Reliable way to create secure tunnels from startup on an ubuntu laptop?

Question

I'm looking for a reliable way to start a secure tunnel at boot on a laptop.

This tunnel will not be needed by other parts of the boot process, but could be needed at any subsequent time by a user. It should "just work", the user should not have to monitor and fix it.

The secure tunnel will "pull in a port" from a insecure application bound to localhost (in this case, a redis database) on a remote server to the ubuntu laptop.

Example:

remote server: example.net

remote port to forward: 6379, bound only to localhost from example.net

remote user: mole@example.net

keyfile: mole@example.net has authorized a ssh keypair with no passphrase, one key is stored in authorized_keys on the server and the other in /root/moleKey.rsa on the laptop

This works inside a terminal window on the laptop:

$ sudo su
...
# ssh -i /root/moleKey.rsa -L 16379:localhost:6379 mole@example.net -N &
# exit
$ telnet localhost 16379
(works fine)
^C

So then I tried putting

ssh -i /root/moleKey.rsa -L 16379:localhost:6379 mole@example.net -N &

into /etc/rc.local

But that doesn't work reliably, the ssh process was gone when the tunnel was needed and I can't find any error lines for it in syslog or messages

Is there a more reliable way to start the secure tunnel at boot-up, or perhaps a manager that will restart the secure tunnel as needed?

Answer 1

I was having the same issues with /etc/rc.local not being persistent through reboots

Upstart is a good solution and this works for me:

# location: /etc/init/tunnel.conf 
description "persistent ssh tunnel through reboots"
author "morgan mcdaris <morganmcdaris@gmail.com>"

start on (local-filesystems and net-device-up IFACE=eth0)
stop on runlevel [016]

respawn
respawn limit 5 60

script
  exec su LOCAL_USERNAME -c "ssh -N -R 4040:localhost:22 -i /home/LOCAL_USERNAME/.ssh/id_rsa REMOTE_USERNAME@REMOTE_MACHINE_IP"
end script

post-start script
   PID=`status tunnel | egrep -oi '([0-9]+)$' | head -n1`
   echo $PID > /var/run/tunnel.pid
end script

post-stop script
    rm -f /var/run/tunnel.pid
end script

you need to enter your values for: LOCAL_USERNAME REMOTE_USERNAME REMOTE_MACHINE_IP

after that you can start it up by rebooting or:

$ sudo start tunnel

the post-start scripts give a pid file if you want to do some monit stuff

Answer 2

For ubuntu 11.10+, the package "gstm" does OK at providing an easier way to set up the tunnel.

see

http://web.archive.org/web/20150318153045/http://linuxers.org/article/manage-your-ssh-tunnel-redirects-graphically-using-gnome-ssh-tunnel-manager (original link now dead)