To reach an isolated network I use an ssh -D socks proxy.In order to avoid having to type the details every time I added them to ~/.ssh/config:alex@laptop:~$ awk '/Host socks-proxy/' RS= ~/.ssh/configHost socks-proxy  Hostname pcit  BatchMode yes  RequestTTY no  Compression yes  DynamicForward localhost:9118Then I created a systemd-user service unit: alex@laptop:~/.config/systemd/user$ cat SocksProxy.service [Unit]Description=SocksProxy Over Bridge Host[Service]ExecStart=/usr/bin/ssh -Nk socks-proxy[Install]WantedBy=default.targetI let the daemon reload the new service definitions, enabled the new service, started it, checked its status, and verified, that it is listening:alex@laptop:~/.config/systemd/user$ systemctl --user daemon-reloadalex@laptop:~/.config/systemd/user$ systemctl --user list-unit-files | grep SocksPSocksProxy.service   disabledalex@laptop:~/.config/systemd/user$ systemctl --user enable SocksProxy.serviceCreated symlink from ~/.config/systemd/user/default.target.wants/SocksProxy.service to ~/.config/systemd/user/SocksProxy.service.alex@laptop:~/.config/systemd/user$ systemctl --user start SocksProxy.service alex@laptop:~/.config/systemd/user$ systemctl --user status SocksProxy.service  SocksProxy.service - SocksProxy Over Bridge Host   Loaded: loaded (/home/alex/.config/systemd/user/SocksProxy.service; enabled)   Active: active (running) since Thu 2017-08-03 10:45:29 CEST; 2s ago Main PID: 26490 (ssh)   CGroup: /user.slice/user-1000.slice/user@1000.service/SocksProxy.service           26490 /usr/bin/ssh -Nk socks-proxyalex@laptop:~/.config/systemd/user$ netstat -tnl | grep 118tcp     0    0 127.0.0.1:9118        0.0.0.0:*             LISTEN     tcp6    0    0 ::1:9118              :::*                  LISTENThis works as intended. Then I wanted to avoid having to manually start the service, or running it permanently with autossh, by using systemd socket-activation for on-demand (re-)spawning. That didn't work, I think (my version of) ssh cannot receive socket file-descriptors. I found the documentation (1,2), and an example for using the systemd-socket-proxyd-tool to create 2 wrapper services, a service and a socket:alex@laptop:~/.config/systemd/user$ cat SocksProxyHelper.socket [Unit]Description=On Demand Socks proxy into Work[Socket]ListenStream=8118#BindToDevice=lo#Accept=yes[Install]WantedBy=sockets.targetalex@laptop:~/.config/systemd/user$ cat SocksProxyHelper.service [Unit]Description=On demand Work Socks tunnelAfter=network.target SocksProxyHelper.socketRequires=SocksProxyHelper.socket SocksProxy.serviceAfter=SocksProxy.service[Service]#Type=simple#Accept=falseExecStart=/lib/systemd/systemd-socket-proxyd 127.0.0.1:9118TimeoutStopSec=5[Install]WantedBy=multi-user.targetThis seems to work, until ssh dies or gets killed. Then it won't respawn at the next connection attempt when it should.Questions:Can /usr/bin/ssh really not accept systemd-passed sockets? Or only newer versions? Mine is the one from up2date Debian 8.9.Can only units of root use the BindTodevice option?Why is my proxy service not respawning correctly on first new connection after the old tunnel dies?Is this the right way to set-up an on-demand ssh socks proxy? If, not, how do you do it?
On-demand SSH Socks proxy through systemd user units with socket-activation doesn't restart as wished
ssh;systemd;proxy;socks;socket activation