Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I have three Computers.
PC1 and PC2 is on a private LAN, where PC1 is known to PC2 as 192.168.0.2
PC2 and PC3 is on a another LAN, where PC2 is known to PC3 as 192.168.123.101
How can I connect to PC1 from PC3 with SSH.
Is there something like:
ssh [email protected] -via [email protected]
ssh -o 'ProxyCommand ssh -W %h:%p [email protected]'
Then you can simply run ssh PC1.
Best used through an alias in ~/.ssh/config:
Host PC1
HostName 192.168.0.2
User user
ProxyCommand ssh -W %h:%p [email protected]
For older versions of OpenSSH that don't have the -W option (I think this means ≤5.4), make sure that netcat is available on PC2 and use
Host PC1
HostName 192.168.0.2
User user
ProxyCommand ssh [email protected] nc %h %p
Using SSH there is a clear solution:
on your local machine set up your ~/.ssh/config such that it has the following:
host WhatYouWillCallTheConnection
hostname the.gateway.server.address.com
user YourUsernameOnTheGateway
On both the gateway and the end server you'd like to connect to, make sure that you have your local client's public keys located in the ~/.ssh/authorized_keys
On the gateway machine you need to alter the ~/.ssh/authorized_keys such that at the beginning of the line that specifies your client's public key, add the forced command as follows:
command="ssh -A [email protected]" ...yourPublicKey....
The -A is to forward the agent if you don't like to send passwords all the time...
This way, anytime you do something like ssh WhatYouWillCallTheConnection it will run straight through the gateway and connect you to the server on the other side transparently.
ssh -A if you don't trust the administrator of the gateway machine. He can't get your private key, but as long as you're connected to the gateway with ssh -A, he can use the forwarded agent to connect to other machines as you.
Port Forwarding might come in handy.
From PC1:
~# ssh -fN -L 22:PC3:7777 -l <user> PC2
7777 can be just any port (provided it is not already being used). I just like that number, plus any "ordering up" I can manage by +1 's (7778, 7779, etc, etc).
This being done, you will have a 'transparent' tunnel from PC1's local port 7777 to PC3's port 22. Just issue:
~# ssh -l <user> -p 7777 localhost
And you should be on PC3.
You can also use -D to dynamically forward a port if you want a SOCKS proxy established.
~# ssh -D <someport> -fN -L 22:PC3:7777 -l <user> PC2
Cheers!
The 2017+(since sshv7.3)-answer to this is ProxyJump:
ssh -J user@jumphost user@destination
, which is short for:
ssh -o "ProxyJump user@jumphost" user@destination
This can be shortened to ssh dest with a ~/.ssh/config snippet as such:
Host jump
User MyJumpHostUser
Hostname Jump.host.tld
Host dest
ProxyJump jump
User MyDestUser
Hostname des.tin.ati.on
The only solution I know for this is ssh scripting with Belier:
Belier allows opening a shell or executing a command on a remote computer through a SSH connection. The main feature of Belier is its ability to cross several intermediate computers before realizing the job.
A while ago I found this README.sshhop on the MIT Lincoln Laboratory Homepage, but I wasn't able to find any further information about that. Does somebody know more?
