Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
How to configure a shortcut for an SSH connection through a SSH tunnel

I have a situation where I would like to have SSH/SFTP access from my workstation to a server that is not directly accessable from my workstation. I do have ssh access to a computer that is on the network which can then ssh to the server in question.

How can I accomplish this?

share|improve this question

migrated from Dec 4 '09 at 17:39

This question came from our site for professional and enthusiast programmers.

marked as duplicate by Zoredache, womble, Chopper3 Aug 28 '11 at 8:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Why can you not just ssh from #1 to console on #2 then ssh from machine #2 to console 3 within the session? I've done it before. – Joe Dec 4 '09 at 17:29
We called this "leapfrogging" – OMG Ponies Dec 4 '09 at 17:30
+1 -- I thought I knew the answer, but in looking below, I see that ssh is more versatile than I thought. – Clinton Blackmore Dec 4 '09 at 20:21

Use the ProxyCommand ssh config variable.

Host inaccessible
ProxyCommand ssh accessible nc -w1 %h %p

This post even explains a way to use a generic config so ssh host1/host2 automatically jumps hosts for you.

Update: Fixed the hostnames in the config snippet as per toppledwagon's comment.

share|improve this answer
+1, that post for a generic option is very useful. I didn't know that was possible. I can use that to drastically simplify my ssh config file. – Zoredache Dec 4 '09 at 18:13
Actually, that example is backwards. <code> Host inaccessible ProxyCommand ssh accessible "nc %h %p" </code> – toppledwagon Dec 4 '09 at 22:45

Use ssh tunnels, of course.

share|improve this answer

You can also do: ssh -t remotelyaccsbl ssh notremotelyaccsbl

share|improve this answer
Would it be possible to make a shortcut for this via .ssh/config so one could simply use ssh notremotelyaccsbl? – sigjuice Dec 22 '09 at 16:17
  1. Open tunnel:

    ssh -qTfnN -D 4040 -C login@remotely-accessible-host

  2. Set up SOCKS5 on localhost with 4040 port in cyberduck

  3. Connect to computer you want access to

    • q - quiet
    • T - without tty
    • f - move to background
    • N - not execute remote commands
    • n - redirect input to /dev/null.
share|improve this answer

If SSH tunnels are not available to you (they can be disabled server-side), then could you reverse the FTP connection?

If your local machine can be seen via SSH on a publicly routable IP address and the inaccessible machine can see the outside world then

  1. SSH to remotelyaccessible
  2. from there SSH to notaccessible
  3. from there use the command-line SCP/SFTP clients to pick up files on your local filesystem

This probably isn't something you are going to be able to automate easily though, so if you have tunnels available use that method instead.

share|improve this answer

WinSCP directly supports connection through an ssh tunnel. Perhaps one of the MacOS clients also provide such functionality?

share|improve this answer

An alternative solution: port forwarding using socat

On the accessible machine, install socat if it is not already installed, and run it like this:

% socat tcp4-listen:1111,fork tcp4:inaccessible:2222

This is basically a port forward. You connect to accessible machine at port 1111 and it will connects you to port 2222 on inaccessible machine. fork will keep socat spawn new process for each connection.

share|improve this answer
up vote -2 down vote accepted

Thanks for all the leads. After playing around with a few options the following setup seems to be the easiest:

  • Downloaded a really nice program call SSHTunnel (highly recommended)
  • Setup my known host in the Servers section of SSHTunnel
  • Setup my desired ports in the Services section
  • Green light shows up letting me know the tunnel is up
  • Use SFTP client (Cyberduck or Fugu) to connect to using the local port set in the Services of SSHTunnel
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.