Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to use OpenSSH to relay to other SSH enabled devices such as routers switches etc.. If is this something that can be done without creating a bespoke application on Linux to do it?

Thanks

share|improve this question
add comment

4 Answers

up vote 2 down vote accepted

Sure; just use SSH port forwarding/tunneling. Start an ssh connection to the "proxy" machine using the following command:

ssh -L$LOCALPORT:$REMOTEHOST:$SSHPORT $PROXYHOST
  • $PROXYHOST: the machine you've got SSH access to
  • $REMOTEHOST: the machine that $PROXYHOST can connect to, but you can't. Use a hostname or IP that $PROXYHOST can use to refer to the machine
  • $SSHPORT: the port that sshd is listening for on remotehost; most likely 22
  • $LOCALPORT: the local outbound port SSH is opening up on your local machine that forwards to port 22 on $REMOTEHOST

Leave that connection up to keep the tunnel working. You might want to also add -N to the command so that this connection won't bring up a remote shell and you won't accidentally close it later.

Once the tunnel is established, do the following:

ssh -p $LOCALPORT localhost

This attempts an SSH connection to your local machine on the port that's forwarded to the $REMOTEHOST's SSH port.

share|improve this answer
add comment

You can forward connections automatically using OpenSSH. In your ~/.ssh/authorized_keys file, you can specify a command to execute, which could be an SSH to a second machine.

[ssh client] ----> [ssh relay server] ----> [ssh target server]
    you          modified authorized_keys      target machine

What you will end up seeing is two prompts for Password:: one for the relay server and one for the target server. You can always remove this behaviour by using certificates.

share|improve this answer
    
that sounds perfect how would you configure the sshd in openssh? –  aHunter Oct 8 '09 at 2:43
    
Refer to the section on [Forced Commands][1] at [1] eng.cam.ac.uk/help/jpmg/ssh/authorized_keys_howto.html –  sybreon Oct 8 '09 at 5:35
add comment

If you are willing to update the configuration on your client you can setup your client to use your gateway box as a proxy. Your relay box will need netcat installed, and for the best results you'll want to have key-based authentication setup.

Here is what I use in my .ssh/config to connect through another host.

Host internal-ssh-host-proxy
    ProxyCommand /usr/bin/ssh username@ssh-relay-host "/bin/netcat -w 1 internal-ssh-host 22"

With the above you can simply run the command ssh internal-ssh-host-proxy from your client machine.

If the proxy SSH host is has the OpenSSH client 5.4 or above you do not need netcat, and instead you can use the built in netcat mode.

Host internal-ssh-host-proxy
    ProxyCommand /usr/bin/ssh username@ssh-relay-host -W internal-ssh-host:22
share|improve this answer
    
Sorry but this is not using OpenSSH you are using netcat to do the relay between client server and server? –  aHunter Oct 7 '09 at 23:38
    
It is using OpenSSH combined with a very common utility that is available almost everywhere. It is not pure ssh, but I wouldn't call it bespoken. –  Zoredache Oct 7 '09 at 23:49
    
No I agree it is not bespoke but I wanted to know if it is possible to relay using OpenSSH so that you use a standard ssh client and ssh to a box running OpenSSH that then automatically then provides ssh access to another machine or multiple machines. Thanks –  aHunter Oct 7 '09 at 23:57
    
+1 works for me –  xkcd150 Mar 29 '10 at 22:09
1  
@aHunter, for the record there is now a 'netcat mode' built into openssh 5.4 which makes offers a pure openssh connection - blog.rootshell.be/2010/03/08/openssh-new-feature-netcat-mode no external tools are needed. –  Zoredache Mar 30 '10 at 0:03
add comment

Of the presented answers, Zordache's is the the best overall solution. However for posterity, if you simply want to connect ad-hoc without editing your config, use the -t flag to allocate a pseudo terminal along with executing ssh directly on the relay.

ssh -t relay.example.com ssh internal.example.com
share|improve this answer
    
simplest solution without edit files –  Kartoch Jul 5 at 8:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.