#1614
Issues/hoophq/hoop/#1614

[Bug]: SSH direct-tcpip port forward through hoop connect opens then immediately closes (bastion → localhost MySQL)

Opendiegogurpeguiopened 3mo ago

Bug Description

With a self-hosted bastion setup, hoop connect on an SSH connection works for interactive shells, but classic local port forwarding (ssh -L / direct-tcpip) does not: the channel gets open confirm and is closed immediately with no payload, so clients like mysql fail with ERROR 2013 … reading initial communication packet. The same key/user/host works when doing ssh -L directly from the bastion (MySQL handshake received), so upstream sshd (AllowTcpForwarding yes) and localhost MySQL are fine — the break is in Hoop’s SSH proxy path. Related: discussion #757 (bastion + localhost-only DB; tunneling claimed available, but this path still broken).

Steps to Reproduce

  1. Self-hosted Hoop on a bastion; agent can SSH to a tenant host where MySQL listens only on 127.0.0.1:3306.
  2. SSH connection type with access_mode_connect enabled (shell via hoop connect works).
  3. On the client: 
    hoop connect <ssh-conn> --port 2221
ssh -p 2221 -o StrictHostKeyChecking=no -N -L 3307:127.0.0.1:3306 <user>@127.0.0.1
mysql -h 127.0.0.1 -P 3307 -u <dbuser> -p
# or: nc -v 127.0.0.1 3307 </dev/null
  4. Contrast: from the bastion host, same key → tenant: 
    ssh -i <same-key> -N -L 127.0.0.1:13306:127.0.0.1:3306 <user>@<tenant>
# reading 20 bytes from 127.0.0.1:13306 returns a valid MySQL handshake

Expected Behavior

direct-tcpip through the Hoop SSH proxy stays open and forwards bytes end-to-end (as in TestSSH_DirectTCPIP_PortForward), so local mysql can complete the handshake on 127.0.0.1:3307.

Actual Behavior

OpenSSH verbose log:

channel 2: new direct-tcpip
channel 2: open confirm ...
channel 2: rcvd close    # immediate, 0 bytes transferred

mysql → ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet'. Same failure forwarding other open ports (e.g. 80/22), so not MySQL-specific.

Version

1.111.5

Browser(s)

Other

Operating System

Ubuntu 22/24 (client + bastion + tenant)

Screenshots

No response

Additional Context

  • Tenant: sshd -T → allowtcpforwarding yes; MySQL bound to 127.0.0.1:3306.
  • Control: bastion-side ssh -L with the same deploy key returns MySQL greeting (8.0.42-…).
  • Matches the use case in https://github.com/hoophq/hoop/discussions/757 (Option 1 / SSH tunnel through Hoop).

Relevant Log Output

Agent (during failed forward):

starting SSH proxy connection, mode=proxy
establishing new SSH connection with server <tenant>:22
received EOF from gateway, closing write side of server channel  conn=1 ch=1

(No successful upstream dial/forward of `127.0.0.1:3306` observed.)

Code of Conduct

  • I agree to follow this project's Code of Conduct

Activity

0

No activity yet.