I am comfortable with using the ProxyCommand feature of ssh and can use it to hop through mulitple bastion hosts to reach the final host efficiently. But I just can't seem to understand how it actually works in the backend.
For eg. I have the following config file.
Host final Hostname final.com Port 22 AgentForwarding yes User guestuser ProxyCommand "ssh firstname.lastname@example.org -W %h:%p"
I understand that for connecting to host
final, the ProxyCommand will run prior to making the connection to
final.com. But I still can't seem to understand the order of connections.
And what does the option
-W %h:%p do? I understand that it is the netcat feature and is similar to
nc %h %p.
So as far as my understanding goes here is the sequence of operations. Kindly let me know if I am wrong. I'm will be using the config file specified above in my example.
1) The user enters
2) An ssh connection to bastion.com created.
3) A netcat tunnel is created from bastion.com to port 22 of final.com. The stdin of netcat is connected to the shell obtained in the connection to bastion.com.
4) So now we have a connection from our system to final.com. The first half of this connection is an ssh connection from our system to bastion.com. The second half of this connection is a netcat tunnel from bastion.com to final.com.
ssh final command takes the above connection as a proxy and tunnels its data through this existing connection.
Additionally I would also like to know whether this techniques is also known as ssh stacking?