Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a remote Xen server running a lot of guest machines (on Linux), with only a couple of IPs available.

Each guest machine should be directly accessible by the SSH from the outer world.

Right now we assign a separate domain name to each guest machine, pointing to one of the few available IPs. We also assign a port number to that guest machine.

So, to access machine named foo, one should do as follows:

$ ssh foo.example.com -p 12345

...And to access machine named bar:

$ ssh bar.example.com -p 12346

Both foo.example.com and bar.example.com point to the same IP.

Is it possible to somehow get rid of custom ports in this configuration and configure SSH server, listening at that IP (or firewall or whatever on server side), so it would route the incoming connection to the correct guest machine, based on the domain address, so that following works as intended?

$ ssh foo.example.com hostname # prints foo
$ ssh bar.example.com hostname # prints bar

Note that I do know about .ssh/config and related client-side configuration solutions, we're using that now. This question is specifically about a zero client configuration solution.

share|improve this question
1  
Go for IPv6 and IP address limitation is no issue anymore ;-) –  johannes Nov 9 '11 at 23:33

4 Answers 4

up vote 7 down vote accepted
                         foo  
                        /
Client ----- Xen server
                        \
                         bar

It sounds like SSH Gateway is what you're looking for.

Firstly, create 2 new users foo, bar on the Xen server:

Xen # useradd foo
Xen # useradd bar

Generate key pairs and copy public key to the foo-server and bar-server:

Xen # su - foo
Xen $ ssh-keygen
Xen $ ssh-copy-id -i ~/.ssh/id_rsa.pub foo-user@foo-server

(Do the same for bar user)

Now, from the Xen server (SSH Gateway) you can login to the foo-server and bar-server without password prompt.

The next step is to let the Client authenticate to the Xen server with public key:

Client $ ssh-keygen
Client $ ssh-copy-id -i ~/.ssh/id_rsa.pub foo@Xen

and the final step is make Xen server open a second connection to the corresponding internal server. Access to Xen, switch to foo, open the ~/.ssh/authorized_keys file and change:

ssh-rsa AAAAB3N...== user@clienthost

to:

command="ssh -t -t foo-user@foo-server" ssh-rsa AAAAB3N...== user@clienthost

The sample result:

$ ssh foo-user@Xen
Last login: Thu Nov 10 13:02:25 2011 from Client
$ id
uid=500(foo-user) gid=500(foo-user) groups=500(foo-user) context=user_u:system_r:unconfined_t
$ exit
logout

Connection to foo-server closed.
Connection to Xen closed.

$ ssh bar-user@Xen
Last login: Thu Nov 10 11:28:52 2011 from Client
$ id
uid=500(bar-user) gid=500(bar-user) groups=500(bar-user) context=user_u:system_r:unconfined_t
$ exit
logout

Connection to bar-server closed.
Connection to Xen closed.
share|improve this answer

As a solution you can use a bonjour, uPNP, DNS/srv based ssh client/wrapper and advertise the services via those protocols. See: http://eric.windisch.us/software/zerossh/

share|improve this answer
2  
In situations where bonjour works (local networks) you usually don't have strong limitations on IP addresses, unless you have a picky network operations group. You have trouble with limited IP addresses on public net systems where IPv4 addresses are limited. –  johannes Nov 9 '11 at 23:32
    
I updated the question to further clarify that the server is remote. –  Alexander Gladysh Nov 9 '11 at 23:33
1  
I'm tempted to downvote any answer that suggests using either Bonjour or uPNP. –  Chris S Nov 10 '11 at 5:00
    
Me too. But I can not downvote my answer. :) –  Mircea Vutcovici Nov 10 '11 at 14:59

Yes, it is possible, but I know of no SSH server or proxy that supports it. You can't use the syntax you suggest though. You'd have to encode the desired host in the user name. For example ssh -u jsmith@foo foo.example.com. The foo.example.com just gives the IP address. The master SSH server running on port 22 would have to 'route' based on what comes after the @ in the user name.

share|improve this answer

This crossed my mind a couple years ago, but it seemed like the answer was no.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.