Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Trying to figure out server side SSH jump hosts logic. Current network schema:

[Client] <--> [Server A: hostname: a.com] <--> [Server B]

[Client] <--> [Server A: hostname: b.com] <--> [Server C]

Server A responds to both DNS records.

Possible flow:

  1. Client opens a ssh connection with ssh user@a.com. Server A accepts it and should automatically jump user onto Server B with ssh user2@server_b.com.

  2. Client opens a ssh connection with ssh user@b.com. Server A accepts it and should automatically just user onto Server C with ssh user2@server_c.com.

In other words, client should be able to connect to the target without performing any local configuration, assuming that we have a stock ssh config. The problem with ssh jumps is that user has to define hosts in local ~/.ssh/config file, which is not acceptable in my case. It needs to be a default sshd behavior.

Im aware that you can define a custom command ~/.ssh/authorized_keys on server, but i dont think there is a way to properly detect source hostname where user tries to connect.

The only solution i can see right now is to generate custom users and set a forced command in ~/.ssh/authorized_key to be like this:

command="ssh user@server_b.com KEYDATA

And then users should establish connection using ssh myuser@a.com.

Im wondering if there is a way to do it with sshd config?

share|improve this question
    
So the connection to server_b should be a completely different username? –  DerfK Nov 29 '12 at 22:50
    
Yes. Server A is just a middle man, used to jump user into virtual machine that runs on the server. –  Dan Sosedoff Nov 29 '12 at 22:52
    
I added a better problem explanation. –  Dan Sosedoff Nov 29 '12 at 22:57
    
OK, I'm still trying to figure out what you're doing. Do your virtual servers not have their own IP addresses? How would anyone reach any of the servers? –  DerfK Nov 29 '12 at 23:09
    
Yes, each virtual server has an IP address 192.168.1.x. I can reach them just running a direct ssh command: ssh user@192.168.1.x. Now i need the client (outside) to be jumped to that virtual server –  Dan Sosedoff Nov 29 '12 at 23:12
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.