My question is basically how to turn my existing two steps into one step.

I have a working SSH tunnel set up between two computers using a middleman server like this:


What I do presently is SSH from Kubuntu_laptop to Debian_Server and then from Debian_Server to Kubuntu_desktop. I would like to make that one SSH command, issued on my Kubuntu_laptop in bash that results in my being connected to the Kubuntu_desktop (shell/bash).

The commands I am using now are as follows.

Step 1:

me@kubuntu_laptop:~$ ssh -i ~/.ssh/id_rsa admin@debian_server  

Step 2:

admin@debian_server:$ ssh -p 1234 -i /home/admin/.ssh/id_rsa admin@localhost 

Then I am connected to the kubuntu_desktop via SSH (from kubuntu_laptop).

RSA keys are required for all SSH connections. Password login is disabled all the way around. And notice that the computer user accounts are different at two of the computers.

Regarding the connection for this leg:


Here is how it is established.

Step 0:

autossh -M 5234 -N -f -R 1234:localhost:22 user@mydebian.com -p 22

Notice Kubuntu_desktop connects to middleman as user@mydebian.com (not admin@debian_server). But when I connect to Kubuntu_desktop, I connect as admin user.

I cannot change the existing monitoring port (5234) or the remote (- R) port number (1234 in this example). I cannot change the SSH security to allow password logins. I cannot open up any new firewall ports. I can't change user accounts (except on laptop).

(Once I have this working, I want to get vnc or some remote desktop support solution working over the SSH tunnel.)

  • When are you getting IPv6 so you can stop worrying about this sort of thing? :) Jul 9 '13 at 2:55
  • I had no idea IPv6 could help with this sort of thing? Have an introductory white paper that's relevant to this question? But for now, I have to deal with 40 or more computers to support. They will not be moving to IPv6 any time soon. I use TeamViewer now, but I want to use this SSH tunnel and VNC to replace TeamViewer.
    – MountainX
    Jul 9 '13 at 2:59
  • IPv6 gets rid of NAT which makes the whole setup irrelevant. You'd just connect directly from an allowed host or over a (probably IPSec) VPN, or later Mobile IPv6 will put your laptop right on the corporate network no matter where in the world it is. Jul 9 '13 at 3:01
  • Ah, I see. Suddenly I want IPv6. It helps to have a clear use case. :-)
    – MountainX
    Jul 9 '13 at 3:04
  • 1
    This message has been crossposted (without notification) to the UNIX/Linux SE. This is VERY BAD!
    – mdpc
    Jul 9 '13 at 3:06

Make sure netcat is installed on the Debian server, and use ProxyCommand in your local SSH configuration (~/.ssh/config).

Host Kubuntu_desktop
  User admin
  IdentityFile ~/.ssh/Kubuntu_desktop.rsa
  ProxyCommand ssh -i ~/.ssh/id_rsa admin@Debian_Server nc localhost 1234
  • Thank you. Where you write e.g. Debian_Server is that the hostname or FQDN or something else? And the port number is for which machine?
    – MountainX
    Jul 9 '13 at 3:47
  • It's however you identify whatever you currently SSH to in the middle. The port there is for the far machine. Jul 9 '13 at 3:48
  • Thanks. I'm part way there. Debian_Server has a FQDN and that's what I use for SSH. But what do I use for Kubuntu_desktop? It has no FQDN and I do not connect to it. It connects to Debian_Server.
    – MountainX
    Jul 9 '13 at 3:58
  • Ah. You'd probably use localhost then. Jul 9 '13 at 3:59
  • I used your ProxyCommand line plus it required an IdentityFile line. Could you add that to your answer to make it complete? I also added a User. That may be optional, but that's what it took to get it to work for me.
    – MountainX
    Jul 9 '13 at 4:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.