Re: Permanent SSH Tunnel

am i missing something, isn't the authorized_keys files only public
keys?  i would think that that should be something that doesn't need
protection.


On 9/21/05, Michael Bond <[email protected]> wrote:
> This works great if you are the only admin on both boxes, but if
> someone else admins the box as well (or, if you are not root at all)
> and can see your authorized_keys file this isn't the best idea.
>
> One thing i've been playing with recently is using scripts to monitor
> various things, and having the scripts report back to me (via rss)
> when something goes wrong. This doesn't provide instant feedback (my
> aggregator only checks every hour), but it does help to let me know
> something is wrong with services i wouldn't be watching otherwise.
>
> Mike.
> [email protected]
>
>
> On Sep 21, 2005, at 6:09 AM, Brian Masney wrote:
>
> > Hey Dave,
> >    You could also generate a SSH key with no password on the client
> > (ssh-keygen -t dsa) and then add that key to ~user/.ssh/
> > authorized_keys on the
> > server. This is useful in scenarios where the SSH tunnel doesn't
> > always have
> > to be up.
> >
> > Brian
> >
> >
> > On Tue, Sep 20, 2005 at 10:27:52PM -0400, David A. Riggs wrote:
> >
> >> Due to an unfortunate kludge of an integration project, I need to
> >> rely
> >> on an SSH tunnel providing access to a database on another host. The
> >> server will only allow database connections from localhost. I've
> >> got an
> >> SSH tunnel set up as follows:
> >>
> >> $> ssh -fNL 3306:localhost:3306 user@dbserver
> >>
> >> which connects my local port 3306 (MySQL) via the SSH connection
> >> user@dbserver, to port 3306 on dbserver *from* dbserver.
> >>
> >> My concern is that this solution is a fragile one, I fear that a
> >> network
> >> interruption will sever this connection at some point leaving my
> >> local
> >> application stranded from its database. I've not yet observed
> >> this, but
> >> I frequently have interactive SSH sessions broken and suspect this
> >> one
> >> could be broken as well.
> >>
> >> Can anyone suggest a more robust solution to this problem? I don't
> >> have
> >> a full grasp of stunnel, but it seems that it could be triggered from
> >> inetd to perform this task perhaps? Could something like runit be
> >> used
> >> to reestablish the SSH connection if it fails? Is there some obscure
> >> product that does exactly what I need?
> >>
> >> - David A. Riggs <[email protected]>
> >>
> >> _______________________________________________
> >> Morlug mailing list
> >> [email protected]
> >> http://mailman.morlug.org/mailman/listinfo/morlug
> >>
> >>
> > _______________________________________________
> > Morlug mailing list
> > [email protected]
> > http://mailman.morlug.org/mailman/listinfo/morlug
> >
>
> _______________________________________________
> Morlug mailing list
> [email protected]
> http://mailman.morlug.org/mailman/listinfo/morlug
>