5

Is there a way in a single SSH command to login via SSH to a remote server passing through an intermediate server? In essence, I need to create a tunnel to my "bridge server" and via the tunnel to login to the remote server.

For example, I'm trying to compress the following into a single ssh command:

  1. ssh -N -L 2222:remoteserver.com:22 bridge_userid@bridgemachine.com
  2. ssh -p 2222 remote_userid@localhost

This currently works, but I would rather be able to squeeze everything into a single command such that if I exit my ssh shell, my tunnel closes at the same time.

I have tried the following in my config but to no avail:

Host axp
  User          remote_userid
  HostName      remoteserver.com
  IdentityFile  ~/.ssh/id_rsa.eric
  ProxyCommand  ssh -W %h:%p  bridge_userid@bridgemachine.com

As per @jasonwryan comments and the transparent-mulithop link, I'm able to get the following command working:

ssh -A -t bridge_userid@bridgemachine.com ssh -A remote_userid@remoteserver.com

but now I would like to package that up neatly into my .ssh/config file, and not quite sure what I need to use as my ProxyCommand. I've seen a couple of links online as well as @boomshadow's answer that requires nc, but unfortunately the AIX server I'm using as my bridge machine does not have netcat installed on it.

  • 1
    ProxyCommand ssh -W %h:%p bridge... – jasonwryan Jul 14 '15 at 18:34
  • @jasonwryan I think I might have something wrong in my config as it is not working. I've got the following in my .ssh/config for my remoteserver: ProxyCommand ssh -W %h:%p bridge_userid@bridgemachine.com. – Eric B. Jul 14 '15 at 18:52
  • Edit that into your question: it will get lost in the comments. You need to declare the host, Host Remote... See sshmenu.sourceforge.net/articles/transparent-mulithop.html – jasonwryan Jul 14 '15 at 19:12
  • Can't you just log into the bridge server and ssh to your target server from there? – daniel kullmann Jul 14 '15 at 20:18
  • @danielkullmann Sure I can. I'm just trying to avoid doing that, and I would rather keep my ssh key on my local machine instead of having to put it on the bridge server as well. – Eric B. Jul 14 '15 at 20:44
6

The ProxyCommand is what you need. At my company, all the DevOps techs have to use a "jumpstation" in order to access the rest of the VPC's. The jumpstation is VPN access-controlled.

We've got our SSH config setup to automatically go through the jumpstation automatically.

Here is an edited version of my .ssh/config file:

Host *.internal.company.com
User jacob
IdentityFile ~/.ssh/id_rsa
ProxyCommand ssh -q -A jacob@company-internal-jumphost  nc -q0 %h %p

Every time I do an 'ssh' to a server on that 'internal' subdomain, it will automatically jump through the jumpstation first.

Edit: Here is the entire section of the .ssh/config for the 'Internal' VPC for us to log into it:

# Internal VPC
Host company-internal-jumphost
   Hostname 10.210.x.x  #(edited out IP for security)
   IdentityFile ~/.ssh/id_rsa
Host 10.210.*
   User ubuntu
   IdentityFile ~/.ssh/company-id_rsa
   ProxyCommand ssh -q -A jacob@company-internal-jumphost  nc -q0 %h %p
Host *.internal.company.com
   User jacob
   IdentityFile ~/.ssh/id_rsa
   ProxyCommand ssh -q -A jacob@company-internal-jumphost  nc -q0 %h %p
  • Thanks for the suggestion. Unfortunately, I don't have netcat (ie: nc) available on the server. (It's an AIX server) – Eric B. Jul 15 '15 at 1:28
  • 2
    There is a more elegant sollution based on ProxyCommand and the -W option which allows you to do things like ssh user@hostA/hostB/hostC to connect to hostC through 2 intermediates, see: dmitry.khlebnikov.net/2015/08/… – galaxy Sep 4 '15 at 13:39
  • Will this work if you have a different username on the intermediary hosts? Can you use ssh user@hostA/otheruser@hostB/someone@hostC? – DopeGhoti Jan 17 '17 at 17:50
  • @DopeGhoti, yes you can. In my 2nd code block, I've got user 'ubuntu' specified for the 10.210.* hosts. Also, you can change your user on the intermediary host (jump host) using the ProxyCommand. See how I've got "jacob@company....". You can also specify a different user there as well. – BoomShadow Jan 17 '17 at 18:56
  • Why not use ssh -W in the ProxyCommand, provided the SSH version isn't too old (5.4)? en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts – 0xC0000022L Mar 27 '18 at 19:22
2

If OpenSSH 7.3 or later is used then you can use ProxyJump like this:

$ ssh -o ProxyJump=user1@gateway user2@remote

If either user is omitted then the local user is implied.


A variation on the indirect login theme is indirect file transfer. You can use scp and rsync with indirect ssh to copy files through the intermediate server.

To copy through the gateway using scp:

$ scp -oProxyJump=root@gateway myfile user@remote:path

If user is omitted, the local user is used.

The ProxyJump was introduced in OpenSSH 7.3. An alternative is to use ProxyCommand:

$ scp -oProxyCommand="ssh -W %h:%p root@gateway" myfile user@remote:path

To copy through the gateway using rsync:

$ rsync -av -e 'ssh -o "ProxyJump root@gateway"' myfile user@remote@path

Or

$ rsync -av -e 'ssh -o "ProxyCommand ssh -A root@gateway -W %h:%p"' myfile user@remote@path

I paraphrase other answers (on superuser) that cover indirect scp and indirect rsync in more detail.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.