8
Local Computer (Fedora)  --SSH-->  Server1  --SSH-->  Server2

In some environments I work in, we have to use "jump boxes" where you ssh to one server in order to get to another server. Is there a quick way to do this, perhaps by editing ~/.ssh/config, such that whenever I ssh to Server2 from my local computer, it automatically creates the necessary connection to Server1? I can setup keys so that I'm not prompted for a password to Server1 if necessary.

1
  • This + scp. Would be perfect.
    – kubanczyk
    Dec 2, 2011 at 19:29

3 Answers 3

6

This type of functionality was added into OpenSSH version 5.4 and can be used by doing

ssh -W server2 server1

Where server2 is your intended destination and server1 is your proxy host. You can make this easier by using the ProxyCommand option in your ssh config, something like:

host = *.example.com
user = packs
port = 22
ProxyCommand ssh -W %h:%p server1

I've also seen it done using netcat, so with the same examples as above

ssh server1 nc -q0 server2 22

Similarly, this can also be used in your ssh config, except replacing the ProxyCommand as

ProxyCommand ssh server1 nc -q0 %h %p
4
  • This seems to be doing the right thing, but I receive channel 0: open failed: administratively prohibited: open failed ssh_exchange_identification: Connection closed by remote host I tried setting PermitTunnel yes in sshd_config on Server1 and restarting sshd but I get the same error. Do I need to do it on Server2?
    – SeanFromIT
    Dec 5, 2011 at 15:10
  • Nevermind. Server1 wasn't resolving Server2. Had to add Server2 to /etc/hosts on Server1 and the error went away.
    – SeanFromIT
    Dec 5, 2011 at 15:25
  • Mind you, the -W option is not available in many existing ssh implementations.
    – ewwhite
    Feb 10, 2013 at 2:47
  • @ewwhite: Precisely, which is exactly why I updated the answer to reflect which versions it's available in.
    – Scott Pack
    Feb 10, 2013 at 2:48
8

You can use a command like:

$ ssh -t user@server1 ssh user@server2

This command ssh you to the server2 via server1. You will be prompted for two passwords consecutively to login to server1 and then to server2. If you setup the needed SSH keys, you will should be logged in automatically to server2.

This is very useful when you can't login directly to server2.

3
  • Nice suggestion.
    – ewwhite
    Dec 2, 2011 at 19:53
  • I recently found this command!
    – Khaled
    Dec 2, 2011 at 19:57
  • Note that such ssh usage is less secure than port forwarding (with ssh -W, or other more traditional methods), because there is no end-to-end encrypted channel between the local machine and server2. If server1 is compromised, the attacker could intercept unencrypted communication between sshd and ssh processes on server1 and get access to server2. Dec 2, 2011 at 20:23
2

I use forwarded ports:

# ~/.ssh/config

# The jumping-off point

Host server1
  Hostname blah.sample.com
  LocalForward 10002 server2:22
  LocalForward 10003 server3:22

# Servers behind the jumping-off point, reached by connecting
# to the forwarded ports above

Host server2
  HostKeyAlias server2
  Hostname localhost
  Port 10002

Host server3
  HostKeyAlias server3
  Hostname localhost
  Port 10003

This has several advantages over ssh -t user@server1 ssh user@server2:

  • Multiple sessions can be established through the same tunnel.
  • You only have to authenticate each connection once instead of twice.
  • Transparent use of ssh, scp and sftp (e.g., you can scp thisfile server2:~/thatfile without having to do any additional gymnastics).
  • X and port forwarding work without having to think about it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .