ProxyCommand use for multiple hops and prompt authentication

Question

How can I rewrite the following command with ProxyCommand?

ssh -l username1 -t jumphost1 \
ssh -l username2 -t jumphost2 \
ssh -l username3 -t jumphost3 \
ssh -l username4    server

This doesn't work

ssh -o ProxyCommand="\
ssh -l username1 -t jumphost1  \
ssh -l username2 -t jumphost2  \
ssh -l username3 -t jumphost3" \
    -l username4    server

username1@jumphost1's password:
Pseudo-terminal will not be allocated because stdin is not a terminal.
Permission denied, please try again.
Permission denied, please try again.
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
ssh_exchange_identification: Connection closed by remote host

I'm aware of its use with nc, but I'm searching for way to use it with 3+ hops, and also use this option with scp. I checked ssh_config man page, but the information is quite scarce, for me at least.

EDIT

I tried using ProxyCommand nested in another ProxyCommand as suggested below but I always get something along the following lines

debug3: ssh_init_stdio_forwarding: 192.17.2.2:2222
debug1: channel_connect_stdio_fwd 192.17.2.2:2222
debug1: channel 0: new [stdio-forward]
debug2: fd 4 setting O_NONBLOCK
debug2: fd 5 setting O_NONBLOCK
debug1: getpeername failed: Bad file descriptor
debug3: send packet: type 90
debug2: fd 3 setting TCP_NODELAY
debug3: ssh_packet_set_tos: set IP_TOS 0x10
debug1: Requesting no-more-sessions@openssh.com
debug3: send packet: type 80
debug1: Entering interactive session.

Fortunately, since 7.3 -J or ProxyJump serves my purpose — although I still to have to work around my keys setup.

ssh -q -J user1@jumphost1,user2@jumphost2,user3@jumphost3 user@server

Answer 1

The nc version is not recommended anymore. Use the -W switch, which is provided in recent versions of OpenSSH. Also, you don't need to copy the config to other hosts! All of the config needs to be done on your host and it does not interfere with the scp in any way. Just create a file ~/.ssh/config with:

Host jumphost1
  User username1
Host jumphost2
  User username2
  ProxyCommand ssh -W %h:%p jumphost1
Host jumphost3
  User username3
  ProxyCommand ssh -W %h:%p jumphost2
Host server
  User username4
  ProxyCommand ssh -W %h:%p jumphost3

And then connect using ssh server or use scp file server:path/. If you insist on oneliner (or not sure what you mean about ProxyCommand nesting), then as already pointed out, it is hell of escapes:

ssh -oProxyCommand= \
  'ssh -W %h:%p -oProxyCommand= \
    \'ssh -W %h:%p -oProxyCommand= \
      \\\'ssh -W %h:%p username1@jumphost1\\\' \
    username2@jumphost2\' \
  username3@jumphost3' \
username4@server

You basically need to go from inside.

Answer 2

I have done this with two hops, but it should work for three. The simplest way is to have the ~/.ssh/config file set on each host. So, if you want to be on hosta and get to hostd via hostb and hostc`, you could set your configurations thusly:

In hosta:~/.ssh/config:

Host hostd
    User username
    ProxyCommand ssh hostb nc %h %p 2> /dev/null

In hostb:~/.ssh/config:

Host hostd
    User username
    ProxyCommand ssh hostc nc %h %p 2> /dev/null

In hostc:~/.ssh/config:

Host hostd
    User username
    ProxyCommand ssh hostd nc %h %p 2> /dev/null

You can then ssh hostd on any of the hosts in the chain and you'll make your way to hostd.

Using netcat for the proxy does not interfere with scp.

If for some reason you really don't want to use local ~/.ssh/config files, you can do this on hosta:

ssh -oProxyCommand='ssh -oProxyCommand=\'ssh -o ProxyCommand=\\\'ssh username@hostd nc %h %p 2>/dev/null\\\' username@hostc nc %h %p 2> /dev/null' username@hostb nc %h %p 2> /dev/null' username@hostd