Sometimes I want to access a private server at home from a different network while being on the go.
The easiest way to do this is to use autossh utility to create a secure and persistent reverse SSH tunnel to the publicly available server.

First step

Connect to the remote server and create sshtunnel user.

$ sudo useradd -s /usr/sbin/nologin -m sshtunnel

It is crucial to disable shell access, but create a home directory to store SSH configuration (known hosts and authorized keys).

Second step

Create sshtunnel user on the local machine.

$ sudo useradd -s /usr/sbin/nologin -m sshtunnel

Switch to the sshtunnel user and create SSH key pair.

$ sudo su sshtunnel -s /bin/bash

sshtunnel$ ssh-keygen -t rsa -b 2048 -q -N "" -f ~/.ssh/tunnel_key_a

Third step

Upload ~/.ssh/tunnel_key_a.pub file to the remote server and perform the following operations while still being connected to it.

Create a missing .ssh directory.

$ sudo su -s /bin/sh sshtunnel -c "mkdir ~/.ssh"

Add uploaded public key to the pool of keys authorized for authentication.

$ echo 'no-agent-forwarding,no-user-rc,no-X11-forwarding,no-pty' $(cat tunnel_key_a.pub) | sudo su -s /bin/bash sshtunnel -c "tee >> ~/.ssh/authorized_keys"

Now you can remove the uploaded public key.

Fourth step

Add remote server to the known servers pool on the local machine.

$ ssh-keyscan -H -t rsa remote-server | sudo su -s /bin/sh sshtunnel -c "tee >> ~/.ssh/known_hosts"

Fifth step

Use the following command on the local machine to test the reverse SSH tunnel to the remote server.

$ sudo su -s /bin/sh sshtunnel -c "autossh -v -i ~/.ssh/tunnel_a remote-server -N -R 9000:localhost:22"
OpenSSH_6.7p1 Debian-3, OpenSSL 1.0.1j 15 Oct 2014
debug1: Reading configuration data /etc/ssh/ssh_config
[..]
Authenticated to remote-server ([111.222.333.444]:22).
[..]
debug1: remote forward success for: listen 60654, connect 127.0.0.1:60655
debug1: remote forward success for: listen 9000, connect localhost:22
debug1: All remote forwarding requests processed

Sixth step

Add autossh command to the /etc/rc.local script to start a ssh tunnel at boot.

$ sudo sed -i -e '$i # create sshtunnel\nsu -s /bin/sh sshtunnel -c "autossh -f -i ~/.ssh/tunnel_key_a remote-server -N -R 9000:localhost:22"\n' /etc/rc.local

$ cat /etc/rc.local
#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.

# create sshtunnel
su -s /bin/sh sshtunnel -c "autossh -f -i ~/.ssh/tunnel_key_a remote-server -N -R 9000:localhost:22"

exit 0

Now you should be able to connect to the SSH service on the local machine from the remote server using port 9000, while autossh is managing the SSH tunnel.

remote-server$ ssh -l milosz -p 9000 localhost
ko-fi