如何实现需密码验证的SSH隧道+socat转发后台运行？

问题背景 #

我原本通过两步实现MySQL套接字转发：

• 执行ssh -N -L 3307:localhost:3307 user@domain.com建立SSH隧道
• 在远程终端执行socat TCP-LISTEN:3307,reuseaddr,fork UNIX-CONNECT:/var/lib/mysql/mysql.sock

目标是整合为单条SSH命令，但目标服务器仅允许密码登录（无法使用密钥认证）。我编写了Shell函数尝试实现，但后台运行时无法弹出密码输入提示，导致进程挂起，原函数代码如下：

start_db_proxy() {
  if [[ -n "$SSH_TUNNEL_PID" && -n "$(ps -p $SSH_TUNNEL_PID -o pid=)" ]]; then
    echo "Proxy is already running with PID $SSH_TUNNEL_PID."
    return
  fi

  echo "Starting SSH tunnel and socat on the remote machine..."

  # Start the SSH tunnel in the background and Start socat on the remote machine via SSH
  ssh -N -L 3307:localhost:3307 user@domain.com "socat TCP-LISTEN:3307,reuseaddr,fork UNIX-CONNECT:/var/lib/mysql/mysql.sock" &
  SSH_TUNNEL_PID=$!

  # Wait for the SSH tunnel to be established
  sleep 2

  # Save the PIDs to environment variables
  export SSH_TUNNEL_PID

  echo "Proxy started with mysql socket forwarding via ssh $SSH_TUNNEL_PID."
}

# Function to stop the SSH tunnel and socat
stop_db_proxy() {
  if [[ -n "$SSH_TUNNEL_PID" ]]; then
    kill $SSH_TUNNEL_PID 2>/dev/null
    unset SSH_TUNNEL_PID
    echo "Killed SSH tunnel."
  fi
}

# Ensure cleanup when the terminal session exits
trap stop_ironwall_db_proxy EXIT

解决方法 #

核心问题是后台运行SSH时，密码输入需要关联终端。通过SSH的-f参数让进程在完成密码验证后自动转入后台，配合-n参数避免标准输入读取异常，同时修正陷阱函数名错误，修改后的完整函数如下：

start_db_proxy() {
  if [[ -n "$SSH_TUNNEL_PID" && -n "$(ps -p $SSH_TUNNEL_PID -o pid=)" ]]; then
    echo "Proxy is already running with PID $SSH_TUNNEL_PID."
    return
  fi

  echo "Starting SSH tunnel and socat on the remote machine..."

  # -f参数完成认证后转入后台，-n避免读取stdin导致异常
  ssh -f -n -L 3307:localhost:3307 user@domain.com "socat TCP-LISTEN:3307,reuseaddr,fork UNIX-CONNECT:/var/lib/mysql/mysql.sock"
  SSH_TUNNEL_PID=$!

  sleep 2
  export SSH_TUNNEL_PID
  echo "Proxy started with mysql socket forwarding via SSH PID $SSH_TUNNEL_PID."
}

stop_db_proxy() {
  if [[ -n "$SSH_TUNNEL_PID" ]]; then
    kill $SSH_TUNNEL_PID 2>/dev/null
    unset SSH_TUNNEL_PID
    echo "Killed SSH tunnel and remote socat process."
  fi
}

# 修正陷阱函数名，与停止函数保持一致
trap stop_db_proxy EXIT

关键说明 #

• -f：让SSH在完成密码验证后自动转入后台运行，确保密码输入在前台正常弹出，不会挂起进程
• -n：将SSH标准输入重定向至/dev/null，避免后台进程尝试读取终端输入引发异常
• 修正原代码中trap指令的函数名错误，保证终端退出时能正确清理进程

内容的提问来源于stack exchange，提问作者juslintek