Speed Up Repeated SSH Connections with Connection Multiplexing

Repeated SSH calls pay the setup tax every time

If your deployment script, ad-hoc troubleshooting loop, or configuration tool runs ssh example.com uptime dozens of times, each invocation performs a fresh TCP handshake and SSH authentication. On a fast network that overhead is still measurable; over a VPN or high-latency link it adds up. One-off connections cannot avoid this cost, but repeated traffic to the same host can.

The useful takeaway: OpenSSH client connection multiplexing lets later SSH, SCP, and SFTP sessions reuse an already-authenticated TCP connection to the same host. Subsequent work skips most setup, at the cost of managing a local socket file and occasional stale connections.

How ControlMaster and ControlPersist work

ControlMaster auto tells the OpenSSH client to create a persistent "master" connection on first use. Later sessions to the same user, host, and port attach to that master through a Unix domain socket—a local file used for inter-process communication—rather than opening a new TCP connection.

ControlPersist keeps the master open after the last client session exits. You can set a fixed duration such as 4h, or yes to keep it open indefinitely. ControlPath names the socket file; a common template is ~/.ssh/sockets/%r@%h:%p, where %r is the remote username, %h is the host, and %p is the port.

Multiplexing works for interactive shells, single remote commands, local and remote port forwards, and subsystems such as SFTP. Channel behavior over a shared transport is not identical in every case, so interactive and bulk-transfer workloads should be checked separately.

Worked example: enable reuse for one host

Run these commands on the client machine, as your normal user. You need write permission to ~/.ssh; the socket directory should be owned by you and mode 700 because SSH enforces ownership and permission checks on socket files.

1. Create the socket directory:

mkdir -p ~/.ssh/sockets
chmod 700 ~/.ssh/sockets

1. Add a host-specific block to ~/.ssh/config. Replace example with your shortcut name and example.com with the real host:

Host example
  HostName example.com
  ControlMaster auto
  ControlPersist 4h
  ControlPath ~/.ssh/sockets/%r@%h:%p

1. Run a command twice:

ssh example true
ssh example true

The first invocation performs normal authentication and creates the socket. The second should attach to the existing master instead of repeating the handshake. Do not assume a specific time saving; measure with time if you need to justify the change.

Confirm the master is running with:

ssh -O check -S ~/.ssh/sockets/[contact removed]:22 example

Replace [contact removed]:22 with the literal socket path implied by your ControlPath. A running master reports that the socket exists; a missing or stale socket reports that no master is running.

Inspect sockets and close stale masters

Use ls -l ~/.ssh/sockets to see socket files and their ownership. ss -x lists Unix domain sockets on Linux and can confirm the file is active. For verbose client-side evidence, run ssh -vvv example true and look for debug lines mentioning the control socket.

If the network changes, a VPN reconnects, or the host moves addresses, the master can become stale. Close it explicitly:

ssh -O exit -S ~/.ssh/sockets/[contact removed]:22 example

A finite ControlPersist value such as 4h limits how long a stale master survives; yes leaves it open until you close it manually or the client process ends.

Trade-offs and limitations

• One-off connections gain little. The first connection still pays the full setup cost, so multiplexing pays off only when you send multiple sessions to the same host.
• Socket paths must be unique. With bastion hosts or proxy jumps, include enough of %r, %h, and %p in ControlPath so unrelated sessions do not share a socket accidentally.
• Interactive authentication can block automation. If the master requires a password or token, later non-interactive jobs may wait for that interactive prompt to finish.
• Socket files are local state. Do not share a socket directory across unrelated users without reviewing ownership, permissions, and access risks.
• Not every SSH implementation supports this. ControlMaster and ControlPersist are OpenSSH client features; older or embedded clients and servers may behave differently. Test on the oldest OpenSSH version in your fleet before standardizing.

Rollback

Because this creates local state, you can reverse it cleanly. First close any running master with ssh -O exit, then remove the Host block from ~/.ssh/config and delete the socket files:

ssh -O exit -S ~/.ssh/sockets/[contact removed]:22 example
rm -f ~/.ssh/sockets/*

Remove the ~/.ssh/sockets directory only if nothing else uses it.

Closing

Enable multiplexing for hosts you contact repeatedly—automation targets, bastion hosts, or daily interactive boxes—and leave one-off hosts alone. Start with a finite ControlPersist window, verify with ssh -O check, and test on your oldest client before rolling the config out more broadly.