You need to enable JavaScript to run this app.
优惠活动
大模型
产品
解决方案
定价
更多
文档控制台
免费开始使用

如何在连接关闭后清理SSH反向隧道套接字?

Fixing SSH Reverse Tunnel Socket File Residue Issue

Alright, let's tackle this problem head-on—this is a super common gotcha with SSH reverse tunnels and Unix sockets, so you're not alone here. The core issue is that when your reverse tunnel drops unexpectedly (server reboot, network blip, etc.), the Unix socket /home/dude/lol.socket on someserver doesn't get cleaned up automatically by sshd, blocking future tunnel attempts.

Here are the official, supported solutions recommended by OpenSSH:

This is the primary, official fix built directly into OpenSSH. The StreamLocalBindUnlink directive tells sshd to automatically delete an existing Unix socket file before binding to it, eliminating the "address already in use" error entirely.

  • Edit your sshd configuration file (usually /etc/ssh/sshd_config):
    sudo nano /etc/ssh/sshd_config
    
  • Add or uncomment this line:
    StreamLocalBindUnlink yes
    
  • Restart the sshd service to apply changes:
    # For systemd-based systems
    sudo systemctl restart sshd
    
    # For SysVinit systems
    sudo service ssh restart
    

This works for all reverse tunnels that create Unix sockets on the server, and it's the most reliable long-term fix.

2. Client-Side Override (Per-Tunnel or Global)

If you don't have access to modify the server's sshd_config, you can pass the StreamLocalBindUnlink option directly from your SSH client when initiating the tunnel:

  • For a one-time tunnel command:
    ssh -R /home/dude/lol.socket:localhost:22 -o StreamLocalBindUnlink=yes someserver
    
  • For persistent client-side configuration, add this to your ~/.ssh/config file:
    Host someserver
      StreamLocalBindUnlink yes
      RemoteForward /home/dude/lol.socket localhost:22
    

This forces the server-side sshd process handling your connection to use the unlink behavior, even if the global server config doesn't enable it.

3. Systemd Service Cleanup (For Persistent Tunnels)

If you're running your reverse tunnel as a systemd service (common for always-on tunnels), you can add a pre-start command to explicitly delete the socket file as an extra safeguard:

  • Edit your systemd service file (e.g., /etc/systemd/system/reverse-tunnel.service):
    [Unit]
    Description=SSH Reverse Tunnel to someserver
    
    [Service]
    ExecStartPre=/bin/rm -f /home/dude/lol.socket
    ExecStart=/usr/bin/ssh -N -R /home/dude/lol.socket:localhost:22 someserver
    Restart=always
    User=dude
    
    [Install]
    WantedBy=multi-user.target
    
  • Reload systemd and restart the service:
    sudo systemctl daemon-reload
    sudo systemctl restart reverse-tunnel.service
    

This complements the StreamLocalBindUnlink setting, ensuring the socket is gone before the tunnel even tries to start.


内容的提问来源于stack exchange,提问作者Timo

火山引擎 最新活动