1

I'm connecting to host-b through host a

Host host-a
    HostName 10.8.0.1
    Port 333
    User host_admin
    IdentityFile ~/.ssh/id-ecdsa-admin

Host host-b
    HostName 1.1.1.1
    Port 567
    ProxyCommand ssh -q -W %h:%p host-a
    User host_user

On my host-a server for host_admin in /home/host_admin/.ssh/config I have:

Host *
   IdentityFile ~/.ssh/id-ecdsa-admin
   User host_user
   Port 567

I do expect that proxy command to consider those User/Port/IdentityFile when connecting to other ssh but they seem to be ignored.

I know they are ignored, because when I remove Port and User from host-b config I can't connect. Shouldn't those from host-b user ssh config be considered?

Host host-b
        HostName 1.1.1.1
        ProxyCommand ssh -q -W %h host-a

What is the catch here?

1

Shouldn't those from host-b user ssh config be considered?

No, the connection from host-a, and host-b all come from your client. At no point is the ssh client invoked on the intermediate system. No shell is opened on that intermediate system, no files are transferred to/from it.

Your keys need to be directly on the client, when using ProxyJump/ProxyCommand.

With your configuration, your computer will make a connection to host-a and basically build a port forward to 1.1.1.1:567 as a socket and this will run as a background process. Then your computer will start a second ssh process which will connect directly to that socket with the port forward.

ProxyCommand/ProxyJump doesn't do something like ssh host-a bash -c "ssh host-b"

Or to put it differently the ProxyJump is basically doing something like this. Just somewhat automagically.

# build tunnel in background
ssh -N -L 2200:1.1.1.1:567 10.8.0.1 -p 333 &
# connect to host-b through the tunnel
ssh 127.0.0.1 -p 2200

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.