How to provide "reverse ssh" to a shell?

linux shell ssh remote-access nat
The Archetypal Paul picture The Archetypal Paul · Aug 3, 2012 · Viewed 9.8k times · Source

Scenario:

Many embedded devices (running Linux) out in the fields, behind routers so NAT'd and we can't make connections to them.

We need for a support person to be able to initiate a terminal/shell session on any of the devices.

Their local terminal will also be NAT'd behind a corporate firewall, so we need some central "meeting point" that both they and the device can connect to.

If necessary, we could require the support person to log into some sort of terminal server, but I'd prefer a solution that just popped up a terminal window on their desktop.

We can (through other means) tell the device to execute some arbitary script or application to start up the session.

Without the NAT, it's just SSH to the device and away we go. But what are my options in this NAT'd environment?

We're OK to develop code at either end or at the meeting point server if required, but obviously if there are apps out there so we don't have to write stuff, even better.

Pointers to other questions I may have missed (although I have looked) or to applications that I should consider for the central "meeting point" server welcomed

Answer

Anders Lindahl picture Anders Lindahl · Aug 3, 2012

How about simply setting up an ssh server that is reachable by both the device and the support user, and have the device set up a reverse tunnel (using remote port forwarding)?

ssh -R 10022:localhost:22 device@server

Then the support personnel can simply connect to the server and log on using 

ssh -p 10022 localhost

Of course there are several security aspects that need to be accounted for here, depending on what kind of information the devices hold/have access to and how the support organization is set up.

Related questions

Automatically enter SSH password with script

I need to create a script that automatically inputs a password to OpenSSH ssh client. Let's say I need to SSH into myname@somehost with the password a1234b. I've already tried... #~/bin/myssh.sh ssh myname@somehost a1234b ...…

Read More
Pseudo-terminal will not be allocated because stdin is not a terminal

I am trying to write a shell script that creates some directories on a remote server and then uses scp to copy files from my local machine onto the remote. Here's what I have so far: ssh -t user@server&…

Read More
write a shell script to ssh to a remote machine and execute commands

I have two questions: There are multiple remote linux machines, and I need to write a shell script which will execute the same set of commands in each machine. (Including some sudo operations). How can this be done using shell …

Read More