Redirect ssh trafic for one user through another port

Question

Is it possible to have a configuration like this:

• A server which listen ssh connections on port 22 as usual
• For one user (let's say git) redirect all the traffic through another port (2222 for instance)

As a result the command ssh git@host will produce the same result as ssh -p 2222 git@host.

Basically I try to have a sort of reverse proxy on ssh but as I know we can't use sub domains to distinguish ssh incoming connection, I was wondering if we can accomplish this kind of thing with an user approach.

Edit:

The reason is I have set up a gitolite server in a Docker container so at the end I have a ssh daemon which listen on the port 2222 for git purpose. Additionally I have a "regular" ssh daemon which listen on the port 22 (and I want keep it).

Of course I can access to the git server through the port 2222 (if I open it from the outside) but I was wondering if I can use the "regular" ssh server from remote and then locally redirect it to the "git" ssh for the user git.

So the traffic will be something like this for the user git:

client <==> 22:server:2222:git_container

Answer 1

A simple TCP port-forwarding can't do it: the username is only mentioned further into the SSH protocol, so if you insist on starting off with ssh git@host, then there have to be two full SSH authentication handshakes. I am not aware of a generic SSH-proxy that could do that transparently. You could automate the second hop server-side, e.g. by making a shell script ssh -p 2222 localhost the user's shell on the outer host. But that would be not compatible with lots of SSH's nice perks, like port-forwarding, sftp, scp, ...

A better way would be to customize the client side. E.g. in ~/.ssh/config

Host git_host
    Hostname host
    Port     2222
    Username git

and then ssh git_host (instead of ssh git@host).

If you have to walk through the outer host first (e.g. because you have no direct visibility to port 2222), then you could use these tricks here, e.g.

Host git_host
    Hostname host
    Username git
    ProxyCommand ssh -q git@host nc -q0 localhost 2222

(might not be 100% correct, play with the options)

Answer 2

Configure your regular SSH server to listen on a non standard port. Then you can configure gitolite to use the now free port 22.

This makes it easy for your users, and you seem capable enough to use ssh on a different port.

Answer 3

You could set up the git user on the main host (the one :22 ends up on) and use that user's authorized_keys file to force a forward to the other ssh server. The authorized_keys file would look like this:

command="ssh -p 2222 git@localhost",restrict ecdsa-sha2-nistp521 AAAAE....

You will have to store the git@:2222 user's private key in the git@:22 user's .ssh/ directory. The alternative is to use an ssh agent on the client and enable agent forwarding on the client connection.

The forced command can also be set in a Match block in /etc/ssh/sshd_config.