Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Default to using control sockets for SSH persisting 15 minutes #25

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

ClashTheBunny
Copy link
Contributor

This then requires only one auth for SSH each backup. This is
convenient if you auth with a password or some key that isn't in root's
ssh-agent.

If you backup more often than the default ControlPersist (say, in a loop
every 10 minutes), you can auth once you start you internet connection
and then it will reuse it for every subsequent backup.

This is supported since 2004 on the client side for OpenSSH.

This then requires only one auth for SSH each backup.  This is
convenient if you auth with a password or some key that isn't in root's
ssh-agent.

If you backup more often than the default ControlPersist (say, in a loop
every 10 minutes), you can auth once you start you internet connection
and then it will reuse it for every subsequent backup.

This is supported since 2004 on the client side for OpenSSH.
@jollyjinx
Copy link
Owner

As it's only a setting for the ssh command - I don't see the value in changing the default for your case or am I missing something here ?

@ClashTheBunny
Copy link
Contributor Author

The bug that this is trying to fix is that you need to auth twice for every filesystem. If you don't have key based auth, you need to watch the process pretty diligently to avoid the 1 minute ssh timeout. What would you suggest to prevent this?

I've thought about a key that can only do zfs commands, you could allow root on you laptop to always do everything on your server, you could use root's ability to read keys in user directories to auth, but then you need a non-password protected key, or we could document .ssh/config examples equivalent to these?

All of those situations are still compatible with this setting. This could also be fixed with just documenting these different options with the trade-offs. If we could move this to a non-default option that concatenates to the ssh options it would be fairly usable for me too. Something like --localcontrolsocket and --remotecontolsocket? I would like for it all to be in one place such that user and compression are all configured there too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants