5

I'm starting from a suggestion to use jvisualVM via SOCKS. However, I have a somewhat complex topology.

Starting from my laptop, I have two intermediate hosts to get through to reach the machine I wish to observe.

LaptopAtHome -> HostAtWork -> AWS-Bastion -> ThingToObserve

I can use ssh-add to handle the keys needed to make those hops. I am not supposed to leave any SSH private keys on the AWS-Bastion. How do I set all this up so that:

ssh -v -D 9696 thingtobserve.example.com

opens the wormhole from my laptop to the other end?

Also note that I need to use a different private key for the first hop than for the second and third. I have both keys loaded on the starting host with ssh-add.

Some research led me to try:

#!/bin/sh

noknown="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"

ssh -A -t -t -v -L9999:localhost:9932 first ssh -A $noknown -t ec2-user@bastion ssh -A $noknown -t -D 9932 ec2-user@target

this fails with 'permission denied'.

I tried a simple first step:

ssh -t -v -A first ssh -A -t -v $noknown ec2-user@bastion

and the log shows that the the extra keys from the agent aren't being presented to 'bastion'. ssh -L shows them on my starting point.

EDIT

It turns out that part of the problem here is that one of the hosts at my office that I was trying to use as the first hop destination has some mysterious problem. If I switch to another, I can get a shell just fine, all the way across. What I can't get is a socks proxy.

A comment on the question suggests that multi-hopping a socks proxy is, in fact, conceptually hard, and so that's the real question of this question.

EDIT 2

this page makes a claim about multi-hop socks, but it looks to me as if there might be a typo in the port numbers; I'm experimenting.

Improve this question
4
  • This is really interesting question. I started writing answer, but realized that it does not work, when you want to hop with SOCKS proxy over more hosts. Also your example can't work, since the local port forwarding is established before the target socks proxy is created. I thought that ~C escape sequence might do this, but it does not work on multiplexed sessions. I bookmarked it and I will try to find some solution.
    – Jakuje
    Commented Jan 17, 2016 at 22:19
  • @Jakuje thank you; since I solved the basic auth issues I'm left, indeed, with troubles in the SOCKS drawer.
    – bmargulies
    Commented Jan 17, 2016 at 22:56
  • Basic authentication should be solved using series of ProxyCommand ssh -W %h:%p stepHost. It is cleaner then the ssh-agent forwarding as described many times before. As I will have some idea about the socks, I will let you know.
    – Jakuje
    Commented Jan 17, 2016 at 23:00
  • Take a look at this related question: superuser.com/questions/96489/an-ssh-tunnel-via-multiple-hops
    – Pierz
    Commented Dec 11, 2017 at 18:34

2 Answers 2

Reset to default
3

Well, I found an answer:

ssh -t -v -A -D9932 -L9933:localhost:9933 -L9934:localhost:9934 FIRST-HOST ssh -D9933 -L9934:localhost:9934 -A -t -v  ec2-user@SECOND-HOST ssh -D9934 -A -t -v ec2-user@THIRD-HOST

using 9934 as the socks proxy port.

Obviously can be mapped to .ssh/config as needed. credits to second link in my question.

Improve this answer
1
  • In VisualVM, what is host for the remote host and jmx host?
    – Kalyanaraman Santhanam
    Commented Aug 31, 2017 at 4:24
2

I wouldn't try to use multihop proxy but using the intermediate host as a SSH relay for accessing the bastion. From there you can setup your SOCKS proxy.

Configure access to the host at work

First configure access to host-at-work:

Host host-at-work
User myself

Configure access to the bastion

Then we configure the access to the bastion. We use host-at-work as a SSH relay for connecting to the bastion:

Host bastion
User myself
ProxyCommand ssh host-at-work -W bastion:22

Now you should be able to connect to bastion using:

ssh bastion

Setting up a SOCKS proxy

Now that you can connect to bastion, you can setup the SOCKS proxy:

ssh bastion -D 9932 -N

Want to connect to the last host on SSH?

Then you want to ask SSH to use the bastion as a relay:

Host thing-to-observe
User myself
ProxyCommand ssh bastion -W thing-to-observe:22

You should then be able to:

ssh thing-to-observe
Improve this answer
3
  • OK, but why is this better than my working multihop?
    – bmargulies
    Commented Jan 18, 2016 at 13:55
  • 1
    @bmargulies, because once it is configured you can just do "ssh THIRD-HOST" completely transparently and forget about the relay hosts. Moreover, you do not have to manage/allocate port numbers. And it doesn't scale very well: you have to add -L flags at each layer.
    – ysdx
    Commented Jan 20, 2016 at 18:33
  • One way this seems to be slightly different is key management - if I'm chaining ssh commands by hand then it can authenticate to bastion using an SSH key that lives on host-at-work. When attempting ProxyCommand key authentication fails, presumably as it's depending on local keys. Perhaps there are extra options that can fix this.
    – Nick H
    Commented Feb 3, 2022 at 14:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .