Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
Local Computer (Fedora)  --SSH-->  Server1  --SSH-->  Server2

In some environments I work in, we have to use "jump boxes" where you ssh to one server in order to get to another server. Is there a quick way to do this, perhaps by editing ~/.ssh/config, such that whenever I ssh to Server2 from my local computer, it automatically creates the necessary connection to Server1? I can setup keys so that I'm not prompted for a password to Server1 if necessary.

share|improve this question
This + scp. Would be perfect. – kubanczyk Dec 2 '11 at 19:29
up vote 6 down vote accepted

This type of functionality was added into OpenSSH version 5.4 and can be used by doing

ssh -W server2 server1

Where server2 is your intended destination and server1 is your proxy host. You can make this easier by using the ProxyCommand option in your ssh config, something like:

host = *
user = packs
port = 22
ProxyCommand ssh -W %h:%p server1

I've also seen it done using netcat, so with the same examples as above

ssh server1 nc -q0 server2 22

Similarly, this can also be used in your ssh config, except replacing the ProxyCommand as

ProxyCommand ssh server1 nc -q0 %h %p
share|improve this answer
This seems to be doing the right thing, but I receive channel 0: open failed: administratively prohibited: open failed ssh_exchange_identification: Connection closed by remote host I tried setting PermitTunnel yes in sshd_config on Server1 and restarting sshd but I get the same error. Do I need to do it on Server2? – SeanFromIT Dec 5 '11 at 15:10
Nevermind. Server1 wasn't resolving Server2. Had to add Server2 to /etc/hosts on Server1 and the error went away. – SeanFromIT Dec 5 '11 at 15:25
Mind you, the -W option is not available in many existing ssh implementations. – ewwhite Feb 10 '13 at 2:47
@ewwhite: Precisely, which is exactly why I updated the answer to reflect which versions it's available in. – Scott Pack Feb 10 '13 at 2:48

You can use a command like:

$ ssh -t user@server1 ssh user@server2

This command ssh you to the server2 via server1. You will be prompted for two passwords consecutively to login to server1 and then to server2. If you setup the needed SSH keys, you will should be logged in automatically to server2.

This is very useful when you can't login directly to server2.

share|improve this answer
Nice suggestion. – ewwhite Dec 2 '11 at 19:53
I recently found this command! – Khaled Dec 2 '11 at 19:57
Note that such ssh usage is less secure than port forwarding (with ssh -W, or other more traditional methods), because there is no end-to-end encrypted channel between the local machine and server2. If server1 is compromised, the attacker could intercept unencrypted communication between sshd and ssh processes on server1 and get access to server2. – Sergey Vlasov Dec 2 '11 at 20:23

I use forwarded ports:

# ~/.ssh/config

# The jumping-off point

Host server1
  LocalForward 10002 server2:22
  LocalForward 10003 server3:22

# Servers behind the jumping-off point, reached by connecting
# to the forwarded ports above

Host server2
  HostKeyAlias server2
  Hostname localhost
  Port 10002

Host server3
  HostKeyAlias server3
  Hostname localhost
  Port 10003

This has several advantages over ssh -t user@server1 ssh user@server2:

  • Multiple sessions can be established through the same tunnel.
  • You only have to authenticate each connection once instead of twice.
  • Transparent use of ssh, scp and sftp (e.g., you can scp thisfile server2:~/thatfile without having to do any additional gymnastics).
  • X and port forwarding work without having to think about it.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.