1

I'm often in a network that for some silly reason blocks TCP destination port 22. It doesn't seem practical to use a full VPN just to overcome this issue, so I'm sometimes using SSH proxy (via ProxyCommand), sometimes a pseudo-VPN using a combination of ssh -w any:any -p 443 and a couple of local and remote ip command lines.

I'm using SSH as the backend for Git so I cannot directly change the ssh command line.

What I'm looking for is a clean and nice way to temporarily (e.g. via a simple script or environment variable) to contact Git servers like GitHub and Fedora distgit via a server with SSH accessible via TCP port 443. I don't insist on ProxyCommand or -w as the methods.

2

You can store both ProxyCommand and Tunnel with TunnelDevice in your ssh_config. Git is respects your ssh configuration you define in ~/.ssh/config.

Additionally, in the Fedora 25 (openssh-7.3, or from copr), you can use Include directive to modify your configuration using single character in your configuration, something like:

# ~/.ssh/config
#Include ~/.ssh/config_proxy
Host github.com
  # some standard configuration

# ~/.ssh/config_proxy
Host github.com
  ProxyCommand something

You can certainly to script this change with simple sed, if you wish.

  • So your interpretation of the word temporarily is to temporarily modify the permanent configuration. Fair enough. But I really hoped for something that will not have permanent side effects if I fail to switch it back. – Pavel Šimerda Aug 12 '16 at 11:45
  • 2
    (Un)fortunately, ssh does not react on (almost any) environment variables, which makes the results quire reproducible. Though you can pass the GIT_SSH_COMMAND env. var to git, where you can also add ssh -F ~/.ssh/config_proxy, if it is what you want. – Jakuje Aug 12 '16 at 11:50
  • I have just tried GIT_SSH_COMMAND="ssh -F ~/.ssh/config.proxy" git ... and it works for more or less. But I realized I cannot set ProxyCommand globally as I'm currently using ProxyCommand ssh my-ssh-server -p 443 nc github.com 22, which I can only use for github. I would instead like to gobally tunnel all Git/SSH connections through the chosen SSH server. I didn't think about that before so it's not included in the question. – Pavel Šimerda Aug 16 '16 at 18:24
2

With reasonably recent versions of the OpenSSH client, you can put conditional settings in your .ssh/config. So you can set the ProxyCommand line inside a conditional stanza. Besides conditions based on the target which aren't useful here, you can have a condition that consists of running an external command. Use a command to detect whether you're in the network where the proxy is needed, e.g. by checking your DHCP lease.

Match exec "awk /var/lib/dhcp/dhclient.eth0.leases '$2 == \"domain-name-servers\" {nsip=$3} END {exit(nsip == \"192.0\.2\.1\")}'"
    ProxyCommand …

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.