I'm trying to create a setup where one could "ssh" to a specific port on localhost and then get forwarded to a remote server and into a shell, without the need to enter credentials (nope, secret key is not an option, unfortunately).

So far I have set up ssh multiplexing, with ControlMaster, so I can start a remote ssh shell without any prompts, from the local shell.

Is there a way to use that socket when new client connects to a specific port on localhost?

I've tried various combinations with -D, -R and -S, with no luck. Is such a setup possible, on either Linux or Mac?


I don't mind entering localhost credentials at any point, but I'm trying to avoid entering remote credentials for all connections following the initial control connection.

localhost        ---->    localhost:2222             ---->   remote:22
  $ ssh -p 2222             forward to remote                  $ _ :)
                            using an existing 
                            control socket
  • Well that sounds incredibly insecure.
    – Grant
    Sep 16, 2014 at 17:10
  • If you want ssh without security it's called rsh.
    – user143703
    Sep 16, 2014 at 17:11
  • It shouldn't be insecure, because a) there needs to be an open control connection, and that requires credentials, and b) closing port 2222 for everything but local traffic should protect it just fine.
    – frnhr
    Sep 16, 2014 at 17:13

2 Answers 2


If you want a basic shell, you could use netcat to create a shell listening on a certain port on remote server, and use Port Forwarding on local ssh to create the tunnels:

On remote:

while true ; do netcat -l -p 15000 -e /bin/bash ; done

On local:

ssh -L 5000:remoteip:15000 user@server
netcat localhost 5000

You will not be able to use some commands (vim behaviour is funny), but it works for most commands. Every time the connection is closed, the loop will spawn a new one.


You could always reroute (forward) localhost:2222 localhost:22 using iptables, eg.

iptables -t nat -A PREROUTING -p tcp --dport 2222 -j REDIRECT --to-port 22

See alias port / port forwarding to another local port or this Google search. This, in addition to ControlMaster auto, should not require any additional passwords (either local or remote).

However to me this seems unnecessary and makes me wonder if you don't have a case of the XY problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.