I want to provide remote support for some linux boxes via ssh. I have no passwords on these machines and they are behind a nat, without port forwarding.

My idea was, that whenever a client needs my service, he/she types a command on her machine, which builds up a two-way connection to my server. Using this two way connection I would like to do the task, he/she asked me to.

It would be an ideal solution, if it would be transperent for the client, like a shared screen session...


Do it via SSH port forwarding. Your client needs to enter

ssh -R 22:yourhost:10022 someuseronyourhost@yourhost

Then you need to (on yourhost)

ssh -p 10022 aclientsusername@yourhost

Your client will not be able to see what you do though.

  • thanks for this answer. However I would need to know the pasword of the client in this case, wouldn't I? I would rather like to avoid that... – ftiaronsem Apr 14 '11 at 22:22
  • @ftiaronsem I've seen others create accounts with good passwords for the only purpose of local and remote administration, simply for the case something goes wrong with the primary user's user profile. That was Windows, but still. On my Mac, I have an additional admin account in case OS X f...s up my primary account's encypted home directory and I can no longer log in. If this assistance is a regular thing for you, consider this option. – Daniel Beck Apr 14 '11 at 22:43
  • Thanks for the reply. I will give it a thought. Probably the user could call a script which is setting a temporary password first. Then this should work... Yeah. That should do it. Thanks – ftiaronsem Apr 14 '11 at 22:57
  • First comamnd should be: ssh -R 10022:yourhost:22 someuseronyourhost@yourhost – ralu Dec 28 '13 at 13:09

If I remember correctly, Gnu Screen lets a user share a session with another user. It is also described at Softpedia and at TipOfTheDay

To let you log on only when needed, they could set up SSH for key-based authentication only (disabling password based authentication) and whenever you need to log on they could rename the RSA authorized key file for your account to the name expected by sshd. Afterwards they can rename the authorized key files to something else. This can obviously be wrapped in a script for ease of use.

See also https://stackoverflow.com/questions/471354/sharing-a-gnu-screen-session


You could also have a look to vncreflector. It can be started on your server and you and the person to be supported can connect to it so both of you see the same graphical screen.

The person to be supported than has to connect via e.g.:

x11vnc -connect server:$PORT -shared

and you have to connect from your client via

vncviewer server:$PORT

I think you can also combine this with an SSH tunnel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.