up vote 1 down vote favorite
share [g+] share [fb]

I have to administer a whole pile of hosts over ssh. However I can only access them through a certain gateway ssh server.

I have the following in my ~/.ssh/config:

Host mygateway-www
Hostname www
IdentityFile ~/.ssh/id_rsa
ProxyCommand ssh mygateway nc %h 22

However I have to connect to lots of these machines. Instead of putting dozens of entries in my ~/.ssh/config, is there anyway I can have something like this:

Host mygateway-*
Hostname ???WHAT GOES HERE????
IdentityFile ~/.ssh/id_rsa
ProxyCommand ssh mygateway nc %h 22

I know you can use %h in the Hostname argument, but that would be the hostname. What I really need is some sort of string substitution, like bash's ${VAR%thingie}. Is this possible?

link|improve this question
79% accept rate
feedback

4 Answers

up vote 1 down vote

You shouldn't need to manually specify HostName as it will come from the command line.

Simply try:

Host *.domain  
  IdentityFile ~/.ssh/id_rsa  
  ProxyCommand ssh mygateway /usr/bin/nc %h 22
link|improve this answer
The problem with that approach is that the Hostname is quite generic (eg db1, www, mail2), whereas I want them prefixed with the project aswell, since I may need to ssh to a different machine called 'db2'. Hence the prefix in Host – Rory McCann Jun 16 '09 at 10:00
2  
So you actually want to reconfigure your DNS. The simplest (but most cumbersome solution) is to modify your hosts file. You could on the other hand always add a local DNS server to your workstation with a .invalid domain and use the hostnames you prefer. – Server Horror Jun 16 '09 at 10:09
+1 the previous. Create a subdomain for each project. DNS is there to make your life easier ;) – Dan Carley Jun 16 '09 at 10:26
feedback
up vote 0 down vote

I had a client with the same setup and I used DSSH to solve my problem.
DSSH among other things allows you to transparently login to remote hosts via a gateway host.

Use cases

  • Collect configuration parameters from Cisco routers which require "ena" login
  • Log in to servers, which have PermitRootLogin disabled directly as root (by typing su - and password automatically), while preserving exit status
  • Add custom logic such as advanced logging
  • tunnel through several connections to get to target server
link|improve this answer
2  
I'd rather not start using some random third party ssh client that uses java, for things that I can do in ~/.ssh/config. – Rory McCann Jun 16 '09 at 10:41
feedback
up vote 0 down vote accepted

It looks like there isn't any way to do this.

link|improve this answer
feedback
up vote 0 down vote

I had a similar problem and ended up writing a script that generated all the boilerplate for me. I no longer change ~/ssh/config, I change ~/ssh/config.in and rerun my script.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.