2

I have a requirement to have a users home workstation (mac) connect via ssh tunnel to a corporate bastion host (bastion.corpnetexternal.com) and through to a mac workstation (host.corpnetinternal.com) in the corporate network. Here is the connection string:

ssh -N -f -L 2345:host.corpnetinternal.com:22 user@bastion.corpnetexternal.com

This is known to work, so no worries there.

The ssh tunnel needs to be automatically created and there must be monitoring ensure that it is functional end to end, and if not to be restarted.

Additionally, this functionality may not be dependent on or interrupted by a VPN tunnel that may or may not be present from the user remote workstation into the corporate network.

I would appreciate any suggestions. Please, no comments on the why of using ssh tunneling if a VPN is available. I have listed the requirements levied upon me.

  • What situations should lead to restart (e.g. just a timeout?) And how swiftly does the forwarding need to be reset after some sort of network change broke it? – anx Apr 20 '18 at 8:11
  • If the requirements do not match what is usually expected from VPN, doing ssh forwarded /bin/true || kill_and_restart_tunnel every minute in cron might be completely sufficient. – anx Apr 20 '18 at 8:13
  • A timeout is one case, inability (for whatever reason) to go end to end in the tunnel is another. Restarting each minute is not an option since there is a process that takes place across the tunnel. – JohnA Apr 20 '18 at 14:34
1

AutoSSH does exactly what you need.

On MacOS, it can be installed through Homebrew with brew install autossh.

See the README for usage instructions, or here and here for some examples.

  • My battery is about to die, so I have to link to examples instead of writing one here in the answer myself. I will try to come back later to finish. – Moshe Katz Apr 26 '18 at 18:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.