SSH ControlMaster Multiplexing for Slow Links

Every new SSH connection pays for TCP, a key exchange, and authentication before a shell appears. On a good metropolitan path that is noise. On a last-mile link into a Lucknow VPS, with 60 to 120 ms of RTT and the occasional packet loss, it is the reason git fetch feels sticky and why opening a second terminal to the same host is a small ritual. ControlMaster multiplexes extra sessions over an already-authenticated connection. The first ssh prod is slow. The next ten share the socket and start in a fraction of the time.

This is a client-side feature. You do not change sshd. You do need to understand hung sockets, ControlPath collisions, and why a multiplexed session still dies if the master does.

Turn on the master in ~/.ssh/config

ControlMaster auto means the first connection to a given ControlPath becomes the master, and later connections attach. ControlPersist 10m keeps the master alive for ten minutes after the last session closes, so a burst of scp and git commands does not pay KEX each time. ControlPath must be unique per remote tuple or you will attach the wrong host.

Host *
  ControlMaster auto
  ControlPersist 10m
  ControlPath ~/.ssh/cm-%C
  ServerAliveInterval 30
  ServerAliveCountMax 3
  IdentitiesOnly yes

%C is a hash of local user, local host, remote user, remote host, and port. It is the right token on modern OpenSSH. Older examples used %r@%h:%p, which can overflow Unix socket path limits once Home directories get long. If attach fails with a path-too-long error, you were on the old pattern.

The ControlPath directory sits on local disk. A High-Speed SSD laptop makes socket create and unlink cheap; a network home directory can make multiplexing slower than a fresh TCP connection. If $HOME is NFS, put ControlPath under /run/user/UID/ssh-%C instead.

What multiplexing actually speeds up

It does not make a 10 gigabyte scp faster. Bulk throughput is still the path and the cipher. It makes session setup cheap. ansible with many small modules, rsync of a few files, git fetch on a tiny repo, and a second interactive shell all benefit. On a 80 ms path, shaving a 200 to 400 ms handshake off each of fifty Ansible tasks is the difference between a playbook you wait for and one you background.

A Lucknow VPS on Intel Xeon Platinum will finish the server half of kex quickly. The RTT still dominates. Multiplexing attacks RTT, not CPU. If you enabled a heavy cipher for policy reasons, you still pay that cost on the first handshake only.

Combine this with ProxyJump. The master socket is for the final destination as the client sees it. A multiplexed session to app reuses the whole hop graph, which is exactly what you want on a slow last mile. You do not need a second master for the bastion unless you also open shells there.

Hung sockets and how to recover

The failure mode is a ControlPath file that points at a dead master. The client then hangs or prints "ControlSocket ... already exists, disabling multiplexing". Fix it without rebooting.

ssh -O check prod
ssh -O exit prod
ls -l ~/.ssh/cm-*
rm -f ~/.ssh/cm-deadhash
ssh -O stop prod

-O check asks the master if it is alive. -O exit asks it to shut down. If the process is gone and the socket file remains, remove the file. -O stop is similar to exit on current OpenSSH. Do this before you assume the network is down.

A laptop sleep is the usual culprit. The TCP session dies; the socket file does not. ServerAliveInterval 30 with ServerAliveCountMax 3 kills a dead master in about ninety seconds, which is kinder than discovering it ten minutes later. On flaky links, lower persist to 60s so you do not keep a zombie around.

Foreground masters (ControlMaster yes without persist, left running in a dedicated terminal) are easier to see and harder to automate. Prefer auto plus persist unless you are debugging.

Interactions with sudo, tmux, and rsync

Multiplexed sessions share the TCP connection, not the remote environment. A sudo in one shell does not sudo the others. tmux on the server is still the right way to keep remote work alive across laptop sleeps; ControlPersist keeps the client socket, not the remote jobs. If you need a long compile, run it in tmux, not in a multiplexed raw shell.

rsync -e ssh benefits. git benefits. scp -o ControlPath=... is unnecessary if the config already matches. Some tools open SSH with a stripped environment and will start a second master if ControlPath expands differently (different %C inputs). If you see two sockets for one host, print ssh -G and compare.

Do not put ControlMaster auto on a Host stanza used by an unattended cron job that cannot clean up sockets. Cron should use ControlMaster no, or a dedicated ControlPath under /tmp that the job deletes in a trap.

A short takeaway: one handshake, many channels, a hashed ControlPath, a persist window that matches how you work, and ssh -O exit when a sleep breaks the socket. That is the slow-link toolkit. Turn it on against a Netbay Ubuntu 24.04 VPS in Lucknow — instances boot in under 60 seconds at netbayhosts.in.