Nested tmux session over ssh

[sourya7]

Hi, first of all, this is pretty sweet. One question I have is about nesting over ssh. In my client, I have tmux and I want to be able to ssh over to a server, run tmux and switch between the two. Is this something that is possible? I'm not very competent with tmux to know if we can even achieve this but it would be pretty cool if we can. If not, I can live with two terminals.

[aleclearmind]

I've thought about that, it should possible to notify an inner tmux session over SSH by sending a key (we send Alt + F12). However notifying the outer tmux session is more of an issue since we do this by writing on the tmux socket specified through an environment variable (TMUX_PARENT). However, that socket is on another machine.
We should redesign this approach and try to switch to a key-based approach to communicate to outer tmux too. However, this is not obvious.

[strazto]

Hi there.
I'll preface this suggestion with the following acknowledgement- What I'm proposing adds a really decent amount of complexity, and turns this from being a tmux conf into being something more complex.

One way to potentially support this is to use remote port fort forwarding in the ssh session, as in:

# Tunnel client's localhost:8008 => remote-host's localhost:8008
ssh -R 8008:localhost:8008 remote-host

OR more robustly in the ssh config

Host remote-host
   RemoteForward 8008 localhost:8008

On the remote host, we can redirect the TMUX_PARENT socket to localhost:8008, probably using socat or something.

On the client (local) machine, we can use socat to redirect localhost:8008 to our actual TMUX socket.

There's a few caveats - A lot of enterprise/corporate servers are going to restrict what you can & can't do with ssh port forwarding (legitimate security reasons)- there's a decent chance you just can't for some servers.

To enable portforwarding, the remote's sshd_config needs to have:

AllowTcpForwarding yes

To allow remote forwarding, it needs

GatewayPorts yes

[strazto]

Actually, according to
https://serverfault.com/a/753733/615908 since OpenSSH 6.7 , you can forward local unix sockets directly (this blew my mind).

Of course, a lot of enterprise servers run old versions of OpenSSH (My workplace's HPC runs OpenSSH 5.3), so we'll have to settle with using socat to redirect in those instances.

Since ssh_configs don't allow for env substitution (for example, substituting TMUX as the socket to forward), chances are, you're going to need either an alias, or a script/function to service this connection, so that you can forward the correct socket dynamically.

EDIT

actually looks like you can only localforward unix domain sockets, so without some more redirection via socat, chances are you can't directly do this - checking now

nevermind, apparently it's valid to remote forward unix sockets. SO cool my gosh.

[strazto]

Since ssh_configs don't allow for env substitution (for example, substituting TMUX as the socket to forward), chances are, you're going to need either an alias, or a script/function to service this connection, so that you can forward the correct socket dynamically.

[aleclearmind]

I didn't know about forwarding UNIX sockets! Nice!
Before thinking about embedding this in ssh_config or supporting old SSH versions, I'd like to see this work with an ssh wrapper we can provide (e.g., ssh-nested-tmux).

Have you tried it? Does it work?

[strazto]

Here's a (probably) working solution for both client & server OpenSSH >= 6.7:

#!/usr/bin/env bash

# -R remote_socket:local_socket
ssh -R "/tmp/tmux_parent:${TMUX}" 

on the remote host, do the following:

# append this env var set to the ssh rc
cat << EOF >> ~/.ssh/rc
# check socket exists
if [ -S /tmp/tmux_parent ]; then 
   echo "export TMUX=/tmp/tmux_parent" >> ~/.ssh/rc
fi
EOF

I think this should do the trick

EDIT Just saw your reply, I'd finished writing this wrapper/conf before I saw it

@aleclearmind

I'd like to see this work with an ssh wrapper we can provide (e.g., ssh-nested-tmux).

Have you tried it? Does it work?

Well, here it is, but I haven't tried it yet, but also, there's a few details that you probably understand better than me about what env vars influence what.

I'd like your feedback on whether we should be setting:
TMUX vs TMUX_PARENT to /tmp/tmux_parent in our ~/.ssh/rc

For context on ~/.ssh/rc , from the man page:

~/.ssh/rc
Commands in this file are executed by ssh when the user logs in, just before the user's shell (or command) is started. See the sshd(8) manual page for more information

(this executes at ssh login, right before the shell starts)

[aleclearmind]

Mmmh, why do you rename the remote socket? This does not support multiple nested sessions over the same machine.
Also, can't you use SendEnv instead of ~/.ssh/rc?

[strazto]

Mmmh, why do you rename the remote socket? This does not support multiple nested sessions over the same machine.

Good point, renamed because I'm not sure what we can write to, but I guess we can just forward the socket 1:1, meaning we can directly forward TMUX as well

Also, can't you use SendEnv instead of ~/.ssh/rc?

I think so, I'm not sure about portability (requires sshd_config to AcceptEnv yes), but assuming you have root on both machines, that's simpler, and would work better for dynamically forwarding TMUX if we don't rename the socket.

I'll rewrite the script & hide the previous attempt

[strazto]

Local ~/.ssh/config

Redundant

Host remote-host
   SendEnv TMUX
   # Maybe wildcard? TMUX_* 

#!/usr/bin/env bash

# -R remote_socket:local_socket
ssh -R "${TMUX}:${TMUX}" -o SendEnv=TMUX  remote-host

[aleclearmind]

-o SendEnv=TMUX?

[strazto]

-o SendEnv=TMUX?

Updated

[strazto]

I actually haven't applied nested-tmux to my own tmux conf, btw, so I can't test this until I do so, if you're able to test it out I'd love to hear about it- Thank you for your feedback!

If it works, I'd love to be the one to open the PR if that's okay

[strazto]

Regarding directly forwarding the tmux socket, I just checked and it looks like my UID is encoded into the directory of the tmux socket, we may need to hack around that a bit for systems where the client uid != remote uid, idk

[aleclearmind]

Please, reduce the amount of messages, test things and then make a PR.
Otherwise I'll look into that when I get the chance.

[deliciouslytyped]

Are there possibly any other ways to do this? I don't know about tmux's security model, but forwarding sockets leaves me a bit uncomfortable. - or is that unwarranted?