I'm trying to mux between two ssh servers based on incoming username i.e.
ssh user1@testserver will go to one sshd instance and user2@testserver goes to another.
Can this be done?
No. Everything in an ssh session is encrypted. How do you propose the proxy would be able to snoop on the username?
I think you can do this with
in /etc/sshd/sshd_config. Here
If you only have a small, fixed set of users who you want to do this for, then you can configure it all in sshd_config with for example
But I don't know if this would correctly hook up the standard out/in of the incoming connection to standard in/out of the new ssh command.
This is quite nontrivial to do transparently (maybe tweak an SSH honeypot program to auto-login and then use
This concept is called an SSH bastion host. No special software is needed on the proxy (the bastion). The only software the end users need access to is netcat (
Each OS X / Linux / BSD / UNIX user would have an entry in their
Each user's config would only differ in the target server (e.g. USER1_SERVER), which is connected to on the local network by the bastion. (If user names differ, consider
That's actually all there is to it. Now USER1 can run
Windows users can do this through PuTTY by using
If you want to tightly restrict the user on the bastion, you can do this:
... though this does prevent user1 from managing their authorized_keys file on the bastion.