Or how to build tunnels and tunneled tunnels

SSH settings

First of all you need a program to allow SSH to use a SOCKS proxy. Its name is connect (name of the executable) or connect-proxy (sometimes name of the package). You can install it with 

# sudo apt-get install connect-proxy # on debian/ubuntu
# sudo emerge connect                # on gentoo

On otherwise you can get the source code here

# wget http://www.taiyo.co.jp/~gotoh/ssh/connect.c
# gcc connect.c -o connect          # on linux 
# gcc connect.c -o connect -lresolv # on macOS

And then you put the connect binary into your path.

Now you need to configure ssh in order to use proxies by editing your ~/.ssh/config file

Host lxplus.cern.ch
    ProxyCommand connect %h %p
Host *.cern.ch
    ProxyCommand connect -S 127.0.0.1:10040 %h %p
Host *.cms
    ProxyCommand connect -S 127.0.0.1:10090 %h %p
Host *
    ControlPath ~/.ssh/master-%r@%h:%p
    ControlMaster auto
    ForwardX11 yes

By doing this you tell ssh to

  • Always connect directly to lxplus.cern.ch
  • Use a local SOCKS proxy on port 10040 to connect to .cern.ch
  • Use a local SOCKS proxy on port 10090 to connect to .cms

COnfiguring automatic tunnels

Given this configuration, you always need a proxt to connect anywhere in .cern.ch. The simple solution is using a tunnel manager program (gSTM for ubuntu works just fine, but I've been told that there are others, also for macOS).

We will define two tunnels for CERN: one (default) for when we are at CERN, and another for when we are at home

  • CERNinside. host: localhost, username YOURLOCALUSER, dynamic on port 10040, autostart
  • CERNoutside. host: lxplus.cern.ch, username YOURAFSLUSER, dynamic on port 10040, no autostart

When we are outside CERN we just have to stop the CERNinside tunnel and start the CERNoutside tunnel. Then we can setup the CMS tunnel:

  • CMSTunnel. host: cmsusr0.cern.ch, username YOURCMSUSER, dynamic on port 10090, no autostart

This tunnel is opened with an ssh onto a pc named *.cern.ch, thus it will try always to tunnel into a proxy. By default it will find the CERNinside proxy running, or it will find the CERNoutside if you started it.

Now even if you are at home you'll be able to ssh to any .cern.ch or .cms pc directly from any shell as long as gSTM says that the tunnels are ok

Also thanks to the ControlPath ~/.ssh/master-%r@%h:%p command in the config you'll never open twice a connection to the same machine, but the second ssh will be tunneled throught the first one.

Connection lost: what do I do?

Occasionally you will lose the connection and you want to clean up all the tunnels. That is easy as:

# killall gstm 
# killall ssh
# rm -f ~/.ssh/master*
# gstm&