Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4971 > unrolled thread

incoming ssh blocked by ISP

Back to article view | Back to comp.os.linux.networking

Contents

  incoming ssh blocked by ISP Bob Tennent <rdtennent@tennent.ca> - 2021-11-06 15:28 +0000
    Re: incoming ssh blocked by ISP Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2021-11-06 16:28 +0000
      Re: incoming ssh blocked by ISP Bob Tennent <rdtennent@tennent.ca> - 2021-11-06 21:33 +0000
        Re: incoming ssh blocked by ISP Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2021-11-06 21:54 +0000
          Re: incoming ssh blocked by ISP "Carlos E. R." <robin_listas@es.invalid> - 2021-11-06 23:13 +0100
            Re: incoming ssh blocked by ISP "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2021-11-06 19:16 -0400
              Re: incoming ssh blocked by ISP "Carlos E. R." <robin_listas@es.invalid> - 2021-11-07 00:28 +0100
          Re: incoming ssh blocked by ISP William Unruh <unruh@invalid.ca> - 2021-11-07 03:03 +0000
          Re: incoming ssh blocked by ISP Marco Moock <invalid@invalid.invalid> - 2021-11-07 12:44 +0100
        Re: incoming ssh blocked by ISP "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2021-11-06 17:57 -0400
          Re: incoming ssh blocked by ISP "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2021-11-06 18:01 -0400
            Re: incoming ssh blocked by ISP Bob Tennent <rdtennent@tennent.ca> - 2021-11-07 01:56 +0000
              Re: incoming ssh blocked by ISP Bob Tennent <rdtennent@tennent.ca> - 2021-11-07 21:21 +0000
                Re: incoming ssh blocked by ISP "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2021-11-07 19:05 -0500
                  Re: incoming ssh blocked by ISP ant@zimage.comANT (Ant) - 2021-11-07 22:51 -0600
                Re: incoming ssh blocked by ISP Bob Tennent <rdtennent@tennent.ca> - 2021-11-08 01:18 +0000
                  Re: incoming ssh blocked by ISP "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2021-11-07 21:25 -0500
                    Re: incoming ssh blocked by ISP Bit Twister <BitTwister@mouse-potato.com> - 2021-11-07 23:35 -0600
        Re: incoming ssh blocked by ISP William Unruh <unruh@invalid.ca> - 2021-11-07 02:51 +0000
      Re: incoming ssh blocked by ISP "Carlos E. R." <robin_listas@es.invalid> - 2021-11-06 22:47 +0100
        Re: incoming ssh blocked by ISP Dan Purgert <dan@djph.net> - 2021-11-10 13:13 +0000
    Re: incoming ssh blocked by ISP "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2021-11-06 13:43 -0400
    Re: incoming ssh blocked by ISP Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-11-06 19:18 +0100
    Re: incoming ssh blocked by ISP Marco Moock <invalid@invalid.invalid> - 2021-11-06 19:35 +0100
      Re: incoming ssh blocked by ISP William Unruh <unruh@invalid.ca> - 2021-11-06 19:54 +0000
        Re: incoming ssh blocked by ISP Bob Tennent <rdtennent@tennent.ca> - 2021-11-06 21:18 +0000
          Re: incoming ssh blocked by ISP "Carlos E. R." <robin_listas@es.invalid> - 2021-11-06 22:47 +0100
            Re: incoming ssh blocked by ISP "Carlos E. R." <robin_listas@es.invalid> - 2021-11-06 23:56 +0100
          Re: incoming ssh blocked by ISP Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-11-06 23:44 +0100
            Re: incoming ssh blocked by ISP "Carlos E. R." <robin_listas@es.invalid> - 2021-11-06 23:54 +0100
              Re: incoming ssh blocked by ISP Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-11-07 10:07 +0100
          Re: incoming ssh blocked by ISP Marco Moock <invalid@invalid.invalid> - 2021-11-07 10:22 +0100
            Re: incoming ssh blocked by ISP Pascal Hambourg <pascal@plouf.fr.eu.org> - 2021-11-07 10:51 +0100
              Re: incoming ssh blocked by ISP Marco Moock <invalid@invalid.invalid> - 2021-11-07 11:09 +0100
    Re: incoming ssh blocked by ISP Joe Beanfish <joebeanfish@nospam.duh> - 2021-11-08 14:52 +0000
      Re: incoming ssh blocked by ISP Bob Tennent <rdtennent@tennent.ca> - 2021-11-14 16:42 +0000
        Re: incoming ssh blocked by ISP Marco Moock <mo01@posteo.de> - 2021-11-14 18:01 +0100
        Re: incoming ssh blocked by ISP "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2021-11-14 13:08 -0500
          Re: incoming ssh blocked by ISP Bob Tennent <rdtennent@tennent.ca> - 2021-11-14 19:20 +0000
            Re: incoming ssh blocked by ISP "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2021-11-14 15:06 -0500
              Re: incoming ssh blocked by ISP Bob Tennent <rdtennent@tennent.ca> - 2021-11-14 21:03 +0000
                Re: incoming ssh blocked by ISP "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2021-11-14 16:28 -0500
                  Re: incoming ssh blocked by ISP ant@zimage.comANT (Ant) - 2021-11-15 04:19 -0600
                    Re: incoming ssh blocked by ISP William Unruh <unruh@invalid.ca> - 2021-11-15 20:18 +0000
        Re: incoming ssh blocked by ISP ant@zimage.comANT (Ant) - 2021-11-15 04:18 -0600

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

#5005

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Carlos E. R. wrote:
> Or reverse ssh. I can not describe, I have not used it. Or a tunnel to
> some server out there.

Reverse-ssh is pretty nice, but would require a couple bucks a month to
say Linode (or Digital Ocean or any of the other VPS providers out
there).

It's been a little while since I've done this, so I might have an error
or two.  Note that this requires sshd to be installed on the machine
behind CGNAT (I think it is, but...)

Hosts:
 - PC-H --> the PC behind the CGNAT ISP
 - VPS --> the intermediary VPS system
 - Laptop --> the device we're carrying around / connecting from outside
   with.

User accounts:
 - dan@pc-h
 - revssh@vps
 - you@laptop
 

1. Setup the tunnel.  
  - As dan@pc-h, connect to the VPS with the command :
    ssh -R 40022:localhost:22 revssh@vps

  - This will open a connection to "revssh@vps".  Leave it open, but
    walk away from "PC-H" now.
  - The port "40022" is arbitrary, it can be anything you like, that is
    above 1024.  
  - The port "22" is the port that sshd is listening to on PC-H

2. Grab the laptop, and login to the VPS as normal (i.e. "ssh
revssh@vps".)
  - Note: any valid account on the VPS will work for this step.

3. Test the tunnel from the VPS.
  - Connect to the tunnel with "ssh -oPort=40022 dan@localhost"
  - Authenticate with the proper ssh credentials (private key and/or
    password, as appropriate) for the account "dan@pc-h"

4. You should now be sitting at your normal "dan@pc-h" prompt.  Use PC-H
as normal, or jump to other hosts on your LAN, as necessary.


HTH :)

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3asj+xn6fYUcweBnbWVw5UznKGAFAmGLxZYACgkQbWVw5Uzn
KGCV6hAAkax/PjOZol2Gat6KyjN4g+esTsR3n1oND4fHMHC59vSz8oH4/GCtWEim
x5gS1pUzSBSYdT/KoIqw/krIDr/01tjcA6QWToP/nnwFVIjupKsRP5eTEnGdFacr
ksQiLi+JHRRFMWIYYzgNNGIQc4GEgeR6XTXBJHmNIlooKw86tyP7SS/14ZL+P2su
7RagkMvGE6S5ukgiCrjUKJq/O+8WV3Kln3LK9EjhggcPUQCCFCDP+teFWTMbv8tL
miNO2+jpH8wibOotazoKqb3gwtb4ojUniG2KvNgw09Q2/00OeUURbMHpZrDqmhsO
mtUMZV2Fx4p3xm2/PBGI4eVBfV8w1FEcUqJ4zwc2PyD6X6sWk8xUfTV3PmN4w5Rs
3fC91kz0X9G0tTvG3KLOZtiHAQOHbd3aYLeujiY/zSKPeNPhdoEUc11ahnqtOje5
mXfLAetF1TUYTj91X9DTajXC11bDWuKt0avZ3nA2GlAT6laSlvtqJhpXd/2JOkOJ
yE4XVehRSLxP/hK7+rrBImmiNX6lE/K/XCunOf5UuaabctyVwWSmvUVilLus3duN
LykYLg81KF9j8YDOKsPsmDL5j3CAzCFj1bk6+XUL/OYv8pYUYb8tdAh7SzaNiypZ
YrJeZw1OOq6EARLkDU6SJUMKjY2ce0F7bgZKaKcrxt1btSg8HNE=
=Tl56
-----END PGP SIGNATURE-----

-- 
|_|O|_| Github: https://github.com/dpurgert
|_|_|O| PGP: DDAB 23FB 19FA 7D85 1CC1  E067 6D65 70E5 4CE7 2860
|O|O|O| Former PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#4973

On Sat, 06 Nov 2021 11:28:52 -0400, Bob Tennent <rdtennent@tennent.ca> wrote:

> Outgoing ssh works fine and sshd is active. It's not my
> firewall and I use ddclient and zoneedit.com to deal with my
> dynamic IP address.
>
> When I complain to Support at my ISP I'm told to pay for a
> static IP address. Is there any other solution? I'm not a
> networking expert. I do have login access to a server with a
> static IP address but it's not the system I'm trying to ssh
> into.

Don't use port 22. Even if it's not blocked and you use keys only, not passwords,
all of the failed brute force attempts may fill the file system containing the logs.

In /etc/ssh/sshd_config specify a port such as Port 49775, then use that port
number when connecting, "ssh -p 49775 whatever.hostname".

Regards, Dave Hodgins

[toc] | [prev] | [next] | [standalone]

#4974

How do you know ?

[toc] | [prev] | [next] | [standalone]

#4975

Am Sat, 6 Nov 2021 15:28:52 -0000 (UTC)
schrieb Bob Tennent <rdtennent@tennent.ca>:

> Outgoing ssh works fine and sshd is active. It's not my
> firewall and I use ddclient and zoneedit.com to deal with my
> dynamic IP address.
> 
> When I complain to Support at my ISP I'm told to pay for a
> static IP address. Is there any other solution? I'm not a
> networking expert. I do have login access to a server with a
> static IP address but it's not the system I'm trying to ssh
> into.

Tell you ISP to disable it and if it doesn't don't pay them anymore
because they restrict your access to the internet. Internet access
means that you are also be able to establish TCP connections to your
computer. This is regardless if you get a static IPv4 address/IPv6 net
or dynamic ones.

[toc] | [prev] | [next] | [standalone]

#4976

On 2021-11-06, Marco Moock <invalid@invalid.invalid> wrote:
> Am Sat, 6 Nov 2021 15:28:52 -0000 (UTC)
> schrieb Bob Tennent <rdtennent@tennent.ca>:
>
>> Outgoing ssh works fine and sshd is active. It's not my
>> firewall and I use ddclient and zoneedit.com to deal with my
>> dynamic IP address.
>> 
>> When I complain to Support at my ISP I'm told to pay for a
>> static IP address. Is there any other solution? I'm not a
>> networking expert. I do have login access to a server with a
>> static IP address but it's not the system I'm trying to ssh
>> into.
>
> Tell you ISP to disable it and if it doesn't don't pay them anymore
> because they restrict your access to the internet. Internet access
> means that you are also be able to establish TCP connections to your
> computer. This is regardless if you get a static IPv4 address/IPv6 net
> or dynamic ones.
>

His post is woefully empty of facts, leading to all sorts of theories.

HIs theory is that the ISP is port blocking him.
His ISPs response has two possibilities-- that he is using a dynamic
adress and thus never knows what the IP address is of his machine. Or
that the ISP blocks most incoming ports on dynamic addresses. But not
static. 

The above advice is pretty useless since the ISP will then simply block
all incoming abd outgoing ports (ie disconnect him), which will
accomplish what?

So the OP has to be a bit more forthcoming as what is happening. 

[toc] | [prev] | [next] | [standalone]

#4977

On Sat, 6 Nov 2021 19:54:48 -0000 (UTC), William Unruh wrote:
 > On 2021-11-06, Marco Moock <invalid@invalid.invalid> wrote:
 >> Am Sat, 6 Nov 2021 15:28:52 -0000 (UTC)
 >> schrieb Bob Tennent <rdtennent@tennent.ca>:
 >>
 >>> Outgoing ssh works fine and sshd is active. It's not my
 >>> firewall and I use ddclient and zoneedit.com to deal with my
 >>> dynamic IP address.
 >>> 
 >>> When I complain to Support at my ISP I'm told to pay for a
 >>> static IP address. Is there any other solution? I'm not a
 >>> networking expert. I do have login access to a server with a
 >>> static IP address but it's not the system I'm trying to ssh
 >>> into.
 >>
 >> Tell you ISP to disable it and if it doesn't don't pay them anymore
 >> because they restrict your access to the internet. Internet access
 >> means that you are also be able to establish TCP connections to your
 >> computer. This is regardless if you get a static IPv4 address/IPv6 net
 >> or dynamic ones.
 >>
 >
 > HIs theory is that the ISP is port blocking him.

Not my theory. The ISP is not allowing me to access the IP
address in any way. I believe they are using some sort of
NAT to conserve IP addresses.

 > His ISPs response has two possibilities-- that he is
 > using a dynamic adress and thus never knows what the IP
 > address is of his machine.

I know what the IP address is by using checkip.dyndns.org
internally. But externally, that IP address is inaccessible,
even to pings.

 > So the OP has to be a bit more forthcoming as what is happening. 

What more can I say?  

[toc] | [prev] | [next] | [standalone]

#4979

On 06/11/2021 22.18, Bob Tennent wrote:
> On Sat, 6 Nov 2021 19:54:48 -0000 (UTC), William Unruh wrote:
>  > On 2021-11-06, Marco Moock <invalid@invalid.invalid> wrote:
>  >> Am Sat, 6 Nov 2021 15:28:52 -0000 (UTC)
>  >> schrieb Bob Tennent <rdtennent@tennent.ca>:

...

>  > HIs theory is that the ISP is port blocking him.
> 
> Not my theory. The ISP is not allowing me to access the IP
> address in any way. I believe they are using some sort of
> NAT to conserve IP addresses.

GNAT. That is not blocking, it is a limitation of the technology. Change
ISP or pay.

Look what it means in the wikipedia.

-- 
Cheers,
       Carlos E.R.

[toc] | [prev] | [next] | [standalone]

#4986

On 06/11/2021 22.47, Carlos E. R. wrote:
> On 06/11/2021 22.18, Bob Tennent wrote:
>> On Sat, 6 Nov 2021 19:54:48 -0000 (UTC), William Unruh wrote:
>>  > On 2021-11-06, Marco Moock <invalid@invalid.invalid> wrote:
>>  >> Am Sat, 6 Nov 2021 15:28:52 -0000 (UTC)
>>  >> schrieb Bob Tennent <rdtennent@tennent.ca>:
> 
> ...
> 
>>  > HIs theory is that the ISP is port blocking him.
>>
>> Not my theory. The ISP is not allowing me to access the IP
>> address in any way. I believe they are using some sort of
>> NAT to conserve IP addresses.
> 
> GNAT. That is not blocking, it is a limitation of the technology. Change
> ISP or pay.
> 
> Look what it means in the wikipedia.

CGNAT, sorry.

You might request your ISP to put you out of the CGNAT and give you
actual Internet service.

Or to put you on IPv6, which is another can of worms.

If they don't, switch ISP.

-- 
Cheers,
       Carlos E.R.

[toc] | [prev] | [next] | [standalone]

#4985

Le 06/11/2021 à 22:18, Bob Tennent a écrit :
> 
> Not my theory. The ISP is not allowing me to access the IP
> address in any way.

How do you know ? What tests did you do ?

> I believe they are using some sort of
> NAT to conserve IP addresses.

We do not care about your beliefs. We need facts.

> I know what the IP address is by using checkip.dyndns.org

The IP address of what device ?

[toc] | [prev] | [next] | [standalone]

#4987

On 06/11/2021 23.44, Pascal Hambourg wrote:
> Le 06/11/2021 à 22:18, Bob Tennent a écrit :
>>
>> Not my theory. The ISP is not allowing me to access the IP
>> address in any way.
> 
> How do you know ? What tests did you do ?
> 
>> I believe they are using some sort of
>> NAT to conserve IP addresses.
> 
> We do not care about your beliefs. We need facts.

That paragraph describes perfectly what CGNAT is, and the symptoms match
perfectly. It is impossible to connect to any client of that ISP, they
are on a 10.*.*.* network, behind a NATting router, which as you know,
is not routable and inaccessible from Internet.

He is telling facts, just not in recognizable words for geeks :-P

> 
>> I know what the IP address is by using checkip.dyndns.org
> 
> The IP address of what device ?

Unfortunately, not his actual IP.

-- 
Cheers,
       Carlos E.R.

[toc] | [prev] | [next] | [standalone]

#4993

Le 06/11/2021 à 23:54, Carlos E. R. a écrit :
> On 06/11/2021 23.44, Pascal Hambourg wrote:
>> Le 06/11/2021 à 22:18, Bob Tennent a écrit :
>>>
>>> Not my theory. The ISP is not allowing me to access the IP
>>> address in any way.
>>
>> How do you know ? What tests did you do ?
>>
>>> I believe they are using some sort of
>>> NAT to conserve IP addresses.
>>
>> We do not care about your beliefs. We need facts.
> 
> That paragraph describes perfectly what CGNAT is

And other things too. CGNAT is only one possible explanation, like the 
OP's own NAT router is not set up for port forwarding.

> and the symptoms match perfectly.

SymptomS ? All we have is one vague symptom "ISP does not allow access 
to the IP address".

> It is impossible to connect to any client of that ISP, they
> are on a 10.*.*.* network, behind a NATting router

I did not see any mention of 10.*.*.* in this thread. Do you have 
another information source ?

[toc] | [prev] | [next] | [standalone]

#4994

Am Sat, 6 Nov 2021 21:18:30 -0000 (UTC)
schrieb Bob Tennent <rdtennent@tennent.ca>:

> Not my theory. The ISP is not allowing me to access the IP
> address in any way. I believe they are using some sort of
> NAT to conserve IP addresses.

Maybe CG-NAT or directly Dual-Stack lite where IPv4 is tunneled over
IPv6 and IPv4 uses NAT. If you have that you can't connect from the
outside by IPv4. Use IPv6 is possible.

[toc] | [prev] | [next] | [standalone]

#4995

Le 07/11/2021 à 10:22, Marco Moock a écrit :
> 
> Maybe CG-NAT or directly Dual-Stack lite where IPv4 is tunneled over
> IPv6 and IPv4 uses NAT.

How is that different from IPv4 CGNAT ?

[toc] | [prev] | [next] | [standalone]

#4996

Am Sun, 7 Nov 2021 10:51:59 +0100
schrieb Pascal Hambourg <pascal@plouf.fr.eu.org>:

> How is that different from IPv4 CGNAT ?
It results in the same, but there is no direct IPv4 connection to the
provider like CG-NAT, IPv4 is being tunneled.

> Dual-Stack Lite is a promising approach that takes the best of NAT464
> while avoiding its problems: It uses IPv6-only links between the
> provider and the customer, but does not use NAT64 translation. When a
> device in the customer network sends an IPv4 packet to an external
> destination, the IPv4 packet is encapsulated in an IPv6 packet for
> transport into the provider network. At the LSN, the packet is
> decapsulated and NAT44 is performed (Figure 1). Tunneling IPv4 over
> IPv6 is far simpler than translation, so the performance and
> redundancy concerns are eliminated.
https://www.networkworld.com/article/2232181/understanding-dual-stack-lite.html

[toc] | [prev] | [next] | [standalone]

#5004

On Sat, 06 Nov 2021 15:28:52 +0000, Bob Tennent wrote:

> Outgoing ssh works fine and sshd is active. It's not my
> firewall and I use ddclient and zoneedit.com to deal with my
> dynamic IP address.
> 
> When I complain to Support at my ISP I'm told to pay for a
> static IP address. Is there any other solution? I'm not a
> networking expert. I do have login access to a server with a
> static IP address but it's not the system I'm trying to ssh
> into.

It might be a little fiddly to maintain, but you could setup
a tunnel from your dynamic IP host to the static server using
ssh -R. Then, whenever you want, you can ssh into the tunnel
port on the static server which will dump you into the dynamic
host.

[toc] | [prev] | [next] | [standalone]

#5008

On Mon, 8 Nov 2021 14:52:17 -0000 (UTC), Joe Beanfish wrote:
 > On Sat, 06 Nov 2021 15:28:52 +0000, Bob Tennent wrote:
 >
 >> Outgoing ssh works fine and sshd is active. It's not my
 >> firewall and I use ddclient and zoneedit.com to deal with my
 >> dynamic IP address.
 >> 
 >> When I complain to Support at my ISP I'm told to pay for a
 >> static IP address. Is there any other solution? I'm not a
 >> networking expert. I do have login access to a server with a
 >> static IP address but it's not the system I'm trying to ssh
 >> into.
 >
 > It might be a little fiddly to maintain, but you could setup
 > a tunnel from your dynamic IP host to the static server using
 > ssh -R. Then, whenever you want, you can ssh into the tunnel
 > port on the static server which will dump you into the dynamic
 > host.

As suggested by you and others, I've been able to set up
a reverse ssh tunnel and can make it persistent by using
autossh.

But why does the original ssh connection die after about 10
minutes of inactivity (and have to be renewed by autossh)?
Is this a security feature on the server and beyond my
control (I don't have superuser privileges)?

[toc] | [prev] | [next] | [standalone]

#5009

Am Sun, 14 Nov 2021 16:42:41 -0000 (UTC)
schrieb Bob Tennent <rdtennent@tennent.ca>:

> But why does the original ssh connection die after about 10
> minutes of inactivity (and have to be renewed by autossh)?
> Is this a security feature on the server and beyond my
> control (I don't have superuser privileges)?
It is a security feature, like locking your screen after some minutes.

[toc] | [prev] | [next] | [standalone]

#5010

On Sun, 14 Nov 2021 11:42:41 -0500, Bob Tennent <rdtennent@tennent.ca> wrote:
> But why does the original ssh connection die after about 10
> minutes of inactivity (and have to be renewed by autossh)?
> Is this a security feature on the server and beyond my
> control (I don't have superuser privileges)?

That's why I put a line with ServerAliveInterval 120 in the stanza for the host in
~/.ssh/config

With that, autossh should only be needed to re-establish the link if the connection
drops for any reason, such as the remote system being rebooted.

Regards, Dave Hodgins

[toc] | [prev] | [next] | [standalone]

#5011

On Sun, 14 Nov 2021 13:08:10 -0500, David W. Hodgins wrote:
 > On Sun, 14 Nov 2021 11:42:41 -0500, Bob Tennent <rdtennent@tennent.ca> wrote:
 >> But why does the original ssh connection die after about 10
 >> minutes of inactivity (and have to be renewed by autossh)?
 >> Is this a security feature on the server and beyond my
 >> control (I don't have superuser privileges)?
 >
 > That's why I put a line with ServerAliveInterval 120 in
 > the stanza for the host in ~/.ssh/config
 >
 > With that, autossh should only be needed to re-establish
 > the link if the connection drops for any reason, such as
 > the remote system being rebooted.

Since I'm using ssh -R , it's not clear to me which
system should get that configuration option.

[toc] | [prev] | [next] | [standalone]

#5012

On Sun, 14 Nov 2021 14:20:49 -0500, Bob Tennent <rdtennent@tennent.ca> wrote:
>  > That's why I put a line with ServerAliveInterval 120 in
>  > the stanza for the host in ~/.ssh/config
>  >
>  > With that, autossh should only be needed to re-establish
>  > the link if the connection drops for any reason, such as
>  > the remote system being rebooted.
>
> Since I'm using ssh -R , it's not clear to me which
> system should get that configuration option.

Both systems. Also on both I have sshd running with ...
# grep -v -e ^'#' -e ^$ /etc/ssh/sshd_config
Port 59385
AddressFamily inet
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
LogLevel VERBOSE
PermitRootLogin without-password
AuthorizedKeysFile      .ssh/authorized_keys
PasswordAuthentication no
UsePAM yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL
GatewayPorts yes
X11Forwarding yes
ClientAliveInterval 45
PermitTunnel yes
Subsystem       sftp    /usr/libexec/openssh/sftp-server

Note the ClientAliveInterval setting.

Regards, Dave Hodgins

[toc] | [prev] | [next] | [standalone]

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

Back to top | Article view | comp.os.linux.networking

csiph-web