11

I have three Computers.

PC1 and PC2 is on a private LAN, where PC1 is known to PC2 as 192.168.0.2

PC2 and PC3 is on a another LAN, where PC2 is known to PC3 as 192.168.123.101

How can I connect to PC1 from PC3 with SSH.

Is there something like:

ssh user@192.168.0.2 -via user@192.168.123.101
18
ssh -o 'ProxyCommand ssh -W %h:%p user@192.168.123.101'

Then you can simply run ssh PC1.

Best used through an alias in ~/.ssh/config:

Host PC1
HostName 192.168.0.2
User user
ProxyCommand ssh -W %h:%p user@192.168.123.101

For older versions of OpenSSH that don't have the -W option (I think this means ≤5.4), make sure that netcat is available on PC2 and use

Host PC1
HostName 192.168.0.2
User user
ProxyCommand ssh user@192.168.123.101 nc %h %p
3

Using SSH there is a clear solution:

  1. on your local machine set up your ~/.ssh/config such that it has the following:

    host WhatYouWillCallTheConnection
        hostname the.gateway.server.address.com
        user YourUsernameOnTheGateway
    
  2. On both the gateway and the end server you'd like to connect to, make sure that you have your local client's public keys located in the ~/.ssh/authorized_keys

  3. On the gateway machine you need to alter the ~/.ssh/authorized_keys such that at the beginning of the line that specifies your client's public key, add the forced command as follows:

    command="ssh -A user_name@ServerTheGatewaySees.ButTheClientCant.net" ...yourPublicKey....
    

The -A is to forward the agent if you don't like to send passwords all the time...

This way, anytime you do something like ssh WhatYouWillCallTheConnection it will run straight through the gateway and connect you to the server on the other side transparently.

  • 2
    Don't use ssh -A if you don't trust the administrator of the gateway machine. He can't get your private key, but as long as you're connected to the gateway with ssh -A, he can use the forwarded agent to connect to other machines as you. – Jander Oct 15 '11 at 6:44
2

Port Forwarding might come in handy.
From PC1:

~# ssh -fN -L 22:PC3:7777 -l <user> PC2  

7777 can be just any port (provided it is not already being used). I just like that number, plus any "ordering up" I can manage by +1 's (7778, 7779, etc, etc).

This being done, you will have a 'transparent' tunnel from PC1's local port 7777 to PC3's port 22. Just issue:

~# ssh -l <user> -p 7777 localhost  

And you should be on PC3.
You can also use -D to dynamically forward a port if you want a SOCKS proxy established.

~# ssh -D <someport> -fN -L 22:PC3:7777 -l <user> PC2  

Cheers!

0

The only solution I know for this is ssh scripting with Belier:

Belier allows opening a shell or executing a command on a remote computer through a SSH connection. The main feature of Belier is its ability to cross several intermediate computers before realizing the job.

A while ago I found this README.sshhop on the MIT Lincoln Laboratory Homepage, but I wasn't able to find any further information about that. Does somebody know more?

0

The 2017+(since v7.3)-answer to this is:

ssh -o "ProxyJump user@jumphost" user@destination

This can be shortened to ssh dest with a ~/.ssh/config as such:

Host jump
    User MyJumpHostUser
    Hostname Jump.host.tld

Host dest
    ProxyJump jump
    User MyDestUser
    Hostname des.tin.ati.on

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.