☰

我的反向 ssh 隧道正在使用 keepalive，但它们没有帮助

tag-icon • tag-icon ssh ssh-tunneling sshd
我的反向 ssh 隧道正在使用 keepalive，但它们没有帮助

我有一个 ssh 客户端机器皮卡德多个不可靠的互联网连接背后 - 全部都带有 NAT。

我有我的服务器时间，具有静态IP，可靠。我希望能够访问皮卡德彻底时间。我以前做过这个：

$ ssh -N -R 19999:localhost:22 [email protected]

这是可行的，但如果出现问题，它会退出并且不会重新启动，并且不会在启动时启动，所以现在我添加一个要运行的 systemd 服务：

/bin/bash -c "while true; do /usr/bin/ssh -i <unencrypted key> \
  -o ServerAliveInterval=10 -v -o ServerAliveCountMax=6 -N \
    -R 19999:localhost:22 [email protected]; sleep 5; done"`

while true ... sleep 5    # re-runs ssh if it exits
  • -o ServerAliveInterval=10每 10 秒发送一次保持活动状态
  • -o ServerAliveCountMax=6如果 6 个 keep-alive 没有响应则退出
  • -v/var/log/messages通过 systemd保留调试信息

在服务器端，我添加了几行sshd_config：

KeepAlive yes
ClientAliveInterval 10
ClientAliveCountMax 6

与客户端的想法相同 - 60 秒不活动后断开连接。

不幸的是，重新启动似乎需要比一分钟长得多的时间：

< tunnel is up and keepalives are coming in >
Jun  7 17:31:02 picard bash[135]: debug1: client_input_global_request: rtype [email protected] want_reply 1
Jun  7 17:31:12 picard bash[135]: debug1: client_input_global_request: rtype [email protected] want_reply 1
Jun  7 17:31:15 picard bash[135]: debug1: client_input_channel_open: ctype forwarded-tcpip rchan 2 win 2097152 max 32768
Jun  7 17:31:15 picard bash[135]: debug1: client_request_forwarded_tcpip: listen localhost port 19998, originator 127.0.0.1 port 38267
Jun  7 17:31:15 picard bash[135]: debug1: connect_next: host localhost ([127.0.0.1]:22) in progress, fd=4
Jun  7 17:31:15 picard bash[135]: debug1: channel 0: new [127.0.0.1]
Jun  7 17:31:15 picard bash[135]: debug1: confirm forwarded-tcpip
Jun  7 17:31:15 picard bash[135]: debug1: channel 0: connected to localhost port 22
Jun  7 17:31:20 picard systemd-logind[137]: New session 1 of user main_username.
< I break eth0 and plug it back in after NM sees it's down >
< eth0 is back up within a few seconds >
< nothing happens with my ssh connection for a LONG time >
Jun  7 17:54:16 picard bash[135]: Write failed: Broken pipe
Jun  7 17:54:22 picard bash[135]: OpenSSH_6.1p1, OpenSSL 1.0.1c-fips 10 May 2012
Jun  7 17:54:22 picard bash[135]: debug1: Reading configuration data /etc/ssh/ssh_config
Jun  7 17:54:22 picard bash[135]: debug1: /etc/ssh/ssh_config line 50: Applying options for *
Jun  7 17:54:22 picard bash[135]: debug1: Connecting to my.domain [123.234.123.234] port 22.
Jun  7 17:54:22 picard bash[135]: debug1: Connection established.
Jun  7 17:54:23 picard bash[135]: debug1: identity file /home/test/.ssh/id_rsa type 1
Jun  7 17:54:23 picard bash[135]: debug1: identity file /home/test/.ssh/id_rsa-cert type -1
Jun  7 17:54:23 picard bash[135]: debug1: Remote protocol version 2.0, remote software version OpenSSH_5.8p1 Debian-1ubuntu3
Jun  7 17:54:23 picard bash[135]: debug1: match: OpenSSH_5.8p1 Debian-1ubuntu3 pat OpenSSH_5*
Jun  7 17:54:23 picard bash[135]: debug1: Enabling compatibility mode for protocol 2.0
Jun  7 17:54:23 picard bash[135]: debug1: Local version string SSH-2.0-OpenSSH_6.1
Jun  7 17:54:23 picard bash[135]: debug1: SSH2_MSG_KEXINIT sent
Jun  7 17:54:23 picard bash[135]: debug1: SSH2_MSG_KEXINIT received
Jun  7 17:54:23 picard bash[135]: debug1: kex: server->client aes128-ctr hmac-md5 none
Jun  7 17:54:23 picard bash[135]: debug1: kex: client->server aes128-ctr hmac-md5 none
Jun  7 17:54:23 picard bash[135]: debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
Jun  7 17:54:23 picard bash[135]: debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
Jun  7 17:54:23 picard bash[135]: debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
Jun  7 17:54:23 picard bash[135]: debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
Jun  7 17:54:23 picard bash[135]: debug1: Server host key: RSA 7a:19:72:9d:f5:39:f5:03:cf:16:b2:ee:fc:a4:e6:ba
Jun  7 17:54:23 picard bash[135]: debug1: Host 'my.domain' is known and matches the RSA host key.
Jun  7 17:54:23 picard bash[135]: debug1: Found key in /home/test/.ssh/known_hosts:1
Jun  7 17:54:23 picard bash[135]: debug1: ssh_rsa_verify: signature correct
Jun  7 17:54:23 picard bash[135]: debug1: SSH2_MSG_NEWKEYS sent
Jun  7 17:54:23 picard bash[135]: debug1: expecting SSH2_MSG_NEWKEYS
Jun  7 17:54:23 picard bash[135]: debug1: SSH2_MSG_NEWKEYS received
Jun  7 17:54:23 picard bash[135]: debug1: Roaming not allowed by server
Jun  7 17:54:23 picard bash[135]: debug1: SSH2_MSG_SERVICE_REQUEST sent
Jun  7 17:54:23 picard bash[135]: debug1: SSH2_MSG_SERVICE_ACCEPT received
Jun  7 17:54:23 picard bash[135]: debug1: Authentications that can continue: publickey,password
Jun  7 17:54:23 picard bash[135]: debug1: Next authentication method: publickey
Jun  7 17:54:23 picard bash[135]: debug1: Offering RSA public key: /home/test/.ssh/id_rsa
Jun  7 17:54:23 picard bash[135]: debug1: Server accepts key: pkalg ssh-rsa blen 279
Jun  7 17:54:23 picard bash[135]: debug1: read PEM private key done: type RSA
Jun  7 17:54:24 picard bash[135]: debug1: Authentication succeeded (publickey).
Jun  7 17:54:24 picard bash[135]: Authenticated to my.domain ([123.234.123.234]:22).
Jun  7 17:54:24 picard bash[135]: debug1: Remote connections from LOCALHOST:19999 forwarded to local address localhost:22
Jun  7 17:54:24 picard bash[135]: debug1: Requesting [email protected]
Jun  7 17:54:24 picard bash[135]: debug1: Entering interactive session.
Jun  7 17:54:24 picard bash[135]: debug1: remote forward success for: listen 19999, connect localhost:22
Jun  7 17:54:24 picard bash[135]: debug1: All remote forwarding requests processed
Jun  7 17:54:44 picard bash[135]: debug1: client_input_global_request: rtype [email protected] want_reply 1
Jun  7 17:54:45 picard bash[135]: debug1: client_input_channel_open: ctype forwarded-tcpip rchan 2 win 2097152 max 32768
Jun  7 17:54:45 picard bash[135]: debug1: client_request_forwarded_tcpip: listen localhost port 19999, originator 127.0.0.1 port 60222
Jun  7 17:54:45 picard bash[135]: debug1: connect_next: host localhost ([127.0.0.1]:22) in progress, fd=4
Jun  7 17:54:45 picard bash[135]: debug1: channel 0: new [127.0.0.1]
Jun  7 17:54:45 picard bash[135]: debug1: confirm forwarded-tcpip
Jun  7 17:54:45 picard bash[135]: debug1: channel 0: connected to localhost port 22
Jun  7 17:54:50 picard systemd-logind[137]: New session 3 of user main_username.
< whenever I connect the keepalive debug messages stop coming, not sure if this is normal >

我确信我忽略了一些事情。我见过一些类似的项目autossh所做的事情与我现在正在做的事情几乎相同，但如果可能的话，我希望能够解决这个问题。如何将延迟从 23 分钟减少到 2-3 分钟？

答案1

如果您使用类似工具autossh来维护 ssh 连接会怎么样？我用自动SSH通过互联网上的服务器保持我的笔记本电脑上的 smtp（端口 25）和 imap（端口 143）打开，其后面有多个服务器通过 NAT 访问互联网。

                                                              smtp (25)
                                                               __  _   
                                                              [__]|=|  
                                                              /::/|_|  
 laptop          .-,(  ),-.         Ext. Host      Int. Host      ^
  (22)        .-(          )-.         (22)           (22)        |
  __  _ ---->(    internet    )----> __  _   -----> __  _   ------.
 [__]|=|      '-(          ).-'     [__]|=|        [__]|=|        |
 /::/|_|          '-.( ).-'         /::/|_|        /::/|_|        v
                                                             imap (143)
                                                              __  _    
                                                             [__]|=|   
                                                             /::/|_|

通过上述设置，我使用以下autossh命令在我的笔记本电脑上进行设置：

autossh -M 0 -f -N -L 2025:localhost:25 -L 2143:localhost:143 me@int-host

在我的$HOME/.ssh/config文件中，我设置了一个主机规则，如下所示：

Host int-host
    ProxyCommand ssh me@ext-host nc int-host %p

相关内容