Hi all, First time poster, long time OpenSSH user :) The Situation: Users within our net require access to a website (http/80) that is being hosted on another, trusted net. Admins on this other trusted net are not necessarily as trusting as we are, though they do provide a ssh gateway. So, one fairly easy solution that was decided upon was to simply allow users access to this website via a "permanent" SSH tunnel (-f) ssh -Nf -L 9100:webserver.trusted.com:80 user@xxxxxxxxxxxxxxxxx The Problem: After a while -- say a few days/weeks -- of having this tunnel established, transactions through this tunnel slow down to a crawl. To the point where requests will typically timeout. Establishing a brand new tunnel alongside the slowing tunnel seems to work fine. I don't see anything particularly wrong with the endpoint systems other than that sshd on the ssh gateway is consuming about 1.4 MB of virtual memory. While this does not pose any threat to the machine per se, it does seem a bit strange to me. I'm curious as to what might be happening here, and what -- if anything -- we can do about it. I've heard from a number of folks that ssh tunnels for this purpose are a "bad idea" and that we might consider a connectionless OpenVPN based solution. This is 100% fine, however no one has been able to explain _why_ the tunnel slows down which happens to be precisely what interests me. Can someone provide me with any insights? The ssh gateway system is CentOS 4.7 w/ OpenSSH 3.9p1 and the client is Ubuntu 8.04 w/ OpenSSH 4.7p1. Thanks in advance, Tim
