Why not simply use %h in OpenSSH ssh's ControlPath option?

Question

Why do the "ssh_config(5)" manpages recommend that the ControlPath option should contain at least the %h, %p and %r placeholders in order to uniquely identify each shared connection?

I thought that multiple sessions should share the same socket with a connection to the same host. Wouldn't it make sense then to have a simple definition such as:

ControlPath ~/.cache/ssh/mux/%h

Instead of something like:

ControlPath ~/.cache/ssh/mux/%r@%h:%p

In my understanding with the first definition one connection is shared between multiple sessions with different remote users, to the same remote host, on different remote ports.

I want to have the first defintion in the host default section so that it suffices to say ssh -o ControlMaster=no.

I want to share the connection to the same remote host between all sessions initiated by the same local user regardless of the remote user and remote port. The master client's socket should live beneath the local user's home directory.

Answer 1

"I thought that multiple sessions should share the same socket with a connection to the same host."

They can. However, note that if you connect to a host using an existing connection via ControlPath, regardless of which user you intend to log in as, you will be logged in as the original user of the connection. Eg., with no established connection to "somewhere":

ssh -o ControlPath=~/.ssh/%h -o ControlMaster=yes bob@somewhere

This session is bob@somewhere.

ssh -o ControlPath=~/.ssh/%h -o ControlMaster=no sue@somewhere

This session will also be bob@somewhere, because you used the same ControlPath and set ControlMaster=no; if ControlMaster=yes, you'd be logged in as sue, but ssh will have ignored your ControlPath argument, as implied in man ssh_config:

Additional sessions can connect to this socket using the same ControlPath with ControlMaster set to 'no'.

As evidence of this, if ControlMaster=yes in both cases, when bob exits the ControlPath socket ~/.ssh/somewhere will disappear even though the "sue" session is still running, meaning the sue session never used that socket.

So, if you want to use the same connection, just %h is fine, but beware that you cannot share a connection as multiple different remote users -- ssh won't let you.

Answer 2

You could have multiple users and multiple ports in use for even the same server. Myself, I connect to hundreds of systems on the company's intranets, most have multiple users with different functions or app servers. Access to userA is very different to access to userB, and the master connection would need to be different. More succinctly, if you were to run:

$ ssh -n -o ControlMaster=auto -o ControlPath=~/.cache/ssh/mux/%h -l userA localhost sleep 10 & # create the master connection and background it
$ ssh -o ControlMaster=auto -o ControlPath=~/.cache/ssh/mux/%h -l userB localhost whoami
userA

As you can see, we do not get an OpenSSH session with userB, but the original with userA. That means that the home directory, permissions and even the authentication itself is not what is expected. Using this, if you were to try to delete a file in userB's directory, then a) it could be the wrong file and b) it could be wrong permissions.

If you will never be connecting to more than a single user on any one server using a single port, then yes, using %h could be enough. In your ~/.ssh/config file, you would want to use:

ControlMaster=auto  # use existing or create a master connection
ControlPath=~/.cache/ssh/mux/%h
ControlPersist=yes

With the ControlPersist option, the master connection remains open in the background until killed or terminated with ssh -O exit. This is a nice set-it-and-forget-it feature.

But if there is any possibility of connecting to more than one user on any one host, then you would want something more secure:

ControlMaster=auto
ControlPath=~/.cache/ssh/mux/%r@%h:%p
ControlPersist=yes