1

I have 3 servers, lets call them A, B and C

Server C is behind a firewall and only server B can connect to it. Server B and C are under my control.

Now I want server A to connect to server C through server B: A -> B -> C

The problem is I can't change the command on server A which is probably just a simple ssh user@B.

I'm trying to forward the incomming connection using the command option in authorized_keys:

command="ssh user@C" ssh-rsa KEY

Whenever A makes a connection to B, I can see that a connection is made to C but A doesn't seem to realize this and timesout.

I have tried to add options -t,-t -t, -T or -N to the ssh command but to no avail. Is there any way to foreward the ssh connection in a way that server A thinks he is communication with server B.

The connection between B and C need to be triggered when A makes the connection to B and closed when A closes the connection.

All authentication is done using keys.

[edit]

To clarify: I can't control the command on Server A but as it is now, A does connect to B AND then B opens a connection to C. The problem here is dat A does not recognise that new connection. I think it doesn't get a prompt or something so that A knows there is a connection.

If I use this setup manually with 

ssh user@B

it works and I'm directly logged in at C.

Improve this question

2 Answers 2

Reset to default
1

What you are looking for is an SSH tunnel.

ssh -f user@B -L 2000:C:22

This connects to server B, directly goes to background with -f and then opens port 2000 on localhost with L. Everything that is send to this port on localhost is forwarded to port 22 on C. So once you entered this command you can do

ssh localhost -p 2000

Which will connect you to C.

Update

Seems I misunderstood you, sorry. If you cannot change the command on A, you can still specify what should happen on login, by changing the ~/.bashrc of the user.

Improve this answer
3
  • This won't work. I can't specify the command on A. I can only enter the hostname, username and port. So I need to create the tunnel on server B at the moment A connects to B.
    – Nin
    Oct 13, 2016 at 13:27
  • @Nin sorry that I misunderstood you. I made an edit. You can change the ~/.bashrc of the user so it does an ssh connect this way.
    – mzhaase
    Oct 13, 2016 at 13:32
  • thanks for you answer. Please see my edit for more clarification (I hope ;:)
    – Nin
    Oct 13, 2016 at 13:52
1

In the home directory of the user in the server B you'd add a last line to the file ~/.login (or create it if it doesn't exist) in order to run the second ssh userc@hostC.

Please, don't used ~/.bashrc: while the former is used after logins, the latter is used for every bash execution, even the one in scripts starting with #!/bin/bash.

Improve this answer
3
  • although I have put it in the autorized_keys file (so it will only be used for server A) it seems that A does not see the new connection. Please see my edit.
    – Nin
    Oct 13, 2016 at 13:53
  • authorized_keys is to be used with the destination SSH server, not the originating one! I'd expect to see authorized_keys in servers B and C for this specific purpose, if needed.
    – EnzoR
    Oct 14, 2016 at 6:23
  • yes, this is in authorized_keys on server B. It works, in that I can see that a connection is made to server C but server A does not see/use the new connection.
    – Nin
    Oct 14, 2016 at 6:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .