An often overlooked feature of the OpenSSH client is the
ControlMaster feature. This feature allows multiple sessions to share a single TCP connection. This results in fast session startup and single sign on.
There are many web pages which explain the feature in more detail which is not the point of this post. Here are some sources:
- Rackspace – Speeding up SSH session creation
- OpenSSH – ssh_config Manual Page
I wanted to use this feature but I also had some of requirements:
- I wanted the sockets that are created (specified by the
ControlPathsetting) to be stored in RAM and not written to disk. This results in all of the files being cleared on reboot.
- A new RAM file system should be used for this purpose, not just reusing an existing one like “/tmp”. The new file system should be mounted in my users home directory.
- The permissions for the mount point should be restrictive.
- The configuration should be maintainable by using native systemd features, not adding hacks in
In the below instructions you will need to replace the path
/home/username/.ssh/sockets with the correct path for your environment.
First I will configure the RAM file system. I will be creating a 2MB file system that will be mounted at
/home/username/.ssh/sockets. Ensure the sockets directory path has already been created before continuing. The RAMFS in the below mount file has 10,000 inodes; this should be more than enough in almost every situation but it can be raised if required (each socket will take up 1 inode).
Create the mount file. The mount file is stored in
/etc/systemd/system and is should be named in the format “
home-username-.ssh-sockets.mount“. This file must reside in the global system directory, it is not (currently) possible to use a user systemd mount file. The contents of the file should be as follows:
[Unit] Description=RAM FS for SSH Multiplexing (/home/username/.ssh/sockets) Documentation=https://systemd.io/TEMPORARY_DIRECTORIES Documentation=man:file-hierarchy(7) Documentation=https://www.freedesktop.org/wiki/Software/systemd/APIFileSystems ConditionPathIsSymbolicLink=!/home/username/.ssh/sockets ConditionPathExists=/home/username/.ssh/sockets DefaultDependencies=no Conflicts=umount.target Before=umount.target After=home.mount [Mount] What=tmpfs Where=/home/username/.ssh/sockets Type=tmpfs Options=mode=0700,strictatime,nosuid,nodev,size=2M,nr_inodes=10k,uid=username,gid=username [Install] WantedBy=local-fs.target
You must make the following changes (the lines have been highlighted above):
- Line 2 – Set an appropriate description
- Line 6, 7 and 15 – Set the correct mount location
- Line 11 – Since I have
/homeon a separate partition, I add a dependency on that mount point. If you do not have
/homeon a separate partition you can remove that line.
- Line 17 – Set the correct UID and GID. Optionally you can resize the tmpfs size.
Note: The filename for the systemd mount file MUST match the path that the file system will be mounted at with all forward slashes replaced with hyphens. You will get an error like this if it is incorrectly named:
Mar 03 23:58:15 laptop systemd: SSH-RAMFS-test.mount: Where= setting doesn't match unit name. Refusing.
You will need to make sure the contents of the file has had the correct file system path set as well as the correct UID and GID configured in the mount options.
The mount can then be enabled and started:
sudo systemctl enable home-username-.ssh-sockets.mount sudo systemctl start home-username-.ssh-sockets.mount
The new RAM file system should be mounted and ready to use. If you get an error starting the file system, check the logs with
systemctl status home-username-.ssh-sockets.mount and
SSH Client Setup
The SSH client can now be configured to use the RAM file system to store the sockets. In the SSH configuration file (
~/.ssh/config – it may not exist if you have never configured anything inside it before) you can select which hosts will use the
To use the feature for any hosts on the example.com domain, the following content would be added:
Host *.example.com ControlMaster auto ControlPath ~/.ssh/sockets/%C ControlPersist 36000
If you would like the configuration to apply to ALL hosts you would simply set a wildcard host:
Host * ControlMaster auto ControlPath ~/.ssh/sockets/%C ControlPersist 36000
In the above configuration, I have set the
ControlPersist option to 36,000 seconds (10 hours). The available settings for this option are:
no– The default if not specified. If you set this option and logout of the “master” SSH session the logout will hang until all other SSH sessions are closed.
yes– The socket will remain indefinitely. You can logout of the “master” session and the control socket will persist.
- <integer> – The number of seconds the socket will remain open. Again, you can logout of the “master” session and the control socket will persist for the defined amount of time after the last remaining session is closed.
ControlPath in the above examples uses the
%C token to create the socket name for each connection. This token is a hash of the connection (username, host, port etc.) generated at run time; it prevents the socket name exposing what username and hostname it is associated with. An example socket name with this token is
If you prefer to expose the username/host/port you can change this to your liking. As an example:
This will result in socket names in the format <username>@<hostname>-<port>. A complete list of tokens is available in the ssh_config man page here.
You should now be able to create a new SSH connection and verify that the socket is created in
~/.ssh/sockets. You should then be able to open a second connection and you will not be prompted for any authentication and the session should establish very quickly.