It is surprisingly difficult to find information on this simple problem.

Like many people we run a gitlabs/gogs server on a remote instance. Currently it listens on port 10022. We also run ssh on that instance to administer the server. It listens on port 22.

We'd like the ssh server listening on port 22 to forward connections for Git@ ONLY to the Git server on 10022.

That way when people use Git locally, they won't have to manually specify the port of our remote Git server each time.

How can we do this?

3 Answers 3


I have never done that but maybe this does what you want:

You can put a Match block for the user git in sshd_config which contains ForceCommand. The forced command can be an ssh login to the real server. You can use public key authentication without passphrase so the users might not even notice this.

  • Can we not forward the user's own public key auth token? The public key authentications and the repos they allow access to are managed by the git server itself -- just like github.
    – DMCoding
    Feb 7, 2016 at 13:59
  • No, it is not possible with openssh. As late as you are in Match block, you can't redirect the connection to different ssh server.
    – Jakuje
    Feb 7, 2016 at 15:14
  • 1
    an complete copy/paste example config snipppet would have been great Jan 14, 2022 at 15:29

A simpler approach would be:

Just tell your users to add an alias for your git-server to the ~/.ssh/config. Then they have the same convenience as with github and you don't have to do some weird redirections on the server side.

For example:

# put into ~/.ssh/config
Host mygitlab
Hostname git.example.org
Port 10022

Then your users can just clone etc. like this:

$ git clone mygitlab:someuser/somerepo.git
  • They are users, not administrators so that would not in any way be simpler. I really dont see how this is a weird idea -- what do github, bitbucket, etc. do? You're telling me they don't use SSH to administer their server fleet just because that port happens to be taken by their git software?
    – DMCoding
    Feb 7, 2016 at 21:49
  • @DanielJames probably they use a different port for admin?
    – nafg
    Mar 31, 2017 at 5:53
  • @nafg, doubtful when there's a more elegant way. You have a list of git users and a list of shell users. Shell users are allowed to use their default shell, git users are forced to use a special git shell binary which only allows git commands. Not difficult, not complicated, not hard to understand. Gitlabs do it (gitlab.com/gitlab-org/gitlab-shell) I'd bet money github does as well.
    – DMCoding
    Mar 31, 2017 at 18:16

the solution lies in the gitlab GUI: just click on the clone button, and paste in the command line.

$ git clone ssh://[email protected]:10022/mygroup/myproject.git

and you can verify everything is correct with:

$ git remote -v
origin  ssh://[email protected]:10022/mygroup/myproject.git (fetch)
origin  ssh://[email protected]:10022/mygroup/myproject.git (push)
  • 2
    How does this address the question?
    – RalfFriedl
    Mar 21, 2019 at 17:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .