1

I am looking for an option for OpenSSH on Linux to insist on using pre-existing control master connection. That is, I would like to make sure that that an ssh command fails if it cannot connect to the master connection socket and never tries to connect to the remote host itself.

I tried different combinations of ControlPath and ControlMaster, but it seems that ssh, when the master socket is not available, will try to connect in any case.

As a workaround I put in my ~/.ssh/config:

Match host my-master-only-host   
  # Use non-existing port to insist on using master connection 
  Port 55555

so by default ssh fails and then switch to the real port when starting the master connection:

ssh -p 22 -M my-master-only-host

This works, but depending on firewall settings ssh without master may take a while until the connection timeouts. Any better way?

2 Answers 2

0

I guess ProxyCommand can be used to enforce this. Have a look at socat for that purpose.

EDIT:

ssh -o ProxyCommand="socat - SOCKET:<path_to_control_path>" <hostname>
0
0

The suggesion by tomek gave a hint how I can use ProxyCommand. The idea is to have in .ssh/config:

# By default prevent any connections via immediate exit from proxy.  
Match host my-master-only-host   
    ProxyCommand exit 1

Then I can call ssh when setting up the control master like:

ssh -M -o ProxyCommand=none my-master-only-host

Here ProxyCommand=none nullify the effect of the ProxyCommand setting in the config. This use of none is not documented, but works with at least OpenSSH 7.7.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .