3

At work, we have a SSH jump host that requires us to use sudo ssh to SSH into the destination host. Something like this:

ssh jump-host
sudo -u sshuser ssh final-host

I'm trying to incorporate this into a ProxyCommand or similar SSH config setup so I can just run ssh final-host, but I'm not sure how or if it's possible.

2

No, you can't integrate a remote sudo call into a ProxyCommand in your use-case, but you can -since OpenSSH 7.6 (Oct 2018)- use:

RemoteCommand

Specifies a command to execute on the remote machine after successfully connecting to the server. The command string extends to the end of the line, and is executed with the user's shell. Arguments to RemoteCommand accept the tokens described in the TOKENS section.

So, you can make an entry in .ssh/config like so:

Host finalhost
    RemoteCommand sudo -u sshuser ssh final-host
    RequestTTY yes
    Hostname jumphost

Host jumphost
     User jumpHostUser
     ... Other options for jumphost, if necessary

This works only for the terminal subsystem, therefore sftp finalhost will land you on jumphost, not finalhost. git and some other tools will not work with finalhost.

0

why don't you have a relay script ?

On jump-host have a script goto.sh

sudo -u $1 ssh $2

on local host have a script jump.sh

ssh jump-host goto.sh my-ssh-user $1

then, from local host, just do

jump.sh final-host

this is assuming

  • every local user have a different ssh-user on jump-host
  • goto.sh is in your $PATH on jump host
-1

This requires that nc is installed on finalhost:

Host finalhost
  proxycommand sudo ssh jumphost ssh finalhost nc localhost 22

It sshs to jumphost, then to finalhost, where it tunnels data to localhost's port 22, which is what the your ssh command then connects to.

1
  • 1
    This does not use sudo on jumphost...
    – yurtesen
    Mar 16 '20 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.