To get to my machine in my office, at the moment I am doing this:

me@home:~$ ssh unix.university.com
me@unix:~$ ssh unix.department.univeristy.com
me@unix.department:~$ ssh office-machine.department.university.com
me@office-machine:~$ echo "This is very annoying"

Is there an easy way of automating this process, perhaps a single command that I can use at my end?

up vote 26 down vote accepted

You can use the ssh client to execute ssh on the remote machine upon login.

ssh -t unix.university.com \
    ssh -t unix.department.univeristy.com \
    ssh -t office-machine.department.university.com

(The reason I include -t in the invocations is because ssh was giving me errors re: stdin not being a terminal when I tried it on my own machine; your machine may be different.)

When you exit from the last shell, the process will chain-exit, saving you typing Ctrl-D over and over again.

  • perfect, thanks – Lucas Nov 21 '11 at 2:58
  • Please note : only add "-t" if you just do a login on the remote machine. To start a command on the remote machine, do NOT put them as they can/will corrupt some things (for exemple: tar cf - something | ssh somewhere "cd /path/remote ; tar xf - " : could become corrupted if you add -t ! See for exemple the wonderful StephaneChazelas's answer unix.stackexchange.com/questions/151916/… ) – Olivier Dulac Jan 20 '17 at 10:07
  • 2
    Using -J is more secure than this answer, because you then have the possibility to store all ssh keys on your local computer. The -J option was introduced in openssh version 7.3 as mentioned in the answer from @Miikka – Erik Sjölund Jan 16 at 18:15
  • @ErikSjölund Openssh doesn't allow more than one -J option. I think you could do it with multiple ProxyCommand options in your config. – amphetamachine Jan 30 at 16:36
  • @amphetamachine With -J you can specify a comma-separated list of hops to go through. But using ProxyCommand with -W is still a much better approach than this answer if you happen to be using a version too old to support -J. – kasperd Feb 11 at 0:22

Yes, there is a great way to do that using ssh ProxyCommand and netcat

Put something like this in your .ssh/config

Host *.department.university.com
User me
ForwardAgent yes
ProxyCommand ssh unix.university.com nc %h %p

This will log directly into any .department.university.com server using the jump/bastion host unix.university.com. You may also need a stanza for unix.university.com directly.

Here is a link explaining how it works: http://backdrift.org/transparent-proxy-with-ssh

With this technique, you can now just write

ssh unix.department.university.com

and it will all appear direct. Tools like rsync, scp, etc (anything in the ssh stack) will work transparently, as well.

  • 1
    +1 I use something similar to this to push data from a test network to a prod network through a staging server. – Arcege Nov 21 '11 at 23:20
  • 1
    Yup, this works great! – gabe. Nov 24 '11 at 19:05
  • 11
    Just for the record newer versions of ssh support the -W option, you can do something like ProxyCommand ssh -W %h:%p gateway instead of depending on nc – Ulrich Dangel Jun 24 '12 at 23:38
  • Good to know! Thx – Aaron Brown Jun 24 '12 at 23:39
  • 1
    works great if the name of the user is the same across machines; if it is different you have to do something like ProxyCommand ssh -W %h:%p user@gateway – Riccardo Cossu Jun 12 '13 at 14:35

In OpenSSH 7.3, ssh added the -J command line flag and the corresponding ProxyJump configuration option to solve exactly this problem.

Give the hosts you wish to ssh through as a comma-separated list to -J. For example:

ssh -J unix.university.com,unix.department.university.com  \
  office-machine.department.university.com

SSH tunneling. I don't recall exactly how to do this however I know there's a way to basically have a machine allow a tunnel by perhaps connecting to a separate port. That way you just shell to the same initial machine (with a different port for example) and it will plop you on your final location.

Would have to look up how to configure it though.

:)

  • You don't want (and probably you can't) open a port or your university ssh gateway… – Stéphane Gimenez Nov 24 '11 at 23:34
  • 7
    If you don't know how to do it, and can't be bothered to look it up, why did you post this answer? – amphetamachine Nov 28 '11 at 8:32
  • 4
    Not really an answer – gabe. Dec 5 '11 at 23:24

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.