SSH Scripts - Historial de revisió

Marti a 09:59, 5 set 2014

2014-09-05T09:59:38Z

← Versió més antiga		Revisió del 09:59, 5 set 2014
Línia 1:		Línia 1:

			Other [[Bash Scripts]]

	==v1 Cron script to keep a reverse tunnel==		==v1 Cron script to keep a reverse tunnel==

Línia 382:		Línia 385:

	LOGFILE="${0}.log"		LOGFILE="${0}.log"
			LOGFILE="/home/marti/$(basename $LOGFILE)" #In case the script is run from a symbolic link (ex. /etc/network/if-up.d/), we force another specific folder for the logs

	if [ "$1" = "test" ] ; then # Only test and display OK/No OK		if [ "$1" = "test" ] ; then # Only test and display OK/No OK
Línia 432:		Línia 435:

	LOGFILE="${0}.log"		LOGFILE="${0}.log"
			LOGFILE="/home/marti/$(basename $LOGFILE)" #In case the script is run from a symbolic link (ex. /etc/network/if-up.d/), we force another specific folder for the logs

	while [ 1 ]; do		while [ 1 ]; do

Marti: /* v5 Cron script to verify that a tunnel is working connecting through it to ssh - better, cleaned up */

2014-08-05T16:56:49Z

v5 Cron script to verify that a tunnel is working connecting through it to ssh - better, cleaned up

← Versió més antiga		Revisió del 16:56, 5 ago 2014
Línia 384:		Línia 384:


	if [ "$1" = "test" ] # Only test and ~~show ok~~/~~no ok~~		if [ "$1" = "test" ] ; then # Only test and display OK/No OK
	ssh -p $NEWLOCALPORT -o ConnectTimeout=1 -o ConnectionAttempts=1 -i $SSHKEY $REMOTEUSER@localhost exit		ssh -p $NEWLOCALPORT -o ConnectTimeout=1 -o ConnectionAttempts=1 -i $SSHKEY $REMOTEUSER@localhost exit
	# > /dev/null 2>&1		# > /dev/null 2>&1

Marti: /* v5 Cron script to verify that a tunnel is working connecting through it to ssh - better, cleaned up */

2014-08-05T16:54:19Z

v5 Cron script to verify that a tunnel is working connecting through it to ssh - better, cleaned up

← Versió més antiga		Revisió del 16:54, 5 ago 2014
Línia 367:		Línia 367:
	<pre>		<pre>
	#!/bin/bash		#!/bin/bash
			# start the script with "test" to display status ./tunnel-hook-xx test

	REMOTEUSER="vpn"		REMOTEUSER="vpn"
Línia 383:		Línia 384:


	# ~~Test~~ to connect via ssh to the local forwared port $NEWLOCALPORT		if [ "$1" = "test" ] # Only test and show ok/no ok
			ssh -p $NEWLOCALPORT -o ConnectTimeout=1 -o ConnectionAttempts=1 -i $SSHKEY $REMOTEUSER@localhost exit
			# > /dev/null 2>&1
			if [ $? -ne 0 ] ; then
			echo "No OK"
			else
			echo "OK"
			fi
			exit
			fi

			# Try to connect via ssh to the local forwared port $NEWLOCALPORT
	ssh -p $NEWLOCALPORT -o ConnectTimeout=2 -o ConnectionAttempts=1 -o StrictHostKeyChecking=no -i $SSHKEY $REMOTEUSER@localhost exit		ssh -p $NEWLOCALPORT -o ConnectTimeout=2 -o ConnectionAttempts=1 -o StrictHostKeyChecking=no -i $SSHKEY $REMOTEUSER@localhost exit
	# > /dev/null 2>&1		# > /dev/null 2>&1

Marti: /* v5 Cron script to verify that a tunnel is working connecting through it to ssh - better, cleaned up */

2014-08-05T16:36:25Z

v5 Cron script to verify that a tunnel is working connecting through it to ssh - better, cleaned up

← Versió més antiga		Revisió del 16:36, 5 ago 2014
Línia 373:		Línia 373:

	REMOTESSH=443		REMOTESSH=443
	NEWLOCALPORT=~~18083~~		NEWLOCALPORT=12122

	LOCALSSH=22		LOCALSSH=22
	NEWREMOTEPORT=~~7722~~		NEWREMOTEPORT=12122

	~~LOGFILE~~="/home/marti/~~tunnel-hook-xx.log"~~		STARTCOMMAND="/home/marti/tunnel-start-germ2a"
	~~STARTSCRIPT="~~tunnel-start-~~xx"~~
	~~COMMAND="/home/marti/$STARTSCRIPT~~"

			LOGFILE="${0}.log"


Línia 390:		Línia 389:
	echo "$(date +'%Y-%m-%d %H:%M:%S') - Cannot connect to local tunnel $NEWLOCALPORT" \|tee -a $LOGFILE		echo "$(date +'%Y-%m-%d %H:%M:%S') - Cannot connect to local tunnel $NEWLOCALPORT" \|tee -a $LOGFILE

	sudo pkill -f -x '$~~COMMAND~~'		sudo pkill -f -x '$STARTCOMMAND'
	sudo killall $~~STARTSCRIPT~~		BASENAMESCRIPT=$(basename $STARTCOMMAND)
			sudo killall $BASENAMESCRIPT
	# sudo pkill -f "ssh -q -N -p443"		# sudo pkill -f "ssh -q -N -p443"
	sudo pkill -f "ssh -q -N -p $REMOTESSH -g -R *:$NEWREMOTEPORT:127.0.0.1:$LOCALSSH -L 127.0.0.1:$NEWLOCALPORT:127.0.0.1:$REMOTESSH"		sudo pkill -f "ssh -q -N -p $REMOTESSH -g -R *:$NEWREMOTEPORT:127.0.0.1:$LOCALSSH -L 127.0.0.1:$NEWLOCALPORT:127.0.0.1:$REMOTESSH"
	sudo killall $~~STARTSCRIPT~~		sudo killall $BASENAMESCRIPT

	$~~COMMAND~~ &		$STARTCOMMAND &

	exit		exit
Línia 414:		Línia 414:

	REMOTESSH=443		REMOTESSH=443
	NEWLOCALPORT=~~18083~~		NEWLOCALPORT=12122

	LOCALSSH=22		LOCALSSH=22
	NEWREMOTEPORT=~~7722~~		NEWREMOTEPORT=12122

	LOGFILE="~~/home/marti/tunnel-start-xx~~.log"		LOGFILE="${0}.log"

Marti: /* v5 Cron script to verify that a tunnel is working connecting through it to ssh - better */

2014-08-05T15:53:17Z

v5 Cron script to verify that a tunnel is working connecting through it to ssh - better

@@ Línia 352: / Línia 352: @@
   #sudo autossh -M 0 -q -N ... ##autossh sometimes it stops working for some reason, so now using only ssh
   sleep 5
 done
 </pre>

Marti: /* v5 Cron script to verify that a tunnel is working connecting through it to ssh - better */

2014-01-30T18:27:41Z

v5 Cron script to verify that a tunnel is working connecting through it to ssh - better

← Versió més antiga		Revisió del 18:27, 30 gen 2014
Línia 335:		Línia 335:

	LOGFILE="/home/marti/tunnel-start-xx.log"		LOGFILE="/home/marti/tunnel-start-xx.log"
	~~DATE=$(date +'%Y-%m-%d %H:%M:%S')~~

	#COMMAND="/usr/bin/ssh -f -N -p23 -i $SSHKEY -CD 8080 -g -R $REMOTE_PORT:localhost:22 $REMOTE_HOST"		#COMMAND="/usr/bin/ssh -f -N -p23 -i $SSHKEY -CD 8080 -g -R $REMOTE_PORT:localhost:22 $REMOTE_HOST"
Línia 345:		Línia 345:
	### /home/marti/routes-load		### /home/marti/routes-load

			DATE=$(date +'%Y-%m-%d %H:%M:%S')
	echo "$DATE - Starting ssh" \|tee -a $LOGFILE		echo "$DATE - Starting ssh" \|tee -a $LOGFILE

Marti: Es crea la pàgina amb «==v1 Cron script to keep a reverse tunnel==

 #!/bin/bash  REMOTE_HOST="marti@xx.server" REMOTE_PORT="1122" SSHKEY="/home/marti/.ssh/id_dsa" COMMAND="ssh -f -N -p23 ...».

2014-01-30T15:17:53Z

Es crea la pàgina amb «==v1 Cron script to keep a reverse tunnel== <pre> #!/bin/bash REMOTE_HOST="marti@xx.server" REMOTE_PORT="1122" SSHKEY="/home/marti/.ssh/id_dsa" COMMAND="ssh -f -N -p23 ...».

Pàgina nova

==v1 Cron script to keep a reverse tunnel==

<pre>
#!/bin/bash

REMOTE_HOST="marti@xx.server"
REMOTE_PORT="1122"
SSHKEY="/home/marti/.ssh/id_dsa"
COMMAND="ssh -f -N -p23 -i $SSHKEY -CD 8080 -g -R $REMOTE_PORT:localhost:22 $REMOTE_HOST"
# important: -f fa que quedi en background i el script continui
# -n fa que no obri ternimal nomes port forwarding

LOGFILE="/home/marti/routes-load.log"
DATE=$(date +'%Y-%m-%d %H:%M:%S')

#disable next line?:
echo "$DATE - Started" >> $LOGFILE

# Is the tunnel up? Perform two tests:

# 1. Check for relevant process ($COMMAND)
pgrep -f -x "$COMMAND" || ($COMMAND && echo "$DATE - Not in ps" >> $LOGFILE)

# 2. Test tunnel by looking at 'netstat' output on $REMOTE_HOST
ssh -p23 -i $SSHKEY $REMOTE_HOST netstat -an | egrep "tcp.*:$REMOTE_PORT.*LISTEN" > /dev/null 2>&1

if [ $? -ne 0 ] ; then
echo "$DATE - Not in netstat" >> $LOGFILE
pkill -f -x '$COMMAND'
$COMMAND
fi
</pre>

* more info: http://zedhead777.blogspot.de/2009/10/help-creating-cron-job-ssh-tunnel.html
* and http://www.anattatechnologies.com/q/2011/11/reverse-ssh-tunnel/

*info about sshd configuration: http://wiki.fabelier.org/index.php?title=Permanent_Reverse_SSH_Tunneling

Edit /etc/ssh/sshd_config and add/modify the following lines :
# TCPKeepAlive yes
# ClientAliveInterval 30
# ClientAliveCountMax 99999
# GatewayPorts yes
millor:
# GatewayPorts clientspecified
More information on keeping SSH connections stable: http://drupal.star.bnl.gov/STAR/comp/sofi/facility-access/ssh-stable-con

==v1.2 Cron script to keep a reverse tunnel in case pgrep is not available - better==

<pre>
#!/bin/bash

# REMOTE_HOST="marti@xx.server"
REMOTE_PORT="9922"
#SSHKEY="/home/marti/.ssh/id_dsa"
#COMMAND="ssh -p23 -i $SSHKEY -CD 8080 -f -N -g -R $REMOTE_PORT:localhost:22 $REMOTE_HOST"
COMMAND="/usr/bin/ssh -f -N -R $REMOTE_PORT:127.0.0.1:22 -L 6622:127.0.0.1:6622 unixsmod@earth ssh -R 0.0.0.0:$REMOTE_PORT:127.0.0.1:9922 -L 6622:127.0.0.1:443 -p 443 esrin@xxx.server"

LOGFILE="/home/marti/routes-load.log"
DATE=$(date +'%Y-%m-%d %H:%M:%S')

#disable next line?:
echo "$DATE - Started" >> $LOGFILE

# Is the tunnel up? Perform two tests:

# 1. Check for relevant process ($COMMAND)
if ! ps ax | grep -v grep | grep "$COMMAND" > /dev/null 2>&1
then
echo "$DATE - Not in ps" >> $LOGFILE
$COMMAND
#Potser: exit
fi

# 2. Test tunnel by looking at 'netstat' output on $REMOTE_HOST
ssh -p23 -i $SSHKEY $REMOTE_HOST netstat -an | egrep "tcp.*:$REMOTE_PORT.*LISTEN" > /dev/null 2>&1
if [ $? -ne 0 ] ; then
echo "$DATE - Not in netstat" >> $LOGFILE
pkill -f -x '$COMMAND'
$COMMAND
fi
</pre>

Si es per obrir "SSH", i a la maquina remota hi ha "nmap" es pot fer:
<pre>
# 2.
ssh -p23 -i $SSHKEY $REMOTE_HOST nmap -sV -p $REMOTE_PORT 127.0.0.1 | grep -i "OpenSSH" > /dev/null 2>&1
if [ $? -ne 0 ] ; then
echo "$DATE - Not detected as OpenSSH" >> $LOGFILE
pkill -f -x '$COMMAND'
$COMMAND
fi
</pre>

Alternativa 1:
if [ $(ps ax | grep "$COMMAND" | grep -vc grep) -lt 1 ]

Alternativa 2:
#ps ax | grep -v grep | grep "$COMMAND" > /dev/null 2>&1
#if [ $? -ne 0 ]

$? es el exit code de la ultima comanda. Si es 0=success. En cas de grep vol dir que ha trobat.

==v2 Cron script to keep a local tunnel==

login-hook
<pre>
#!/bin/bash
COMMAND="/Users/<user>/devel/tunnel-start.sh"
LOGFILE="/home/marti/routes-load.log"
DATE=$(date +'%Y-%m-%d %H:%M:%S')

if [ "$(ps ax | grep tunnel-start.sh | grep -vc grep)" -lt 1 ]; then
echo "$DATE - Not in ps" >> $LOGFILE
$COMMAND &
#sudo -u <user> /Users/<user>/devel/tunnel-start.sh &
exit
fi

#Opcional: Potser es pot mirar tambe el nestat local si el port esta obert:
netstat -an | egrep "tcp.*:$REMOTE_PORT.*LISTEN" > /dev/null 2>&1
if [ $? -ne 0 ] ; then
echo "$DATE - Not in netstat" >> $LOGFILE
pkill -f -x '$COMMAND'
$COMMAND &
fi
</pre>

tunnel-start.sh
<pre>
#!/bin/bash

while [ 1 ]; do
ssh -N -L 6667:127.0.0.1:6667 -o ServerAliveInterval=3 user@server
sleep 5
done
</pre>

More info: http://crz.lt/2007/09/26/setting-up-a-permanent-ssh-tunnel-on-mac-os-x/

-o ServerAliveInterval=15 or even 60 should be fine and with less stress:
*ServerAliveInterval: number of seconds that the client will wait before sending a null packet to the server (to keep the connection alive).
*ClientAliveInternal: number of seconds that the server will wait before sending a null packet to the client (to keep the connection alive).
Setting a value of 0 (the default) will disable these features so your connection could drop if it is idle for too long.

==Cron script to keep a double reverse tunnel (using a gateway)==

<pre>
#!/bin/bash

REMOTE_PORT="9922"
LOCAL_PORT="6722"
#COMMAND="/usr/bin/ssh -f -N -R $REMOTE_PORT:127.0.0.1:22 -L 6622:127.0.0.1:6622 unixsmod@earth ssh -R 0.0.0.0:$REMOTE_PORT:127.0.0.1:9922 -L 6622:127.0.0.1:443 -p 443 esrin@xx.server"
#COMMAND="/usr/bin/ssh -R 9922:127.0.0.1:22 -L 6622:127.0.0.1:6622 unixsmod@earth ssh -N -R 0.0.0.0:9922:127.0.0.1:9922 -L 6622:127.0.0.1:443 -p 443 esrin@xx.server"

COMMAND1="/usr/bin/ssh -f -N -L $LOCAL_PORT:xx.server:23 unixsmod@earth"
COMMAND2="/usr/bin/ssh -f -N -R 0.0.0.0:$REMOTE_PORT:127.0.0.1:22 -p $LOCAL_PORT esrin@localhost"

LOGFILE="/home/logica/checksshbackup.log"
DATE=$(date +'%Y-%m-%d %H:%M:%S')

#disable next line?:
#echo "$DATE - Started" >> $LOGFILE

# 2 tests to check if the tunnel is working:

# 1st Check the 2 processes are running
#if [ $(ps ax | grep "$COMMAND" | grep -vc grep) -lt 1 ]

if ! ps ax | grep -v grep | grep "$COMMAND1" > /dev/null 2>&1
then
echo "$DATE - Command1 not in ps" >> $LOGFILE
$COMMAND1
fi

if ! ps ax | grep -v grep | grep "$COMMAND2" > /dev/null 2>&1
then
echo "$DATE - Command2 not in ps" >> $LOGFILE
$COMMAND2
fi

# 2nd Test tunnel

ssh -p $LOCAL_PORT esrin@localhost netstat -an | egrep "tcp.*:$REMOTE_PORT.*LISTEN" > /dev/null 2>&1
if [ $? -ne 0 ] ; then
echo "$DATE - Not in netstat" >> $LOGFILE
pkill -f -x '$COMMAND1'
pkill -f -x '$COMMAND2'

$COMMAND1
$COMMAND2
#else
# echo "Ok"
fi

exit
</pre>

==v3 Cron script to keep a local/remote tunnel v3 using autossh - better==

login-hook
<pre>
#!/bin/bash
COMMAND="/home/<user>/tunnel-start.sh"
LOGFILE="/home/<user>/tunnel-start.log"
DATE=$(date +'%Y-%m-%d %H:%M:%S')

if [ "$(ps ax | grep tunnel-start.sh | grep -vc grep)" -lt 1 ]; then
echo "$DATE - Starting tunnel-start.sh" >> $LOGFILE
$COMMAND &
exit
fi
</pre>

tunnel-start.sh
<pre>
#!/bin/bash

LOGFILE="/home/<user>/tunnel-start.log"
DATE=$(date +'%Y-%m-%d %H:%M:%S')

while [ 1 ]; do
echo "$DATE - Starting autossh" >> $LOGFILE
autossh -M 0 -q -N -o "ServerAliveInterval 60" -o "ServerAliveCountMax 3" -R 8081:localhost:80 my.linuxbox.at.home
sleep 5
done
</pre>

More info: http://en.gentoo-wiki.com/wiki/Autossh

Without them, the -f option complains that it needs a command to fork and will just quit. -N says no command and -q says be quiet. Also if you would like to have a special key with no passphrase you can generate one and then use it via the -i option for ssh.

The above command will make ssh send a keep-alive request if no other data has been sent for 60 seconds, if it doesn't receive a reply after 3 attempts it will close the connection. autossh will then detect its been closed and attempt re-establish it.

The "-M 0" option disables autossh's own monitoring which uses separate ports and is less reliable.

==v4 Cron script to verify that a tunnel is working connecting through it to ssh==

El ssh executat a tunnel-start-xx2.sh conté '''-L 127.0.0.1:28083:127.0.0.1:23'''

<pre>
#!/bin/bash

COMMAND="/home/marti/tunnel-start-xx2.sh"
LOGFILE="/home/marti/tunnel-hook-xx2.log"
DATE=$(date +'%Y-%m-%d %H:%M:%S')

# Test to connect via ssh to the local forwared port
ssh -p28083 -o ConnectTimeout=1 -o ConnectionAttempts=1 marti@localhost exit
# > /dev/null 2>&1
if [ $? -ne 0 ] ; then
echo "$DATE - Cannot connect to local tunnel" |tee $LOGFILE
pkill -f -x '$COMMAND'

sudo killall tunnel-start-xx2.sh
sudo killall sshguard
sudo killall autossh
sudo killall tunnel-start-xx2.sh
sudo killall sshguard
sudo killall autossh
sudo killall tunnel-start-xx2.sh
sudo killall sshguard
sudo killall autossh

$COMMAND &
exit
fi
</pre>

==v5 Cron script to verify that a tunnel is working connecting through it to ssh - better==

tunnel-hook-xx
<pre>
#!/bin/bash

COMMAND="/home/marti/tunnel-start-xx"
LOGFILE="/home/marti/tunnel-hook-xx.log"
DATE=$(date +'%Y-%m-%d %H:%M:%S')

# Test to connect via ssh to the local forwared port
ssh -p18083 -o ConnectTimeout=2 -o ConnectionAttempts=1 -i /home/marti/.ssh/id_dsa marti@localhost exit
# > /dev/null 2>&1
if [ $? -ne 0 ] ; then
echo "$DATE - Cannot connect to local tunnel" |tee -a $LOGFILE

sudo pkill -f -x '$COMMAND'
sudo killall tunnel-start-xx
sudo killall autossh
sudo pkill -f "ssh -q -N -p443"
sudo killall tunnel-start-xx

$COMMAND &

sleep 1
/home/marti/tunnel-hook-xx-test

exit
fi
</pre>

tunnel-start-xx

<pre>
#!/bin/bash

REMOTE_HOST="vpn@xx.server"
SSHKEY="/home/marti/.ssh/id_dsa"

LOGFILE="/home/marti/tunnel-start-xx.log"
DATE=$(date +'%Y-%m-%d %H:%M:%S')

#COMMAND="/usr/bin/ssh -f -N -p23 -i $SSHKEY -CD 8080 -g -R $REMOTE_PORT:localhost:22 $REMOTE_HOST"
# -f fa que quedi en background i el script continui
# -n fa que no obri ternimal nomes port forwarding

while [ 1 ]; do
# Carregem les routes per utilitzar la xarxa sense fils:
### /home/marti/routes-load

echo "$DATE - Starting ssh" |tee -a $LOGFILE

#Connecta a xx.server a traves de LAN amb el proxy X.X.X.X
sudo ssh -q -N -p443 -i $SSHKEY -CD 18081 -L 127.0.0.1:18082:127.0.0.1:3333 -L 127.0.0.1:18083:127.0.0.1:23 -L 127.0.0.1:18084:aspmx.l.google.com:25 -o "ProxyCommand /usr/bin/corkscrew X.X.X.X 8080 %h %p" -o "ServerAliveInterval 10" -o "ServerAliveCountMax 2" -g -R *:7722:localhost:22 $REMOTE_HOST
#sudo autossh -M 0 -q -N ... ##autossh sometimes it stops working for some reason, so now using only ssh

sleep 5
done
</pre>