Bulletproof SSH Tunnel using Cygwin and AutoSSH

Ever try to get around those pesky firewalls at work? Well here is a way to setup permanent SSH tunnels that will self heal! The main reason I set this up was so that I wouldn’t have to keep setting up firewall holes in my remote routers. All of my systems now phone home and allow me to always have permanent connections.

You will need the following:

  • autossh
  • cygwin on Windows 7
  • cygrunsrv on cygwin
  • cron on cygwin
  • openssh on cygwin

Setup your shared keys between your servers. Make sure you are using the same user across both machines.

  • ssh-keygen.exe -t rsa
  • scp ~/.ssh/id_rsa.pub to your remote host and put in ~/.ssh/authorized_keys2 file
  • test “ssh [email protected]

Setup autossh on Cygwin

  • just install it from repository

Create a tunnel script on your originating server.

a=(`ps -ef | grep autossh | grep -v grep`)
if [ ! “$a” ]; then  /usr/bin/autossh.exe -M 10984 -N -f -R 6666:localhost:22 [email protected] -p 40022 &

Install CRON for Cygwin and run cron-config to setup cron. Just take the defaults but add your username and password.

  • run cygwin setup.exe to install cron
  • run “cron-config” to setup cron
  • start up the cron service “net start cron”

Add the check script to the users’ crontab

  • crontab -e
  • * * * * /home/user/tuncheck.sh
  • run “crontab -l” to verify

Verify operation

  • on originating server run “ps -ef |grep auto”
  • You should see the process running “14:50:01 /usr/bin/autossh”
  • on remote server run “ssh -p 6666 [email protected]
  • You should get logged onto the originating server.

Dont forget to turn off your power management on the originating server. Needs to stay alive!



CYGWIN install on Windows 8 ssh-host-config as well!

Install cygwin from cygwin.com

Run cygwin shell as “Administrator”

Run “ssh-host-config”

$ ssh-host-config

*** Info: Generating /etc/ssh_host_key
*** Info: Generating /etc/ssh_host_rsa_key
*** Info: Generating /etc/ssh_host_dsa_key
*** Info: Generating /etc/ssh_host_ecdsa_key
*** Info: Creating default /etc/ssh_config file
*** Info: Creating default /etc/sshd_config file
*** Info: Privilege separation is set to yes by default since OpenSSH 3.3.
*** Info: However, this requires a non-privileged account called ‘sshd’.
*** Info: For more info on privilege separation read /usr/share/doc/openssh/README.privsep.
*** Query: Should privilege separation be used? (yes/no) yes
*** Info: Note that creating a new user requires that the current account have
*** Info: Administrator privileges. Should this script attempt to create a
*** Query: new local account ‘sshd’? (yes/no) yes
*** Info: Updating /etc/sshd_config file

*** Query: Do you want to install sshd as a service?
*** Query: (Say “no” if it is already installed as a service) (yes/no) yes
*** Query: Enter the value of CYGWIN for the daemon: [] binmod ntsec
*** Info: On Windows Server 2003, Windows Vista, and above, the
*** Info: SYSTEM account cannot setuid to other users — a capability
*** Info: sshd requires. You need to have or to create a privileged
*** Info: account. This script will help you do so.

*** Info: You appear to be running Windows XP 64bit, Windows 2003 Server,
*** Info: or later. On these systems, it’s not possible to use the LocalSystem
*** Info: account for services that can change the user id without an
*** Info: explicit password (such as passwordless logins [e.g. public key
*** Info: authentication] via sshd).

*** Info: If you want to enable that functionality, it’s required to create
*** Info: a new account with special privileges (unless a similar account
*** Info: already exists). This account is then used to run these special
*** Info: servers.

*** Info: Note that creating a new user requires that the current account
*** Info: have Administrator privileges itself.

*** Info: No privileged account could be found.

*** Info: This script plans to use ‘cyg_server’.
*** Info: ‘cyg_server’ will only be used by registered services.
*** Query: Do you want to use a different name? (yes/no) no
*** Query: Create new privileged user account ‘cyg_server’? (yes/no) yes
*** Info: Please enter a password for new user cyg_server. Please be sure
*** Info: that this password matches the password rules given on your system.
*** Info: Entering no password will exit the configuration.
*** Query: Please enter the password:
*** Query: Reenter:

*** Info: User ‘cyg_server’ has been created with password ‘xxxxxxxx’.
*** Info: If you change the password, please remember also to change the
*** Info: password for the installed services which use (or will soon use)
*** Info: the ‘cyg_server’ account.

*** Info: Also keep in mind that the user ‘cyg_server’ needs read permissions
*** Info: on all users’ relevant files for the services running as ‘cyg_server’.
*** Info: In particular, for the sshd server all users’ .ssh/authorized_keys
*** Info: files must have appropriate permissions to allow public key
*** Info: authentication. (Re-)running ssh-user-config for each user will set
*** Info: these permissions correctly. [Similar restrictions apply, for
*** Info: instance, for .rhosts files if the rshd server is running, etc].
*** Info: The sshd service has been installed under the ‘cyg_server’
*** Info: account. To start the service now, call `net start sshd’ or
*** Info: `cygrunsrv -S sshd’. Otherwise, it will start automatically
*** Info: after the next reboot.

*** Info: Host configuration finished. Have fun!
$ net stop sshd
The CYGWIN sshd service is not started.

More help is available by typing NET HELPMSG 3521.


Change Permissions on /etc/ssh key files

chmod 600 /etc/ssh*key

chmod 755 /var/empty


Start it up!!!

net start sshd


Stop it yo!!

net stop sshd

Cygwin command line installation

Have you ever wished you could install Cygwin programs via the command line? Well you can. Just use this shellscript that Stephen Jungels wrote. Just download it into your cygwin /usr/bin directory and modify if necessary. View apt-cyg

  • First ssh to the cygwin box.
  • Next download the needed packages for apt-cyg
  • ./setup.exe -q -P  wget,tar,qawk,bzip2,subversion,vim
  • Finally, download the apt-cyg script from Stephen’s repository.
  • $ svn –force export http://apt-cyg.googlecode.com/svn/trunk/ /bin/
  • $ chmod +x /bin/apt-cyg

Now that you have all the tools, just run the “apt-cyg” command to find and install anything from the cygwin repositories.

apt-cyg install <package names>” to install packages
apt-cyg remove <package names>” to remove packages
apt-cyg update” to update setup.ini
apt-cyg show” to show installed packages
apt-cyg find <pattern(s)>” to find packages matching patterns
apt-cyg describe <pattern(s)>” to describe packages matching patterns
apt-cyg packageof <commands or files>” to locate parent packages