TopolearnMultiplexing makes repeated ssh, scp, rsync and Ansible calls near-instant and reduces load on bastions.
Every new SSH connection pays for a TCP handshake, key exchange and authentication, often hundreds of milliseconds, more through a bastion, plus a hardware-key touch if you use one. Multiplexing lets later sessions ride on an existing connection as additional channels.
Three options:
ControlMaster auto: the first connection becomes the master and creates a control socket; later ones use it if present.ControlPath ~/.ssh/cm-%C: where the socket lives.%Cis a hash of host, port, user and jump settings, keeping paths short and unique (Unix socket paths are limited to about 100 bytes).ControlPersist 10m: keep the master open in the background for ten minutes after the last session closes.
Control the master with -O: ssh -O check web shows whether it is running, ssh -O exit web closes it, ssh -O forward -L 5433:localhost:5432 web adds a port forward to an existing connection.
Trade-offs to know: all sessions share one TCP connection, so a stalled network stalls them all; connection-level options given to later commands (ciphers, compression, keepalives) are ignored because the master's settings apply; and if the server revokes your key, an open master still works until it closes. Ansible enables multiplexing by default for exactly the speed reason.
Example
# ~/.ssh/config
Host *
ControlMaster auto
ControlPath ~/.ssh/cm-%C
ControlPersist 10m
# first connection authenticates and becomes the master
ssh web 'true'
time ssh web 'true' # real 0m0.05s instead of ~0.5s
ssh -O check web # Master running (pid=4242)
ssh -O forward -L 5433:localhost:5432 web # add a tunnel to it
ssh -O exit web # Exit request sent.Remember
- ControlMaster auto + ControlPath + ControlPersist = reuse connections
- %C in ControlPath gives a short unique socket name
- ssh -O check/exit/forward manages the master
Watch out for
- Changing options for a host while a master is running and seeing no effect; ssh -O exit first.