SSH dial home daemon or automatic tunneler? [closed]

Question

I know a number of vendors that sell network/server appliances, that have a support button, that once pressed, setup an SSH support tunnel back to the vendors main servers so the support technician can connect directly into the appliance and troubleshoot it.

I would like to set this up, but without the need to press the support button. I want to deploy laptops at remote locations that then automatically call back to a master on a regular basis, and reestablish connections if the box reboots, or the remote network drops connection for a short while. (both ends are Linux boxes)

Basically I want to deploy temporary Zenoss/Cacti monitoring servers in customer environments, but I do not want to have to punch holes through their firewalls, or deal with their site specific VPN settings.

Does anyone know of any scripts or ssh daemons that help set this functionality up?

Answer 1

Try autossh. It's doing exactly what you are asking for, assuming you setup public key authentication (otherwise you must manually enter password each time).

Quote from autossh web page:

autossh is a program to start a copy of ssh and monitor it, restarting it as necessary should it die or stop passing traffic.

If you want to start it automatically, you can use crontab. Run crontab -e and add

@reboot /usr/local/bin/start_tunnel.sh

or just

@reboot autossh username@host <other ssh options here>

Caveat: autossh do not start if first connect fails (network is not up / resolving is not working). Workaround: put something like this to start_tunnel.sh:

while true; do
  autossh username@host -M 12313 -R...
  sleep 15
done

This way, if autossh exits for some reason, it's restarted later on.

Also, autossh default connection polling isn't happening really often, you can control it with AUTOSSH_POLL and AUTOSSH_FIRST_POLL variables.

Answer 2

but I do not want to have to punch holes through their firewalls

So what it boils down to is that you're trying to bypass existing security mechanisms. Not exactly very ethical. Why not tell them how their firewalls should be configured.

I've previously used ppp over an SSL tunnel (using stunnel, but ssh is just as viable, and most other vpns would work too) to map remote devices into a network. I'd set it up to run as a sysV initscript but running from upstart or DJB's daemontools is probably a more senible approach.

Answer 3

Surely you have the permission to do such a thing? Where I work that would be a blatant violation of the security policy.

Anyways, if you're going to have just a handful of boxes, you can do it without any external applications. Just set up public key authentication to the "support" server and add something like this to crontab on the laptops:

@reboot ssh -R 65000:localhost:22 support.box.on.example.com

(Obviously using a different port for different machines, the next laptop could use port 65001 instead etc.)

Now when you ssh to localhost on port 65000, you're connecting to the laptop's port 22.