Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

We have a remote Xen server running a lot of guest machines (on Linux), with only a couple of IPs available.

Each guest machine should be directly accessible by the SSH from the outer world.

Right now we assign a separate domain name to each guest machine, pointing to one of the few available IPs. We also assign a port number to that guest machine.

So, to access machine named foo, one should do as follows:

$ ssh -p 12345

...And to access machine named bar:

$ ssh -p 12346

Both and point to the same IP.

Is it possible to somehow get rid of custom ports in this configuration and configure SSH server, listening at that IP (or firewall or whatever on server side), so it would route the incoming connection to the correct guest machine, based on the domain address, so that following works as intended?

$ ssh hostname # prints foo
$ ssh hostname # prints bar

Note that I do know about .ssh/config and related client-side configuration solutions, we're using that now. This question is specifically about a zero client configuration solution.

share|improve this question

marked as duplicate by Cristian Ciupitu, masegaloeh, kasperd, Jenny D, HBruijn May 25 '15 at 12:51

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Go for IPv6 and IP address limitation is no issue anymore ;-) – johannes Nov 9 '11 at 23:33
up vote 10 down vote accepted
Client ----- Xen server

It sounds like SSH Gateway is what you're looking for.

Firstly, create 2 new users foo, bar on the Xen server:

Xen # useradd foo
Xen # useradd bar

Generate key pairs and copy public key to the foo-server and bar-server:

Xen # su - foo
Xen $ ssh-keygen
Xen $ ssh-copy-id -i ~/.ssh/ foo-user@foo-server

(Do the same for bar user)

Now, from the Xen server (SSH Gateway) you can login to the foo-server and bar-server without password prompt.

The next step is to let the Client authenticate to the Xen server with public key:

Client $ ssh-keygen
Client $ ssh-copy-id -i ~/.ssh/ foo@Xen

and the final step is make Xen server open a second connection to the corresponding internal server. Access to Xen, switch to foo, open the ~/.ssh/authorized_keys file and change:

ssh-rsa AAAAB3N...== user@clienthost


command="ssh -t -t foo-user@foo-server" ssh-rsa AAAAB3N...== user@clienthost

The sample result:

$ ssh foo-user@Xen
Last login: Thu Nov 10 13:02:25 2011 from Client
$ id
uid=500(foo-user) gid=500(foo-user) groups=500(foo-user) context=user_u:system_r:unconfined_t
$ exit

Connection to foo-server closed.
Connection to Xen closed.

$ ssh bar-user@Xen
Last login: Thu Nov 10 11:28:52 2011 from Client
$ id
uid=500(bar-user) gid=500(bar-user) groups=500(bar-user) context=user_u:system_r:unconfined_t
$ exit

Connection to bar-server closed.
Connection to Xen closed.
share|improve this answer

As a solution you can use a bonjour, uPNP, DNS/srv based ssh client/wrapper and advertise the services via those protocols. See:

share|improve this answer
In situations where bonjour works (local networks) you usually don't have strong limitations on IP addresses, unless you have a picky network operations group. You have trouble with limited IP addresses on public net systems where IPv4 addresses are limited. – johannes Nov 9 '11 at 23:32
I updated the question to further clarify that the server is remote. – Alexander Gladysh Nov 9 '11 at 23:33
I'm tempted to downvote any answer that suggests using either Bonjour or uPNP. – Chris S Nov 10 '11 at 5:00
Me too. But I can not downvote my answer. :) – Mircea Vutcovici Nov 10 '11 at 14:59

Yes, it is possible, but I know of no SSH server or proxy that supports it. You can't use the syntax you suggest though. You'd have to encode the desired host in the user name. For example ssh -u jsmith@foo The just gives the IP address. The master SSH server running on port 22 would have to 'route' based on what comes after the @ in the user name.

share|improve this answer

This crossed my mind a couple years ago, but it seemed like the answer was no.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.