Raist,
I had a similar problem. I solved it by setting a flag file in a
central location that all the remote boxes could see.
1) Copy the appropriate SSH public keys across to your central admin
box. Add them to ~/.ssh/authorized_keys or authorized_keys2 files.
Make sure the remote client can connect to you without a password.
2) On a central FTP or HTTP site, set up a flag file. Mine is a simple
flag.html and contains a 0 or a 1.
3) For each client, write a cron script using wget or another tool to
automatically check either for the existence of this file, or specific
content. If the flag is set, then bring up a ssh connection. In
addition to grabbing a remote port, issue a sleep command. This will
keep the window of opportunity open.
Here's my cron script:
--------------------------------------------------------------
#!/bin/sh
# DELETE OLD FLAG FILE
rm /root/.ssh/flag.html
# GET NEW FLAG FILE
http_proxy=ncache.entp.attws.com:8080 /usr/local/bin/wget\
-q http://206.x.y.z/flag.html -O /root/.ssh/flag.html
read FLAG < /root/.ssh/flag.html
# IF FLAG FILE CONTAINS "1" THEN SETUP SSH CONNECTION, OTHERWISE EXIT
if test $FLAG -eq 1
then
exec /usr/bin/ssh -nfg -R 2222:127.0.0.1:22 -lroot 206.x.y.z -o\
keepalive=yes sleep 60
fi
-----------------------------------------------------------
The -R 2222:127.0.0.1:22 is what does the reverse trick. We grab port
2222 on the REMOTE machine and forward it to localhost:22
4) When you want to connect to a specific machine, set the flag file.
The remote cron will detect the flag and grab a port on your machine (2222).
5) Now you need to ssh to localhost port 2222, and end up on the remote
machine. You can add other ports to forward, too. The only problem
I've seen is ssh will be confused with ssh to localhost if you've
already ssh'd to it before. Simply remove it from your known_hosts file
or use 127.0.0.1.
6) When done, make sure you change the flag file back. Otherwise,
frequent ssh setup & teardowns will attract the attention of the
security folk...
I'd love to hear of a more elegant solution, maybe using ping or port
knocking. I did it this way so an hourly ssh session wouldn't raise
flags with the security guys, as well as getting through the firewall.
Ftp/Http is a little more subtle.
-Abe
