Answer by Kamil Maciorowski for How to get Rsync to prompt for one time password from Duo?

Idea

In the SSH protocol there is this functionality where you can create a master connection and then zero or more sessions can "piggyback" on it. This is called "connection sharing", "connection multiplexing" or "session multiplexing". ssh processes that "piggyback" communicate with the master ssh via a socket.

Authentication happens when the master connection starts. Sessions that "piggyback" require no separate nor additional authentication, they use the already authenticated master connection.

Now the idea is to start a master connection to the server in question before you start rsync; then to make rsync use ssh with connection sharing.

There is at least one way to disable or limit session multiplexing on a server, so the idea may or may not work, depending on the server.

Manual (ad hoc) setup

You can start a master connection by giving ssh the -M and -S options:

ssh -M -S /path/to/socket user@server

The above command will most likely give you an interactive remote shell, to exit it type exitEnter or hit Ctrl+d. The same command with -N will give you a connection without a shell, Ctrl+c will terminate it. The same command with -N and -f will give a connection that puts itself in the background (after authentication) and this is useful when you want to use just a single local terminal. Any form of master connection (including the background one) can be terminated by communicating with it via the socket:

ssh -S /path/to/socket -O exit dummy

where dummy is just a placeholder "destination", it may or may not be user@server you have used with ssh -M, it is irrelevant, only the socket matters.

As long as the master connection works, you can "piggyback" on it by telling ssh to use the right socket without -M. For example this command:

ssh -S /path/to/socket dummy

should give you an interactive remote shell without a separate or additional authentication. Again, dummy is just a placeholder.

To make rsync use ssh -S /path/to/socket instead of just ssh, you need something like:

rsync -e 'ssh -S /path/to/socket'…

where … denotes arguments you would normally use.

Automation

See this answer on our sister site: How can I maintain open ssh connection and use it from shell scripts?

A snippet like this in your ~/.ssh/config:

Host myserver  ControlMaster auto  ControlPath ~/.ssh/master-%C  # for openssh < 6.7 you need to use this one:  # ControlPath ~/.ssh/master-%r@%h-%p

will make any ssh destined to myserver that does not find a master connection become a master connection; and it will make any ssh destined to myserver that finds a master connection "piggyback" on it.

There is no need to adjust rsync commands in this case.

Now choose modus operandi that fits you the most. Examples:

• Start an interactive remote shell with ssh myserver, authenticate. In another local terminal use rsync. When finished, deliberately exit the remote shell.

• Or start a master connection with ssh -Nf myserver, authenticate and wait for it to go to the background. Use rsync. When finished, run ssh -O exit myserver.

• Or include ControlPersist 5m in the config. Start a master connection with ssh -Nf myserver, authenticate and wait for it to go to the background. Use rsync. When finished, move on and the master connection will terminate itself after 5 minutes of being idle.

^{Note the destination myserver tells ssh what part of the config to use and what to substitute for %C, thus where the socket is; it cannot be dummy like in the manual setup described above.}