Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My question is basically how to turn my existing two steps into one step.

I have a working SSH tunnel set up between two computers using a middleman server like this:


What I do presently is SSH from Kubuntu_laptop to Debian_Server and then from Debian_Server to Kubuntu_desktop. I would like to make that one SSH command, issued on my Kubuntu_laptop in bash that results in my being connected to the Kubuntu_desktop (shell/bash).

The commands I am using now are as follows.

Step 1:

me@kubuntu_laptop:~$ ssh -i ~/.ssh/id_rsa admin@debian_server  

Step 2:

admin@debian_server:$ ssh -p 1234 -i /home/admin/.ssh/id_rsa admin@localhost 

Then I am connected to the kubuntu_desktop via SSH (from kubuntu_laptop).

RSA keys are required for all SSH connections. Password login is disabled all the way around. And notice that the computer user accounts are different at two of the computers.

Regarding the connection for this leg:


Here is how it is established.

Step 0:

autossh -M 5234 -N -f -R 1234:localhost:22 -p 22

Notice Kubuntu_desktop connects to middleman as (not admin@debian_server). But when I connect to Kubuntu_desktop, I connect as admin user.

I cannot change the existing monitoring port (5234) or the remote (- R) port number (1234 in this example). I cannot change the SSH security to allow password logins. I cannot open up any new firewall ports. I can't change user accounts (except on laptop).

(Once I have this working, I want to get vnc or some remote desktop support solution working over the SSH tunnel.)

share|improve this question
When are you getting IPv6 so you can stop worrying about this sort of thing? :) – Michael Hampton Jul 9 '13 at 2:55
I had no idea IPv6 could help with this sort of thing? Have an introductory white paper that's relevant to this question? But for now, I have to deal with 40 or more computers to support. They will not be moving to IPv6 any time soon. I use TeamViewer now, but I want to use this SSH tunnel and VNC to replace TeamViewer. – MountainX Jul 9 '13 at 2:59
IPv6 gets rid of NAT which makes the whole setup irrelevant. You'd just connect directly from an allowed host or over a (probably IPSec) VPN, or later Mobile IPv6 will put your laptop right on the corporate network no matter where in the world it is. – Michael Hampton Jul 9 '13 at 3:01
Ah, I see. Suddenly I want IPv6. It helps to have a clear use case. :-) – MountainX Jul 9 '13 at 3:04
This message has been crossposted (without notification) to the UNIX/Linux SE. This is VERY BAD! – mdpc Jul 9 '13 at 3:06
up vote 1 down vote accepted

Make sure netcat is installed on the Debian server, and use ProxyCommand in your local SSH configuration (~/.ssh/config).

Host Kubuntu_desktop
  User admin
  IdentityFile ~/.ssh/Kubuntu_desktop.rsa
  ProxyCommand ssh -i ~/.ssh/id_rsa admin@Debian_Server nc localhost 1234
share|improve this answer
Thank you. Where you write e.g. Debian_Server is that the hostname or FQDN or something else? And the port number is for which machine? – MountainX Jul 9 '13 at 3:47
It's however you identify whatever you currently SSH to in the middle. The port there is for the far machine. – Ignacio Vazquez-Abrams Jul 9 '13 at 3:48
Thanks. I'm part way there. Debian_Server has a FQDN and that's what I use for SSH. But what do I use for Kubuntu_desktop? It has no FQDN and I do not connect to it. It connects to Debian_Server. – MountainX Jul 9 '13 at 3:58
Ah. You'd probably use localhost then. – Ignacio Vazquez-Abrams Jul 9 '13 at 3:59
yes, localhost works! Thank you. – MountainX Jul 9 '13 at 4:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.