Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have to administer a whole pile of hosts over ssh. However I can only access them through a certain gateway ssh server.

I have the following in my ~/.ssh/config:

Host mygateway-www
Hostname www
IdentityFile ~/.ssh/id_rsa
ProxyCommand ssh mygateway nc %h 22

However I have to connect to lots of these machines. Instead of putting dozens of entries in my ~/.ssh/config, is there anyway I can have something like this:

Host mygateway-*
Hostname ???WHAT GOES HERE????
IdentityFile ~/.ssh/id_rsa
ProxyCommand ssh mygateway nc %h 22

I know you can use %h in the Hostname argument, but that would be the hostname. What I really need is some sort of string substitution, like bash's ${VAR%thingie}. Is this possible?

share|improve this question

5 Answers 5

You shouldn't need to manually specify HostName as it will come from the command line.

Simply try:

Host *.domain  
  IdentityFile ~/.ssh/id_rsa  
  ProxyCommand ssh mygateway /usr/bin/nc %h 22
share|improve this answer
The problem with that approach is that the Hostname is quite generic (eg db1, www, mail2), whereas I want them prefixed with the project aswell, since I may need to ssh to a different machine called 'db2'. Hence the prefix in Host –  Rory Jun 16 '09 at 10:00
So you actually want to reconfigure your DNS. The simplest (but most cumbersome solution) is to modify your hosts file. You could on the other hand always add a local DNS server to your workstation with a .invalid domain and use the hostnames you prefer. –  Server Horror Jun 16 '09 at 10:09
+1 the previous. Create a subdomain for each project. DNS is there to make your life easier ;) –  Dan Carley Jun 16 '09 at 10:26
up vote 1 down vote accepted

It looks like there isn't any way to do this.

share|improve this answer

This can be done with the following SSH config file:

Host *
  ServerAliveInterval 120

Host gateway.somewhere.com
  User jdoe

Host gateway+*
  User jdoe
  ProxyCommand ssh -T -a $(echo %h |cut -d+ -f1).somewhere.com nc $(echo %h |cut -d+ -f2) %p 2>/dev/null
  ControlMaster auto
  ControlPath ~/.ssh/ssh-control_%r@%h:%p

You then access your internal hosts like so:

ssh gateway+internalhost01.somewhere.com
ssh gateway+internalhost02.somewhere.com

The name you choose for the right half should be resolvable by the jump host.

The User parameter is specified in case you need to manually map to different users on the different classes of hosts. ControlMaster and ControlPath are specified to allow SSH connection re-use.

share|improve this answer

I had a client with the same setup and I used DSSH to solve my problem.
DSSH among other things allows you to transparently login to remote hosts via a gateway host.

Use cases

  • Collect configuration parameters from Cisco routers which require "ena" login
  • Log in to servers, which have PermitRootLogin disabled directly as root (by typing su - and password automatically), while preserving exit status
  • Add custom logic such as advanced logging
  • tunnel through several connections to get to target server
share|improve this answer
I'd rather not start using some random third party ssh client that uses java, for things that I can do in ~/.ssh/config. –  Rory Jun 16 '09 at 10:41

I had a similar problem and ended up writing a script that generated all the boilerplate for me. I no longer change ~/ssh/config, I change ~/ssh/config.in and rerun my script.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.