cloudflare / cloudflare/cloudflared
Can't multiplex SSH connections with cloudflared and OpenSSH 8.0+
- Dominant language
- Go
- Stars
- 15.6k
- Forks
- 1.4k
- PR merge metrics
- No merged PRs in 30d
Description
Using the SSH option `ControlPersist` while tunneling via `cloudflared` causes the auth prompt to be discarded, effectively rendering the user unable to authenticate. Apparently in OpenSSH 8.0 they started redirecting the stderr of any configured `ProxyCommand` to `/dev/null` to avoid console spam: https://www.openssh.com/txt/release-8.0
I'm not sure how this could be addressed. Both `stdin` and `stdout` are reserved for use by OpenSSH and it expects only SSH-related data. Using `ControlMaster` without `ControlPersist` isn't nearly as useful because closing the first session will also kill any other multiplexed sessions; this requires keeping track of which session was first or figuring out some way of daemonizing SSH while still getting the `cloudflared` output.
I'm not a Go developer, but would it be possible to play some kind of shell game with the passed pipes, similar to this: https://dmitry.khlebnikov.net/2016/07/25/ssh-interactive-proxycommand/
To reproduce:
- Add the following to your `~/.ssh/config` file
```
Host *
ControlMaster auto
ControlPersist 30
```
- Attempt to connect to a Cloudflared-tunneled host, after making sure that any auth has expired
- Note that the connection appears to hang
- Remove the `ControlPersist` line from `ssh_config` and try connecting again; it should work
Contributor guide
Assessment
This issue has not been assessed yet.