ssh tunnel w/ auth only to proxy

Question

I have a use case to proxy ssh requests through a proxy without knowing the credential for the remote host.

client -> proxy -> remote

I am attempting to setup an ssh tunnel where the client can connect to the proxy on a specific port that is mapped to the remote. Instead of authenticating on the remote, I want for the remote to handle the auth.

Workflow

1. Proxy creates an ssh tunnel, proxy:9000 -> remote:22
2. The client connects: curl proxy_user@proxy -p 9000
3. Authentication is done using proxy account credentials, but connection is made to remote

A bit of background, I want to have access from the client to the remote without the client having knowledge of the credential information for the remote - and without using a key.

Thoughts? Perhaps another way to approach this issue?

Sorry if there is any confusion, to clairify, want to do something like this:

[proxy] ssh -L proxy:9000:localhost:22 remote_user@remote

[client] ssh -p 9000 proxy_user@proxy

I want the client to not know the credential of the remote.

Answer 1

It is very confusing what you are trying to describe, but generally, that should work:

1. Proxy creates an ssh tunnel, proxy:9000 -> remote:22

   [proxy]$ ssh -g -L proxy:9000:localhost:22 remote
   

2. The client connects: curl proxy_user@proxy -p 9000

   Client should connect using ssh, isn't it?

   [client] ssh -p 9000 proxy
   

But the first step can be set up using simple port forwarding using iptables or so. The communication is already encrypted with the first ssh connection.