3

In my workflow I frequently have to open several chained/nested (?) ssh sessions to get where I need:

  1. ssh to remote management server
  2. Escalate privileges (sudo su ...)
  3. Ssh to another remote management server
  4. Ssh to target machine
  5. Optionally escalate privileges again

And it got me wondering...

How long could I keep going on this? How many "jumps" can I open via ssh this way? Is there an upper limit?

As a programmer, my intuition tells me that there is no upper limit because each additional ssh session only needs to know

  1. Where requests come from
  2. Where those requests should be sent

And so my ssh session on my computer is not aware of the other ssh sessions that I opened later.

Is that true or is there an upper limit?

PS. Latency is an obvious upper, but only practical, limit.

  • 3
    I would think that there would be no limit for the reasons you have stated and reading through the rfc pages appears to validate this belief. – user78605 Apr 23 '15 at 10:35
  • The only limit is the user, do you really need to use 10 hop ? 20 ? 256 ? – Archemar Apr 23 '15 at 10:48
  • No, I have no real need to use so many hops - this was intended as a hypothetical question to better understand how ssh works under the hood. @JID, if you can post an answer with some links to the rfc where this is described I will happily accept it! – Robert Rossmann Apr 23 '15 at 10:54
  • 1
    @RobertRossmann There is no specific mention of it, it's just that all the protocols/variable etc only seem to be relevant to the to an from servers with no indication that anything from the previous ssh is known. So there isn't really anything to post, sorry! – user78605 Apr 23 '15 at 10:58
  • 1
    Why this sudo su thing that seems so popular? – roaima Apr 23 '15 at 23:28
2

There is a theoretical limit of sorts: eventually the latency (which has a minimum value due to the fact that each hop must add an overhead of a few CPU instructions) will become so high that it will be larger than TCP timeouts. However you will have given up the system as unusable long before it reaches that stage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.