Multihop with sshpass

Question

I want to use .ssh/config to connect to a host through a gateway. I don't want to set up an RSA key and have to use password. I have previously done this kind of hopping without password. Now trying to do it with password.

A direct command that works for me is:

sshpass -p mypassword ssh -o ProxyCommand="ssh gateway -W %h:%p" myusername@myip

Where I have already set up key auth in gateway and it's details are present in my .ssh/config. To set this up in .ssh/config, I tried the following:

Host h_act
      <username, hostname, port etc.>
      ProxyCommand ssh gateway -W %h:%p
Host h
      ProxyCommand sshpass -p mypassword ssh h_act

However, when I try ssh h, I get Pseudo-terminal will not be allocated as stdin is not a terminal. I tried -vtt with ssh to get weird messages, but no terminal. I know that a chain of ProxyCommand works when there is a netcat/nc or just ssh -W with it. But here, it is not working. Even when I try the last command without sshpass, I get the same error. I am guessing it has to do with certain expectations that ProxyCommand has with the command that follows and I am not able to fulfill them.

Any ideas?

Answer 1

I don't think your configuration is the same as that one-liner, it looks more like this:

ssh -o ProxyCommand='sshpass -p mypassword ssh -o ProxyCommand="ssh gateway -W %h:%p" h_act' myusername@myip 

i.e. you have the sshpass running inside a ProxyCommand.

But I don't think that will work, sshpass wraps the ssh client in a pseudo-terminal, hiding the fact that the password actually comes from a file or something other than user input from a terminal. To do this, it needs to run before the ssh client runs.

If your first one-liner works, but you just don't feel like typing the sshpass each time, you can wrap it in a shell script:

#/bin/sh
sshpass -f passwordfile ssh -o ProxyCommand="ssh gateway -W %h:%p" "$@"

Then run with something like sshscript myusername@myip.

As an aside, don't use sshpass -p, it will make the password visible in ps output for as long as the ssh client (and sshpass) runs. Better use sshpass -e to pass the pw through the environment, or sshpass -f file to read it from a file.