: channel 0: new [127.0.0.1]
Jun 7 17:54:45 picard bash[135]: debug1: confirm forwarded-tcpip
Jun 7 17:54:45 picard bash[135]: debug1: channel 0: connected to localhost port 22
Jun 7 17:54:50 picard systemd-logind[137]: New session 3 of user main_username.
< whenever I connect the keepalive debug messages stop coming, not sure if this is normal >
我确定我忽略了一些东西。我已经看到一些这样的项目和autossh我现在正在做的事情几乎一样，但如果可能的话，我希望能够解决这个问题。如何将延迟减少到 2-3 分钟而不是 23 分钟？
如果您使用类似工具autossh来维护 ssh 连接会怎么样？我使用autossh来维护笔记本电脑上的 smtp（端口 25）和 imap（端口 143）通过互联网上的服务器打开，后面有多个服务器通过 NAT 访问互联网。
smtp (25)
__ _
[__]|=|
/::/|_|
laptop .-,( ),-. Ext. Host Int. Host ^
(22) .-( )-. (22) (22) |
__ _ ---->( internet )----> __ _ -----> __ _ ------.
[__]|=| '-( ).-' [__]|=| [__]|=| |
/::/|_| '-.( ).-' /::/|_| /::/|_| v
imap (143)
__ _
[__]|=|
/::/|_|
通过上述设置，我使用以下autossh命令在我的笔记本电脑上进行设置：
autossh -M 0 -f -N -L 2025:localhost:25 -L 2143:localhost:143 me@int-host
在我的$HOME/.ssh/config文件中，我设置了一个主机规则，如下所示：
Host int-host
ProxyCommand ssh me@ext-host nc int-host %p