I am comfortable with using the ProxyCommand feature of ssh and can use it to hop through mulitple bastion hosts to reach the final host efficiently. But I just can't seem to understand how it actually works in the backend.
For eg. I have the following config file.
Host final Hostname final.com Port 22 AgentForwarding yes User guestuser ProxyCommand "ssh email@example.com -W %h:%p"
I understand that for connecting to host
final, the ProxyCommand will run prior to making the connection to
final.com. But I still can't seem to understand the order of connections.
And what does the option
-W %h:%p do? I understand that it is the netcat feature and is similar to
nc %h %p.
So as far as my understanding goes here is the sequence of operations. Kindly let me know if I am wrong. I'm will be using the config file specified above in my example.
- The user enters
- An ssh connection to bastion.com created.
- A netcat tunnel is created from bastion.com to port 22 of final.com. The stdin of netcat is connected to the shell obtained in the connection to bastion.com.
- So now we have a connection from our system to final.com. The first half of this connection is an ssh connection from our system to bastion.com. The second half of this connection is a netcat tunnel from bastion.com to final.com.
ssh finalcommand takes the above connection as a proxy and tunnels its data through this existing connection.
Additionally I would also like to know whether this techniques is also known as ssh stacking?