Remote work is a blessing and sometimes a nightmare, depending on your line of work. I’ve been in a situation where I’m connected to a remote workstation but, due to some technicalities, I’m not allowed to disconnect the current SSH1 connection or create a new one. And where it lies, I need to tunnel a service from the remote workstation to my local machine, without killing the session that is already running. Closing the connection would have meant losing an important process, so a new connection was not an option.
The answer, as it turns out, was hiding inside the SSH client itself: an escape sequence that opens a mini command line inside your running session. So, here’s how I did it!
The real voyage of discovery consists not in seeking new landscapes, but in having new eyes.
~ Marcel Proust.
🛠️ So where do we start?
Once you have an existing SSH session opened using the default OpenSSH2 client, to open a tunnel simply type <enter>~C where <enter> is the key on your computer keyboard.
~ (tilde) is the SSH’s default EscapeChar. You press <enter> first to clear the buffer, then the ~ escape char, and then any one of a number of options. The leading enter matters more than people realize: it makes sure the tilde is not consumed as part of a command you were typing on the remote shell.
If all goes well it will bring up a new console associated with your local SSH client, that will accept SSH command flags, which includes -R and -L. It looks like a prompt appearing out of nowhere, and it is the backdoor to your running tunnel.
To map a server service to your local workstation you need to use the -L flag. The arguments for that flag would be [bind_address:]port:host:hostport but normally the bind_address is optional.
Then if you want to map a local service and tunnel it to the remote server, you’ll need to use the -R flag. This flag holds similar arguments to the -L.
For example, if I want to forward a remote server’s Nginx deployed website and access it locally (with a local bind IP), what I could do is type <enter>~C then -L 80:localhost:8080<enter>. After that I will immediately gain access to that when I access the site using localhost:8080 on my local machine.
To get a full list of the escape sequences that the OpenSSH client accepts, type <enter>~?:
Supported escape sequences:
~. - terminate connection (and any multiplexed sessions)
~B - send a BREAK to the remote system
~C - open a command line
~R - request rekey
~V/v - decrease/increase verbosity (LogLevel)
~^Z - suspend ssh
~# - list forwarded connections
~& - background ssh (when waiting for connections to terminate)
~? - this message
~~ - send the escape character by typing it twiceThat’s all guys. 🐲
🧠 Final Thoughts
Most of the command line tools have flags you probably haven’t explored. So, try to explore each one to become proficient in the platform you are currently working on. Just like programming, you won’t memorize it in a day, but to truly know a tool’s capability you must use it in a very dire situation.
This OpenSSH2 escape sequence is really helpful for DevOps and software engineers (for software development). The next time you are stuck inside a session you cannot close, remember: the tunnel is one ~C away. Your future self, staring at a remote Nginx server with no way to test it locally, will thank you.
Let me know in the comments if you have questions or queries, you can also DM me directly.
Follow me for similar article, tips, and tricks ❤.
- SSH or Secure Shell is a cryptographic network protocol for operating network services securely over an unsecured network. ↩︎
- OpenSSH (also known as OpenBSD Secure Shell) is a suite of secure networking utilities based on the Secure Shell (SSH) protocol, which provides a secure channel over an unsecured network in a client-server architecture. ↩︎