Michael Schiemer
24cbbccf4c
- Update Ansible playbooks and roles for application deployment - Add new Gitea/Traefik troubleshooting playbooks - Update Docker Compose configurations (base, local, staging, production) - Enhance EncryptedEnvLoader with improved error handling - Add deployment scripts (autossh setup, migration, secret testing) - Update CI/CD workflows and documentation - Add Semaphore stack configuration
429 lines
8.5 KiB
Markdown
429 lines
8.5 KiB
Markdown
# Autossh Setup - Persistente SSH-Verbindungen
|
|
|
|
**Status**: ? Ready
|
|
**Last Updated**: 2025-01-31
|
|
**Purpose**: Automatische ?berwachung und Neustart von SSH-Verbindungen zum Production-Server
|
|
|
|
---
|
|
|
|
## ?bersicht
|
|
|
|
Autossh ist ein Tool, das SSH-Verbindungen automatisch ?berwacht und neu aufbaut, wenn sie abbrechen. Dies ist besonders n?tzlich f?r:
|
|
- SSH-Tunnel zu entfernten Servern
|
|
- Persistente SSH-Verbindungen f?r Ansible/CI/CD
|
|
- Automatische Verbindungswiederherstellung nach Netzwerkunterbrechungen
|
|
|
|
---
|
|
|
|
## Installation
|
|
|
|
### Linux (Ubuntu/Debian)
|
|
|
|
```bash
|
|
sudo apt update
|
|
sudo apt install autossh
|
|
```
|
|
|
|
### macOS
|
|
|
|
```bash
|
|
brew install autossh
|
|
```
|
|
|
|
### WSL2 / Windows
|
|
|
|
Autossh ist normalerweise ?ber das Linux-Subsystem verf?gbar. Falls nicht:
|
|
|
|
```bash
|
|
# In WSL2
|
|
sudo apt update
|
|
sudo apt install autossh
|
|
```
|
|
|
|
---
|
|
|
|
## Konfiguration
|
|
|
|
### Schritt 1: SSH-Config erweitern
|
|
|
|
Erweitere deine `~/.ssh/config` mit Keep-Alive und ServerAliveInterval Optionen:
|
|
|
|
```bash
|
|
# Edit SSH config
|
|
nano ~/.ssh/config
|
|
```
|
|
|
|
F?ge folgende Konfiguration hinzu:
|
|
|
|
```
|
|
# Production Server - Persistent Connection
|
|
Host production
|
|
HostName 94.16.110.151
|
|
User deploy
|
|
IdentityFile ~/.ssh/production
|
|
ServerAliveInterval 60
|
|
ServerAliveCountMax 3
|
|
TCPKeepAlive yes
|
|
Compression yes
|
|
StrictHostKeyChecking accept-new
|
|
|
|
# Git Server - Persistent Connection
|
|
Host git.michaelschiemer.de
|
|
HostName git.michaelschiemer.de
|
|
Port 2222
|
|
User git
|
|
IdentityFile ~/.ssh/git_michaelschiemer
|
|
ServerAliveInterval 60
|
|
ServerAliveCountMax 3
|
|
TCPKeepAlive yes
|
|
Compression yes
|
|
StrictHostKeyChecking no
|
|
UserKnownHostsFile /dev/null
|
|
```
|
|
|
|
**Wichtige Optionen:**
|
|
- `ServerAliveInterval 60`: Sendet alle 60 Sekunden ein Keep-Alive-Signal
|
|
- `ServerAliveCountMax 3`: Gibt nach 3 fehlgeschlagenen Keep-Alive-Versuchen auf
|
|
- `TCPKeepAlive yes`: Nutzt TCP Keep-Alive f?r zus?tzliche Persistenz
|
|
|
|
### Schritt 2: Autossh als Service einrichten
|
|
|
|
#### Option A: Systemd Service (Linux/WSL2)
|
|
|
|
Erstelle einen systemd Service f?r autossh:
|
|
|
|
```bash
|
|
# Create systemd service directory
|
|
mkdir -p ~/.config/systemd/user
|
|
|
|
# Create service file
|
|
nano ~/.config/systemd/user/autossh-production.service
|
|
```
|
|
|
|
Service-Datei Inhalt:
|
|
|
|
```ini
|
|
[Unit]
|
|
Description=AutoSSH for Production Server
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
Environment="AUTOSSH_GATETIME=0"
|
|
Environment="AUTOSSH_POLL=10"
|
|
ExecStart=/usr/bin/autossh -M 20000 -N -o "ServerAliveInterval=60" -o "ServerAliveCountMax=3" production
|
|
Restart=always
|
|
RestartSec=10
|
|
|
|
[Install]
|
|
WantedBy=default.target
|
|
```
|
|
|
|
**Wichtige Hinweise:**
|
|
- `-M 20000`: Monitoring-Port (nur Port-Nummer, nicht IP:Port!)
|
|
- `-N`: Keine Remote-Commands (nur persistente Verbindung)
|
|
- **Kein `-f` Flag**: Bei systemd Type=simple wird `-f` nicht ben?tigt, da systemd die Background-Operation ?bernimmt
|
|
|
|
**Service aktivieren:**
|
|
|
|
```bash
|
|
# Reload systemd user services
|
|
systemctl --user daemon-reload
|
|
|
|
# Enable service (startet automatisch beim Login)
|
|
systemctl --user enable autossh-production.service
|
|
|
|
# Start service
|
|
systemctl --user start autossh-production.service
|
|
|
|
# Check status
|
|
systemctl --user status autossh-production.service
|
|
|
|
# View logs
|
|
journalctl --user -u autossh-production.service -f
|
|
```
|
|
|
|
#### Option B: Manuelle Autossh-Verbindung
|
|
|
|
F?r manuelle/tempor?re Verbindungen:
|
|
|
|
```bash
|
|
# Start autossh mit Monitoring-Port
|
|
autossh -M 20000 -N -f -o "ServerAliveInterval=60" -o "ServerAliveCountMax=3" production
|
|
|
|
# Check if running
|
|
ps aux | grep autossh
|
|
|
|
# Stop autossh
|
|
pkill autossh
|
|
```
|
|
|
|
**Parameter-Erkl?rung:**
|
|
- `-M 20000`: Monitoring-Port (autossh nutzt diesen zum Health-Check)
|
|
- `-N`: Keine Remote-Commands ausf?hren (nur Tunnel)
|
|
- `-f`: Im Hintergrund laufen
|
|
- `-o "ServerAliveInterval=60"`: SSH Keep-Alive alle 60 Sekunden
|
|
- `-o "ServerAliveCountMax=3"`: Nach 3 Fehlversuchen aufgeben
|
|
|
|
#### Option C: SSH-Tunnel mit Autossh
|
|
|
|
F?r SSH-Tunnel (z.B. Port-Forwarding):
|
|
|
|
```bash
|
|
# Forward local port 8080 to remote 80
|
|
autossh -M 20000 -N -f -L 8080:localhost:80 production
|
|
|
|
# Forward remote port 3306 to local
|
|
autossh -M 20000 -N -f -R 3306:localhost:3306 production
|
|
|
|
# Check tunnel
|
|
ps aux | grep autossh
|
|
ss -tuln | grep 8080
|
|
```
|
|
|
|
---
|
|
|
|
## Testing
|
|
|
|
### Verbindung testen
|
|
|
|
```bash
|
|
# Test normal SSH
|
|
ssh production "echo 'Connection successful'"
|
|
|
|
# Test autossh connection
|
|
autossh -M 20000 -v -N -o "ServerAliveInterval=60" production
|
|
|
|
# Check if autossh is monitoring
|
|
ps aux | grep autossh
|
|
netstat -tuln | grep 20000
|
|
```
|
|
|
|
### Verbindungsstatus ?berwachen
|
|
|
|
```bash
|
|
# Check active SSH connections
|
|
ssh production "who"
|
|
|
|
# Check autossh process
|
|
ps aux | grep autossh
|
|
|
|
# Check systemd service status
|
|
systemctl --user status autossh-production.service
|
|
|
|
# View logs
|
|
journalctl --user -u autossh-production.service --since "10 minutes ago"
|
|
```
|
|
|
|
---
|
|
|
|
## Troubleshooting
|
|
|
|
### Autossh startet nicht
|
|
|
|
**Problem**: Autossh-Process startet nicht oder crasht sofort
|
|
|
|
**L?sung**:
|
|
```bash
|
|
# Test SSH-Verbindung manuell
|
|
ssh -v production "echo test"
|
|
|
|
# Test autossh mit verbose logging
|
|
autossh -M 20000 -v -N production
|
|
|
|
# Pr?fe SSH-Config
|
|
ssh -F ~/.ssh/config production "echo test"
|
|
|
|
# Pr?fe Berechtigungen
|
|
ls -la ~/.ssh/production
|
|
chmod 600 ~/.ssh/production
|
|
```
|
|
|
|
### Verbindung bricht trotzdem ab
|
|
|
|
**Problem**: Verbindung bricht auch mit autossh regelm??ig ab
|
|
|
|
**L?sung**:
|
|
1. **Erh?he Keep-Alive-Interval:**
|
|
```bash
|
|
# In ~/.ssh/config
|
|
ServerAliveInterval 30
|
|
ServerAliveCountMax 10
|
|
```
|
|
|
|
2. **Pr?fe Netzwerk/Firewall:**
|
|
```bash
|
|
# Test network connectivity
|
|
ping 94.16.110.151
|
|
|
|
# Test SSH port
|
|
nc -zv 94.16.110.151 22
|
|
```
|
|
|
|
3. **Pr?fe Server-Konfiguration:**
|
|
```bash
|
|
# Auf dem Server pr?fen
|
|
ssh production "cat /etc/ssh/sshd_config | grep -E 'ClientAlive|TCPKeepAlive'"
|
|
```
|
|
|
|
### Port-Konflikte
|
|
|
|
**Problem**: Monitoring-Port (20000) ist bereits belegt
|
|
|
|
**L?sung**:
|
|
```bash
|
|
# W?hle einen anderen Port
|
|
autossh -M 20001 -N -f production
|
|
|
|
# Oder nutze einen zuf?lligen Port
|
|
autossh -M 0 -N -f production # 0 = random port
|
|
```
|
|
|
|
---
|
|
|
|
## Best Practices
|
|
|
|
### 1. Monitoring-Port anpassen
|
|
|
|
Wenn mehrere autossh-Instanzen laufen, nutze verschiedene Monitoring-Ports:
|
|
|
|
```bash
|
|
# Production Server
|
|
autossh -M 20000 -N -f production
|
|
|
|
# Git Server
|
|
autossh -M 20001 -N -f git.michaelschiemer.de
|
|
```
|
|
|
|
### 2. Systemd Service f?r Produktivit?t
|
|
|
|
Nutze systemd Services f?r automatischen Start:
|
|
|
|
```bash
|
|
# Enable lingering f?r user services
|
|
sudo loginctl enable-linger $USER
|
|
|
|
# Services starten beim Boot
|
|
systemctl --user enable autossh-production.service
|
|
```
|
|
|
|
### 3. Logging konfigurieren
|
|
|
|
F?r besseres Debugging:
|
|
|
|
```bash
|
|
# Systemd service mit logging
|
|
[Service]
|
|
ExecStart=/usr/bin/autossh -M 20000 -v -N -o "ServerAliveInterval=60" -o "LogLevel=DEBUG" production
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
```
|
|
|
|
### 4. Automatischer Neustart
|
|
|
|
Systemd Service startet automatisch neu, aber f?r manuelle Instanzen:
|
|
|
|
```bash
|
|
# Mit automatischem Restart
|
|
while true; do
|
|
autossh -M 20000 -N production || sleep 10
|
|
done
|
|
```
|
|
|
|
---
|
|
|
|
## Integration mit Ansible
|
|
|
|
Autossh kann auch f?r Ansible-Verbindungen genutzt werden:
|
|
|
|
```yaml
|
|
# ansible.cfg
|
|
[defaults]
|
|
transport = ssh
|
|
pipelining = True
|
|
ssh_args = -o ServerAliveInterval=60 -o ServerAliveCountMax=3
|
|
control_path = ~/.ansible/cp/%%h-%%p-%%r
|
|
```
|
|
|
|
Oder nutze die SSH-Config direkt (empfohlen):
|
|
|
|
```bash
|
|
# ~/.ssh/config ist bereits f?r Ansible nutzbar
|
|
ansible production -m ping
|
|
```
|
|
|
|
---
|
|
|
|
## Sicherheitshinweise
|
|
|
|
1. **SSH-Keys sch?tzen:**
|
|
```bash
|
|
chmod 600 ~/.ssh/production
|
|
chmod 644 ~/.ssh/production.pub
|
|
```
|
|
|
|
2. **Monitoring-Port absichern:**
|
|
```bash
|
|
# Monitoring-Port nur lokal verf?gbar
|
|
autossh -M 127.0.0.1:20000 -N -f production
|
|
```
|
|
|
|
3. **Keine Passw?rter:**
|
|
- Nutze immer SSH-Keys
|
|
- Keine Passw?rter in autossh-Commands
|
|
|
|
---
|
|
|
|
## Quick Reference
|
|
|
|
### Makefile-Befehle
|
|
|
|
```bash
|
|
# SSH-Verbindung zum Production-Server
|
|
make ssh
|
|
# oder
|
|
make ssh-production
|
|
|
|
# SSH-Verbindung zum Git-Server
|
|
make ssh-git
|
|
|
|
# Status der autossh-Services pr?fen
|
|
make ssh-status
|
|
|
|
# Logs der autossh-Services anzeigen
|
|
make ssh-logs
|
|
|
|
# Autossh einrichten
|
|
make setup-autossh
|
|
```
|
|
|
|
### Manuelle Befehle
|
|
|
|
```bash
|
|
# Service starten
|
|
systemctl --user start autossh-production.service
|
|
|
|
# Service stoppen
|
|
systemctl --user stop autossh-production.service
|
|
|
|
# Service Status
|
|
systemctl --user status autossh-production.service
|
|
|
|
# Logs anzeigen
|
|
journalctl --user -u autossh-production.service -f
|
|
|
|
# Manuelle Verbindung (ohne systemd)
|
|
autossh -M 20000 -N -f production
|
|
|
|
# Verbindung beenden
|
|
pkill autossh
|
|
```
|
|
|
|
---
|
|
|
|
## Weitere Ressourcen
|
|
|
|
- [Autossh Manual](https://www.harding.motd.ca/autossh/)
|
|
- [SSH Keep-Alive Documentation](https://www.ssh.com/academy/ssh/config)
|
|
- [Systemd User Services](https://wiki.archlinux.org/title/Systemd/User)
|