1

I'm connecting to host-b through host a

Host host-a
    HostName 10.8.0.1
    Port 333
    User host_admin
    IdentityFile ~/.ssh/id-ecdsa-admin

Host host-b
    HostName 1.1.1.1
    Port 567
    ProxyCommand ssh -q -W %h:%p host-a
    User host_user

On my host-a server for host_admin in /home/host_admin/.ssh/config I have:

Host *
   IdentityFile ~/.ssh/id-ecdsa-admin
   User host_user
   Port 567

I do expect that proxy command to consider those User/Port/IdentityFile when connecting to other ssh but they seem to be ignored.

I know they are ignored, because when I remove Port and User from host-b config I can't connect. Shouldn't those from host-b user ssh config be considered?

Host host-b
        HostName 1.1.1.1
        ProxyCommand ssh -q -W %h host-a

What is the catch here?

1 Answer 1

1

Shouldn't those from host-b user ssh config be considered?

No, the connection from host-a, and host-b all come from your client. At no point is the ssh client invoked on the intermediate system. No shell is opened on that intermediate system, no files are transferred to/from it.

Your keys need to be directly on the client, when using ProxyJump/ProxyCommand.

With your configuration, your computer will make a connection to host-a and basically build a port forward to 1.1.1.1:567 as a socket and this will run as a background process. Then your computer will start a second ssh process which will connect directly to that socket with the port forward.

ProxyCommand/ProxyJump doesn't do something like ssh host-a bash -c "ssh host-b"

Or to put it differently the ProxyJump is basically doing something like this. Just somewhat automagically.

# build tunnel in background
ssh -N -L 2200:1.1.1.1:567 10.8.0.1 -p 333 &
# connect to host-b through the tunnel
ssh 127.0.0.1 -p 2200

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .