Using CVS transparently through an SSH tunnel

Question

It seems a simple thing, but I am stuck.

On an Ubuntu machine, to ssh into a particular REMOTE_HOST machine, until now I could do

ssh REMOTE_HOST

as expected (keys are all setup fine). Now, I am forced to setup an ssh tunnel through a particular BRIDGE_HOST machine with

ssh -L 2222:REMOTE_HOST:22 BRIDGE_HOST -N -f

and then I can ssh to the REMOTE_HOST with

ssh -p 2222 localhost

This works perfectly fine although things are a little more complicated. Here are a few problems:

• localhost runs OpenSSH_7.2p2 so there is no -J / ProxyJump option, if that would help. I am not able to update OpenSSH, or at least I would prefer to avoid it.

• I must login on REMOTE_HOST with a password so I need to use sshpass (please do not tell me that I should not, I have no control on this). So the first ssh command above is not quite as shown but more complicated; yet, I think it adds nothing to show the more complex version. But this is a constraint I have and, I am afraid, prevents some cleaner solutions.

• There is no shell on REMOTE_HOST and as far as I can tell (or I understand) I am only allowed to setup tunnels.

Anyway, I can ssh into REMOTE_HOST with these two steps, but what I would like to do is to hide all this in .ssh/config to make this transparent (especially for CVS, see below). Something like this appears to be fine:

Host REMOTE_HOST
   Hostname localhost
   Port 2222
   ProxyCommand tcsh -c "ssh -L 2222:REMOTE_HOST:22 BRIDGE_HOST -N -f; nc %h %p"

If I now run

ssh REMOTE_HOST

I can ssh into REMOTE_HOST as if the tunnel did not exist. Great.

The final source of complication (and the question) is that I want to use this ssh connection also for CVS. Everything is certainly setup fine from the CVS side (e.g., it was working when I did not have to use BRIDGE_HOST). And if I now run

cvs up

in an appropriate directory, everything seems to work fine... but the cvs command, after doing its job properly, never terminates. I seem to understand that this is because the ssh creating the tunnel is still running at the end. I would be happy to kill it, but I cannot figure out how. Relatedly, note that if I omit ProxyCommand in .ssh/config and if the tunnel is setup manually before, all is perfectly fine and CVS runs smoothly (and terminates). I would forget ProxyCommand and set up autossh but I understand it does not work with sshpass. I could setup a cron job or some script that manually keeps the tunnel alive, but I think (or hope) that there must be a better way....

What is the correct, simplest, and cleanest way to achieve the result I desire? That is, simply use cvs as always despite the insertion of BRIDGE_HOST on which I have no control whatsoever?

Answer 1

localhost runs OpenSSH_7.2p2 so there is no -J / ProxyJump option, if that would help. I am not able to update OpenSSH, or at least I would prefer to avoid it.

A near-equivalent to ProxyJump is:

Host REMOTE_HOST
    ProxyCommand "ssh -W %h:%p BRIDGE_HOST"

This is actually what ProxyJump does in the background. The only real difference between the two is that ProxyJump would automatically copy certain other options (e.g. verbose -v mode) to all connections involved.

If the bridge server allows creating tunnels using -L then it automatically allows -W (and -D as well), as they all use the same SSHv2 channel type; the server doesn't know the difference.

This should also work with sshpass as the command. Alternatively, to avoid having to retype the password multiple times, you could use connection multiplexing for the bridge host:

Host BRIDGE_HOST
    ControlMaster auto
    ControlPath ~/.ssh/S.%r@%h:%p

The first connection to BRIDGE_HOST will leave a process in background; alternatively, you can use ssh -fNM BRIDGE_HOST (with sshpass if you want) to start the background process, which future ssh -w ... BRIDGE_HOST will automatically use.

---

In your tcsh+nc example, the command would be better written as:

Host REMOTE_HOST
    ProxyCommand tcsh -c "ssh -L 2222:%h:%p BRIDGE_HOST -N -f; nc localhost 2222"

Answer 2

Since I did not manage to understand how to kill the tunnel once CVS is done with it and since I cannot use autossh with sshpass, I decided to add a cron job.

I first created a small script putting together a bunch of recipes and ideas found around on the web. Here is the script:

myself=${BASH_SOURCE[0]}

for pid in $(pgrep -d " " $myself); do
    if [ $pid != $$ ]; then
        kill -9 $pid
    fi 
done

while true
do
    pkill -f "sshpass.*2222:"
    sshpass -p PASSWORD ssh -o ServerAliveInterval=60 -L 2222:REMOTE_HOST:22 BRIDGE_HOST -l USER -N
    sleep 1
done

Essentially it kills any other copy of itself first, then kills existing tunnel(s) on the same port and brings the required tunnel up, repeating this forever anytime ssh dies. It is a sort of poor man version of autossh.

Together with this .ssh/config file

Host REMOTE_HOST
   Hostname localhost
   Port 2222

this makes ssh (and CVS) behave as if REMOTE_HOST were still directly accessible.

The script can be conveniently invoked through cron:

  @reboot                            /PATH/TO/THE/SCRIPT &
  30         4     *     *     *     /PATH/TO/THE/SCRIPT &

The daily restart at 4:30am is probably perfectly unnecessary, but somehow seems a safe thing to do, in case something goes wrong.