I have the following servers:

  • My localhost (localhost)
  • A Jumphost (jumphost)
  • A server accessible only through jumphost (finalhost)

I can run the following command

ssh -t user@jumphost ssh -t user@finalhost

To connect to finalhost from localhost. The connection from jumphost to finalhost is authenticated using gssapi-with-mic, and from localhost to jumphost with password.

What is the equivalent ssh_config I need to use so that I can do

ssh finalhost


scp file finalhost:/some/path/

from localhost and be connected?

The normal use of proxycommand

ssh -o ProxyCommand='ssh -W finalhost:22 user@jumphost' user@finalhost

does not work, as it tries to authenticate to finalhost using my localhost.

  • 1
    does not work, as it tries to authenticate to finalhost using my localhost. ... that is right. You don't want to copy your private keys fo the jumpbox.
    – Jakuje
    Commented Jan 31, 2017 at 10:32
  • localhost does not have any private keys for finalhost, but jumphost does... and I have a password for jumphost. So what I want is for jumphost's private key to be used (well, to be accurate, jumphost to finalhost is gssapi-with-mic, not private key)
    – BX21
    Commented Jan 31, 2017 at 11:35
  • It is not possible if you want to authenticate from the second host. It is not jumpbox, but bastion.
    – Jakuje
    Commented Jan 31, 2017 at 11:54
  • Simply chaining 2 SSH commands works though... Is there no option to replicate that in ssh_config? It doesn't have to be ProxyCommand, any other option would do as well.
    – BX21
    Commented Feb 1, 2017 at 3:53
  • Exactly. There is no alternative dor ssh config. Only chance is bash alias or function as a "shortcut"
    – Jakuje
    Commented Feb 1, 2017 at 6:39

1 Answer 1


It is not possible to set up bastion "jumpbox" in ssh configuration, where you need the second hop authentication to be initiated from the bastion.

Your only chance is to use bash aliases or functions to simplify local commands.

Unfortunately, there I so simple way to use scp in this case.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .