I have a laptop, which I use both at work and at home.

When I am at work, I can ssh directly to any server I like.

When I'm at home, I have to go through a jumphost, to get on to the network.

I have a few entries like:

Host jump-server
  hostname server1
  proxyjump workproxy

but I have a LOT of servers, and a few scripts that I use which ssh to specific hosts also (which means they all need command-line options to specify use of jumphost or not).

Is there a way of automating this? For example, can I set an environment option so all hosts (except workproxy) should proxyjump?

  • You can always create a TAP tunnel via ssh and do routing via the jump server. Bit more complicated to setup, but so much easier to use. OR get in via a real VPN instead of an SSH server. – Rui F Ribeiro Oct 3 '18 at 22:15
  • @meuh could you put that as an answer please, so I can mark it correct? – AMADANON Inc. Oct 8 '18 at 23:25

This is not a specific answer, but you might get some ideas from wikibooks "Cookbook on Proxies and Jump Hosts".

If you use Host * and ProxyCommand with %h as the host you might be able to write a generic rule. And Match can work like Host but allows you to exec a command that can help reduce the * to match only those names you want to.

  • Thanks @meuh this led me to the right path. I have never come across "Match" before, this is the answer I was looking for. "Match" is hard to search for, the wikibooks link is very handy! – AMADANON Inc. Oct 9 '18 at 23:13

This could be done with a ProxyCommand instead of ProxyJump. ProxyCommand here could be a shell script that checks for some variable and runs different commands. For example, you could have a script /some/proxy like:

#! /bin/sh

if [ -n "$WORK" ] && [ "$1" != workproxy ]
    echo Work >&2
    ssh -qW "$1:$2" workproxy
    nc "$1" "$2"

And SSH config:

Host *
    ProxyCommand /some/proxy %h %p

This checks if the WORK environment variable is not empty, and the host isn't workproxy and connects to workproxy. Otherwise it uses netcat to connect to the given host and port (effectively, a direct connection).

  • The other answer is simpler, unfortunately I can't mark both as accepted answers. I have +1'd it. – AMADANON Inc. Oct 9 '18 at 23:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.