8 ms·

Closing a stale SSH connection

188 points by granddave 3y ago

pstrateman 3y ago
Being able to change port forwarding without reconnecting is really useful too.
LinuxBender 3y ago
Adding for completeness sake, if using Alpine Linux the ssh escape sequence menu and output will not display correctly if using /bin/ash from BusyBox as your login shell. One work-around is to type 'cat [Return]' and then use the escape sequences, or to carefully change your shell to /bin/bash
- CoolCold 3y ago
  With all that glory of Alpine, my personal choice is to avoid having it on server side, it's too much "if" with it to keep in my memory.
- blueflow 3y ago
  Alpine Linux user here, i could not reproduce that. How does the used shell even matter for that? The ssh client talks to the tty directly, not via shell.
  - LinuxBender 3y ago
    This thread [1] explains the issue people run into. I ran into it and thus found that explanation. Verified I can still reproduce it on Alpine 3.17.3 up to date on patches For clarification regarding what I mean with menu and output will not display the disconnect command will still work but there will be no feedback. So disconnecting will work but one won't get the menu or feedback on changing verbosity or dropping to a command line or displaying forwarded connections, etc... and a few of the sub-commands will not work. [1] - https://superuser.com/questions/985437/ssh-escape-key-only-works-when-connection-is-stuck https://superuser.com/questions/985437/ssh-escape-key-only-w...
abdusco 3y ago
One of the most useful SSH tricks I've ever learned. I wonder if there's a way to detect a stale session and force reconnect when I turn on the computer? Like mosh[0], but with SSH. [0]: https://mosh.org/ https://mosh.org/
- LinuxBender 3y ago
  I wonder if there's a way to detect a stale session and force reconnect SSH uses TCP and if the session is gone it will be an invalid session in iptables/nftables and likely have timed out on the remote end depending on state table timeouts and how long your laptop were offline. If there were no firewall in the path then one could play with long SO_KEEPALIVE sessions which I have done in the past when rebooting datacenter-wide diskless NFS clients and NAS's but I dont believe this will work with SSH due to session keys. As you alluded to, Mosh is the best current way to deal with broken or roaming sessions as Mosh uses a nonce and is designed to be stateless. If the sshd and ssh client timeouts are high enough, a UDP VPN can at times work around intermittent timeouts.
  - chrisweekly 3y ago
    > "As you _eluded_ to" should be "alluded to"; eluded: evaded / dodged, vs alluded to: mentioned / referred to NOT being pedantic about spelling, just trying to be helpful (esp. for non-native English readers).
    - LinuxBender 3y ago
      Thanks. I'm sure I will get it wrong again but I try. Another one that my subconscious types out wrong is queue vs cue out of habit. Fixed in above comment.
- saurik 3y ago
  You can turn on TCP keeyalive on ssh using a handful of -o flags if that's the behavior you prefer. https://news.ycombinator.com/item?id=5017108 https://news.ycombinator.com/item?id=5017108
c0l0 3y ago
If you enjoyed this article, you may also find other useful tips in a piece I submitted to HN a while ago on "advanced SSH usage": https://johannes.truschnigg.info/writing/2022-07_advanced_ssh_usage/ https://johannes.truschnigg.info/writing/2022-07_advanced_ss...
- jeffrallen 3y ago
  If you enjoyed this article, you may like to learn about man pages... Try "man man".
- navaati 3y ago
  Loved your article, thank you for writing it !
maratc 3y ago
Pro tip: if you used ssh to get into host A and then another ssh to get from host A into host B, to break the A-B connection you need to issue `~~.` ("control up-arrow Q" song playing in the background.)
- imp0cat 3y ago
  Thanks.
- yuvadam 3y ago
  Alternatively just use jump hosts: $(ssh -J bastion target)
  - penguin_booze 3y ago
    Oh, I didn't know about the -J option. At $WORK, after ssh-ing onto the jump host, we've to do 'sudo -u special_user sudosh' (no password) before we ssh further. I don't suppose there's any way around that, is there?
    - maratc 3y ago
      ProxyCommand may help you; see [0] [0] https://sshmenu.sourceforge.net/articles/transparent-mulithop.html https://sshmenu.sourceforge.net/articles/transparent-mulitho...
- totetsu 3y ago
  And if you use host A like that enough you can also change the ssh escape key in your config.
blueflow 3y ago
Primary source is the SSH manpage, Section "ESCAPE CHARACTERS". Read it from your terminal with the `man ssh` command.
hartator 3y ago
I wish there is an easy way to have the reverse: a “sticky” ssh session. It’s so annoying that the connection is lost when going to sleep or network issues. And the solutions to fix this are not really worth the effort.
- rsfern 3y ago
  I’m not sure about resuming from sleep, but does mosh address your network stability issues? https://mosh.org/ https://mosh.org/
  - hartator 3y ago
    The main thing about Mosh is you need both on the sever and the client. Installing on random servers you might be ssh -in only once feels gross.
    - devman0 3y ago
      Has Mosh crypto been reviewed? Last I checked they were using some custom crypto on top of UDP instead of using something like DTLS or QUIC. Given SSH is one of the most battle tested protocols out there I am wary of replacing it with something else.
      - lwf 3y ago
        https://mosh.org/#faq:~:text=Q%3A%20What%20is%20Mosh%27s%20security%20track%20record%20so%20far%3F https://mosh.org/#faq:~:text=Q%3A%20What%20is%20Mosh%27s%20s... The cryptography is standard AES-128 in OCB3 mode. It's been around long enough, and has had enough security scrutiny to at least discover a few minor DoS vulnerabilities, that it isn't entirely unreviewed. For the cipher itself, see https://en.wikipedia.org/wiki/OCB_mode#Attacks https://en.wikipedia.org/wiki/OCB_mode#Attacks
      - gsich 3y ago
        It was AES-OCB last time I looked at it. Not sure if this is good/bad.
hsjqllzlfkf 3y ago
Why is this better than CTRL-C?
- Deukhoofd 3y ago
  Generally ssh will just forward signals (SIGINT, SIGQUIT) to the remote host. If that side is not responsive, you can hit Ctrl+C all you want, but it won't do anything.
- deleted 3y ago
  [deleted]
- lwf 3y ago
  It's client-side, so works even if the remote system is totally hung and did not clearly disconnect. For example, running `systemctl suspend` will not terminate active SSH connections before putting the destination machine into a sleep state, and thus Ctrl+C (which isn't processed by SSH) will do nothing until the remote host is woken up by some mechanism.
- nerdbert 3y ago
  Control-C won't stop a connection that's already been established. It only aborts if it hasn't completed the handshake yet. Otherwise how could you send a control-C without any special guard sequence while ssh-ing?
capableweb 3y ago
Lots of words to just say "Enter then ~."
- ivlad 3y ago
  [flagged]
- emmelaich 3y ago
  Also, if the terminal has gone weird, you may have to use ^j instead of enter(^m).
dingosity 3y ago
I feel old. I remember when we moved from telnet and rlogin to ssh and this was in the man page. I'm also happy to learn kids are still using terminals and ssh.
- dingosity 3y ago
  Well... terminal emulators. Bonus points to everyone who has an actual VT240 on their physical desktop.
  - LoganDark 3y ago
    > Bonus points to everyone who has an actual VT240 on their physical desktop. Bonus points to anyone who can find one and get it to work. I want one, but it's a huge investment (both in price and effort)
    - dingosity 3y ago
      Yikes. Yeah. Went on ebay thinking they couldn't possibly be THAT expensive. I was wrong. I wonder if there's a market for a $200 VT420 clone built with a FPGA that has a USB connection for a keyboard and a HDMI connector for a monitor?
    - chasil 3y ago
      The MAME emulator will actually run a VT260 rom, allowing the emulated serial port to be output to a socket.
      - Datagenerator 3y ago
        Are guides available on how to setup and use? Edit: Found this https://zork.net/~st/jottings/Real-VT102-emulation-with-MAME.html https://zork.net/~st/jottings/Real-VT102-emulation-with-MAME...
        chasil 3y ago
        Here are a bunch of URLs that I collected for the VT240. http://www.bitsavers.org/pdf/dec/terminal/ http://www.bitsavers.org/pdf/dec/terminal/ https://github.com/larsbrinkhoff/terminal-simulator/issues/1 https://github.com/larsbrinkhoff/terminal-simulator/issues/1 https://www.mail-archive.com/simh@trailing-edge.com/msg09086.html https://www.mail-archive.com/simh@trailing-edge.com/msg09086... https://forums.bannister.org/ubbthreads.php?ubb=showflat&Number=117474 https://forums.bannister.org/ubbthreads.php?ubb=showflat&Num... https://simh.trailing-edge.narkive.com/qgzCvrl8/dec-vt-emulators-on-mame https://simh.trailing-edge.narkive.com/qgzCvrl8/dec-vt-emula... The command that I ended up using was: mame -rp . vt240 -window -nothrottle -host null_modem -bitb socket.foo.com:23
tjoff 3y ago
One caveat here is the note: > (Note that escapes are only recognized immediately after newline.) This means that it is easy to pick up a habit to smash the enter-button a few times before doing this dance, and as noted on a nordic layout it can be a bit tricky and since you might seldom do it you might do it a few times. Problem can be that sometimes the connection is only broken one way, what you are typing goes to the server but the responses don't. So you might end up wreaking some kind of havoc on the remote server when you just want to kill the session. Maybe you had a half-written command. Maybe you had just done an up-arrow to get to the previous command, maybe you redid that up-arrow one or more times before you realized that the connection was broken. If you press enter now you will re-run one of your previous commands. Could be quite scary. To save you from some of that, you could do a ctrl+c which will clear your current line, before pressing enter. But whether that is a good idea depends on the context... The most apparent issue this has been for me is if on the remote you have IRC or something and you type a bunch of garbage to whatever channel you are on. No biggie, but the old restart the terminal isn't too bad either.
- diftraku 3y ago
  Another note for nordic layouts and Linux: tilde (~) is considered to be a "dead key" on most nordic layouts, meaning you may need to follow AltGr + ~ with a space before typing out the dot. Otherwise you might get weird looks from the terminal trying to figure what you meant with the tilde-dot. Incidentally, while testing on Windows (in both WSL and cmd.exe) with a Finnish layout: you do not need a space after typing out the tilde.
  - SoftTalker 3y ago
    ~ is also the (very common) shorthand for home directory. How do Nordic keyboard users deal with that?
    - nemetroid 3y ago
      With agony. It sucks.
    - 3y ago
riffic 3y ago
tilde dot is my jam.
scsibug 3y ago
Another good tip; when randomly generating passwords (especially for other users), filter out anything starting with a tilde to prevent strange behavior.
- teddyh 3y ago
  Your new password is: +++ATH0
  - NoZebra120vClip 3y ago
    This doesn't work. The Hayes modem protocol specifies that a significant pause must be inserted after "+++" for it to have signaling effect. https://en.wikipedia.org/wiki/Hayes_AT_command_set#Hayes'_solution https://en.wikipedia.org/wiki/Hayes_AT_command_set#Hayes'_so...
    - detaro 3y ago
      ... that link describes why it does sometimes work
davesmylie 3y ago
Pretty sure the answer is no, cause I've been searching for a way to do this for a while, but is there any way to trigger these escapes from script? Use case is bouncing through to an RDS that only allows access from specific EC2 instances. The RDS endpoint in question is highly specific to the EC2 - not a big deal to hit ~L and create the forward manually, but doing this automatically would be great.
- hamandcheese 3y ago
  Maybe take a look at expect: https://linux.die.net/man/1/expect https://linux.die.net/man/1/expect
- deadbunny 3y ago
  Can you not use SSH proxyjump? https://www.redhat.com/sysadmin/ssh-proxy-bastion-proxyjump https://www.redhat.com/sysadmin/ssh-proxy-bastion-proxyjump
  - davesmylie 3y ago
    Yup. Though doesn't help much for my use case (I don't think) - I have an ever change set of ec2's, each with access to a single RDS endpoint. Most debug/config is done via sqlcl which is straight forward as that's run from the ec2 and so has access to the DB, but sometimes I need to fall back to eg TOAD or sqldeveloper which require the forward to be setup - either adhoc via ~L or -L or via .ssh/config Each ec2 knows it's RDS end point and I have an extracted list which I use to generate a list of .ssh/config entries periodically to automatically set up the forwards, but just being able to run a command from the ec2s that translates to eg: ~L > 1521:<extracted rds endpoint from app config:1521 would make my life marginally easier
    - philsnow 3y ago
      ssh only looks for those escape sequences on the input side / on the controlling pty. I think you would have to do something like have the script on the remote ec2 instance emit some pattern that you configure your local terminal emulator to watch for and then somehow tell your terminal to emit the ~L sequence of keystrokes. iterm2 can do this kind of thing, see https://iterm2.com/triggers.html https://iterm2.com/triggers.html .
est 3y ago
that typeface makes the tilde prefix (~) almost looks like a hyphen (-)
pabs3 3y ago
Due to my use of the ControlMaster feature, I usually just do `ssh -O exit foo` in another terminal to close an existing connection. Either that or just close the terminal and open a new one.
bullen 3y ago
I would love the opposite, how to keep a SSH connection alive when sleeping the computer? XD
- selfhoster69 3y ago
  On a desktop machine, sure... but on a laptop, I'd want it to enter sleep and subsequently deep sleep when I close the lid or lock it.
- TwoNineFive 3y ago
  Using a tmux or screen session to maintain persistence instead might be a better idea, depending on your use case.
motge 3y ago
Also very helpful: There is ~C which opens a "command" mode where you can add local or remote forwardings after you opened a SSH session (e.g. -L8080:localhost:8080)
yubiox 3y ago
Probably too late to post here but the timing of this article was interesting. I use the ~. on a daily basis because something in the firewall at work was causing my idle ssh connections to hang. But just yesterday morning right before reading this article I added ServerAliveInterval 30 in the client ssh config to see if it would help and guess what, the connections were not stuck today.
- hddqsb 3y ago
  You might also want to set ServerAliveCountMax to something high, the default is 3 which means if your network is down for 3*30s the SSH client will disconnect.

188 points by granddave 3y ago

Being able to change port forwarding without reconnecting is really useful too.

Adding for completeness sake, if using Alpine Linux the ssh escape sequence menu and output will not display correctly if using /bin/ash from BusyBox as your login shell. One work-around is to type 'cat [Return]' and then use the escape sequences, or to carefully change your shell to /bin/bash

CoolCold 3y ago
With all that glory of Alpine, my personal choice is to avoid having it on server side, it's too much "if" with it to keep in my memory.
blueflow 3y ago
Alpine Linux user here, i could not reproduce that. How does the used shell even matter for that? The ssh client talks to the tty directly, not via shell.
- LinuxBender 3y ago
  This thread [1] explains the issue people run into. I ran into it and thus found that explanation. Verified I can still reproduce it on Alpine 3.17.3 up to date on patches For clarification regarding what I mean with menu and output will not display the disconnect command will still work but there will be no feedback. So disconnecting will work but one won't get the menu or feedback on changing verbosity or dropping to a command line or displaying forwarded connections, etc... and a few of the sub-commands will not work. [1] - https://superuser.com/questions/985437/ssh-escape-key-only-works-when-connection-is-stuck https://superuser.com/questions/985437/ssh-escape-key-only-w...

abdusco 3y ago

One of the most useful SSH tricks I've ever learned. I wonder if there's a way to detect a stale session and force reconnect when I turn on the computer? Like mosh[0], but with SSH. [0]: https://mosh.org/ https://mosh.org/

LinuxBender 3y ago
I wonder if there's a way to detect a stale session and force reconnect SSH uses TCP and if the session is gone it will be an invalid session in iptables/nftables and likely have timed out on the remote end depending on state table timeouts and how long your laptop were offline. If there were no firewall in the path then one could play with long SO_KEEPALIVE sessions which I have done in the past when rebooting datacenter-wide diskless NFS clients and NAS's but I dont believe this will work with SSH due to session keys. As you alluded to, Mosh is the best current way to deal with broken or roaming sessions as Mosh uses a nonce and is designed to be stateless. If the sshd and ssh client timeouts are high enough, a UDP VPN can at times work around intermittent timeouts.
- chrisweekly 3y ago
  > "As you _eluded_ to" should be "alluded to"; eluded: evaded / dodged, vs alluded to: mentioned / referred to NOT being pedantic about spelling, just trying to be helpful (esp. for non-native English readers).
  - LinuxBender 3y ago
    Thanks. I'm sure I will get it wrong again but I try. Another one that my subconscious types out wrong is queue vs cue out of habit. Fixed in above comment.
saurik 3y ago
You can turn on TCP keeyalive on ssh using a handful of -o flags if that's the behavior you prefer. https://news.ycombinator.com/item?id=5017108 https://news.ycombinator.com/item?id=5017108

c0l0 3y ago

If you enjoyed this article, you may also find other useful tips in a piece I submitted to HN a while ago on "advanced SSH usage": https://johannes.truschnigg.info/writing/2022-07_advanced_ssh_usage/ https://johannes.truschnigg.info/writing/2022-07_advanced_ss...

jeffrallen 3y ago
If you enjoyed this article, you may like to learn about man pages... Try "man man".
navaati 3y ago
Loved your article, thank you for writing it !

maratc 3y ago

Pro tip: if you used ssh to get into host A and then another ssh to get from host A into host B, to break the A-B connection you need to issue `~~.` ("control up-arrow Q" song playing in the background.)

imp0cat 3y ago
Thanks.
yuvadam 3y ago
Alternatively just use jump hosts: $(ssh -J bastion target)
- penguin_booze 3y ago
  Oh, I didn't know about the -J option. At $WORK, after ssh-ing onto the jump host, we've to do 'sudo -u special_user sudosh' (no password) before we ssh further. I don't suppose there's any way around that, is there?
  - maratc 3y ago
    ProxyCommand may help you; see [0] [0] https://sshmenu.sourceforge.net/articles/transparent-mulithop.html https://sshmenu.sourceforge.net/articles/transparent-mulitho...
totetsu 3y ago
And if you use host A like that enough you can also change the ssh escape key in your config.

blueflow 3y ago

Primary source is the SSH manpage, Section "ESCAPE CHARACTERS". Read it from your terminal with the `man ssh` command.

hartator 3y ago

I wish there is an easy way to have the reverse: a “sticky” ssh session. It’s so annoying that the connection is lost when going to sleep or network issues. And the solutions to fix this are not really worth the effort.

rsfern 3y ago
I’m not sure about resuming from sleep, but does mosh address your network stability issues? https://mosh.org/ https://mosh.org/
- hartator 3y ago
  The main thing about Mosh is you need both on the sever and the client. Installing on random servers you might be ssh -in only once feels gross.
  - devman0 3y ago
    Has Mosh crypto been reviewed? Last I checked they were using some custom crypto on top of UDP instead of using something like DTLS or QUIC. Given SSH is one of the most battle tested protocols out there I am wary of replacing it with something else.
    - lwf 3y ago
      https://mosh.org/#faq:~:text=Q%3A%20What%20is%20Mosh%27s%20security%20track%20record%20so%20far%3F https://mosh.org/#faq:~:text=Q%3A%20What%20is%20Mosh%27s%20s... The cryptography is standard AES-128 in OCB3 mode. It's been around long enough, and has had enough security scrutiny to at least discover a few minor DoS vulnerabilities, that it isn't entirely unreviewed. For the cipher itself, see https://en.wikipedia.org/wiki/OCB_mode#Attacks https://en.wikipedia.org/wiki/OCB_mode#Attacks
    - gsich 3y ago
      It was AES-OCB last time I looked at it. Not sure if this is good/bad.

hsjqllzlfkf 3y ago

Why is this better than CTRL-C?

Deukhoofd 3y ago
Generally ssh will just forward signals (SIGINT, SIGQUIT) to the remote host. If that side is not responsive, you can hit Ctrl+C all you want, but it won't do anything.
deleted 3y ago
[deleted]
lwf 3y ago
It's client-side, so works even if the remote system is totally hung and did not clearly disconnect. For example, running `systemctl suspend` will not terminate active SSH connections before putting the destination machine into a sleep state, and thus Ctrl+C (which isn't processed by SSH) will do nothing until the remote host is woken up by some mechanism.
nerdbert 3y ago
Control-C won't stop a connection that's already been established. It only aborts if it hasn't completed the handshake yet. Otherwise how could you send a control-C without any special guard sequence while ssh-ing?

capableweb 3y ago

Lots of words to just say "Enter then ~."

ivlad 3y ago
[flagged]
emmelaich 3y ago
Also, if the terminal has gone weird, you may have to use ^j instead of enter(^m).

dingosity 3y ago

I feel old. I remember when we moved from telnet and rlogin to ssh and this was in the man page. I'm also happy to learn kids are still using terminals and ssh.

dingosity 3y ago
Well... terminal emulators. Bonus points to everyone who has an actual VT240 on their physical desktop.
- LoganDark 3y ago
  > Bonus points to everyone who has an actual VT240 on their physical desktop. Bonus points to anyone who can find one and get it to work. I want one, but it's a huge investment (both in price and effort)
  - dingosity 3y ago
    Yikes. Yeah. Went on ebay thinking they couldn't possibly be THAT expensive. I was wrong. I wonder if there's a market for a $200 VT420 clone built with a FPGA that has a USB connection for a keyboard and a HDMI connector for a monitor?
  - chasil 3y ago
    The MAME emulator will actually run a VT260 rom, allowing the emulated serial port to be output to a socket.
    - Datagenerator 3y ago
      Are guides available on how to setup and use? Edit: Found this https://zork.net/~st/jottings/Real-VT102-emulation-with-MAME.html https://zork.net/~st/jottings/Real-VT102-emulation-with-MAME...
      - chasil 3y ago
        Here are a bunch of URLs that I collected for the VT240. http://www.bitsavers.org/pdf/dec/terminal/ http://www.bitsavers.org/pdf/dec/terminal/ https://github.com/larsbrinkhoff/terminal-simulator/issues/1 https://github.com/larsbrinkhoff/terminal-simulator/issues/1 https://www.mail-archive.com/simh@trailing-edge.com/msg09086.html https://www.mail-archive.com/simh@trailing-edge.com/msg09086... https://forums.bannister.org/ubbthreads.php?ubb=showflat&Number=117474 https://forums.bannister.org/ubbthreads.php?ubb=showflat&Num... https://simh.trailing-edge.narkive.com/qgzCvrl8/dec-vt-emulators-on-mame https://simh.trailing-edge.narkive.com/qgzCvrl8/dec-vt-emula... The command that I ended up using was: mame -rp . vt240 -window -nothrottle -host null_modem -bitb socket.foo.com:23

tjoff 3y ago

One caveat here is the note: > (Note that escapes are only recognized immediately after newline.) This means that it is easy to pick up a habit to smash the enter-button a few times before doing this dance, and as noted on a nordic layout it can be a bit tricky and since you might seldom do it you might do it a few times. Problem can be that sometimes the connection is only broken one way, what you are typing goes to the server but the responses don't. So you might end up wreaking some kind of havoc on the remote server when you just want to kill the session. Maybe you had a half-written command. Maybe you had just done an up-arrow to get to the previous command, maybe you redid that up-arrow one or more times before you realized that the connection was broken. If you press enter now you will re-run one of your previous commands. Could be quite scary. To save you from some of that, you could do a ctrl+c which will clear your current line, before pressing enter. But whether that is a good idea depends on the context... The most apparent issue this has been for me is if on the remote you have IRC or something and you type a bunch of garbage to whatever channel you are on. No biggie, but the old restart the terminal isn't too bad either.

diftraku 3y ago
Another note for nordic layouts and Linux: tilde (~) is considered to be a "dead key" on most nordic layouts, meaning you may need to follow AltGr + ~ with a space before typing out the dot. Otherwise you might get weird looks from the terminal trying to figure what you meant with the tilde-dot. Incidentally, while testing on Windows (in both WSL and cmd.exe) with a Finnish layout: you do not need a space after typing out the tilde.
- SoftTalker 3y ago
  ~ is also the (very common) shorthand for home directory. How do Nordic keyboard users deal with that?
  - nemetroid 3y ago
    With agony. It sucks.
  - 3y ago

riffic 3y ago

tilde dot is my jam.

scsibug 3y ago

Another good tip; when randomly generating passwords (especially for other users), filter out anything starting with a tilde to prevent strange behavior.

teddyh 3y ago
Your new password is: +++ATH0
- NoZebra120vClip 3y ago
  This doesn't work. The Hayes modem protocol specifies that a significant pause must be inserted after "+++" for it to have signaling effect. https://en.wikipedia.org/wiki/Hayes_AT_command_set#Hayes'_solution https://en.wikipedia.org/wiki/Hayes_AT_command_set#Hayes'_so...
  - detaro 3y ago
    ... that link describes why it does sometimes work

davesmylie 3y ago

Pretty sure the answer is no, cause I've been searching for a way to do this for a while, but is there any way to trigger these escapes from script? Use case is bouncing through to an RDS that only allows access from specific EC2 instances. The RDS endpoint in question is highly specific to the EC2 - not a big deal to hit ~L and create the forward manually, but doing this automatically would be great.

hamandcheese 3y ago
Maybe take a look at expect: https://linux.die.net/man/1/expect https://linux.die.net/man/1/expect
deadbunny 3y ago
Can you not use SSH proxyjump? https://www.redhat.com/sysadmin/ssh-proxy-bastion-proxyjump https://www.redhat.com/sysadmin/ssh-proxy-bastion-proxyjump
- davesmylie 3y ago
  Yup. Though doesn't help much for my use case (I don't think) - I have an ever change set of ec2's, each with access to a single RDS endpoint. Most debug/config is done via sqlcl which is straight forward as that's run from the ec2 and so has access to the DB, but sometimes I need to fall back to eg TOAD or sqldeveloper which require the forward to be setup - either adhoc via ~L or -L or via .ssh/config Each ec2 knows it's RDS end point and I have an extracted list which I use to generate a list of .ssh/config entries periodically to automatically set up the forwards, but just being able to run a command from the ec2s that translates to eg: ~L > 1521:<extracted rds endpoint from app config:1521 would make my life marginally easier
  - philsnow 3y ago
    ssh only looks for those escape sequences on the input side / on the controlling pty. I think you would have to do something like have the script on the remote ec2 instance emit some pattern that you configure your local terminal emulator to watch for and then somehow tell your terminal to emit the ~L sequence of keystrokes. iterm2 can do this kind of thing, see https://iterm2.com/triggers.html https://iterm2.com/triggers.html .

est 3y ago

that typeface makes the tilde prefix (~) almost looks like a hyphen (-)

pabs3 3y ago

Due to my use of the ControlMaster feature, I usually just do `ssh -O exit foo` in another terminal to close an existing connection. Either that or just close the terminal and open a new one.

bullen 3y ago

I would love the opposite, how to keep a SSH connection alive when sleeping the computer? XD

selfhoster69 3y ago
On a desktop machine, sure... but on a laptop, I'd want it to enter sleep and subsequently deep sleep when I close the lid or lock it.
TwoNineFive 3y ago
Using a tmux or screen session to maintain persistence instead might be a better idea, depending on your use case.

motge 3y ago

Also very helpful: There is ~C which opens a "command" mode where you can add local or remote forwardings after you opened a SSH session (e.g. -L8080:localhost:8080)

yubiox 3y ago

Probably too late to post here but the timing of this article was interesting. I use the ~. on a daily basis because something in the firewall at work was causing my idle ssh connections to hang. But just yesterday morning right before reading this article I added ServerAliveInterval 30 in the client ssh config to see if it would help and guess what, the connections were not stuck today.

hddqsb 3y ago
You might also want to set ServerAliveCountMax to something high, the default is 3 which means if your network is down for 3*30s the SSH client will disconnect.