3

I have a server in a private subnet to which I want to connect via a machine that faces the Internet. There are some tutorials for this. I used this one: https://heipei.github.io/2015/02/26/SSH-Agent-Forwarding-considered-harmful/

The problem with it is that it assumes I can edit the ~/.ssh/config file. If I am however running code on CI, I would rather use the config file shipped in my repository and use -F switch. In this case the above strategy stops working as the ssh command used as ProxyCommand doesn't load the the same configuration file and doesn't know the aliases. What I did was:

Host ansible                                                                    
  User ubuntu                                                                   
  Hostname xxx.compute.amazonaws.com                  

Host app                                                                        
  User ubuntu                                                                   
  Hostname 10.0.2.40                                                            
  ProxyCommand ssh -F test-ssh.cfg -W %h:%p ansible

This works but is a little dirty, as I need to put the name of the file into the file itself and it would break if someone changes the filename. So my question is: is there a cleaner way to create a configuration file with aliases and ProxyCommand that could be used with -F?

5

According to this SuperUser entry, from version 7.3p1, there is an Include directive, so you can create a config file which includes your "regular" config, but has all the ProxyCommand entries. This way, if you specify that file, the proxying connections will work, if you omit the -F switch, the default config will be read, like this:

~/.ssh/config:

Host ansible
  User ubuntu
  Hostname xxx.compute.amazonaws.com

~/.ssh/proxyconfig:

Include config

Host app
  User ubuntu
  Hostname 10.0.2.40
  ProxyCommand ssh -W %h:%p ansible

If you have configs like above, you can use

ssh -F proxyconfig app

to reach the "app" server.

If you can't install the aformentioned version to your client computer, you can specify the ProxyCommand in the command line, without needing a separate config file, like this:

ssh -o ProxyCommand='ssh -W %h:%p ansible' app

Since it is a bit uncomfortable to write the whole command every time, you might want to make an alias to the command, or - if you want to access more computers by proxy - a function, like this:

function proxyssh {
    # The first argument is the 'stepping stone',
    # the second is the target to ssh into
    ssh -o proxyCommand="ssh -W %h:%p $1" $2
}

and use it like

proxyssh ansible app
|improve this answer|||||
5

For proxy hosts you don't need ProxyCommand anymore. There is a new option ProxyJump, which does the same without the need of another ssh with configuration. It will internally issue the same command, but it will also pass the -F argument if provided:

Host ansible                                                                    
  User ubuntu                                                                   
  Hostname xxx.compute.amazonaws.com                  

Host app                                                                        
  User ubuntu                                                                   
  Hostname 10.0.2.40                                                            
  ProxyJump ansible

This feature is available since OpenSSH 7.3.

|improve this answer|||||
2

You could do this without editing ~/.ssh/config by using ProxyCommand as a parameter.

From OpenSSH 5.4 (2010-03-08) there has been "netcat mode":

  • Added a 'netcat mode' to ssh(1): ssh -W host:port ... This connects stdio on the client to a single port forward on the server. This allows, for example, using ssh as a ProxyCommand to route connections via intermediate servers. bz#1618

So it is possible to:

ssh -o ProxyCommand="ssh -W %h:%p firewall" user@10.0.2.40

For historical versions, you can use external nc (from a SSH ProxyCommand article by Vivek Gite):

ssh -o ProxyCommand='ssh user@firewall nc 10.0.2.40 22' user@10.0.2.40

Where

  • firewall is the server facing the Internet.
  • 10.0.2.40 is the server on the local network.
  • netcat (nc) is used to set and establish a TCP pipe between the servers on your local network.
|improve this answer|||||
  • 2
    Don't recommend nc, when the original command already contains -W switch doing the same without requiring any other software installed on the jump host. – Jakuje Apr 7 '17 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.