In the environment I work in, we use tunnels to SSH to various servers. For example, I'll 'ssh -p XXXXX username@localhost' to reach the server.

If the port was always the same, I could do this, and I'd be done:

Host somehost
  User bryan
  Hostname localhost
  Port 12345
  ProxyCommand ssh -p 2218 bryan@first.server.com -W %h:%p

However, the port used can and will change if the tunnel goes down and comes back up. This isn't something I have the ability to change - it's built into the infrastructure. So, I wrote a program to find the current port. But I don't know how to either:

a) Run that program and use the output for the %p variable; or b) Run a cron job on first.server.com to write out a text file with the port in it, or set an environment variable, or something.

In effect, I want to do this. Is it possible?

Host somehost
  User bryan
  Hostname localhost
  Port `sh get_port_for_somehost.sh`
  ProxyCommand ssh -p 2218 bryan@first.server.com -W %h:%p

The only thing I can think of right now is to run a program on my laptop which rewrites my .ssh/config after going and querying what the ports currently are, but I'd prefer not to do that.

  • 1
    There may be something I don't understand about your setup. Why are you specifying a Port directive and then using %p in the ProxyCommand, if specifying Port is a problem? Why not use ssh -W %h:$(get_port_for %h) … as the ProxyCommand? Oct 26, 2017 at 21:34
  • @Gilles, I'm just starting to use .ssh/config, so I think that's just a case of my misunderstanding what the best use case is. I will try out what you suggest. Thanks!
    – Bryan
    Oct 27, 2017 at 21:21

1 Answer 1


It is not possible to write a script in the configuration file to pull a variable for port number.

But you can write a bash function to get the port for you and place it into the correct place. For example place the following to the ~/.bashrc:

function ssh-dynamic() {
  PORT=`sh get_port_for_somehost.sh`
  exec ssh -p "$PORT" somehost "$@"

where the other configuration may stay in the ~/.ssh/config.

  • Just to verify, this needs to be on the initiating system (i.e., my laptop), correct? Or could I do this on the proxy server via ProxyCommand or another method?
    – Bryan
    Oct 26, 2017 at 20:25
  • This needs to be on the initiating system. The other hosts using ProxyCommand are used merely for dumb io redirection. I didn't test the function, but you should be able to get the idea from it.
    – Jakuje
    Oct 26, 2017 at 20:27
  • While this appears to be the only option as long as using the -p option is required, there is absolutely no point in using that option, because it will only be interpreted by the ProxyCommand—which can be trivially modified to get it directly.
    – Jan Hudec
    Jan 4, 2019 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.