How and why to reuse SSH connections

I still remember the revelation I had more than 20 years ago, when I started using SecureCRT and no longer had to authenticate for every new shell I opened for a host.

SSH supports multiple sessions over a single connection. This is useful for several reasons: it makes new sessions faster while the first is active (or while connection persistence is enabled) because no new TCP handshake or authentication is required. The downside is that options such as agent forwarding must be enabled on the first (master) connection.

It began to matter when I found myself constantly opening new windows and sometimes copying files, and wanted to recreate this on my Linux desktop (and later on my Mac).

This was all it took

Host *
   ControlMaster auto
   ControlPath ~/.ssh/sess/sock-%C

Note: you have many options for naming the socket file, but it is easy to exceed the maximum path length if you are not careful. If you use multiple accounts on the same host, you may want to add the username to the socket filename.

Changes in my day-to-day

It does not move mountains, but it lets your favourite tools copy files while you have an open session in Terminal without authenticating again. Whether you use command-line scp or a GUI tool such as ForkLift, password, key, and agent management becomes easier.

The only annoying part is when the master session closes and you have to hunt down every remaining multiplexed session.

You could say it is really nothing. But when a firewall is misconfigured, a router's connection-tracking table is full, and you need an extra shell to fix something—or when many users connect to even more servers over SSH—reusing sessions makes things more manageable.

It does not make your .ssh/config complicated, but it is useful.

There is also an option called ControlPersist. When enabled, it leaves the master connection open after the initial client exits; you can limit this with a duration such as 10m. I do not use this option because an already established connection can hide network issues, and I prefer not to leave pre-authenticated sessions open.

For a list of my SSH-related notes, see SSH, my way.